Provider-Risk Signals Matched to $500M+ in Public Enforcement Cases

Decision brief

What the hackathon result shows—and what it does not

ProvenanceCompany-led ACT-IAC hackathon work using public data; not a federal production deployment, agency fraud determination, or production authorization.
Demonstrated signalA four-person team processed 548 million rows, scored 1.47 million providers, achieved 42% precision at the top 100 in its backtest, and matched 37 high-ranked non-LEIE providers to public enforcement records.
Buyer relevanceA mission or acquisition team could test whether public data helps investigators focus scarce review time before committing to protected-data integration or production operations. This evidence supports that next experiment; authorized investigators still review, corroborate, and decide.
Maturity limitProduction must still prove performance on current authorized data, false-positive and false-negative controls, fairness, security, privacy, Section 508 accessibility, workflow fit, and Government acceptance.

The Challenge

Medicare pays over $1 trillion annually. Roughly $70 billion of that, about 7 cents on every dollar, is estimated to be improper payments. The GAO has repeatedly criticized CMS for lacking quantifiable fraud detection metrics. The existing model is reactive: pay first, chase later, often years after the money is gone.

The ACT-IAC 2026 AI Hackathon posed a direct question: Can AI shift CMS from reactive to proactive program integrity?

We had 13 days.

The Constraint

The team had no protected health information, data use agreements, or claims-level data. Everything had to work on publicly available CMS datasets, the same data anyone can download from data.cms.gov.

This problem is harder than it sounds because public data consists of annual aggregates and contains no individual claims. You can see that a provider billed $2.3M last year, but the data cannot show whether they billed the same patient twice on the same day. Most academic fraud detection work assumes claims-level access. We didn't have that luxury.

Can AI shift CMS from reactive to proactive program integrity? We had 13 days.

The Evidence Ladder

Each rung supports a different conclusion. The farther the system moves toward operational use, the more evidence the Government should require before acceptance.

Rung 1 · Bounded challenge
A working public-data prototype under a 13-day constraint
Four people built the system without protected health information, data use agreements, or claims-level records. That demonstrates delivery speed and feasibility on public annual aggregates. Readiness for operational casework remains unproven.
Rung 2 · Historical backtest
The model concentrated known validation labels near the top
42%
P@100
890x
Lift over random
0.965
Validation AUC
6.9yr
Avg. lead time
The study trained on 2013 to 2019 data and validated on 2020 to 2023 labels. At the study's 0.047% base rate, 42 of the top 100 matched the validation label. The lead-time calculation is retrospective, and the roughly $3.4 million-per-provider scenario is neither realized nor guaranteed savings.

Rung 3 · Public-record corroboration

High-ranked providers matched later public enforcement records

Researchers checked every non-LEIE provider in the top 250 against DOJ releases, OIG actions, court records, and state medical boards. Thirty-seven matched documented cases involving more than $500 million in alleged or resolved fraud. A match corroborates prioritization value; it does not establish causation or make an independent fraud finding.

Examples of high-ranked providers matched to public enforcement records
Rank	Public-record match
#2	DOJ settlement of $1.2 million
#7	55,000 false claims involving deceased patients
#8	$14.3 million wound-care fraud case
#22	$250 million opioid conspiracy
#52	$6.5 million false-claims case independently investigated by ProPublica

Rung 4 · Production acceptance
The Government would define and verify the operational threshold
A production engagement should test current authorized data, sampling and label quality, threshold tradeoffs, subgroup performance, drift, traceability, security and privacy controls, Section 508 accessibility, investigator workflow, and false-positive/false-negative handling. Government acceptance should rest on agreed evidence and human review. The hackathon award and a single model metric are insufficient.

What We Built

A single Go binary that ingests 22 CMS datasets, scores 1.47 million providers, and serves an interactive investigation dashboard.

Integrity is a single Go binary that runs on one server, ingests 22 CMS datasets (548 million rows), scores 1.47 million Medicare providers across 10 years of history, and serves an interactive investigation dashboard.

Inspectability is part of the result

Investigators can see contributing factors, SQL, weights, peer groups, and history behind a score. Live weight adjustment lets an authorized user explore priorities without converting the score into an automatic finding.

Define acceptance before production work

A Government buyer can define measurable ranking quality, traceability, response time, accessibility, security, and investigator-utility standards, then accept the capability against evidence rather than staffing volume.

Model mechanicsHow public data, 27 features, and three scoring methods produced reviewable risk signals

The Data Pipeline

The system ingests data from CMS, OIG, DEA, Census, and other public sources directly into an embedded DuckDB database using CSV-to-columnar ingestion with SHA-256 deduplication. It requires no external database server or ETL orchestration platform.

Data pipeline scale and coverage
Metric	Value
Rows ingested	548M+
Providers scored	1.47M
Coverage	2013 to 2023
Peer groups	1,046 (specialty x region x year)
Graph nodes	5.8M
Graph edges	82.6M

27 Features, 8 Categories

Every provider gets scored on 27 features in eight categories:

Billing Volume: billing far more than specialty peers, sudden spikes, solo practitioners billing like groups.
Procedure Mix: upcoding E&M visits, concentrating in expensive codes, deviating from specialty norms.
Drug Prescribing: opioid prescribing intensity, high-risk medications for elderly, rare drug combinations.
Payment Network: Open Payments manufacturer relationships correlated with prescribing patterns.
Sanctions: LEIE exclusions, Corporate Integrity Agreements, SAM exclusions.
Geographic: billing deviation from county baselines, cross-payer risk signals.
Graph Analysis: six custom network algorithms: prescribing isolation, opioid network contagion, manufacturer concentration, exclusion proximity, geographic deviation, co-prescribing anomalies.
Enrichment: career stage anomalies, controlled substance supply chain deviations from DEA ARCOS data.

Three-Way Ensemble Scoring

1. Weighted Composite

27 features normalized to 0-100, combined with tunable weights. Deterministic, reproducible, transparent.

2. ML Corroboration

Isolation Forest, K-Means, Local Outlier Factor. Corroboration boost up to +30 points.

3. Gradient Boosted Trees with Focal Loss

Trained on LEIE exclusion labels. Validation AUC: 0.965.

The Dashboard

National heatmap, state/county drill-downs, deep provider profiles. Peer comparison radar charts, top contributing factors, 10-year billing trajectories, network visualizations.

Key differentiator: live weight adjustment. Investigators tune feature weights in real-time and watch scores re-rank instantly.

Every score shows exactly how it was computed, including the SQL queries, weights, and peer groups available for inspection.

Every score exposes its SQL queries, weights, peer groups, and calculation for inspection.

Technical Implementation, On Demand

The architecture is useful evidence of feasibility and deployment discipline. These mechanics support the result, but they are not the Government's acceptance decision.

Architecture detailArchitecture: one Go binary, one server, and an in-process analytical stack

DuckDB, GraphWizard, the machine-learning libraries, and the HTMX, Alpine, and ECharts interface all ran in process. The prototype therefore needed no external database or graph server at runtime.

Integrity prototype architecture choices and rationale
Component	Choice	Why
Language	Go	Single binary, embedded assets, goroutines for pipeline work
Database	DuckDB (embedded)	Columnar analytics across 548 million rows without a separate server
Graph engine	GraphWizard (in process)	Replaced a 100GB-RAM Memgraph dependency
Frontend	HTMX + Alpine + ECharts	Embedded in the binary with no production build step
Machine learning	Go libraries	Isolation Forest, K-Means, LOF, and GBT in process
Deployment shape	Single VPS	Bounded prototype footprint; production requirements remain to be defined

Production caveat: this footprint is not a production authorization, security baseline, availability design, recovery plan, or independent cost estimate. Those requirements should follow the Government's data, control, service-level, and continuity needs.

Open-source implementationGraphWizard: 82.6 million-edge analysis in about 90 seconds with a public Go library

GraphWizard was built during and after the hackathon to replace Memgraph. Its core library provides more than 40 algorithms behind standard gonum interfaces, reports 97.3% test coverage, and is available under the MIT license. The current repository has since added disk-backed graph and loading tools that use DuckDB and SQLite.

GraphWizard implementation and benchmark metrics
Metric	Value
Algorithms	40+
Direct module dependencies	gonum, DuckDB, and SQLite in the current repository
Test coverage	97.3%
License	MIT
Graph size handled	82.6 million edges and 5.8 million nodes
Analysis time	About 90 seconds in the prototype environment
RAM dependency replaced	100GB Memgraph deployment replaced with an in-process library

View on GitHub All Open Source Projects

Menu

Test whether public data can focus scarce investigator time.