They Stole Your Umbrella: Why Healthcare Professionals Should Support Stronger Fraud Controls

The rain, it raineth on the just and also on the unjust fella: But chiefly on the just, because the unjust steals the just’s umbrella.^*

Introduction

Total US National Health Expenditures (NHE)—projected at $5.9 trillion for calendar year 2026, which represents 18.6% of GDP—are expected to rise to an unprecedented 20% of GDP by 2033.¹ The need for effective cost containment strategies is pressing.

One path would be to launch a more vigorous assault on health care fraud and abuse, assuming that there is plenty of it to be found, that we know how to detect and suppress it, and that we could do so without harming patients’ health or rights, or interfering with legitimate medical practice.

Alternative approaches to cost control involve less discriminating methods. Squeeze everything. Reduce benefits across the board. Restrict eligibility. Reduce access to services. Cut provider reimbursement rates. Decrease utilization and shift costs to patients by limiting insurance coverage, increasing premiums and deductibles, and eliminating subsidies.

Providers and their associations have historically been leery of the first approach, scarcely if ever expressing public support for it. Physicians resent medical judgments being second-guessed by investigators and auditors. Some providers are nervous about mobilizing condemnation for even the most blatantly criminal acts of their peers if they cannot draw a bright line separating what the crooks do from what they do themselves. Perhaps they engage in small-fry noble-cause corruption, such as altering diagnoses or fabricating symptoms to help patients qualify for treatments that physicians believe they need. Would they welcome more attention to “False Claims?” Provider associations, defending the financial interests of their members, see only downside risk, especially if controls were poorly directed.

Does the medical provider community prefer the more general methods for ratcheting down costs? In theory, any “broad squeeze” hits the honest and the dishonest alike. In practice, it hits the honest providers and genuinely needy patients hardest. Fraud perpetrators, faced with tighter restrictions and lower reimbursements, enjoy the advantage of being unconstrained by truth; they adjust their billings to fit whatever pays, invent new ways to cheat, and step up their volume of fictitious claims. Honest providers take the pay cut, and their patients suffer the health consequences.

I want to make the case that more rigorous control of fraud and abuse, properly targeted, could cut costs substantially without denying patients necessary services or adversely affecting legitimate medical practice.

How Goes the War?

The Clinton Administration “declared war” on health care fraud and abuse in 1993. Attorney General Janet Reno ranked health care fraud the number two crime problem in America, second only to violent crime—an extraordinary status for any white-collar crime.² Attention to health care fraud has waxed and waned over the years since, gaining prominence whenever the annual medical costs inflation rate ticks upwards towards 10%.

How goes the war now? Rather well, one might surmise, based on a number of recent and highly visible signals:

1. “Crushing Fraud, Waste & Abuse”—a banner headline—now tops the Fraud webpage for the Center for Medicare and Medicaid Services.³

2. On June 30, 2025, the US Department of Justice announced the largest “National Health Care Fraud Takedown” of all time, resulting in 324 defendants charged with over $14.6 billion in alleged fraud.⁴ The press release points out this new record “More than Doubles [the] Prior Record of $6 billion.”

3. In January 2025, the Department of Justice reported a record high number, 979, of whistleblower (or qui tam) lawsuits filed in Fiscal Year 2024 under the False Claims Act, with the majority of cases related to health programs. Every year since 1986, when the Act’s coverage was broadened to include health care expenditures, health-care fraud cases have made up the majority of cases filed.⁵

4. During FY 2024, the Office of Inspector General (DHHS) excluded 3,234 “untrustworthy” individuals and entities from participating in federal health care programs.⁶ The total number of federal exclusions currently exceeds 82,100.⁷ Forty-five states also maintain their own state-level health care provider exclusion lists which they use in addition to the federal list to keep bad actors out.

Taken together these signals suggest high levels of determination, record numbers of prosecutions, a plentiful supply of whistleblowers, and an apparently robust system for shutting out identified miscreants. But does that mean fraud and abuse is well controlled?

Invisible Risks

Health care fraud belongs to the class of “Invisible Risks.” These risks have detection or discovery rates substantially lower than 100%, and in many cases as low as 10% or even 1%. This class of risks include most white collar crimes which, if well designed, remain invisible in perpetuity; consensual crimes like drug-dealing and bribery, and abuses that occur inside closed institutions (e.g., prisons, nursing homes, locked psychiatric wards, boarding schools).⁸

For such risks, we know the problem exists because we observe some cases and deal with those that come to light. We may make the mistake of assuming that the cases we detect are typical of those that remain hidden. We have little or no idea about the true scale of the problem and, as a corollary, cannot estimate our discovery rate, even roughly. The challenge with invisible risks is to get to grips with the invisible mass, rather than simply dealing with the visible sliver; which means, for starters, discerning the true scale of the problem.

“Invisible Risks” present a variety of operational challenges. First and foremost, massive underinvestment in controls is the norm. Underinvestment is a self-perpetuating reality, as lack of commensurate resourcing guarantees under-discovery, which in turn perpetuates uncertainty and continuing underinvestment. This macro-level circularity trap of underinvestment routinely stifles effective control for risks of this type.

Second, all readily available metrics are inherently ambiguous. If this year we discover twice as much fraud as last year, is that good news or bad? Call this the “find more trouble conundrum:” we found more trouble, so maybe there’s more trouble, or maybe we got better at finding it, or both at once. And if we find less trouble, good news and bad stories are similarly available. Unless the ambiguity is somehow resolved, everyone is free to pick the good news or bad news narratives, whichever they prefer.

What should we make of the government’s “record fraud take-down” involving $14.6 billion in fraud? It has become an annual ritual for the government to bundle enough cases together to produce impressive hauls like this. They have announced massive “fraud take-downs” every year for the past 10 years, most often in June or July. New records have been set in 2016, 2017, 2018, 2020, and now 2025.⁹

If a fishing boat returning to shore dumps massive and possibly record hauls on the quayside trip after trip, what conclusion might an observer reach? That the fishermen had worked hard and should be applauded? For sure. That fishing methods and technologies were improving? Perhaps. That fishing was close to extinguishing the fish population? Certainly not. That the fishermen were demonstrating their “zero tolerance” for fish? With massive haul after massive haul, one would surely assume that the seas were veritably teeming with fish, and that the number of fishermen was insufficient to alter that reality.

Measurement Studies

To break the circular trap of underinvestment and resolve the ambiguities in the metrics, we need reliable estimates of the true scale of the problem. Then we could base future control investments in some rational way on the actual prevalence of fraud and abuse rather than on the sliver of cases that come to light. We could also interpret output metrics and caseloads more reliably.

The standard approach to measurement of invisible problems involves conducting rigorous audits or inspections on a random, quasi-random, or otherwise representative sample drawn from the relevant population. In the fee-for-service setting, this means conducting fraud audits on a random sample of health care claims recently paid. Such measurement audits need to be rigorous enough to find “the trouble,” if present, at least most of the time. Findings from the sample can then be extrapolated to the entire population with statistical validity.

Unfortunately, when formal measurement studies for invisible problems are conducted with the appropriate level of rigor, they typically produce estimates of prevalence so high that nobody wants to believe them. To avoid rocking the boat too much, officials may be tempted to use softer audit or inspection protocols which produce reassuringly low estimates.

Both Medicare Fee-for-Service and Medicaid are designated “High Risk” programs and therefore required under federal law to measure and publish payment accuracy rates on an annual basis, which they do through the “Payment Error Rate Measurement Program” (PERM) for Medicaid, and the “Comprehensive Error Rate Testing (CERT)” program for Medicare Fee-for-Service.

The figures produced by these programs provide a partial and somewhat patchy picture. Over the last decade improper payment estimates for Medicaid have ranged from a low of 3.13% in 2020 to a high of 21.69% in 2021; and for Medicare, a low of 6.26% in 2021 to a high of 12.09% in 2015.¹⁰ The estimates vary so widely because of the way the studies are conducted, with different review factors either included or excluded year by year, and varying degrees of rigor applied to the audit process.

The audit protocols include standard document reviews to check whether the claim, taken at face value, complies with coverage, coding, and billing rules. Medical records supplied by the providers are then reviewed to see if they match and justify the claim.¹¹

Bear in mind that fraud perpetrators, even 30 years ago, had learned how to fabricate medical records to match their fabricated claims. Assuming they bill their lies correctly and back up their fake claims with fake medical records (which is ordinary common sense for fraud perpetrators), any of their claims that fall within such samples will likely be determined “correct.”

The audit protocols used make no determinations of fraud or abuse because there is no way to get inside the mind of the claimant to determine the relevant mens rea. Nor do they include enough broader contextual analysis to spot kickbacks and illegal referral schemes, or anomalous patterns of coincidence that might reveal organized scams orchestrated at high levels.

Hence error and overpayment rates, as estimated by the PERM and CERT programs, turn out to be poor proxies for fraud and abuse. (Officials conducting these programs readily acknowledge they are not designed to measure fraud and abuse rates per se, even though many observers assume that they do.)

These measurement programs focus on fee-for service, and we have no equivalent studies attempting to calibrate the full range of abuses under managed care. (More than half of Medicaid and Medicare patients are now enrolled in some kind of managed care plan). We have no aggregate estimates from the private insurance market, which now represent 30% of health care spending; nor for personal out-of-pocket health care spending, which represents another 10%.¹² So we really don’t know much at all about the true scale and scope of health care fraud and abuse; at least, not this way.

Characteristics of Cases Uncovered

We can, however, extract some clues about the effectiveness of control systems by examining the characteristics of the cases that come to light. Let us imagine two different worlds. In World One, control systems are well resourced, vigilant, quick to react, and effective. Fraud and abuse has not been completely eliminated but is certainly well contained. In World Two, control systems are inadequately resourced and overwhelmed, with weak detection systems and shortages of investigators, auditors, and prosecutors for follow up.

Consider the characteristics of the cases that might be discovered under these two scenarios, and how they might differ from each other. In World Two, fraud schemes uncovered would likely be huge. They would have been running for years and caused substantial economic damage before being discovered and shut off. They might involve widespread conspiracies, which take a long time to set up. During many years of operation, the scheme’s activities evaded detection. More likely than not, the scheme was uncovered in the end when a whistleblower stepped forward, rather than through the routine operation of detection apparatus. Had the whistleblower not stepped forward, it seems plausible that the scheme could have grown yet further and rumbled on for several more years.

In World One, by contrast, schemes would be discovered in their early set-up stages. They would not yet involve broad conspiracies, nor have done much economic damage. They would be discovered through the operation of routine detection or intelligence systems, and possibly through the operation of multiple, independent, discovery methods each attuned to different aspects of the scam.

Which world do we live in? Consider the following cases, each discovered or settled within the last year.

1. In May 2025, Dr. Jorge Zamora-Quezada, a Texas rheumatologist, was sentenced to 10 years in prison for submitting $118 million in fraudulent claims to public and private insurers. He falsely diagnosed patients with rheumatoid arthritis and then provided tests and unnecessary and potentially harmful treatments over many years. In addition to his prison sentence, he was ordered to forfeit $28 million, 13 real-estate properties, and a private jet.¹³

2. In June 2025, Gary Cox, CEO of a Healthcare software company DMERx was convicted of operating an internet-based platform which generated more than $1 billion in fraudulent claims. Cox and his co-conspirators targeted “hundreds of thousands” of Medicare patients, using false advertising and offshore call centers to persuade them to accept unnecessary medical supplies. Fake doctor’s order and kickbacks were used across a vast network of participating pharmacies, DME providers, and telemedicine companies.¹⁴

3. In June 2025, Tyler Kontos, Joel Kupetz, and Jorge Kinds were indicted for billing more than $1 billion over a 14-month period for unnecessary but expensive amniotic wound allografts. They targeted elderly Medicare patients in hospice care. They were paid more than $600 million.¹⁵

4. In May 2025, Syed Murtuza Kablazada and Syed Mehdi Hussain were arrested in Illinois having submitted $227 million in fraudulent Medicare claims for COVID-19 test kits supposedly provided to Medicare beneficiaries. Foreign nationals brought in as nominee owners of the laboratories were instructed to leave the country at the first sign of any investigation.¹⁶

5. In June 2025, the Department of Justice charged Farrukh Jarar Ali, a Pakistani national, in a fraud scheme involving at least 41 addiction clinics in Arizona. False claims totaling $650 million were submitted for services not provided as billed, or medically unnecessary—$564 million was paid. The scheme preyed on native Americans, the homeless, and other vulnerable individuals, enrolling them in the state insurance system and then providing substandard care or no care at all.¹⁷

6. A broader pattern of fraudulent “sober homes” in Arizona, involving more than 100 facilities, is estimated to have cost the state’s Medicaid program at least $2.5 billion dollars.¹⁸ Relatives of the victims (many of whom died in these facilities) have launched a class-action lawsuit against the state for its sluggish response, claiming they failed to intervene earlier when the scheme was apparent in 2019, with estimated losses of $43 million at that time.¹⁹

7. In December 2024, consulting company McKinsey agreed to pay $650 million to settle allegations that its advice to opioid manufacturer Purdue Pharma resulted in fraudulent claims for oxycontin being submitted to federal health care programs. McKinsey advised Purdue on marketing strategies and how to “turbocharge” sales.²⁰

8. In June 2025, 11 defendants were indicted as a result of “Operation Gold Rush.” A transnational criminal organization with roots in Russia bought up dozens of existing DME companies and used them to submit $10.6 billion in false claims, using more than a million stolen identities. Fake corporate documents disguised foreign ownership of the companies. Claims totaling roughly $941 million were paid. In announcing the indictments, the Department of Justice seems to celebrate the “Largest Case by Loss Amount Ever Charged by the Department of Justice.”²¹

Welcome to World 2. It is astonishing how large such schemes can become and how long they can operate before eventually being exposed and shut down. The medical community needs to understand that these offenders and thousands like them—the majority of which go undetected—are eating your lunch or they stole your umbrella, whichever metaphor you prefer. They are ripping several hundred billion dollars a year out of the health system, huge sums of money for which we could all imagine better uses.

How Many Hundreds of Billions of Dollars?

Suppose we took the broad range of “overpayment” estimates from the PERM and CERT studies—that is, a low of 3% to a high of 25%—and imagined losses to fraud and abuse lying somewhere between these extremes. Applied across the totality of annual health care spending ($5.9 trillion) the range is roughly two hundred billion to 15 hundred billion dollars. That is, for some integer n, most probably in the range n=2 to n=15, the losses would be n followed by eleven zeroes, or $n00,000,000,000. We just do not know n.

Based on 2018 health expenditures, the National Health Care Anti-Fraud Association (NHCAA) floated the possibility—based on what they saw and heard from law enforcement—that n might be three (i.e., annual losses of $300 billion at that time). In 2025, if I had to guess (which I have some qualms about doing), I would guess n was at least 10. Readers can guess too, based on what they see happening around them.

But whether the scale of the problem is $300 billion, or more than a trillion dollars, it makes absolutely no sense that the aggregate national budget for Medicaid Fraud Control Units is less than half a billion (at $396 million). This equates to 0.04% of the Medicaid budget.²² Or that the FBI only gets $168 million (FY 2024) for its work on health care fraud cases, and the Department of Justice $196 million.²³ The DHHS Office of Inspector General’s budget for oversight of the Medicaid and Medicare programs, at $341 million,²⁴ is equivalent to just 0.015% of the combined program budgets.

These control investments seem impressive until you hold them up against the potential scale of the problem, at which point they appear miniscule. These dollar amounts have the wrong number of zeroes. Total annual federal spending on Health Care Fraud and Abuse control ($2.5 billion) equates to just 0.07% of total government health care spending. False Claims Act recoveries by the Department of Justice (for healthcare matters) totaled $1.67 billion last year, with a clear majority of the cases prompted by whistleblower reports.²⁵ To make a substantial impact, that number needs to be at least $20 billion.

If we could discover and add up all the investments in fraud and abuse control across the entire US health system, total spending would likely not exceed $5 billion. Given total health expenditures of $5.9 trillion, this means that for every $100 we spend on health care we devote less than 10 cents to checking that we got what we paid for and that it was medically appropriate. Would not any prudent shopper be prepared to spend a whole dollar, or even $5, to assure themselves that their $100 was well spent?

Managed Care and Capitated Systems

Thirty years ago, in the early days of managed care, many hoped that capitation arrangements would eliminate fraud and abuse by removing all the incentives for overbilling and overtreatment. But capitation merely changes the forms of fraud, creating incentives for undertreatment and diversion of funds away from front line service delivery. The locus for fraud also changes, from the front-line providers to the plans themselves.

MCOs can cheat by manipulating risk scores on which capitation payments are based, fabricating enrollments, using selective enrollment and disenrollment practices, improperly restricting access to care, destroying or arbitrarily denying claims, or assigning unreasonably high numbers of patients to providers. They can divert or embezzle capitation funds through fraudulent subcontracts and by paying excessive salaries and fees to executives and close associates.²⁶

Most of these practices do not involve false claims per se, hence they do not show up at all in the fee-for-service measurement studies. These are corporate frauds and abuses, hidden somewhere within the complex layers of for-profit enterprise which now separate payers from patients. These illicit practices are especially hard to detect through routine audits, therefore even more “invisible.” We have relied heavily on serendipitous disclosure by whistleblowers for discovery.

Manipulating patient risk scores, on which capitation rates are based, seems to have emerged as one favored method for boosting revenues. The last five years have seen a slew of cases brought by the DOJ against major plans (and provider groups that receive risk-adjusted payments) for submitting false, exaggerated, or unsupported diagnosis codes. The Cigna Group paid $172 million in FY 2023 to settle such allegations in relation to the Medicare Advantage program.²⁷

In October 2024, the Office of Inspector General published analysis showing that diagnoses reported on Health Risk Assessments, but which did not appear on any other service records, increased Medicare Advantage risk-adjusted payments for 2023 by an estimated $7.5 billion.²⁸ The vast majority of Medicare Advantage companies (157 of 170) had submitted such uncorroborated diagnostic codes.²⁹ UnitedHealth Group ($3.7 billion) and Humana ($1.7 billion) accounted for substantial and disproportionate shares of the $7.5 billion.³⁰ UnitedHealth faces criminal and civil investigations by DOJ, with no final resolution as of October 2025.³¹

Ramping Up, and Returns on Investment

The Office of Inspector General (OIG), in their Spring 2025 semi-annual report, cites a return ratio of $11 for every $1 of their budget.³² Economists might argue that the efficient level of fraud and abuse control is the point at which marginal costs are equal to marginal benefits. As control investments are currently so small compared with the scale of the problem (i.e., with so many fish in the sea, and so few fishermen), we are nowhere near a point of diminishing returns.

In fact, the 11:1 ratio cited by the OIG is a very modest claim. The OIG base this estimate purely on hard-dollar recoveries and restitution resulting from their enforcement and oversight actions. They do not include specific deterrence effects (shutting off the stream of future billings from a specific provider), nor general deterrence (effects on the behavior of other providers based on actions taken against one). Both of these effects are potentially much greater than the hard-dollar recoveries, but are more difficult to estimate.

Get On Board

There is plenty of room for at least a five-fold increase in fraud and abuse control investments, across the entire US health system, without running any risk of approaching or exceeding an optimal level of control. Not a 5% increase. Five-fold. We need to break the circularity trap of under-investment and under-discovery, and match the scale of control efforts to the scale of the problem.

Officials in the current administration have publicly expressed their determination to “crush” fraud and abuse. Aggressively ramping up controls should pay off handsomely over time, but would of course be politically contentious and take time and cost money up front.

I wonder whether the medical community would support such a dramatic, five-fold, scaling-up of control efforts, or any significant steps in that direction. They should. Other academic commentators have warned against additional fraud control efforts, assuming they necessarily make life more difficult for honest physicians and place obstacles in the way of patients seeking care. Neither is true. It is the big, broad, general, indiscriminate “squeeze” that has those effects; not a properly targeted campaign focused on crooks and crime.

Conclusion

Fraud and abuse harms patients. Patients treated by perpetrators suffer worse medical outcomes.³³ With abuses by managed care plans, patients cannot get the care they need. With fee-for-service fraud and abuse, patients suffer the adverse health consequences of unnecessary and inappropriate treatments, see their insurance benefits exhausted or substantially used up, and end up paying co-pays and deductibles for treatments they do not need and should not have. False diagnoses and fictitious treatments included on their medical records may distort future care decisions and restrict their ability to obtain health insurance, life insurance, and some forms of employment.

Ramping up fraud and abuse controls would benefit all legitimate providers, providing a discriminating way of controlling costs by identifying and removing bad actors and stemming the flow of funds to them. Carefully targeted controls protect the interests of the good by squeezing out the bad, enabling a “pay-on-trust” system to survive by weeding out those who cannot be trusted.

Finally, consider this: last year, qui tam relators (whistleblowers) took home between them $463 million as their share of settlements in cases they brought forward.³⁴ Whistle-blowing is a painful path to follow, but one sure way to take your umbrella back!