1. Purpose
This policy establishes the framework for preventing, detecting, reporting, investigating, and addressing fraud, waste, and abuse (FWA) within Explore Health, Oregon's Health Insurance Marketplace. The policy promotes program integrity, safeguards public resources and consumer information, and ensures compliance with applicable federal and state laws, regulations, and contractual requirements.
2. Authority
This policy is issued under the authority of Explore Health and the Oregon Health Authority (OHA) to establish requirements for the prevention, detection, reporting, investigation, and resolution of fraud, waste, and abuse (FWA) within Oregon's Health Insurance Marketplace.
This policy supports compliance with applicable federal and state laws, regulations, contractual requirements, and Marketplace operational standards, including, as applicable:
- Patient Protection and Affordable Care Act (ACA).
- Centers for Medicare & Medicaid Services (CMS) regulations governing Federally Facilitated and State-Based Marketplaces.
- Applicable federal program integrity, privacy, and information security requirements.
- Oregon Revised Statutes (ORS) and Oregon Administrative Rules (OAR) governing the Oregon Health Authority and public resources.
- Oregon Health Authority policies and procedures.
- Applicable contracts, grant agreements, and cooperative agreements governing Marketplace operations.
Nothing in this policy supersedes applicable federal or state law. Where a conflict exists, the applicable law, regulation, or contractual requirement shall govern.
3. Scope
This policy applies to all individuals and entities participating in or supporting Explore Health operations, including employees, contractors, vendors, enrollment partners, certified assisters, insurance agents and brokers, customer assistance representatives, healthcare providers participating in Marketplace plans, and any other individuals or organizations interacting with Explore Health systems, services, programs, or consumers.
All covered individuals are responsible for complying with this policy, protecting confidential information, completing required FWA training, and promptly reporting suspected fraud, waste, or abuse.
4. Definitions
a. Fraud
An intentional act of deception, misrepresentation, or concealment intended to obtain an unauthorized benefit or cause harm to Explore Health, the State of Oregon, the federal government, consumers, or other parties.
Example: Falsifying financial records, submitting false information, or knowingly misrepresenting eligibility or enrollment information.
b. Waste
The unnecessary, careless, or inefficient use of public resources, funds, property, or services resulting from poor management practices or misuse, whether intentional or unintentional.
Example: Purchasing goods or services without a legitimate business need or failing to appropriately manage public resources.
c. Abuse
Practices that are inconsistent with sound fiscal, business, or operational practices or that improperly use Marketplace resources, systems, authority, or information, regardless of whether criminal intent exists.
Example: Misuse of state equipment, unauthorized access to information, or improper use of leave or work time.
For additional information regarding fraud, waste, and abuse involving Oregon public resources, refer to guidance provided by the Oregon Secretary of State Office of the Inspector General.
5. Covered Individuals and Responsibilities
The following individuals and entities are subject to this policy.
a. Employees and Program Staff
All Explore Health employees, whether full-time, part-time, temporary, or otherwise employed to support Marketplace operations, are responsible for:
- Complying with applicable laws, regulations, and Marketplace policies.
- Protecting confidential and consumer information.
- Completing required FWA training.
- Promptly reporting suspected fraud, waste, or abuse.
- Cooperating with authorized investigations.
b. Enrollment Partners
Enrollment partners include certified insurance agents, certified assisters, and community partner organizations authorized to assist consumers with Marketplace enrollment.
Enrollment partners are responsible for:
- Maintaining required certifications and training.
- Protecting personally identifiable information.
- Displaying required credentials while assisting consumers.
- Following Marketplace policies and certification requirements.
- Reporting suspected fraud, waste, or abuse.
c. Customer Assistance Representatives
Customer assistance representatives employed by or under contract with Explore Health are responsible for:
- Following Marketplace identity verification and customer service procedures.
- Protecting confidential information.
- Reporting suspected fraud, waste, or abuse.
- Cooperating with investigations when requested.
d. Contractors and Vendors
Contractors and vendors providing operational, technical, administrative, or customer support services must:
- Comply with applicable contractual requirements and Marketplace policies.
- Protect confidential information.
- Complete required FWA training when applicable.
- Report suspected fraud, waste, or abuse.
- Cooperate with investigations.
e. Participating Providers
Healthcare providers participating in Marketplace health plans are expected to maintain accurate documentation, submit truthful and complete information when required, and cooperate with investigations involving Marketplace operations.
f. Members of the Public
Consumers, enrollees, providers, contractors, and members of the public who become aware of suspected fraud, waste, or abuse involving Explore Health are encouraged to report their concerns through the reporting channels identified in this policy.
g. Quality Assurance and Data Analyst and Business Process Team
The Quality Assurance and Data Analyst and Business Process Team are responsible for administering Explore Health's FWA program, including oversight of reporting, intake, investigations, monitoring, referrals, and corrective actions as described elsewhere in this policy.
6. Reporting Requirements and Reporting Channels
All covered individuals must promptly report suspected fraud, waste, abuse, misuse of public resources, improper disclosure of confidential information, or other activities that may threaten Marketplace integrity.
Reports may be submitted by employees, contractors, enrollment partners, providers, consumers, or members of the public. Reports made in good faith are accepted regardless of whether the allegation is ultimately substantiated.
Official Explore Health reporting methods include:
Explore Health may also coordinate with appropriate oversight or enforcement agencies when allegations involve criminal conduct, federally funded Marketplace activities, identity theft, misuse of public resources, or other matters within another agency's jurisdiction.
These agencies may include:
- Oregon Secretary of State Office of the Inspector General (OSCIG)
- Centers for Medicare & Medicaid Services (CMS)
- Offices of Inspector General (OIG)
- Federal Trade Commission (FTC)
- Appropriate local, state, or federal law enforcement agencies
7. Consumer Fraud Prevention Guidance
Explore Health is committed to helping consumers protect themselves from fraud, waste, abuse, identity theft, and other improper activities related to Marketplace services.
Consumers should:
- Verify they are communicating with Explore Health before sharing personal information.
- Use only the official Explore Health website for Marketplace services.
- Work only with certified enrollment partners or authorized Explore Health representatives who display valid credentials.
- Never pay for Marketplace enrollment assistance. Authorized enrollment assistance is provided at no cost.
- Report suspected misuse of personal information, improper requests for payment, or suspicious Marketplace activities.
- Contact the Federal Trade Commission if identity theft is suspected.
These practices help protect consumers while supporting the integrity of Marketplace operations.
8. Anonymous Reporting
Explore Health accepts anonymous reports of suspected fraud, waste, or abuse through any official reporting channel.
Individuals may also submit anonymous reports through the Oregon Secretary of State Office of the Inspector General , which provides a confidential mechanism for reporting suspected misuse of public resources, employee misconduct, or violations of state or federal law.
Anonymous reports are reviewed using the same standards as identified reports. Individuals submitting anonymous reports are encouraged to provide sufficient detail to allow an appropriate review and investigation.
- Explore Health prohibits retaliation against any individual who reports suspected fraud, waste, or abuse in good faith.
9. Internal Controls, Monitoring, and Risk Management
Explore Health maintains a comprehensive system of internal controls to prevent, detect, and address FWA while protecting consumer information, public resources, and the integrity of Marketplace operations. These controls support compliance with applicable federal and state laws, regulations, and contractual requirements.
a. Internal Controls
Explore Health maintains administrative, operational, financial, and technical controls designed to:
- Prevent and detect fraud, waste, and abuse.
- Safeguard confidential and personally identifiable information.
- Promote compliance with Marketplace policies and regulatory requirements.
- Identify operational vulnerabilities and emerging risks.
- Support timely corrective action and continuous program improvement.
b. Audits and Monitoring
Explore Health conducts periodic audits and ongoing monitoring of Marketplace operations, which may include:
- Enrollment and eligibility activities.
- Customer assistance operations.
- Enrollment partner performance.
- Contractor and vendor compliance.
- Financial transactions.
- Information systems and data security.
- Program compliance with Marketplace policies and contractual requirements.
Audit findings and monitoring activities are used to identify irregularities, strengthen internal controls, improve operational performance, and support corrective actions when necessary.
c. Data Analytics
Explore Health uses data analytics, automated monitoring tools, trend analysis, and other risk-based review methods to identify unusual activity, potential fraud indicators, data anomalies, or patterns requiring additional review.
Monitoring activities may include evaluation of enrollment activity, consumer interactions, access to confidential information, partner performance, and other operational metrics that may indicate increased risk.
d. Risk Assessments
Explore Health conducts periodic risk assessments to evaluate operational, financial, cybersecurity, privacy, and program integrity risks.
Risk assessment results are used to:
- Prioritize compliance activities.
- Update internal procedures.
- Improve training and awareness.
- Strengthen fraud prevention strategies.
- Support compliance with oversight agencies, including CMS and applicable Offices of Inspector General.
e. Continuous Improvement
Explore Health uses information obtained through audits, monitoring, investigations, data analytics, and risk assessments to continually improve policies, procedures, internal controls, training, and system protections.
10. Compliance Officer and Special Investigations Unit
Explore Health designates a Compliance Officer and Special Investigations Unit to oversee the administration of its FWA Program.
The Compliance Officer and SIU are responsible for protecting program integrity through prevention, detection, investigation, monitoring, and coordination with internal leadership and external oversight agencies.
a. Responsibilities
The Compliance Officer and SIU are responsible for:
- Receiving allegations of suspected fraud, waste, or abuse submitted through any reporting channel.
- Conducting intake and preliminary assessments.
- Prioritizing and triaging allegations according to risk, urgency, and potential impact.
- Managing investigative case files using secure systems.
- Conducting investigations through interviews, document reviews, record verification, system analysis, and data review.
- Monitoring trends, audit findings, and risk indicators to identify emerging threats.
- Recommending corrective actions, process improvements, compliance enhancements, or administrative sanctions when appropriate.
- Providing guidance and support regarding FWA prevention, reporting, and compliance.
- Coordinating referrals to appropriate regulatory or law enforcement agencies when warranted.
- Supporting organizational training and awareness activities related to fraud prevention and program integrity.
b. Authority
The Compliance Officer and SIU have authority, consistent with applicable law and policy, to:
- Request documentation and records relevant to an investigation.
- Review Marketplace systems and operational records.
- Interview employees, contractors, enrollment partners, and other individuals involved in Marketplace operations.
- Coordinate with internal leadership and external oversight agencies.
- Recommend corrective, administrative, contractual, or disciplinary actions resulting from investigative findings.
All Explore Health employees, contractors, vendors, and enrollment partners are expected to cooperate fully with authorized investigations.
c. Confidentiality
Information obtained during FWA reviews and investigations will be handled confidentially in accordance with and to the extent allowed by applicable federal and state privacy, records management, and information security requirements.
11. Investigation Procedures
Explore Health follows a consistent, documented process for receiving, evaluating, investigating, and resolving allegations of fraud, waste, and abuse.
a. Intake and Initial Review
All allegations, whether submitted anonymously or by an identified individual, are documented and reviewed upon receipt. Reports are evaluated using consistent criteria to determine credibility, potential impact, urgency, and the need for immediate action.
b. Triage
The Compliance Officer or SIU conducts an initial assessment to determine:
- The nature and scope of the allegation.
- Potential risks to consumers or Marketplace operations.
- Whether immediate mitigation is necessary.
- Whether referral to another agency is appropriate.
- The appropriate investigative approach.
c. Investigation
Investigations may include:
- Interviews with relevant individuals.
- Review of paper and electronic records.
- Verification of information and documentation.
- Analysis of enrollment, financial, operational, or system data.
- Coordination with insurers, contractors, enrollment partners, providers, or other entities as appropriate.
Investigations begin as promptly as practicable following triage. Explore Health strives to complete preliminary assessments within ten (10) business days whenever feasible. Investigation timelines may vary depending on the complexity, scope, and availability of information.
d. Investigation Outcomes
Upon completion of an investigation, Explore Health may take one or more appropriate actions, including:
- Corrective action plans.
- Additional monitoring.
- Required training or retraining.
- Administrative or contractual remedies.
- Suspension or termination of certification or authorization.
- Referral to regulatory or law enforcement agencies.
- Closure of the matter when allegations are unsubstantiated.
All investigations and resulting actions will be documented in accordance with applicable law and record retention requirements.
12. Coordination with Oversight and Law Enforcement Agencies
Explore Health collaborates with appropriate federal, state, and local agencies when allegations of fraud, waste, abuse, identity theft, misuse of public resources, or other potential violations fall within another agency's jurisdiction.
Coordination may occur during intake, investigation, or following completion of an investigation, depending on the nature of the allegation.
Referral or coordination may include, as appropriate:
- Centers for Medicare & Medicaid Services for matters involving federally funded Marketplace operations or program compliance.
- Federal Offices of Inspector General for matters involving federal oversight, program integrity, or potential violations of federal requirements.
- Oregon Secretary of State Office of the Inspector General for suspected misuse of state resources, employee misconduct, or other matters within its jurisdiction.
- Federal Trade Commission for matters involving identity theft, consumer fraud, or related issues.
- Local, state, or federal law enforcement agencies when criminal activity or other violations of law are suspected.
Coordination may include sharing information as authorized by law, referring allegations, participating in joint or parallel investigations, responding to oversight inquiries, and supporting enforcement or corrective actions.
All information sharing will be conducted in accordance with applicable federal and state confidentiality, privacy, security, and records management requirements.
13. Training and Awareness
Explore Health is committed to promoting a culture of integrity through ongoing education and awareness related to fraud, waste, and abuse. Annual FWA training is required for all individuals whose responsibilities support Marketplace operations, including employees, program staff, contractors, customer assistance representatives, enrollment partners, certified assisters, and other individuals identified by Explore Health.
Training is provided during onboarding, as applicable, and annually thereafter. Additional refresher or targeted training may be required in response to regulatory changes, audit findings, identified risks, or operational needs.
Training topics include, at a minimum:
- Identifying fraud, waste, and abuse.
- Reporting responsibilities and available reporting channels.
- Consumer privacy and information security.
- Roles and responsibilities for protecting program integrity.
- Applicable federal and state requirements.
- Updates to Marketplace policies, procedures, or operational guidance.
Completion of required training is a condition of continued certification, authorization, employment, or contractual participation, as applicable. Failure to complete required training may result in corrective action, suspension of certification or authorization, contractual remedies, or other administrative action consistent with applicable law and policy.
14. Sanctions and Corrective Actions
Individuals or entities determined to have engaged in fraud, waste, abuse, or other violations of applicable laws, regulations, contractual requirements, or Marketplace policies may be subject to corrective or enforcement actions appropriate to the nature and severity of the violation.
Potential actions may include:
- Required corrective action plans.
- Additional monitoring or oversight.
- Retraining or other compliance requirements.
- Administrative or employment-related discipline.
- Suspension or termination of certification, authorization, or Marketplace participation.
- Contractual remedies or contract termination.
- Referral to regulatory agencies or law enforcement for civil, administrative, or criminal enforcement.
Explore Health will determine appropriate corrective actions based on the facts of each case, including the seriousness of the conduct, intent, impact on consumers or public resources, and applicable legal or contractual requirements.
15. Confidentiality
Explore Health is committed to protecting the confidentiality of individuals who report suspected fraud, waste, or abuse, as well as information obtained during reviews and investigations.
Reports, investigative records, and related information will be maintained and disclosed only as permitted or required by applicable federal and state laws governing privacy, confidentiality, public records, records retention, and information security.
Information will be shared only with individuals or agencies having a legitimate business, regulatory, investigative, or legal need to know. Explore Health will take reasonable steps to protect sensitive information throughout the reporting and investigative process.
16. Non-Retaliation
Explore Health strictly prohibits retaliation against any individual who, in good faith:
- Reports suspected fraud, waste, or abuse.
- Cooperates with or participates in an investigation.
- Provides information during an audit or compliance review.
- Refuses to participate in conduct reasonably believed to violate applicable laws, regulations, or Marketplace policies.
This protection applies to employees, contractors, enrollment partners, certified assisters, providers, consumers, and members of the public.
Individuals who report concerns anonymously or through external oversight agencies receive the same protections as those who report directly to Explore Health.
Retaliation, intimidation, discrimination, adverse employment action, denial of services, or other reprisals against individuals making good-faith reports are prohibited and may result in disciplinary or corrective action.
17. Contact Information
Questions regarding this policy or reports of suspected fraud, waste, or abuse may be submitted through the following official Explore Health reporting channels:
Mail: Explore Health
PO Box 191
Salem, OR 97308
Phone: 855-268-3767 (relay calls welcome)
Email: explorehealth@oha.oregon.gov
Individuals who suspect identity theft or believe their personal information has been compromised may also report concerns to the Federal Trade Commission through its Identity Theft reporting resources.
Phone: 877-438-4338 (1-877-ID-THEFT)
Online Reporting: IdentityTheft.gov
Individuals who prefer to report concerns outside of Explore Health or who believe reporting internally may not be appropriate, may also contact the Oregon Secretary of State Office of the Inspector General:
Phone: 800-336-8218
Online Reporting: https://orhim.info/4uDMgND
Reports submitted to OSCIG may be made confidentially in accordance with applicable law and OSCIG procedures.
18. Policy Review
This policy shall be reviewed at least annually by the Explore Health Compliance Officer, or designee, to ensure continued compliance with applicable federal and state laws, regulations, contractual requirements, and Marketplace operational needs.
The policy may be revised at any time to reflect changes in legal or regulatory requirements, organizational responsibilities, operational processes, identified risks, audit findings, or other program integrity considerations.
Approved revisions shall be communicated to affected staff, contractors, enrollment partners, and other individuals or organizations subject to this policy, as appropriate.