Initiative 1
Provider Level Claims Anomaly Detection
A provider level anomaly detection model for state Medicaid program integrity units, HHS OIG and its analytic contractors, Medicare Administrative Contractors, and Unified Program Integrity Contractors.
Status
- Feature dictionaryPublished 2026-05-30
- Validation protocolPublished 2026-05-30
- Reference implementationPublished 2026-05-30
- Methodology paperPublished 2026-05-30
The problem #
Rule based review cannot reach uncharacterized schemes
This is definitional. Detection coverage bounded by rules is bounded by the enumeration of known patterns: a rule based system detects only the fraud schemes that have already been identified and written down, and cannot detect a billing pattern no one has yet characterized. Fraud schemes adapt faster than rule sets are revised, and the gap between adaptation and revision is where loss concentrates.
Claim level review misses aggregate provider behavior
A rule evaluating one claim at a time cannot observe that a provider's overall pattern is implausible when each individual claim is defensible in isolation. This is the specific evasion strategy that sophisticated billing fraud employs, and it is invisible to claim level logic by construction: a provider whose individual claims each appear defensible remains unflagged even when their aggregate billing behavior is a statistical outlier against peers of the same specialty, region, and patient mix.
Post payment recovery yields less than prevention
Money paid out and later determined improper must be recovered through administrative or judicial process against parties who may be insolvent, dissolved, or beyond reach. Detection that improves prioritization before or shortly after payment converts a recovery problem into a prevention problem, and the two have materially different yields.
How the method works #
-
Peer group construction
The unit of analysis is the provider, not the claim. Each provider is grouped with peers of the same specialty, region, and patient mix, so that billing behavior is judged against a comparable population rather than an abstract norm.
-
Behavioral feature computation
The model combines measurements taken directly from claims data, among them how often a provider bills the highest intensity variant of a common procedure, and how many patient encounters a provider logs per day relative to peers. It reads claims data in the standardized administrative formats federal and state programs already use, rather than requiring an agency to reformat its data first.
-
Deviation scoring
Each provider receives a risk score and a rank relative to peers, generated by measuring deviation rather than matching a known signature. Because the model does not need to be told in advance what a given fraud scheme looks like, it can surface billing patterns that were never enumerated in a rule set.
-
Explanation generation
Every measurement the model uses is documented: how it is calculated, and why it bears on fraud risk. Each score is accompanied by an itemized account of the specific measured behaviors that produced it. A fraud referral that cannot be explained cannot be defended, so a detection tool that cannot show its reasoning is not usable by a government investigator.
-
Validation before deployment
A written validation protocol lets an agency's own analysts run the model against their own historical claims, including cases already known to be fraudulent, and measure independently how many the model catches and how many false alarms it produces. An agency deploys nothing on the strength of a published accuracy figure; it verifies performance on its own data first.
What it produces #
What it consumes
Historical claims records in the form federal and state programs already store them: provider identifiers, procedure and diagnosis codes, service dates, billed and paid amounts, place of service, and beneficiary identifiers. No new data collection is required. Every field the model uses is already captured in the normal course of claims adjudication.
What it emits
For each provider: a risk score, a rank relative to peers, and an itemized account of which measured behaviors drove that score. For example, that a provider bills the highest intensity variant of a common procedure at a rate several standard deviations above peers of the same specialty and region, while also showing an implausible number of patient encounters per day.
Who uses it #
Program integrity analysts and investigators with claims data familiarity, not machine learning specialists, which is why the feature dictionary, implementation guide, and validation protocol are treated as first class deliverables alongside the model itself.
- State Medicaid program integrity units
- HHS OIG and its analytic contractors
- Medicare Administrative Contractors
- Unified Program Integrity Contractors
Artifacts #
Feature dictionary
Validation protocol
Methodology paper
Reference implementation
Tier 2 artifacts are reference implementations, available at no cost after institutional identity verification. Tier 1 artifacts, including documentation, protocols, and papers, are open to anyone without registration.