In connection with the annual Nationwide Health Care Fraud Takedown, the Department of Justice (DOJ) announced recently a series of interagency data-sharing agreements that I do not think our industry has fully processed yet.
The announcement itself was easy to miss. It arrived alongside the Takedown numbers, which are always the headline, and it read on the surface as a bureaucratic update. It is not.
The change is one of the most consequential structural changes in federal healthcare fraud enforcement in twenty years, and it is going to change what an audit looks like for everyone reading this article.
Let me tell you what happened. And then I’ll tell you why I think it matters more than the headline suggests.
What DOJ Announced
Three agreements, in plain language.
First, the DOJ recently created the National Fraud Enforcement Division entered an arrangement with the Centers for Medicare and Medicaid Services (CMS) that gives DOJ cloud computing capacity directly inside the CMS Integrated Data Repository. In practical terms, DOJ can now run artifical intelligence (AI) and advanced analytics directly against the same Medicare and Medicaid claims data that CMS uses, without a request, without a delay, and without a translation layer between agencies.
Second, DOJ has signed a data-sharing agreement with the Department of Homeland Security. DHS will provide travel information. The stated purpose is to identify off-premises billing, situations where a claim asserts that a provider rendered a service in one place while government records suggest the provider was somewhere else.
Third, DOJ has signed a similar agreement with the Federal Trade Commission. FTC will provide telemarketing and telemedicine consumer complaint data.
None of these datasets is new. What is new is that they are now available together, in the same analytical environment, to the same investigators.
The Real Story Is Detect and Deploy
In March, CMS Administrator Dr. Oz described the agency’s new posture as a shift from pay and chase to detect and deploy. That language matters. Pay and chase was the model our industry grew up in.
Claims were paid on the front end, suspicions were raised on the back end, and audits worked backward from a paid claim to a documentation problem. That model produced its own kind of risk exposure, and the industry got reasonably good at defending against it.
Detect and deploy is a different model. The government catches the anomaly before the payment ever leaves the door. And to do that at scale, the government needs an analytical environment powerful enough to see anomalies in real time, across every dataset that might inform the picture. The June 23 announcement is what that environment looks like when it gets built.
Why the Join Matters
Here is the part that is my wheelhouse, and it is the part I want every reader of this article to sit with.
For decades, government fraud investigations were bounded by dataset. CMS looked at claims. DHS looked at travel and immigration. FTC looked at consumer complaints. Each of those datasets, on its own, contains a lot of noise. A claim that looks slightly unusual in isolation could reflect a hundred different legitimate variations in clinical practice. A travel record on its own tells you almost nothing about billing. A consumer complaint about a telemedicine call, standing alone, may or may not indicate anything actionable.
But when you join those datasets, something remarkable happens. Ambiguity in one dataset gets resolved by information from another. A claim that looked defensible in isolation can look very different when the join reveals that the provider whose NPI is on the claim was outside the country on the date of service. A telemedicine complaint that seemed like noise can suddenly become the thread that unravels an entire billing pattern, once it is joined against the claims data associated with that patient identifier.
In the language of my field, joining datasets increases the signal-to-noise ratio dramatically. Patterns that were invisible in any single dataset become vivid when the datasets are combined. That is not because the data itself changed. It is because the analytical environment did. The government has, for the first time, given itself the ability to see across the silos that used to protect providers from the full weight of federal analytical attention.
What This Actually Looks Like on the Ground
Let me offer an anonymized composite from the sort of matter I have worked on over the years, adjusted to reflect the new environment.
A telemedicine practice bills a substantial volume of remote encounters across a wide geographic footprint. In the old model, if CMS’s surveillance systems noticed an unusual utilization pattern, the process to investigate it was long. Someone at CMS would flag it, an audit would eventually be opened, the practice would be asked for records, and the process of testing whether the claims were legitimate would take months and involve a lot of judgment calls.
In the new model, that same utilization pattern gets flagged, and within days it can be joined against DHS travel records for the licensed providers whose NPIs appear on the claims. If those providers were in fact where their claims say they were, the flag resolves and the audit never happens. If they were not, the case has essentially built itself. The data raised the alarm, and the join proved the case.
Why This Matters for Coders, CDIs, and Rev Cycle
I know this article has been dense so far, so let me bring it back to the daily work of the audience this reaches.
If you are a coder or a CDI specialist or a revenue cycle professional, here is the thing to internalize. The set of things that count as a suspicious pattern is expanding. Under the old model, the government mostly looked at your claims data in isolation. If your data looked normal against the claims data of your peers, you were essentially safe from a pattern-based inquiry. That is no longer true.
Now your claims data is being evaluated against multiple external datasets simultaneously. A billing pattern that looks perfectly reasonable against your peers’ claims data may still get flagged, because it does not look reasonable when joined against travel records, or telemedicine complaint data, or FTC consumer reports, or whatever else the government is quietly pulling into that shared analytical environment next.
What that means for your work is not that you should be alarmed. It means that the concept of a defensible pattern has to broaden. Distributions matter, and distributions still need monitoring. I have written about that at length. But cross-referenceability now matters too. If your claims data cannot be reconciled cleanly against external ground truth, that is a vulnerability, whether or not any individual chart looks wrong.
What Compliance Programs Should Actually Do
Three practical suggestions, drawn from what I am seeing in the field.
One, take an honest look at whether the data you submit to Medicare could be reconciled against reasonable external sources. Locations of service. Provider availability on billed dates. Any place your claim asserts a fact that some other federal dataset could contradict.
Two, think about what your data looks like from outside your organization, not just from inside it. The government now sees your claims in the context of other datasets you have never seen. Ask yourself what patterns might emerge from that vantage that would not be visible from yours.
Three, get somebody inside your organization looking at your data with the same eyes DOJ is now bringing to it. That is a capability most compliance programs do not currently have, and it is one that is going to become table stakes.
The Broader Point
We have entered an environment in which the government has categorically expanded the analytical surface it is willing to bring against healthcare claims. The datasets that used to be siloed are no longer siloed. The suspicions that used to originate with human beings can now originate with a data join. And the False Claims Act, which has always been the sharpest financial exposure in this space, is now being fed by a fundamentally different kind of input.
The industry has rightly focused on RADV, ambient AI, the CRUSH RFI, and the record enforcement numbers from the June Takedown. All these issues matter. But the data-sharing agreements are the deeper structural shift beneath them, and they are likely to shape this field for the next decade.
