Where the signals converge. Medicaid provider fraud detection for managed care plans, health plans and state program integrity units.

Exhibit A · Signal convergence

Illustrative composite. No real provider depicted. A simulated network of 324 entities.

  • No signal
  • One or two signals
  • Three or more
  • Hit by the signal being applied
  • Goes forward for review

Signals applied0 of 10

Entities with any signal0

Most on one entity0

Exhibit AIllustrative. Ten signals applied in turn to a simulated network of 324 entities; darker squares carry more signals. Many entities show one or two, which ordinary business usually explains. One carries six and goes forward for investigator review. No fixed number of signals makes a case. Not client data.

Marque scores every entity in your network on ten independent signals, read from claims, provider registries, exclusion lists, corporate filings, federal loan records and addresses. Investigators review the highest-scoring entities before anything is called a finding. You receive a ranked register and referral-ready evidence. Confirmed patterns become pre-payment rules.

The ten signals Read the terms
First findings
10 business days
Signals scored
Ten per entity
Led by
A principal named in the statement of work

01

The problem

Why Medicaid fraud is usually found after payment.

Most program integrity work begins once a claim has been paid. Recovery starts from behind, and the entity that billed may be gone by the time the review is done.

Medicaid’s improper payment rate for fiscal year 2025 was 6.12%, an estimated $37.39 billion.1 CMS states that improper payment measurement is not a measure of fraud. Most of it, 77.17%, reflects payments that could not be supported by documentation when reviewed.

Fraud is a separate estimate. GAO puts federal fraud losses across all programs at between $233 billion and $521 billion a year, based on fiscal 2018 to 2022 data.2 GAO says preventive activities generally offer the most cost-efficient use of resources and help avoid a costly, inefficient “pay-and-chase” model. In February 2026 HHS and CMS announced a shift from “pay and chase” to a “detect and deploy” strategy.3

Claim-level edits read one claim at a time. A scheme is a structure: several entities at one suite, a shared phone line, an officer common to all of them, a billing agent tied to an excluded individual. That structure becomes visible only when claims, registries, exclusion lists and corporate filings are read together, at the level of the entity.

CMS improper payment estimates, fiscal year 2025
ProgramRateEstimate
Medicaid6.12%$37.39B
CHIP7.05%$1.37B
Medicare Part C6.09%$23.67B
Medicare fee-for-service6.55%$28.83B
Fig. 1CMS improper payment estimates, fiscal year 2025. Source: CMS fact sheet.1 CMS: improper payment measurement is not a measure of fraud.

$233B–$521B

Estimated federal fraud losses per year, all programs. GAO, fiscal 2018 to 2022 data.2

What the public Medicaid claims data show

Marque’s analysis of the federal Medicaid provider-spending file and the OIG exclusion list.45 These are aggregates. No provider is identified.

  1. 45.6–47.7%

    of the paid dollars in the federal provider-spending file went to the top 1% of billing NPIs in each year from 2018 to 2024.

    A billing NPI is not a company. Large health systems legitimately bill a great deal of care under a small number of NPIs.

  2. 604

    instances, 2019 through 2023, where a provider paid in every month of the prior year passed $1 million after growing more than tenfold in one year.6

    Growth alone does not show fraud; mergers and identifier changes produce legitimate jumps. In a plan’s own network, a jump like this is scored with the other nine signals before anyone looks at it.

  3. 10.25%

    of OIG exclusion records carry an NPI (8,482 of 82,749). Matching on NPI alone cannot check most excluded parties.

    For providers excluded from 2019 through 2024 that had earlier Medicaid payments, the median gap between the last payment and the exclusion is 29 months.

Fig. 2Data. Marque analysis of HHS Medicaid Provider Spending by HCPCS, version 2026-02-09 (file dated April 6, 2026; rows with a billing provider NPI; T-MSIS fee-for-service, managed care and CHIP claim lines), and the OIG List of Excluded Individuals/Entities. Aggregates only.

The method and caveats are in two research notes: where Medicaid money concentrates and the NPI gap in exclusion screening.

  1. 1Centers for Medicare & Medicaid Services, Fiscal Year 2025 Improper Payments Fact Sheet, January 15, 2026. CMS states that “improper payment measurement is not a measure of fraud” and that 77.17% of FY 2025 Medicaid improper payments were the result of insufficient documentation.
  2. 2U.S. Government Accountability Office, GAO-25-108412, April 9, 2025. Fraud loss range of $233 billion to $521 billion annually, based on fiscal 2018 to 2022 data.
  3. 3Centers for Medicare & Medicaid Services, press release, February 25, 2026, CMS newsroom.
  4. 4U.S. Department of Health and Human Services, Medicaid Provider Spending by HCPCS, HHS Open Data Platform, version 2026-02-09; file dated April 6, 2026; rows with a billing provider NPI; service months January 2018 to December 2024, 2024 preliminary. Service years; nominal dollars. Year-over-year comparisons stop at 2023 because 2024 data are preliminary.
  5. 5HHS Office of Inspector General, List of Excluded Individuals/Entities, downloaded March 14, 2026.
  6. 6Together those 604 instances were paid $2.97 billion. Including preliminary 2024 data, the count is 706 and the total $3.56 billion. Typical annual growth among providers paid over $1 million is about 1.1×.

02

The ten signals

Provider risk scoring on ten independent signals.

The signals are measured independently. One signal on its own has many innocent explanations. Several on the same entity have fewer, and that is where investigators start.

Schedule S · Signal definitions

Scored for every entity in an engagement

  1. S.01

    Billing intensity vs. peers

    Volume, units per patient or paid amounts far above same-specialty peers, sustained over consecutive periods.

    ReadsYour claims, measured against a national baseline of 227 million rows of Medicaid provider-spending data (HHS, version 2026-02-09, 2018–2024) and against your own network. See where Medicaid money concentrates.

  2. S.02

    Co-location density

    Many unrelated enrolled entities registered to one building or suite. The physical footprint of a fraud mill.

    ReadsPractice and service addresses from provider registries and your enrollment file, resolved to the suite.

  3. S.03

    Shared phones and billing agents

    Nominally independent providers sharing a phone line, a billing agent or a billing service.

    ReadsRegistry contact records, enrollment records and billing-agent details on claims.

  4. S.04

    Registry staleness

    Registry records that stood still while the billing did not, including dormant identities that start billing again.

    ReadsRegistry update history, set against claims activity over the same period.

  5. S.05

    Undisclosed affiliations

    Ownership and control that do not appear in enrollment disclosures, such as one officer common to several entities.

    ReadsCorporate filings and federal loan records that name owners, compared with what was disclosed at enrollment.

  6. S.06

    Prior exclusions

    Links to excluded individuals or entities through owners, officers, agents or addresses, beyond a direct identifier match.

    ReadsThe OIG exclusion list, resolved against names, addresses and affiliations. Only about one exclusion record in ten carries an NPI. See the NPI gap in exclusion screening.

  7. S.07

    Implausible growth

    Billing that outruns any plausible capacity, such as claims multiplying in a quarter with no added staff or locations.

    ReadsClaims trajectory by month, set against peer growth and the entity’s own history.

  8. S.08

    Taxonomy mismatch

    Services billed that do not fit the specialty the provider registered.

    ReadsRegistered taxonomy, set against the procedure mix on claims.

  9. S.09

    Cross-program mismatches

    Records that disagree from one program to the next: different owners, addresses or scale for what should be the same business.

    ReadsEnrollment and claims across programs, and 11.4 million pandemic-era federal loan records that tie owners to entities, including some never seen in enrollment files.

  10. S.10

    Enrollment anomalies

    Irregularities in how and when an entity entered the network, including re-enrollment under a new name by the same owners.

    ReadsYour network and enrollment file, with registry creation dates and 9.4 million provider records cross-referenced against federal registries.

Fraud mill detection

A fraud mill is a cluster of entities that share an address, a phone line, owners or a billing agent, and bill as if they were independent. When one is shut down, another enrolls under a new name, often at the same address. Co-location density, shared phones and billing agents, and undisclosed affiliations are read together to find the cluster. Network Watch sends a mill and network alert when entities begin to gather around the same suite, phone, owner or agent.

Pre-payment fraud detection

Patterns confirmed in an engagement become pre-payment flag rules that your claims team applies so high-risk billing is held before it is paid. New-entity screening checks newly enrolled providers as they enter the network. The aim is to stop the next payment, which costs less than recovering the last one.

03

Engagements

What you receive.

The assessment is the first read. Network Watch is the standing watch: every entity re-scored monthly, each new enrollee screened as it enters the network, and an alert when entities begin to gather around the same suite, phone, owner or agent.

The Program Integrity Engagement is the deeper engagement, where the findings call for it. Marque does the work in all three engagements. Fees are quoted on mandate and are not published.

Schedule of engagements · Payment integrity

Specimen. Confirmed in writing on mandate.

Schedule A The first read

10-Day Exposure Assessment

A first read of your network. It ranks the providers that carry the most risk and estimates the exposure.

  1. A.1Full network risk scan
  2. A.2Top-25 risk register
  3. A.3Dollar exposure estimate
  4. A.4Three investigator-ready dossiers
  5. A.560-minute executive and SIU briefing

Schedule B The standing watch

Network Watch

Where the assessment leads. Your network stays under watch, re-scored every month.

  1. B.1Every entity re-scored monthly
  2. B.2New enrollees screened as they enter the network
  3. B.3Mill and network alerts on a shared suite, phone, owner or agent
  4. B.4Quarterly briefing

Schedule C The deeper engagement

Program Integrity Engagement

Marque runs the work, from network scoring through recovery support.

  1. C.1Complete network scoring
  2. C.2Pre-payment flag rules
  3. C.3Referral-ready evidence packages for SIU, OIG and MFCU
  4. C.4Field and OSINT verification
  5. C.5Recovery support

Discuss the Exposure AssessmentDiscuss Network Watch

Terms Exposure Assessment

First findings
10 business days
Fee
Quoted on mandate
Credit
100% of the fee, credited toward a Program Integrity Engagement begun within 30 days
Findings Guarantee
If your SIU does not open a review on at least one entity in the Top-25 register, the fee is returned.Applies to payer Exposure Assessments. For state agencies, fee, credit and guarantee terms are set in writing to fit your contracting rules.
Confidentiality
Mutual NDA executed before any data moves
Order of events
Conflicts check, mutual NDA, business associate agreement, then written scoping. The 10 business days begin when the agreed extract is received and passes validation.
Before you sign
Marque has reviewed its screens against resolved DOJ enforcement matters. That review is retrospective, and a data anomaly is not proof of fraud. Details are provided under NDA.

04

Your data

How claims and enrollment data are handled.

Set out in writing before any data moves, and confirmed against your own security and data-use requirements.

Schedule D Data handling

The floor
Before any scoping: conflicts check, mutual NDA and business associate agreement. The conflicts and data-use terms below apply to every engagement. Further controls are added to your requirements.
Order of events
Conflicts check, mutual NDA, business associate agreement, then written scoping. The 10 business days begin when the agreed extract is received and passes validation. No data moves before all four.
Inputs
A claims extract and your provider network or enrollment file for the period in question. Provider-level scoring does not need member names, so a limited extract is often enough.
Transfer and storage
Transfer method, storage location, encryption and any subprocessors are set out in writing at scoping, to your requirements.
Your terms
Your security questionnaire is completed, and your program’s data-use and confidentiality terms are agreed, before transfer.
Intake form
Please leave PHI and matter-specific detail out of the web form. That conversation happens under NDA.

Conflicts and data use

Conflicts
Every mandate is checked for conflicts before an NDA is signed.
Data use
Client data, and anything derived from it, is used only for that client’s engagement. Data from payer and agency engagements never enters a matter for counsel.
Access
Access is limited to the engagement staff named in the statement of work. The team is based in the United States.
Close
Data is returned or destroyed at close.
Leadership
Every mandate is led by a principal named in the statement of work.

For Medicaid managed care plans.

Referrals
Packages are formatted for the plan’s fraud, waste and abuse reporting under its state contract, and for MFCU referral.
Pre-payment rules
Written for the plan’s own edit system, with review queues sized to keep provider abrasion and prompt-pay exposure in view.
Recovery
Support documented for recoupment under the plan’s provider agreements.

For state program integrity units.

Referrals
Packages are prepared for MFCU referral and documented to support the agency’s own review.
Pre-payment rules
Written as specifications that an MMIS or fiscal agent can apply as edits.
Contracting
The Exposure Assessment has a fixed scope and a single fee, so it can be written as one statement of work or task order. Fee, credit and guarantee terms are set in writing to fit the agency’s contracting rules.

Candor about fit. Where Marque is not the right firm for the problem, we will say so and, where we can, suggest one that is. The firm’s principals include a Chief Data Officer with 14 years of Medicaid actuarial analysis, including managed care. Marque Analytics LLC was formed in February 2026.

05

Approach

How a Marque engagement differs from an FWA software platform.

Payment integrity is often bought as software that a plan’s own team operates. Marque is retained to do the analysis and hand over the evidence.

A software platform compared with a Marque engagement
QuestionSoftware platformMarque engagement
Who does the analysisYour SIU or analytics staff, using the vendor’s toolsMarque’s team
What you receiveScores, alerts and work queuesA ranked register, investigator-ready dossiers and referral-ready evidence packages
VerificationBy your investigators, after the alertInvestigator review; field and open-source verification in a Program Integrity Engagement
Evidence standardSet by your teamReferral-ready evidence packages for SIU, OIG or MFCU
First findingsDepends on implementation10 business days
Commercial termsLicense or subscriptionFee quoted on mandate, credited toward a Program Integrity Engagement begun within 30 days, with the Findings Guarantee for payers
Fig. 3Illustrative comparison of categories of offering, in general terms. No vendor is described. Some vendors also offer managed services; this compares the self-operated platform model.

Alongside the vendors you already use.

Claim editing and post-payment recovery work at the level of the claim. Marque works at the level of the entity: owners, officers, affiliations, addresses, phones and billing agents, read across claims, registries, corporate filings and federal loan records.

The engagement adds that layer to the program you already run. Confirmed patterns go to your claims team as pre-payment rules your existing edit system can apply, and referral packages go to your SIU in the form it already uses.

06

Questions

On scoring, mills and pre-payment rules.

What is Medicaid provider fraud detection?

It is the work of finding the providers who draw Medicaid payments they are not owed, and documenting the evidence well enough for a plan or state to act. Marque works at the level of the entity. Every provider in a network is scored on ten independent signals, read from claims, provider registries, exclusion lists, corporate filings, federal loan records and addresses, and the highest-scoring entities are reviewed by investigators before anything is called a finding. Field and open-source verification is part of the Program Integrity Engagement.

How does provider risk scoring work?

Each entity is scored on ten signals: billing intensity against peers, co-location density, shared phones and billing agents, registry staleness, undisclosed affiliations, prior exclusions, implausible growth, taxonomy mismatch, cross-program mismatches and enrollment anomalies. Billing is measured against a national baseline of 227 million rows of Medicaid provider-spending data (HHS Medicaid Provider Spending by HCPCS, version 2026-02-09, 2018 through 2024), and against your own network. Entities where several independent signals converge rise to the top of a ranked register. No fixed number of signals makes a case.

What is a fraud mill, and how is one detected?

A fraud mill is a cluster of entities that share an address, a phone line, owners or a billing agent while billing as if they were independent. When one entity closes, another often enrolls under a new name with the same owners. Marque finds mills by reading co-location density, shared phones and billing agents, and undisclosed affiliations together, with corporate filings and federal loan records used to tie owners to entities. Network Watch alerts you when entities begin to cluster.

Can fraudulent claims be stopped before they are paid?

For patterns that have been identified, yes. In a Program Integrity Engagement, Marque turns confirmed patterns into pre-payment flag rules for your claims team, so high-risk billing is held before it is paid. Network Watch screens newly enrolled providers as they enter the network.

Are improper payments the same as fraud?

No. CMS estimated Medicaid improper payments at 6.12%, or $37.39 billion, for fiscal year 2025, and states that improper payment measurement is not a measure of fraud. GAO separately estimates federal fraud losses across all programs at $233 billion to $521 billion a year. Neither figure describes a particular plan’s network. The Exposure Assessment estimates exposure for a specific network.

What data does Marque need, and how is it protected?

Typically a claims extract and your provider network or enrollment file for the period in question. The order of events is a conflicts check, a mutual NDA, a business associate agreement, then written scoping. No data moves before all four. Fields, format, transfer method, storage, retention and return or destruction at close are agreed in writing during scoping, against your own security and data-use requirements. Client data, and anything derived from it, is used only for that client’s engagement. Data from payer and agency engagements never enters a matter for counsel. Access is limited to the engagement staff named in the statement of work.

07

Request an introduction.

Tell us about your network and what you are seeing. A senior member of the firm replies within one business day, and we sign a mutual NDA before discussing specifics.

Reply
Within one business day, from a senior member of the firm
Confidentiality
Mutual NDA before any data or specifics change hands
Conflicts
Every mandate is checked for conflicts before an NDA is signed.

Request for introduction

General terms only