Fraud in private healthcare: how hospitals protect themselves

Cases of fraud in private healthcare take many : a plan member who is not who they claim to be, a court injunction based on a forged medical report, a supplier that inflated the price of a drug before the invoice even reached billing. The hospital provides the care, records it and bills for it, but only discovers the irregularity when the payer denies the claim, when the audit flags it or when the institution’s name shows up in an investigation.

This is the risk most hospital managers underestimate: being dragged into a fraud that started outside the institution. Private healthcare moves hundreds of billions of reais a year and attracts sophisticated schemes that exploit gaps in hospitals’ internal processes, not necessarily to defraud the hospital, but to use the hospital as a path to defraud the system.

Understanding fraud in private healthcare from the hospital’s perspective means identifying where these risks are concentrated, which signs indicate that something irregular is happening and how preventive auditing and internal controls reduce the institution’s exposure.

What fraud in private healthcare is and how it reaches the hospital

Fraud in private healthcare is any intentional practice that generates improper charges, irregular use of benefits or deliberate distortion of clinical and administrative information to obtain a financial advantage. What sets it apart from an operational billing error is intent: an incorrect code entered out of ignorance is an error; the same code chosen to inflate the value of a procedure is fraud.

The fraud that hits the hospital usually originates outside and uses the institution’s internal processes as its path: a plan member with false documents at admission, a legal scheme that forces the purchase of an overpriced drug, a supplier that tampers with invoices before handing them to billing.

Protecting the institution requires the same controls that protect billing from internal errors: systematic auditing, traceability of clinical records and document validation at every stage of the cycle.

The main types of fraud that directly affect the hospital

Private healthcare in Brazil covers 26% of the Brazilian population, or more than 50 million plan members. 2022 studies by the Instituto de Estudos de Saúde Suplementar (IESS) estimate that fraud and waste accounted for between R$ 30 billion and R$ 34 billion, about 12.7% of payers’ revenue that year.

These numbers reveal the scale of the problem and, above all, how often the hospital ends up at the center of these cases, even when it is not the perpetrator of the fraud.

Recent cases illustrate how sophisticated these schemes are. In January 2025, the Federal Police dismantled an operation that manipulated queues in the National Regulation System to trade slots for appointments and tests for political support. In the same period, Operation Bisturi by the Rio de Janeiro Civil Police uncovered a scheme that used court injunctions to force payers to authorize overpriced surgeries, with procedures that in many cases were never performed, causing an estimated loss of R$ 50 million.

In São Paulo, a payer identified reimbursement requests from 20 plan members with identical medical reports, all issued by the same professionals to justify cosmetic treatments not covered by the plan. The common denominator: in every case, the hospital or clinic was the scheme’s point of passage. Learn about other forms of fraud in the industry.

Improper use of benefits by third parties

Lending a membership card is one of the oldest and still most frequent practices in private healthcare. A plan member hands over the plan to a relative, friend or stranger, who shows up at the hospital as the policyholder.

The institution provides care in good faith, records the procedures correctly and bills within the rules, but answers to the payer when the irregularity is identified. The denial falls on the claim, and the hospital absorbs the cost of care it legitimately provided.

Identity verification at admission, checking the policyholder’s ID and photo, is the most direct control against this practice. In elective care, the time available allows for more rigorous verification.

Fraudulent litigation schemes

Healthcare litigation has grown significantly in Brazil in recent years, and with it came schemes that exploit the power of injunctions to obtain improper charges. The most common pattern involves forged or inflated medical reports, submitted in lawsuits to justify treatments not covered by the plan, high-cost drugs or hospital stays extended beyond clinical need.

A hospital that complies with a court order acts within the law, but it may be performing a procedure that should never have been authorized. When the fraud is discovered, the payer disputes the payment and the institution faces a recovery process that can drag on for months. Auditing the medical reports behind lawsuits is a layer of protection that reduces this risk.

External document fraud

Documents forged by third parties to justify care, reimbursements or authorizations reach the hospital in various ways: reports with tampered signatures, prescriptions with altered dates, medical reports describing clinical conditions that do not match the medical record. The hospital is often the last to spot the irregularity, but the first to be audited when it comes to light.

Consistency between what is in the medical record, what was requested and billed is the main barrier against this type of fraud. Document inconsistencies that slip past the internal audit reach the payer and come back as denials.

Overpricing along the supply chain

Suppliers or outsourced providers that inflate the prices of materials, drugs or services charge the hospital more than the market rate. The hospital passes the cost on to the payer within the contract rules, without realizing that the input price had already been tampered with.

This type of fraud is harder to identify because the problem lies upstream of billing. Systematic price comparison against market references, auditing invoices for high-cost supplies and contracts with traceability clauses are the main protection mechanisms.

Warning signs in billing: what to look for

External fraud leaves traces in billing data. Spotting them takes less investigation than it seems: in most cases, the irregular patterns are visible to anyone who knows what to look for. Systematic monitoring of these patterns is part of managing hospital denial indicators.

The main warning signs are:

Abnormal volume of a given procedure in a short period

A sudden increase in the frequency of a specific procedure, with no matching change in the care profile, may indicate improper use of benefits or a fictitious billing scheme.

Requests concentrated on a single professional or department

When the irregularity involves an agent who operates systematically, a concentration of visits or prescriptions at a single point in the operation is a clear sign.

Mismatch between the clinical record and the billed item

The hospital claim lists procedures that the medical record does not support. It may be a coding error, but when the pattern repeats, it signals something more organized.

High-cost items with no match in the patient’s progress notes

Oncology drugs, OPME (implants and special materials) or high-complexity procedures billed for cases whose clinical condition does not justify them are one of the most frequent patterns in fraud audits.

Plan members with a care profile inconsistent with the plan

Utilization far above the plan’s average, concentrated in short periods or in specialties unrelated to the recorded diagnoses, deserves verification.

Reports and documents with formal inconsistencies

Mismatched dates, signatures that differ from the usual pattern, unusual formatting or patient data that does not match the registration are indicators of document tampering.

Any one of these signs on its own may have a legitimate explanation. What draws attention is the combination or repetition of patterns for the same plan member, professional or type of procedure.

How preventive auditing protects the hospital

Reactive auditing identifies fraud after the claim has been sent and the denial has arrived. Preventive auditing intercepts the irregularity before it leaves the hospital. The difference between the two is not just timing: it is cost, exposure and the ability to recover.

When a claim with fraudulent items reaches the payer, the hospital faces denials, rework and, in the most serious cases, a broader audit scope over all its claims. When the same irregularity is caught internally before submission, the hospital corrects it, protects its relationship with the payer and avoids the appeal cycle.

Preventive auditing works in three layers.

• Document review: verifying that reports, prescriptions and authorizations are consistent with the clinical record and with the plan member’s identity.

• Validation of billed items: comparing what was recorded in the medical record, what was authorized by the payer and what is being entered on the claim.

• Pattern analysis: continuous monitoring of the indicators that signal irregularities.

For a complete view of the types of audit available, see the article Hospital auditing: a complete guide for managers.

The volume of claims a hospital processes makes it unfeasible to manually audit 100% of them with the necessary depth.

Technology changes that balance: systems that automatically cross-check clinical and administrative data can flag inconsistencies at scale, so the audit team can focus its effort on the cases that truly need human review.

Compliance and a culture of integrity

Preventive auditing and process controls protect the hospital from fraud that comes from outside. Compliance protects the hospital from fraud that could originate inside.

A hospital integrity program sets the rules for every agent involved in the revenue cycle: clinical staff, billing, procurement, third parties and suppliers. It formalizes what is expected of each one, defines procedures for risk situations and creates mechanisms for irregularities to be reported without exposing whoever identified them.

Fraud protection starts before the audit

Fraud in private healthcare affects the hospital even when the institution acts correctly. The plan member who presents a false identity, the report behind an inflated injunction, the supplier who tampers with the invoice before handing it over: in all these cases, the hospital is in the path of the fraud, not at its origin.

Effective protection combines three layers: entry controls that verify identity and documentation before care, preventive auditing that compares clinical records and billed items before the claim is sent, and a culture of integrity that makes the internal environment hostile to irregularities.

Rivio works in depth on the second layer. The platform automatically cross-checks clinical and administrative data, flags inconsistencies before claims leave the hospital and manages appeals with technical grounds when a denial arrives anyway. With a contractual commitment to full reimbursement for any denial that is not reversed, Rivio turns auditing into a revenue guarantee.

Frequently asked questions about fraud in private healthcare

What is fraud in private healthcare?

It is any intentional practice that generates improper charges, irregular use of benefits or deliberate distortion of clinical and administrative information to obtain a financial advantage in the private healthcare system. The central element that sets it apart from an operational error is intent.

What is the difference between fraud and error in hospital billing?

An error stems from an unintentional failure: an incorrect code entered out of ignorance, a field filled in wrongly, a document missing through carelessness. Fraud involves deliberation: choosing a higher-value code to inflate the claim, tampering with a report to justify a procedure that was not performed, presenting a false identity to use a benefit improperly. In practice, both lead to denials, but the preventive measures and the institutional consequences are different.

How can a hospital identify fraud in billing?

The main signs are: abnormal volume of a given procedure in a short period, requests concentrated on a single professional, mismatch between the clinical record and the billed item, high-cost items with no match in the patient’s progress notes and formal inconsistencies in reports and documents. Analyzing patterns over time is more effective than checking each claim in isolation.

Can a hospital be held liable for fraud committed by third parties?

Liability depends on the degree of diligence the institution has shown. A hospital with lax admission controls, no auditing and inconsistent clinical documentation will struggle to defend itself before the payer, even if the fraud came from a plan member or an outside supplier. Having formal verification and audit processes in place is the main argument for the institution’s defense.

How does preventive auditing reduce the risk of fraud?

Preventive auditing intercepts irregularities before the claim is sent, when they can still be corrected without external consequences. It works in three layers: document review, validation of billed items and pattern analysis. Systems that automatically cross-check clinical and administrative data expand detection capacity without relying on manual review of every item.