The Challenge

Medicare pays over $1 trillion annually. Roughly $70 billion of that -- about 7 cents on every dollar -- is estimated to be improper payments. The GAO has repeatedly criticized CMS for lacking quantifiable fraud detection metrics. The existing model is reactive: pay first, chase later, often years after the money is gone.

The ACT-IAC 2026 AI Hackathon posed a direct question: Can AI shift CMS from reactive to proactive program integrity?

We had 13 days.

The Constraint

No protected health information. No data use agreements. No claims-level data. Everything had to work on publicly available CMS datasets -- the same data anyone can download from data.cms.gov.

This is a harder problem than it sounds. Public data is annual aggregates, not individual claims. You can see that a provider billed $2.3M last year, but not whether they billed the same patient twice on the same day. Most academic fraud detection work assumes claims-level access. We didn't have that luxury.

Integrity is a single Go binary that ingests 22 CMS datasets (548 million rows), scores 1.47 million Medicare providers across 10 years of history, and serves an interactive investigation dashboard -- all from one server.

The Data Pipeline

The system ingests data from CMS, OIG, DEA, Census, and other public sources into an embedded DuckDB database. No external database server. No ETL orchestration platform. Just direct CSV-to-columnar ingestion with SHA-256 deduplication.

27 Features, 8 Categories

Every provider gets scored on 27 features in eight categories:

• Billing Volume -- billing far more than specialty peers, sudden spikes, solo practitioners billing like groups.
• Procedure Mix -- upcoding E&M visits, concentrating in expensive codes, deviating from specialty norms.
• Drug Prescribing -- opioid prescribing intensity, high-risk medications for elderly, rare drug combinations.
• Payment Network -- Open Payments manufacturer relationships correlated with prescribing patterns.
• Sanctions -- LEIE exclusions, Corporate Integrity Agreements, SAM exclusions.
• Geographic -- billing deviation from county baselines, cross-payer risk signals.
• Graph Analysis -- six custom network algorithms: prescribing isolation, opioid network contagion, manufacturer concentration, exclusion proximity, geographic deviation, co-prescribing anomalies.
• Enrichment -- career stage anomalies, controlled substance supply chain deviations from DEA ARCOS data.

Three-Way Ensemble Scoring

The Dashboard

National heatmap, state/county drill-downs, deep provider profiles. Peer comparison radar charts, top contributing factors, 10-year billing trajectories, network visualizations.

Key differentiator: live weight adjustment. Investigators tune feature weights in real-time and watch scores re-rank instantly.

Every score shows exactly how it was computed. The SQL queries are visible. The weights are visible. The peer groups are visible. Not a black box.

Out-of-Sample Validation

We searched every non-LEIE provider in our top 250 against DOJ press releases, OIG enforcement actions, court records, and state medical boards. 37 confirmed fraud cases. $500M+ total fraud value.

Highlights

Single server: Go binary, DuckDB embedded, GraphWizard in-process, HTMX+Alpine+ECharts frontend embedded, <$800/mo infrastructure.

Built during and after the hackathon to replace Memgraph. 40+ algorithms, pure Go, zero dependencies beyond gonum, 97.3% test coverage. MIT licensed, open source.

Replaced a 100GB RAM Memgraph dependency with an in-process library. Full 82.6M-edge graph analysis in ~90 seconds.