Medicare Fraud Detection: What the Billing Pattern Leaves Out

Medicare investigators detect fraud by using claims data to flag unusual billing, then checking the services, orders and payments behind it. A billing employee may see the code that keeps appearing. A clinician may know what care the patient received. Someone in finance may know who received the money. Those different views can explain what a claims pattern leaves out: how the business produced the bill, and who understood what it represented.

How Medicare Fraud Is Detected With Claims Data

Medicare uses automated analysis to identify suspicious claims and direct investigative attention. The Centers for Medicare & Medicaid Services’ April 2026 fraud and abuse booklet describes its Fraud Prevention System running predictive algorithms and other analytics on Medicare fee-for-service claims nationwide before payment. It also draws on the Integrated Data Repository, which brings together claims, beneficiary, provider and other program data.

Claims comparisons connect what a provider bills with the activity around it. A sudden billing spike can identify a supplier worth examining. Procedure mix, specialty and payment patterns can help narrow that inquiry. Interviews, medical review and financial records then supply different parts of the explanation.

Under the Medicare claims-processing manual, a clean claim can proceed to payment without the contractor asking the provider, patient or another outside source for more information. The underlying order, clinical record, delivery evidence and ownership records may sit elsewhere.

That separation is where connecting the claim to its supporting records matters. The claim says what the business wants Medicare to pay for. The records behind it show how that request came to exist.

Medicare Claim Analytics and Corroborating Evidence

Medicare claim analytics and corroborating evidence answer different questions. Analytics identifies patterns worth investigating. Corroboration connects those patterns to particular patients, services, decisions and payments.

A Medicare billing outlier gives investigators a place to look. Comparing a provider with others in the same specialty makes that signal more useful. A study published by the Association for the Advancement of Artificial Intelligence in 2017, Multivariate Anomaly Detection in Medicare Using Model Residuals and Probabilistic Programming, examined provider payments within specialties. Its inputs included service counts, beneficiary service days and payment amounts. It treated the resulting outliers as observations needing further investigation.

What the Training Labels Actually Describe

The 2018 Journal of Big Data paper Big Data fraud detection using multiple medicare data sources combined Part B, Part D and durable medical equipment data. It mapped provider labels from the government’s List of Excluded Individuals and Entities. The paper identified a consequential limitation:

That is the gap an investigator has to close. The label describes the provider. The case needs the transactions: which test, which prescription, which equipment order and what happened to the payment.

Why an Explainable Alert Matters

The 2023 Journal of Big Data study Explainable machine learning models for Medicare fraud detection reduced the number of input features by approximately 87.5% without compromising performance in its experiments. The resulting models were easier to explain and less prone to fitting the training data too closely.

The paper also shows how a model can look successful across a large dataset while missing many of the relatively few providers labeled for fraud.

For a healthcare analyst or compliance employee, the useful output is a reason to examine a specific relationship: the service mix, the volume or the payment pattern. We want to know what made the alert fire and what the underlying records say about it.

Medicare Identity Alert and Payment Control

Claims for supplies a beneficiary never received can expose misuse of a Medicare number and lead to payment controls. Beneficiary statements, ordering-provider confirmation and medical review give investigators ways to test that mismatch.

Medicare’s own guidance describes comparing statement dates and services with the beneficiary’s calendar. The Medicare referral manual also identifies confirmation from ordering providers that they did not order the service, beneficiary interviews about services not received, and confirmation of forged documentation. These comparisons connect the billed event to the people supposedly involved in it.

The use of stolen Medicare numbers and false orders makes the ordering relationship especially important. The patient can speak to receipt of the supply. The doctor can speak to the order. The supplier’s claim connects both identities to a request for money.

In its report published March 30, 2026, the Government Accountability Office described 15 health care providers who allegedly billed Medicare for more than $4 billion in urinary catheters never supplied. Analytics helped the Centers for Medicare & Medicaid Services identify the providers, suspend payments and later revoke their enrollment. Patients’ identities supplied the billing opportunity. Taxpayers supplied the money.

The same report shows why coordination with other payers matters. The Centers for Medicare & Medicaid Services began sharing provider-payment-suspension information with supplemental payers in December 2025. Before that sharing, some supplemental payers had paid beneficiary cost-sharing on potentially fraudulent claims. Stopping one payment stream still left another paying.

Medicare Billing Records Show How the Bill Was Produced

Document review follows the claim back to the order and service, then forward to payment, adjustment and any refund. Each record answers a different part of the question.

The clinical chart describes the care. A delivery record describes the supply. The claim carries the billed code and units. The remittance advice explains payment and adjustments, including denials, reduced payments and additional payments. Bank records identify who received and controlled the proceeds. A warning and the billing that followed it show what happened after someone raised the problem.

For cost reporting or drug-plan reconciliation, the comparison also reaches the underlying expenses, reports and later corrections. In Part D, reconciliation and retained overpayments connect pharmacy activity, sponsor reporting and federal payments. The transaction being examined determines which records belong together.

UCHealth’s Alleged Automatic Billing Rule

UCHealth’s emergency-department case shows why the rule inside the billing system can matter as much as the pattern outside it. In the whistleblower’s complaint, repeated vital-sign checks allegedly triggered a high facility charge automatically:

The whistleblower also alleged being told that the issue had been discussed with UCHealth’s chief financial officer and that staff were to leave it as it was. That allegation connects the billing rule to a warning inside management.

UCHealth agreed to a $23 million settlement in November 2024 resolving allegations of emergency-department upcoding. The alleged mechanism puts a concrete question behind the billing pattern: did the charge reflect the hospital resources used, or an automatic trigger? We see an alleged billing rule that turned routine vital checks into high-resource care on paper.

Axis and Kingdom’s Ordering Pattern Led to the Money

The investigation involving Axis Professional Labs and Kingdom Health Laboratory connected an unusual ordering pattern to contracts, invoices, messages and payments. The Justice Department’s account of its analytics work described billing and diagnosis patterns pointing investigators toward a changed ordering network.

In its February 20, 2026 account of the laboratory owner’s criminal trial, the department described evidence that the owner paid marketers for beneficiary samples, Medicare information and signed orders for medically unnecessary cardiovascular genetic tests. Marketers used other companies to solicit beneficiaries and pressure their primary care physicians to approve testing.

The trial evidence included sham contracts and invoices presented as charges for marketing hours. The invoices were reverse-engineered to match the agreed payments per sample. The owner also described payments as software charges and loans that did not exist. The jury convicted the owner of conspiracy, kickback and money-laundering offenses.

Hours on the invoice. Samples in the calculation.

That comparison explains the payment arrangement in a way a billing spike alone cannot. It connects what the laboratories bought with how the payments were described. The Federal Bureau of Investigation, the HHS Office of Inspector General, Texas’s Medicaid Fraud Control Unit and the Department of Veterans Affairs Office of Inspector General investigated the case.

Who Follows a Medicare Fraud Lead?

The Centers for Medicare & Medicaid Services and its contractors review claims and develop leads, while the HHS Office of Inspector General, the Federal Bureau of Investigation and the Justice Department investigate and pursue cases. The different Medicare contractor assignments separate claim processing, payment recovery and fraud investigation.

What Is the Medicare Fraud Strike Force?

The Medicare Fraud Strike Force combines data analytics with federal, state and local investigative resources. The HHS Office of Inspector General describes teams bringing together its investigators, the Justice Department, U.S. Attorneys’ Offices, the FBI and other law enforcement partners. It also describes referring credible allegations to the Centers for Medicare & Medicaid Services for payment suspension, connecting investigative work to a payment control.

A Declined Referral Can Still Lead to Action

A referral declined by the HHS Office of Inspector General can still lead to payment suspension, denial or recovery of overpayments under the Medicare referral manual. The Justice Department’s coordination policy also preserves potential civil action when criminal prosecution is declined.

New Medicare Analytics Still Need the Business Explanation

The Justice Department’s June 30, 2025 announcement proposed a Health Care Fraud Data Fusion Center bringing together federal investigators and advanced analytics. Its June 23, 2026 announcement described an agreement for computing space within Medicare’s Integrated Data Repository and developing Claims Core capabilities to check submission identity.

Those developments target connections that recur throughout detection: who submitted the information, which records belong together and how analysts can see across separate systems. An insider who knows why the company changed a billing rule or disguised a payment brings the business decision into that picture.

Do You Get a Reward for Reporting Fraud?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Know What Produced the Pattern

You may know why the same code keeps appearing, who approved the orders or what a payment really bought. Speak with our whistleblower experts about the conduct behind the claims to build your strongest Medicare whistleblower case. We connect your knowledge to the billing and payment records, bring in Medicare fraud whistleblower lawyers who know laboratory and hospital billing cases, and stay beside you through the process.