Why Aggressive Fraud Enforcement Keeps Catching the Wrong People
The Vance task force’s hospice sweep exposed a false positive problem that has been there for years.
A Washington Post article today told the story of a hospice owner who built his agency around direct personal attention to a small number of patients at a time, pursued the most rigorous accreditation available, never had a formal complaint in five years, had a 9 out of 10 quality rating and had to shut down because CMS stopped paying him due to suspected fraud.
In the dry language of fraud prevention, this small business owner is a “false positive.” In plain terms, he lost his business because the government’s fraud detection tools aren’t precise enough to distinguish between his legitimate company and a shell company run by a sophisticated fraudster.
When the Vance task force suspended roughly 800 hospices in Los Angeles this spring, the criteria for who made that list was proximity to a fraud-saturated market — not individualized evidence of wrongdoing. The reality is that CMS’s detection infrastructure was always going to produce that outcome at scale.
It is a fact that Los Angeles has become the country’s most productive market for hospice billing schemes. Federal agents suspended 447 hospices and 23 home health agencies in the greater Los Angeles area this spring, alleging $600 million in Medicare fraud. The fraudsters are using the same playbook repeatedly because it has proven effective. Operators enroll patients without their knowledge or consent, bill Medicare for services never delivered, and flip licenses to stay ahead of investigators. California’s Attorney General separately charged 21 suspects for stealing $267 million through a scheme in which not a single legitimate hospice service was ever provided. There is no dispute about the problem, but how to address it still needs some work.
How CMS detects fraud today
One of CMS’s primary fraud detection tools is benchmark comparison. The agency measures a provider’s billing volume, coding intensity, test ordering patterns, and service frequency against regional and national averages. When a provider falls outside expected ranges, contractors can impose prepayment review, deny claims, or suspend payments entirely.
That approach has a structural flaw that the Los Angeles sweep made visible. In a market where fraud is endemic, the benchmarks themselves are corrupted. A legitimate hospice operating in Los Angeles— and billing accurately for real patients receiving real services— looks anomalous compared to the surrounding ecosystem of shell operators billing at maximum volume for fictitious care. The algorithm can’t distinguish between a provider who’s committing fraud and a provider who’s operating legitimately in a market full of people committing fraud.
Compounding this, federal regulations allow suspension based on a “credible allegation” of fraud, but the agency has never precisely defined what this means. Notices of suspension frequently provide limited information about the underlying basis for the action, leaving providers with little to contest and no clear path to resolution.
When CMS is working quickly to generate momentum and splashy press conferences, and the agency can’t tell the difference between a bad actor and a legitimate provider who happens to be in the wrong zip code, the wrong people are punished.
How banks solved this problem
Banks had the same problem. Under legacy rule-based detection systems, false positive rates in financial institutions commonly exceeded 90 percent. The system flagged suspicious transactions based on fixed rules such as thresholds, geographic triggers, and transaction types without any account of individual customer history or behavior. Legitimate customers had their transactions blocked constantly. It was a costly, blunt instrument.
Industry analysis has found that the hidden costs of false positives in terms of lost customers, complaints, churn, and reputational damage, can outweigh actual fraud losses by a factor of 3:1. When blocking a legitimate customer costs you more than the fraud you prevented, the business case for better tools writes itself.
So, what did they replace the rule-based system with? Continuous monitoring of individual account history, real-time transaction scoring, and network analysis, or graph analytics, that maps relationships between accounts rather than evaluating each transaction in isolation. Financial institutions shifted the question from “does this transaction look unusual in the abstract” to “does this transaction look unusual for this specific customer, given everything we know about how they behave.”
That is a fundamentally different analytical framework, and it produces fundamentally different results, in terms of a reduction in both false positive and fraud losses. The tool gets smarter over time because it learns from outcomes rather than applying static rules to each new transaction.
Importantly, in terms of incentives, the government simply doesn’t face the same pressures the private sector does. CMS doesn’t lose customers when it suspends a legitimate provider. The cost falls on that provider. CMS has no revenue at risk and no churn metric that lands on a dashboard somewhere and demands explanation. The institutional incentive structure doesn’t punish false positives the way a bank’s does. That asymmetry is a big reason why it’s so hard to fight fraud in government programs.
The tools gap
CMS has been trying to build an effective fraud prevention apparatus for decades, and it has made some real progress. The agency uses predictive analytics on claims data, it has imposed prepayment edits through the National Correct Coding Initiative, and it has taken increasingly aggressive action on payment suspensions— it’s suspended $5.7 billion in suspicious payments in 2025 alone.
But the distance between what CMS deploys and what the private sector uses is vast, and the agency knows it. Last fall, CMS held what it called the Crushing Fraud Chili Cook-Off Competition — a market research challenge inviting outside vendors to submit explainable AI tools capable of detecting anomalies in Medicare claims data. The Chili Cook Off was itself an admission that CMS’s existing tools are not performing well enough.
One significant limitation CMS faces is that it relies primarily on data and not intelligence. CMS has a lot of data, but it lacks the analytical infrastructure to turn that data into a picture of how fraud actually operates as a network.
Modern fraud hides in relationships. The $10.6 billion Operation Gold Rush scheme was caught because DOJ’s data analytics team mapped the connections between dozens of shell companies, foreign straw owners, and stolen patient identities across multiple states and saw the network underneath. That kind of detection requires graph analytics— tools that treat providers, billing entities, patients, and referral relationships as nodes in a web rather than as isolated data points to be measured against a benchmark.
Graph analytics can identify a cluster of hospices sharing the same administrator, the same billing address, or the same medical director across nominally separate entities. It can surface the license-flipping patterns that let bad actors evade revocation by reconstituting under new names. It can map referral networks that look legitimate in isolation but reveal kickback arrangements when viewed as a whole.
A network analysis of the legitimate hospice provider who had to shutter his business because CMS mistook him for a fraud actor would have shown an owner and his nurse wife, five years of clean claims, a single location, no shared administrators or billing addresses with known bad actors, no license transfers, no referral patterns linking them to criminal networks. In other words, the opposite of every signal that organized hospice fraud actually produces. Graph analytics catches fraud by looking at relationships rather than volume. That distinction is what separates a precision tool from a blunt one.
These are standard tools used routinely by major insurers and fintechs to detect organized fraud rings. CMS is not using them at scale, and the result is both more fraud losses and more legitimate businesses being caught up in the fraud net.
What precision actually requires
The LA hospice market is a genuine crisis, and the scale of the fraud warrants aggressive action. But aggressive action built on imprecise tools results in suspensions of legitimate providers, disruptions to patient care, and legal challenges that slow enforcement further while fraudsters move on to the next scheme. And the headlines of legitimate businesses having to shutter because CMS stopped paying them undermines the public’s trust in the government’s ability to fight fraud effectively.
Precision requires individualized behavioral baselines, not just benchmark comparisons. It requires cross-program data visibility so that fraud networks exploiting multiple federal programs can be identified as networks rather than as a series of unconnected anomalies. It requires a defined, transparent evidentiary standard for payment suspension so that providers have meaningful notice and a credible path to appeal. And it requires the use of intelligence to draw connections that uncover hidden fraud networks.
The Vance task force is putting the right level of senior attention on fraud, but the detection infrastructure the government is working with is outdated and poorly fit to the scale of the problem. CMS is piloting new tools in an effort to address the enormous shortcomings of its current approach, but the hospice owner who had a 9 out of 10 quality score and lost his business anyway paid the price for those shortcomings.