Healthcare Fraud Patterns and Detection
Summary
This chapter applies graph thinking to one of the book's central use cases: fraud, waste, and abuse. It introduces common fraud patterns -- upcoding, unbundling, phantom billing, duplicate claims, and kickback schemes -- and the graph analytics techniques (community detection, anomaly detection, referral network analysis) used to surface them. It also covers fraud patterns specific to behavioral health and durable medical equipment.
Concepts Covered
This chapter covers the following 15 concepts from the learning graph:
| Concept | Concept Impact Score |
|---|---|
| Healthcare Fraud | 50 |
| Fraud Detection | 22 |
| Waste In Healthcare | 1 |
| Abuse Detection | 2 |
| Upcoding | 1 |
| Unbundling | 25 |
| Phantom Billing | 2 |
| Duplicate Claim | 1 |
| Kickback Scheme | 2 |
| Referral Network Analysis | 1 |
| Community Detection | 20 |
| Anomaly Detection | 2 |
| Behavioral Health Fraud | 1 |
| DME Fraud | 2 |
| Durable Medical Equipment | 1 |
Prerequisites
This chapter builds on concepts from:
- Chapter 5: Graph Algorithms, Centrality, and Similarity Measures
- Chapter 6: Graph Embeddings, Clustering, and Graph Neural Networks
- Chapter 11: Specialty Care, Surgery, and Remote Monitoring
- Chapter 14: Insurance Claims, Coverage, and Pharmacy Benefits
Every concept in this book so far has assumed claims, referrals, and billing codes reflect real, legitimately delivered care. This chapter drops that assumption. Healthcare fraud costs the U.S. system tens of billions of dollars every year, and it hides inside exactly the same claims, provider, and referral graphs this book has been modeling since Chapter 14 — which is precisely why graph analytics, rather than row-by-row claim review, has become one of the most effective tools for finding it. This chapter defines fraud precisely, surveys the billing patterns fraud most often takes, and introduces the graph algorithms from Chapters 5 and 6 that surface those patterns at scale.
Time to Put On Our Detective Arms
Hi again — this chapter is a little more serious than our usual fare, since we're modeling fraud, not just billing. But here's the good news: everything you've learned about graphs so far turns out to be exactly what fraud investigators actually use, from dense clusters to referral networks that don't quite look right. Let's connect the dots (and catch a few bad ones along the way).
Fraud, Waste, and Abuse
Healthcare fraud is the intentional deception or misrepresentation of facts to obtain an unauthorized healthcare payment — the key word is intentional: a provider knowingly billing for a service that was never delivered, or knowingly submitting a diagnosis code chosen to justify a more expensive procedure, is committing fraud. Fraud in the U.S. healthcare system is estimated to account for a significant share of total healthcare spending each year — figures commonly cited range from 3% to 10% of total spending, which against a multi-trillion-dollar system translates into tens of billions of dollars annually, making fraud detection not a peripheral compliance exercise but a first-order cost-containment problem in its own right, directly connected to the cost analysis covered in Chapter 16.
This intent requirement distinguishes fraud from two related but legally and analytically distinct problems, together often abbreviated FWA (fraud, waste, and abuse) in industry usage. Waste in healthcare refers to overutilization or inefficient use of healthcare resources that has no fraudulent intent behind it — ordering a redundant test out of excessive caution, or a hospital keeping a patient an extra unnecessary day out of habit rather than clinical judgment, are typical examples. Abuse detection falls in between the two: it targets provider practices that are inconsistent with accepted medical, business, or fiscal standards and that result in unnecessary cost, without the deliberate deception that would elevate the behavior to fraud — a physician who habitually orders a slightly more expensive imaging study than necessary, out of genuine (if misguided) clinical caution rather than financial motive, is engaged in abuse rather than fraud. The legal consequences differ sharply across the three: fraud can trigger criminal prosecution, while waste and abuse are typically addressed through recoupment, provider education, or civil penalties. A single suspicious billing pattern can plausibly originate from any of the three, which is exactly why fraud investigators, covered in depth in Chapter 19, must corroborate a graph-detected pattern with additional evidence before concluding intent was actually present.
Consider three cardiologists who each bill an elevated volume of stress tests relative to their peers. The first genuinely believes, based on outdated training, that more frequent testing is the safest course for her patients — waste, since no deception is involved even though the resulting cost is unnecessary. The second has simply fallen into a habit of ordering the test as a defensive-medicine reflex without reassessing whether it fits current clinical guidelines each time — abuse, an unsound practice pattern rather than active deceit. The third knowingly orders unnecessary tests specifically because a diagnostic imaging company he co-owns bills for them — fraud, because the deception (billing for a service chosen for financial rather than clinical reasons while representing it as medically indicated) is deliberate. All three produce an identical anomalous statistic — elevated stress-test volume — which is exactly why the anomaly-detection techniques introduced later in this chapter can only flag the pattern; determining which of the three explanations actually applies is the investigative work Chapter 19 covers.
Healthcare fraud rarely announces itself in a single suspicious claim. It reveals itself in the shape of a provider's billing pattern over time — an unusually dense concentration of high-value procedure codes billed to very few patients, or a referral relationship that only ever flows in one direction with suspiciously perfect reciprocity. These are structural properties of a graph, not properties of any individual claim, which is exactly why the row-based, one-claim-at-a-time review common in legacy systems misses so much of it, and why every detection technique introduced later in this chapter operates on relationships between claims rather than on any single claim in isolation.
Diagram: Healthcare Fraud Scheme Network Visualization
Run the Healthcare Fraud Scheme Network Visualization Fullscreen
Healthcare Fraud Scheme Network Visualization (reused)
Type: graph-model
sim-id: healthcare-fraud-scheme-network-visualization
Library: vis-network
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/healthcare-fraud-scheme-network-visualization/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/healthcare-fraud-scheme-network-visualization
Bloom Taxonomy: Analyze
Bloom Taxonomy Verb: examine, distinguish
Learning objective: Given two provider subgraphs, the learner can distinguish the structural signature of a fraudulent billing pattern from a normal one by examining claim density, patient concentration, and procedure-code repetition.
Reused from this book's MicroSim library. This graph contrasts a flagged provider whose claims form a dense star -- an unusually high volume of claims billing the same high-value procedure for only two patients with the same diagnosis -- against a normal provider's single routine claim. Dragging nodes to compare the two subgraphs directly makes the "shape, not a single claim" argument in the prose concrete and visually memorable.
Common Billing Fraud Patterns
Several recurring billing patterns account for most detected healthcare fraud. Upcoding is billing for a more expensive service or a higher severity level than what was actually provided — for example, billing a brief follow-up visit under the procedure code reserved for a lengthy, complex evaluation. Unbundling is the practice of separately billing for the individual components of a procedure that should be billed together under a single, lower-priced bundled code, deliberately fragmenting a $400 bundled procedure into three separately billed components that together total $650. Unbundling carries the second-highest Concept Impact Score in this chapter because it directly connects two concepts from earlier in the book: it exploits the charge master and billing code structure from Chapter 16, and it is caught by exactly the coding-consistency edits built into the claim processing pipeline from Chapter 14.
Phantom billing is billing for a service, supply, or piece of equipment that was never actually provided to the patient at all — the most direct and most legally unambiguous form of fraud, since there is no legitimate care to point to as justification, and it is frequently uncovered simply by cross-referencing a billed service's date against independent evidence that the patient was not present that day (a facility's own access logs, or a claim from a different, legitimate provider placing the patient elsewhere entirely). A duplicate claim is the same service billed more than once, whether through a genuine data-entry error or a deliberate attempt to collect payment twice for a single encounter — graph analytics distinguishes the two by checking whether the duplicate claims cluster suspiciously around a single provider's billing pattern or appear as isolated, one-off errors scattered across many unrelated providers, since honest mistakes tend to be randomly distributed while deliberate double-billing concentrates around whoever benefits from it. A kickback scheme is an illegal payment made in exchange for patient referrals or for ordering a specific service, supply, or medication — turning what should be a clinical decision made in the patient's best interest into a transaction driven by undisclosed financial incentive. Kickbacks are illegal under federal law specifically because they corrupt referral decisions regardless of whether the referred care itself is medically appropriate, and a kickback is the specific pattern underlying the behavioral health fraud ring examined later in this chapter.
The table below reinforces the dollar-scale difference these patterns can produce on an identical underlying procedure, using the same $400 bundled-procedure example introduced above.
| Pattern | Billed As | Amount Billed | Fraud Signal |
|---|---|---|---|
| Legitimate bundled billing | One bundled CPT code | $400 | None -- normal practice |
| Unbundling | Three separate component codes | $650 | 62% cost inflation on identical care |
| Upcoding | A single higher-severity code | $720 | No component services delivered to justify the higher code |
| Phantom billing | The full bundled code | $400 | No visit occurred at all |
A Pattern Alone Isn't Proof
Here's an easy trap to fall into: seeing one of these billing patterns and assuming fraud automatically. A single unbundled claim could be a coding mistake, a legitimate clinical exception, or genuine fraud — graph analytics flags the pattern, but confirming intent always requires the human investigation process covered in Chapter 19.
Detecting Fraud with Graph Analytics
Fraud detection is the systematic process of identifying claims, providers, or networks likely to involve fraud, waste, or abuse, using the structural, statistical, and network-based techniques introduced in Chapters 5 and 6. Rather than relying on a single technique, production fraud-detection systems typically run several graph algorithms in parallel and combine their outputs into one composite risk score, since each algorithm is sensitive to a different kind of pattern that the others might miss entirely.
Anomaly detection flags claims or providers whose billing statistics deviate significantly from a peer-group norm — a provider billing a specific procedure at ten times the volume of similarly situated peers, for instance, without any obvious clinical explanation. Establishing that peer group correctly matters enormously: comparing a specialist against general practitioners, or an urban academic medical center against a rural clinic, produces false anomalies purely from differences in patient population and scope of practice rather than any billing irregularity. Community detection, introduced in Chapter 6, applies the Louvain algorithm to partition a claims or referral graph into densely connected clusters, or communities, so that a group of providers, patients, and pharmacies transacting unusually tightly with one another — far more tightly than the sparse connections typical of a legitimate network — becomes visible as a distinct structural cluster rather than a collection of individually unremarkable relationships. Referral network analysis examines the structure of referral relationships specifically, looking for patterns such as suspiciously reciprocal referrals (Provider A refers almost exclusively to Provider B, and vice versa) or referral volume wildly out of proportion to a specialty's typical practice pattern — patterns that a legitimate, clinically driven referral network essentially never produces on its own, since real patient need rarely concentrates so neatly around a single pair of providers.
Diagram: Graph-Based Fraud Detection Algorithm Workflow
Run the Graph-Based Fraud Detection Algorithm Workflow Fullscreen
Graph-Based Fraud Detection Algorithm Workflow (reused)
Type: workflow
sim-id: graph-based-fraud-detection-algorithm-workflow
Library: Mermaid
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/graph-based-fraud-detection-algorithm-workflow/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/graph-based-fraud-detection-algorithm-workflow
Bloom Taxonomy: Analyze
Bloom Taxonomy Verb: examine, organize
Learning objective: Given the five parallel fraud-detection algorithms feeding a composite risk score, the learner can organize which algorithm targets which structural pattern and examine how confirmed outcomes feed back into model retraining.
Reused from this book's MicroSim library. This flowchart shows five detection algorithms -- statistical outliers, Louvain community detection, referral-network centrality and cycles, temporal change-points, and claim similarity -- running in parallel on a claims graph and merging into a weighted composite risk score that drives investigation routing. The feedback loop from confirmed outcomes back into "Update Detection Models" shows the learner that fraud detection is a continuously retrained system, not a one-time rule set.
Community detection deserves a closer look given how central it is to modern fraud analytics. Applied to a claims graph containing patients, providers, diagnoses, and medications, the Louvain algorithm typically surfaces communities that correspond to legitimate disease cohorts — a cardiac-care community, a diabetes-management community — because patients genuinely being treated for the same condition naturally cluster around the same specialists, medications, and facilities. A fraud ring disguises itself by mimicking this same density, but its cluster forms around an illegitimate organizing principle instead — shared ownership, a kickback arrangement, or a single referral source — which the algorithm cannot distinguish from a legitimate disease cohort without a human investigator examining exactly why a given community is so tightly connected.
Diagram: Network Community Detection Interactive Graph Model
Run the Network Community Detection Graph Model Fullscreen
Network Community Detection Interactive Graph Model (reused)
Type: graph-model
sim-id: network-community-detection-graph-model
Library: vis-network
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/network-community-detection-graph-model/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/network-community-detection-graph-model
Bloom Taxonomy: Understand
Bloom Taxonomy Verb: explain, interpret
Learning objective: Given an uncolored healthcare network, the learner can interpret which nodes the Louvain algorithm groups into communities and explain why dense within-group connections versus sparse between-group connections define a community.
Reused from this book's MicroSim library. Toggling "Color by community" on and off shows the same cardiac, diabetes, and renal patient cohorts before and after Louvain assigns them to communities, with sparse bridge edges representing comorbid patients. Seeing the network un-colored first reinforces that communities are not obvious in advance -- they are a genuine algorithmic discovery, exactly the property a fraud-detection system relies on to surface a hidden ring.
Once anomaly detection assigns every provider a numeric risk score, a fraud team still faces a practical decision: where to draw the line between "investigate this" and "let it pass." Setting that threshold is a genuine trade-off, not a purely technical calculation, because it trades missed fraud against wasted investigator time on false alarms.
Diagram: Anomaly Score Threshold Explorer MicroSim
Run the Anomaly Score Threshold Explorer MicroSim Fullscreen
Anomaly Score Threshold Explorer MicroSim (reused)
Type: microsim
sim-id: anomaly-score-threshold-explorer
Library: p5.js
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/anomaly-score-threshold-explorer/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/anomaly-score-threshold-explorer
Bloom Taxonomy: Evaluate
Bloom Taxonomy Verb: assess, justify
Learning objective: Given a distribution of provider anomaly scores, investigator capacity, and the relative costs of missed fraud versus false-positive investigations, the learner can assess where to set a detection threshold and justify the choice using total expected cost.
Reused from this book's MicroSim library. Dragging the threshold line across roughly 120 plotted providers updates a confusion matrix, precision, recall, and total expected cost in real time, showing the learner that an interior threshold -- not the most aggressive or the most conservative setting -- minimizes total cost once both missed-fraud cost and investigation cost are weighed together.
Why a Graph Sees What a Table Can't
Notice that every technique on this page depends on relationships between rows, not any single row in isolation — exactly the index-free adjacency advantage from Chapter 1. A relational fraud query has to reconstruct that network with expensive joins every single time it runs; a graph database just walks the edges that are already sitting there. That's not a coincidence — it's the whole reason graph databases became the standard tool for this job.
Fraud in Specialized Domains: Behavioral Health and DME
Two areas of healthcare see fraud patterns distinctive enough to warrant their own detection approach. Behavioral health fraud frequently takes the form of patient-recruitment schemes: a "body broker" recruits patients, often from out of state and often carrying favorable out-of-network insurance, in exchange for a per-patient kickback from a treatment facility; the facility houses recruited patients together, over-orders urine drug screens from an affiliated lab, and bills the insurer for services that may be medically unnecessary or never fully delivered. The referral reciprocity, closed financial kickback loops, and shared housing arrangement in such a scheme are exactly the kind of structural signature that referral network analysis and community detection, covered earlier in this chapter, are built to surface.
Diagram: Behavioral Health Fraud Network MicroSim
Run the Behavioral Health Fraud Network MicroSim Fullscreen
Behavioral Health Fraud Network MicroSim (reused)
Type: microsim
sim-id: behavioral-health-fraud-network-microsim
Library: p5.js
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/behavioral-health-fraud-network-microsim/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/behavioral-health-fraud-network-microsim
Bloom Taxonomy: Analyze
Bloom Taxonomy Verb: examine, identify
Learning objective: Given a patient-recruitment fraud ring diagram, the learner can identify the kickback, referral, lab-order, and shared-housing edges and examine how their combination distinguishes the ring from a legitimate referral network.
Reused from this book's MicroSim library. Clicking any node isolates its relationships and opens an investigation panel describing its role, while a fraud-indicator summary calls out referral reciprocity, closed financial loops, and out-of-state insurance -- the three structural signals described in the prose above, made directly inspectable rather than merely asserted.
Durable medical equipment (DME) — wheelchairs, oxygen equipment, hospital beds, and similar reusable equipment prescribed for home use — is a second high-risk category, because DME items are often high-value, physically hard for a payer to verify after delivery, and prescribed based on a physician's order that a supplier rarely double-checks clinically. DME fraud commonly combines several red flags at once: referral concentration (nearly all of a supplier's referrals originating from just one or two physicians), specialty mismatch (a podiatrist ordering power wheelchairs, well outside typical practice patterns), geographic distance between patient and supplier, and clustering of patient addresses that suggests a recruited, rather than organically referred, patient population. No single flag proves fraud on its own, but converging signals across several flags at once is a strong indicator.
Diagram: DME Fraud Pattern Detector MicroSim
Run the DME Fraud Pattern Detector MicroSim Fullscreen
DME Fraud Pattern Detector MicroSim (reused)
Type: microsim
sim-id: dme-fraud-pattern-detector
Library: vis-network
Status: Reused
Source: https://dmccreary.github.io/modeling-healthcare-data/sims/dme-fraud-pattern-detector/
Source Repo: https://github.com/dmccreary/modeling-healthcare-data/tree/main/docs/sims/dme-fraud-pattern-detector
Bloom Taxonomy: Evaluate
Bloom Taxonomy Verb: assess, justify
Learning objective: Given a physician-supplier referral network and a set of toggleable DME red flags, the learner can assess which supplier is most likely fraudulent and justify the ranking using converging, rather than single, signals.
Reused from this book's MicroSim library. Toggling referral concentration, geographic distance, specialty mismatch, and address-clustering red flags shifts each supplier's color and ranked risk score, with a seeded fraud supplier tripping every flag while legitimate suppliers trip few or none -- directly demonstrating the converging-signals argument in the prose above rather than any single red flag in isolation.
Fraud Patterns Get Easier to Spot With Practice
If the DME red flags feel like a lot to hold in your head at once, that's completely fair — real investigators build this pattern recognition over years, not in one reading. The MicroSim above is a safe place to build that instinct: try toggling flags on and off one at a time until the "converging signals" idea clicks.
Behavioral health and DME fraud are really just the general detection techniques from earlier in this chapter applied to two domains with their own distinctive red flags — proof that the same graph-analytics toolkit generalizes well beyond the patterns it was originally built to catch.
Chapter Summary
You Can Now Spot Fraud in the Shape of a Graph
You just learned to tell fraud, waste, and abuse apart, catalog the major billing fraud patterns, and apply community detection, anomaly detection, and referral network analysis to surface them — including the specialized playbooks for behavioral health and DME fraud. That's genuinely advanced graph analytics, and you handled it like a pro.
This chapter defined healthcare fraud precisely against waste and abuse, cataloged the recurring billing patterns fraud takes (upcoding, unbundling, phantom billing, duplicate claims, and kickback schemes), and modeled the graph algorithms — community detection, anomaly detection, and referral network analysis — that surface those patterns at scale, including the specialized fraud signatures found in behavioral health and durable medical equipment. Every technique here answers the question "is this pattern suspicious?" — Chapter 19 picks up what happens next, following a flagged pattern through formal investigation, regulatory compliance, and resolution.