---
name: screening-medicare-billing-data
description: Screens CMS's public, provider-level Medicare billing files (data.cms.gov, no API key) for fraud signals such as sudden code growth, one biller holding a national code, new entrants, ordering-clinician fingerprints and test stacking, then checks every flag against CMS revocations, HHS-OIG exclusions and current enrollment before reporting. Use when asked to look for Medicare fraud or billing anomalies, to find outlier providers, suppliers or labs in CMS data, or to re-run the Pure Karma Labs Medicare screen on a new data year.
license: CC BY 4.0, Pure Karma Labs. The data is a U.S. government work.
---

# Screening Medicare billing data for fraud signals

Version 2026-10-13. Canonical copy: https://purekarmalabs.com/skills/screening-medicare-billing-data/SKILL.md
Corrections, false positives and run-log lines: hello@purekarmalabs.com.

## Hard rules (apply before anything else)

1. **A statistical outlier is a lead, never an accusation.** Nothing in this data proves fraud.
2. **Name no individual, ever. Name a business only with an official record** (DOJ charge,
   OIG exclusion, CMS revocation), quoting its stated ground. Everything else: describe, don't name.
3. **Do not contact, visit, review or post about anyone found.** Leads go to the HHS-OIG hotline
   (see "If something screams"), not to social media and not to the business.
4. **Write "Medicare's public data records about $X in payments."** Never "Medicare paid $X" or
   "they stole $X." The files do not say whether money was later suspended or recovered.
5. **Never hard-code dataset ids.** Resolve them from the catalog at run time.
6. **Check every flag against the enforcement lists before reporting it.** Most large outliers
   have already been acted on. The useful finding is "same pattern, still enrolled, no record."

## The data

CMS publishes yearly, provider-level summaries of traditional Medicare Part B: one row per
biller, billing code and year, with patient count, service count and average submitted, allowed
and paid amounts. Aggregated (no patient records), suppressed (10 or fewer patients), late (a data
year appears 17 to 19 months after it ends), and traditional Medicare only (no Medicare
Advantage, no Medicaid). No API key, no account.

**API mechanics:** follow CMS's own documentation at https://data.cms.gov/api-docs (endpoint
`https://data.cms.gov/data-api/v1/dataset/{id}/data`, JSON:API `filter[COLUMN]=VALUE`, `size`
and `offset` paging, 5,000 rows per page maximum, catalog at `https://data.cms.gov/data.json`).
The API Guide and FAQ PDFs linked from that page explain dataset versioning. Column definitions
are in the data dictionary linked from each dataset's catalog entry and dataset page.

What the docs do not tell you:

- **Find datasets by title, not id.** In `data.json`, each data year is its own entry. Match the
  series title prefix, take the entry with the newest `temporal` start (or the year you want),
  and use the distribution whose `format` is `API`. Record the entry's `modified` date. Some ids
  are "latest" aliases that roll forward when a new year publishes.
- **Series titles:** `Medicare Physician & Other Practitioners - by Geography and Service`,
  `... - by Provider and Service`, `... - by Provider` (yearly totals with real sum columns);
  `Medicare Durable Medical Equipment, Devices & Supplies - by Geography and Service`,
  `... - by Supplier and Service`, `... - by Referring Provider and Service` (ordering
  clinicians; aggregates only, rule 2), `... - by Supplier` (yearly totals with real sum columns).
- **Always filter** by code (`filter[HCPCS_Cd]=A4353`; the Referring Provider file spells it
  `HCPCS_CD`) or geography (`filter[Rndrng_Prvdr_Geo_Lvl]=National`; DME files use
  `Rfrg_Prvdr_Geo_Lvl`) so you never download a whole file. Page until a page is short.
- **Amounts.** Code-level files have no total column: `paid ≈ Avg_Mdcr_Pymt_Amt × Tot_Srvcs`
  (physician) or `Avg_Suplr_Mdcr_Pymt_Amt × Tot_Suplr_Srvcs` (DME), summed over place-of-service
  rows, labelled "approximately." Yearly totals per biller: `Tot_Mdcr_Pymt_Amt` (by Provider) or
  `Suplr_Mdcr_Pymt_Amt` (by Supplier). Patients: `Tot_Benes` / `Tot_Suplr_Benes`. Identity:
  `Rndrng_NPI` / `Suplr_NPI` / `Rfrg_NPI`. Specialty: `Rfrg_Prvdr_Spclty_Desc`.
- **Suppression.** Most files drop rows with 10 or fewer patients; the Referring Provider file
  keeps them with a blank patient count. Sums understate true totals, and provider-file biller
  counts differ from Geography-file counts. Some providers bill under both an individual and an
  organizational NPI.
- **Payment field.** Per CMS's dictionaries: what Medicare paid after deductible and coinsurance,
  on final-action claims. Silent on later suspensions and recoupments (hence rule 4).

## Workflow

Copy this checklist and check items off as you go:

```
Screen progress:
- [ ] 1. Resolve the newest data year from the catalog
- [ ] 2. Reproduce the self-check values
- [ ] 3. Run the screens
- [ ] 4. Discard known false positives
- [ ] 5. Enforcement check on every flag
- [ ] 6. Classify each flag: actioned / still enrolled, no record / unclear
- [ ] 7. Write the report
```

### Step 2. Self-check (data year 2024)

Reproduce these first. If any differs by more than rounding, the pipeline is wrong.
"Paid" is the avg × services approximation. Verified against the live API 2026-10-12/13.

| Query | Expected |
|---|---|
| A4353 national, DME Geography file | about $1,155M (2023: $3,059M; 2021: $40.7M) |
| A6197 national, DME Geography file | about $650M (2023: $23.0M) |
| 81419 national, Physician Geography file | about $72.8M, about 30,300 patients |
| 81419 distinct billers, Provider and Service file | 48 (the Geography file counts 58) |
| A5057 top supplier share, Supplier and Service file | one supplier at 87.5% of about $113M |

Ordering-clinician cut used in screen 4 (Referring Provider file, clinicians with a visible
patient count, i.e. more than 10):

| Code | Visible orderers | Family practice | Specialty that does the work |
|---|---|---|---|
| A5057 ostomy pouches | 271 (1,100 rows; the blank-count rows carry 3% of dollars) | 213, median 176 patients, 40 states, median about $481K recorded each | 15 colorectal surgeons |
| A4353 catheters | 1,720 | 1,343, median 118 patients | 7 urologists |
| A6197 wound dressings | 1,421 | 910, median 92 patients | 21 general surgeons |

### Step 3. Screens

Run on the newest year, with prior years from the Geography files for growth.

1. **Code growth.** National paid per code; keep codes at or above $5M that grew 4x or more over
   three years or 2x or more in one year.
2. **Concentration.** For each grown code: top-5 biller share, and top city or state share versus
   that state's share of all spending in the file. One biller or one office park holding 20 to
   90% of a national code is the signal.
3. **New entrants.** Billers absent or tiny in the prior year's "by Provider" or "by Supplier"
   file that now hold a large share. Check the NPI enumeration date; say "new to this billing,"
   not "new company," when the NPI is old.
4. **Ordering-clinician fingerprint (DME).** In the Referring Provider file for a flagged code,
   take every ordering clinician with a visible patient count and look at the mix: how many,
   how many states, specialty split, patient-count distribution, cost per patient. The signal is
   specialty plus volume (hundreds of family doctors each with 100-plus ostomy or catheter
   patients, while the surgeons and urologists who do that work barely appear). Uniform cost per
   patient alone is usually the fee schedule; if you use a band, report its width.
5. **Stacking (labs).** One lab billing nearly the same patient count across several unrelated
   panels or single-gene tests. The file cannot prove linkage; write "nearly identical patient
   counts across N tests." Do not characterize clinical appropriateness without a clinician.
6. **Cost-per-patient extremes.** Paid divided by patients far above peers for the same code.

### Step 4. Known false positives (filter or explain, do not report)

New drugs, vaccines and newly created codes (infinite growth). Patented single-lab tests (PLA
codes ending in `U`) are concentrated by design. National labs bill from headquarters, so state
concentration is not where patients live. Identical cost per patient can be the fee schedule
times a standard monthly quantity. An apparently new biller may have an old NPI.

### Step 5. Enforcement check (every flagged organization)

1. **CMS "Revoked Medicare Providers and Suppliers."** Same catalog; `filter[NPI]=` works.
   Record the effective date, the re-enrollment bar and the stated reason, for example
   "424.535(a)(8)(ii) Abuse of Billing Privileges: Pattern or Practice."
2. **HHS-OIG List of Excluded Individuals/Entities (LEIE):**
   `https://oig.hhs.gov/exclusions/downloadables/UPDATED.csv`. Match on NPI; record `EXCLTYPE`,
   `EXCLDATE`, `REINDATE`. Type `1128Aa` corresponds to section 1128A(a) of the Social Security
   Act, the Civil Monetary Penalties Law: write "excluded by HHS-OIG" and, if a ground is needed,
   "under the Civil Monetary Penalties Law (section 1128A(a))."
3. **Current enrollment:** `Medicare Fee-For-Service Public Provider Enrollment` in the catalog
   (quarterly). Present means enrolled as of the file date; record that date.
4. **NPPES:** `https://npiregistry.cms.hhs.gov/api/?version=2.1&number=NPI` for enumeration
   date, entity type, taxonomy, status. No result usually means the NPI was deactivated ("no
   longer resolves in NPPES," not "closed"). Do not report authorized officials' names.

### Step 6. Classify

**Actioned** (revoked, excluded, charged, or under a published payment suspension); **still
enrolled, no record**; or **unclear**. Only the second group is new information. Quote a record's
own ground and date; never infer a causal link between an exclusion and a news event. "Revoked"
and "excluded" are different actions by different agencies; use the one the record shows.

### Step 7. Report format

Header: data year, each dataset's catalog `modified` date, run date, years used for growth.
Per flag: code and plain description; national recorded payments (approximately) by year; the
concentration or pattern; enforcement status with dates and stated grounds; classification; the
exact query parameters. Aggregates only for clinicians. Dollar wording per rule 4. Close with the
false positives discarded and why, so the next run can skip them.

## If something screams

1. Do not contact anyone, do not look up individuals, do not post names anywhere.
2. Re-run from scratch. Confirm the figures reproduce and the enforcement check still shows no
   record. Note the catalog `modified` dates.
3. Write a one-page lead memo: pattern, codes, numbers, exact queries, enforcement results, and
   the words "statistical pattern in CMS public data; not a finding of fraud." Organization NPIs
   go in the memo only.
4. Send it to the HHS-OIG hotline: https://tips.oig.hhs.gov or 1-800-HHS-TIPS. Medicaid version
   of the same pattern: the state Medicaid Fraud Control Unit. A beneficiary whose own number was
   used: Senior Medicare Patrol (smpresource.org) and 1-800-MEDICARE.
5. If publishing anything, publish the method and the checks. Name only record-backed
   organizations, with the record's stated ground (rule 2).

## Run log

One line per run: dated, non-accusatory, what the public data showed and what enforcement status
was at the time. Append yours here and send it to the contact address.

- 2026-10-12, data year 2024, Pure Karma Labs. Catheters, wound dressings, ostomy pouches and
  braces: top suppliers all revoked and/or excluded in 2024 to 2026, after the 2024 money moved.
  Genetic-panel stacking cluster (FL, TX): three labs revoked in 2025; the largest two and about
  eight others still enrolled with no record as of the July 2026 enrollment file.