CMS’s Fraud AI Doesn’t Know the Difference Between a Scammer and a Growing Practice

On Friday, CMS announced it had blocked or recovered more than $1.6 billion in improper Medicare laboratory payments since the start of this administration — 157 lab providers revoked, 185 payment suspensions out of 600 labs investigated, $276 million clawed back. The press covered it as a win, and on the numbers, it is one.

That is the headline. It is not the story that matters to anyone running a billing operation.

How CMS is actually catching them

Every writeup led with the total and the provider count. Almost none looked at the detection method. In one case CMS highlighted, a Texas lab started billing in earnest, got flagged, had $1.2 million in claims denied, then changed its billing behaviour to try to get around the controls. CMS’s Fraud Defense Operations Center kept watching, caught the shift, and suspended payment before another $150,000 went out. Another case followed the same shape: a burst of activity, a pattern change, a fast suspension.

Read that as a detection method, not a fraud story. What CMS is flagging is volatility — billing volume or billing pattern that moves faster or differently than the baseline the algorithm expects.

That is a reasonable way to catch a shell lab. It is also exactly what a legitimate practice looks like when it opens a second location, signs a new payer contract, onboards a new provider, absorbs a merger, or brings a new CPT code into regular use.

Why this is an operations problem before it is a compliance problem

Fraud enforcement has always run on pattern detection. What is different now is the speed and the surface area. The Fraud Defense Operations Center has suspended over $371 million in payments across 267 providers and suppliers since January, and CMS says explicitly this technology now runs across labs, hospice, DME and autism therapy — with more categories almost certainly coming.

A suspension is not a fraud conviction. It is a hold on cash flow that gets sorted out later, and “later” is not a word anyone wants attached to their receivables. If your practice is about to ramp billing volume for a legitimate reason, you are producing the same shape of signal the algorithm was built to catch. Nobody at CMS is going to call ahead and ask if there is an innocent explanation.

What to actually do with this

• Know your own volatility before CMS’s model finds it first. If billing volume, code mix or payer mix is about to move sharply for a real business reason, document it in real time — not reconstruct it after a suspension notice arrives.
• Build a change log, not just a claims log. Every new location, provider, contract or coding shift that will visibly move your billing pattern should have a dated, written reason behind it, ready to hand to a payer integrity contractor on request.
• Loop in whoever owns credentialing and enrolment, not just billing. A lot of the volatility that trips these models starts upstream — a provider goes live before enrolment fully clears, or a new NPI starts billing with no pattern history behind it.
• Do not treat this as someone else’s problem until a suspension letter makes it yours. The labs CMS named did not get a warning shot.

The 2030 view

The fraud numbers will keep climbing every quarter, because that is the mandate and the technology only gets better at spotting outliers. The practices hurt by that will not be the shell labs — they are built to disappear once caught. It will be the legitimate operators whose growth looks, for a few weeks, exactly like the thing the model was trained to flag.

The providers who come through cleanly will not be the ones who wait for a suspension to explain themselves. They will be the ones who can already show, on request, exactly why their numbers moved.