Health Law Daily Wrap Up, GENERAL HEALTH CARE NEWS—GAO REPORTS: Study examines CMS data-driven approach to Medicare fraud prevention, (Apr 28, 2026)

By Patricia K. Ruiz, J.D.

The GAO found the agency used claims analysis and administrative actions to prevent an estimated $11.9 billion in potentially fraudulent payments between fiscal years 2022 and 2024.

A report by the Government Accountability Office (GAO) details CMS’s use of data analytics to identify anomalous billing patterns and take administrative actions aimed at preventing fraud in traditional Medicare. The report describes common Medicare fraud schemes, explains how CMS and its contractors analyze claims to develop investigative leads, and outlines how those efforts translated into payment suspensions, revocations, and referrals to law enforcement. It also examines newly implemented information-sharing practices between CMS and Medicare supplemental payers following a high-dollar fraud scheme involving urinary catheters (GAO Report, GAO-26-107799, Apr. 21, 2026).

Inherent risks. The GAO reiterated that Medicare has long been designated a high-risk federal program because of its size, complexity, and vulnerability to fraud. In 2024, Medicare spent an estimated $1.1 trillion to provide services to roughly 68 million beneficiaries and paid more than one billion claims annually to over 1.4 million providers across more than 20 payment systems. According to the GAO, that scale creates inherent risks for improper payments and fraudulent activity.

Recurrent characteristics of fraud schemes. The report identifies recurring characteristics of Medicare fraud schemes, including the misuse of provider billing privileges, stolen or improperly obtained Medicare beneficiary identifiers, fraudulent or misappropriated provider orders, and a focus on specific services or supplies. GAO said durable medical equipment, hospice services, and certain high-reimbursement products have frequently been targeted. In many cases, fraud schemes rely on obtaining access to Medicare billing privileges by purchasing existing enrolled providers or using straw owners, combined with the use of compromised beneficiary identifiers to submit claims for services that were not provided or not medically necessary.

The GAO also described recent developments affecting Medicare fraud, including increased involvement by organized criminal groups, sometimes operating across borders, and the use of artificial intelligence to scale fraudulent billing. Another trend noted in the report is the rise of so-called “bust;out” schemes, in which providers rapidly submit large volumes of fraudulent claims over a short period before detection systems can stop payments.

Fraud prevention. To address these risks, CMS relies on data analytics applied to Medicare claims data to detect anomalous billing patterns. The GAO explained that the analytics are not used to automatically deny individual claims based solely on fraud risk, but instead to identify providers or patterns that warrant further investigation. CMS officials told the GAO that the agency does not have authority to deny a claim solely on the basis of data analytics.

Two primary analytic mechanisms are central to CMS’s efforts: the Fraud Prevention System, which is managed centrally by CMS, and additional analytic models developed by Unified Program Integrity Contractors (UPIC) operating in five geographic jurisdictions. The systems analyze billing data to identify sudden spikes, outlier billing compared to peers, and other anomalies that may suggest emerging fraud schemes or problematic providers.

The Fraud Prevention System assigns risk scores to providers based on billing behavior and generates leads that contractors can prioritize for investigation. UPICs supplement this with their own models tailored to regional trends or emerging schemes identified through law enforcement or inter;contractor information sharing. The GAO said the models include peer;to;peer comparisons, predictive analytics based on historical fraud patterns, rules;based thresholds, geographic analyses, and some uses of machine learning.

According to the GAO, data analytics are used to inform a range of administrative actions designed to prevent potentially fraudulent payments. These include placing providers on prepayment medical review, implementing automated prepayment denials for specific billing patterns, suspending payments while investigations are conducted, revoking or deactivating Medicare enrollment, and referring cases to law enforcement.

Reported savings, catheter scheme. CMS estimates that these actions prevented a total of $11.9 billion in potentially fraudulent Medicare payments from fiscal years 2022 through 2024. Of that amount, the largest share—nearly $8 billion—was associated with revocations and deactivations, followed by payment suspensions. CMS also reported hundreds of millions of dollars associated with overpayment recoveries and estimated amounts tied to law enforcement referrals. The GAO noted that some of the prevented payment totals are projected estimates of cost avoidance rather than confirmed recoveries.

A significant portion of the reported savings stemmed from a scheme involving urinary catheters, in which 15 providers allegedly attempted to bill Medicare for more than $4 billion for supplies that were not needed or never provided in 2023 and 2024. CMS suspended payments to those providers and later revoked their enrollment, actions the agency said prevented more than 99 percent of the billed amounts from being paid.

The catheter scheme also highlighted issues related to Medicare supplemental payers. The GAO found that prior to December 2025, CMS generally did not share information about provider payment suspensions with entities that cover beneficiaries’ cost sharing, such as Medigap insurers and state Medicaid programs. Because claims from suspended providers are processed but unpaid by Medicare, they can appear approved in systems accessed by supplemental payers.

The GAO reported that some supplemental payers made cost sharing payments on potentially fraudulent claims during the catheter scheme. Representatives of private payers told the GAO that such payments may have totaled tens of millions of dollars, though exact amounts were not available. The GAO’s analysis of Medicaid data found that state Medicaid agencies paid at least $196,000 in cost sharing to providers under suspension during 2023 and 2024.

In response, CMS began sharing reports on providers subject to payment suspension with supplemental payers in December 2025 and January 2026. The GAO said CMS plans to provide the information on a monthly basis and to evaluate whether more frequent reporting is needed. CMS officials told the GAO that supplemental payers cannot use a Medicare suspension alone as a basis to deny payment and must make independent determinations.

The GAO also described steps CMS has taken to address vulnerabilities identified in fraud schemes, including enhanced screening for high risk providers, site visits and fingerprinting requirements, processes to address compromised beneficiary identifiers, and updates to coverage and payment rules for services targeted by fraudsters. The report notes that CMS implemented a nationwide moratorium on enrolling new durable medical equipment suppliers beginning in February 2026 and previously conducted unannounced site visits to all Medicare enrolled hospices.

ReportsLetters: GAOReports CMSNews FraudNews GeneralNews ProgramIntegrityNews