Thematic threads
States are weaponizing program design against fraud risk
New York is not just prosecuting SADC fraud, it is directing Managed Long Term Care plans to implement prepayment review and payment suspensions and weighing whether to phase out a $500 million benefit entirely. Rhode Island charged seven defendants, including NEMT owners who billed for rides without valid insurance or while hospitalized abroad, and Ohio secured guilty pleas tied to 27,000 telehealth claims proved false by portal login records. The through-line: states now expect MCO and plan controls to catch obvious data anomalies (login logs, insurance validity, provider location) before claims pay, and are willing to restructure benefits when plans fail.
Billing fraud and data security are being charged together
Connecticut and New York jointly extracted $2.7 million from Boston Children's Health Physicians and its IT vendor where executives knew for two years an unencrypted archive held a million billing records. California added a $6 million 23andMe settlement premised on a Genetic Information Privacy Act consent theory that survived bankruptcy. State AGs are stitching FCA and privacy theories into one settlement to multiply damages and extract longer corrective obligations.
OIG tightens the self-disclosure math and the heightened scrutiny lane
OIG's updated SDP locks in employment or contracting cost as the damages base for unlicensed-individual disclosures with no payor-mix reduction, and the refreshed Fraud Risk Spectrum plus Negril's five-year Heightened Scrutiny placement without a CIA show OIG is comfortable denying integrity agreements for NPI-sharing arrangements it views as structural fraud.
Enforcement patterns and posture shifts
DOJ continues to lean on objective digital evidence: respiratory panel billing after the lab was closed and the defendant barred staff from entering, telehealth claims on days providers never logged in, and EMR records changed to "Covid19 HRSA Uninsured" while insurance cards sat in the file. The $19 million Chicago psychotherapy indictment confirms DOL EBSA is now a working partner on commercial ERISA-plan fraud, not just a referral source.
On the policy side, CMS's proposed MA/Part D rule introduces disgorgement to CMS as the PBM remedy and ties enrollee cost-sharing protection to directory accuracy scores, importing a transparency-plus-forfeiture model from the drug pricing side into plan operations.
Implications for your program
- Medicaid waiver and HCBS operators: Pull enrollment and billing data against staff attestations, GPS, timekeeping, and travel records now. New York's SADC playbook (prepayment review, payment suspensions, benefit phase-out) will travel, and MCOs will push these controls down to contracted providers before year-end.
- Behavioral health and telehealth networks: Reconcile claims against platform login, EHR audit trail, and scheduling data as a routine monitoring control. Treat portal-session evidence as the new baseline that prosecutors will subpoena first, and update staff training to flag "ghost" encounters.
- Multistate providers with PHI: Fold HIPAA Security Rule and state WISP compliance into the same risk assessment as coding and billing. Where a prior audit flagged an unencrypted repository or vendor exposure, document remediation on a dated timeline. State AGs are reading old audits in discovery and pricing settlements off them.
- Any provider weighing self-disclosure: Rebuild damages models for unlicensed-individual exposure using total employment or contracting cost without payor-mix offset, and brief the board on the Negril outcome before assuming an integrity agreement will be offered. Structural arrangements involving NPI sharing or shell billing entities should go through fresh legal review this quarter.
- MA plans, Part D sponsors, and PBMs: Begin gap analysis against the 90-day directory verification, accuracy scoring, cost-sharing cap, and PBM fair-market-value compensation requirements. Comments close December 15, and the disgorgement remedy makes documentation of pricing methodology and directory QA a board-level reporting item.
This memo synthesizes the week's most consequential developments across RuleResource Intelligence Report. Article links are free to forward.