DOJ's new fraud detection center makes your billing data the starting point

The Justice Department opened a National Fraud Detection Center on Monday that pools analysts and data from more than a dozen federal inspector general offices, including the one that polices Medicare and Medicaid, into a single prosecutor-led unit.

Colin M. McDonald, assistant attorney general of the department's National Fraud Enforcement Division, said in the announcement that the center marks “a decisive shift in how the federal government detects and investigates complex fraud.” The stated purpose is to close a cross-program blind spot, the gap that has let some actors run schemes against several taxpayer-funded programs at once without detection.

For a practice billing Medicare or Medicaid, the operative question is not whether the government is looking. It is what the government is looking at, and what happens to cash flow if a practice's claims stand out.

Flagging is comparative, not case by case

Enforcement no longer starts with a complaint. It starts with a comparison.

Shannon Sumner, CPA, CHC, managing principal of PYA's Nashville office and the firm's chief compliance officer, told Medical Economics that investigations are increasingly triggered by analytics and that “practices get flagged because their data does not look like their peers.”

The change is methodological. Investigators once reviewed a sample of claims and extrapolated the findings. Now a practice's full claims population can be analyzed and benchmarked against peers. A divergence in one code family, from one provider, becomes visible without anyone pulling a chart.

The consequence can arrive before any charge

This is the part practice leaders tend to miss. The first thing a data flag produces is usually not an indictment. It is a payment hold.

Pat Naples, an attorney at ArentFox Schiff whose practice focuses on health care litigation and government investigations, told Medical Economics that claims data mining was written into federal regulation as a potential basis for a credible allegation of fraud back in 2011, and that the government generally looks for large outliers in a data set rather than a single odd claim.

That threshold matters because a credible allegation of fraud is what CMS must clear to suspend a practice's payments, and the determination rests largely with the agency. A physician whose payments are withheld can submit a written rebuttal, but whether CMS considers or rejects it is discretionary, and formal review runs through administrative appeals before any case reaches a court.

The scale of that lever showed up in June. Alongside the department's national health care fraud takedown, CMS suspended 1,079 providers and revoked billing privileges for 1,403 more.

What practices can do about it

Naples' advice is the shortest version: “Check your own data and be on top of it,” he said, which preserves the option of voluntary self-disclosure and its reduced penalties.

Concretely, that means building the same outlier view regulators use. Sumner recommends internal dashboards tracking evaluation and management distributions, modifier rates, use of high-cost codes and supplies, and denials and refunds, then running targeted audits on the roughly 20 percent of activity generating most of the risk.

The areas drawing the most scrutiny are specific: E/M level selection and medical necessity, modifier misuse, incident-to billing, split and shared visits, telehealth documentation, and Medicare Advantage risk adjustment. Referral relationships with suppliers such as durable medical equipment companies belong on the list too.

A compliance program does not require a large budget. Sumner's floor is a designated compliance lead who is not also handling billing, written policies that match how the practice actually operates, role-specific training and routine auditing of the highest-risk billing areas. She warns that data errors get treated as compliance failures rather than technical mistakes, and that the Office of Inspector General has signaled the absence of an effective program is itself an aggravating factor, even at the smallest practices.

Third-party exposure deserves its own look. Sumner points to vendor due diligence, business associate agreements and an internal risk assessment of how AI-assisted documentation and coding tools affect billing risk. A billing company's default coding settings become the practice's data profile.

And a practice does not have to be a target to absorb the cost. Naples noted that serving as a witness in a supplier's case can still mean responding to subpoenas and making staff available for interviews.

The center is operating now. There is no comment period and no effective date attached to it.