An anomaly score is a lead, not a finding. Payment integrity models flag providers whose billing departs from their peers, and DOJ said advanced analytics helped identify many of the cases in its 2026 national fraud takedown. A flag is where an investigation starts. When a payer treats it as the end, honest providers pay for the model’s mistakes.
The distinction matters more as analytics get faster. Our analysis of the 2026 takedown argued that payers should shorten the time from the first signal of a scheme to the moment payments stop. That argument holds only if the step in between is a real review. A shorter lag built on automatic stops would trade one kind of loss for another.
What a score measures
An anomaly score measures distance from a norm. The norm might be a provider’s peers in the same specialty and region, or the provider’s own history. A high score says the provider bills differently. It does not say why.
Many reasons for billing differently are honest. A practice may see sicker patients than its peers. A new specialist may join a group and change its mix of services. A clinic may open a second location, or a billing system may start coding a visit differently after an upgrade. Each of those patterns can look like fraud to a model trained on averages.
The peer group itself can be wrong. A model that compares a pediatric cardiologist with general pediatricians, because of a taxonomy code entered years ago, will keep flagging the cardiologist. Errors like that are common in provider data, and they produce flags that no amount of investigation will confirm.
The arithmetic of rare events makes the problem sharper. Consider an illustrative network of 1,000 providers in which 10 are billing fraudulently. A model that catches 9 of the 10 sounds strong. If it also flags 5% of the honest providers, it flags about 50 of them. Of roughly 59 providers flagged, 9 are committing fraud. About 1 flag in 7 points to a real scheme, even though the model looks accurate on paper.
The numbers are illustrative, not a measured rate. The pattern is general, though. When fraud is rare, most flags fall on honest providers unless the model is extraordinarily precise. A payer that suspends payment on every flag will stop more honest providers than dishonest ones.
A flag tells you where to look. It does not tell you what you will find.
What the rules already say
Medicaid’s rules draw this line explicitly. Under 42 CFR § 455.2, a credible allegation of fraud can come from many sources. “Claims data mining” is one of them. The allegation must be “verified by the State,” though. It is credible when it has “indicia of reliability” and the agency “acts judiciously on a case-by-case basis.”
That definition matters because it governs payment suspensions. State Medicaid agencies suspend payments when they determine there is a credible allegation of fraud, subject to good cause exceptions. A data pattern can start that process. It cannot complete it without verification.
The standard is a sound one for any payer, public or private. Our piece on prepayment review as a diagnostic test argued that review programs should be measured like tests, counting both missed fraud and false alarms. An anomaly score is the screening test. Verification is the confirmatory test that follows it.
From lead to finding
A payment integrity team can turn a score into a finding through a series of steps, each with a person accountable for it.
- Explain the score. The model should show which features drove the flag, such as the volume of a specific code compared with peers. A score that cannot be explained cannot be checked.
- Rule out the honest explanations first. Differences in specialty and patient mix account for many flags. Recent changes in a practice account for others. Checking them early saves the provider and the payer an investigation that was never needed.
- Look at the records. A sample of claims goes to a clinician or certified coder for review against the medical record. This is where most leads are confirmed or dropped.
- Decide, and write down why. A person decides whether to act on the lead or close it. Acting might mean starting a prepayment review. The reasons go in the record.
- Feed the result back. Every closed lead is a labeled example. Tracking the share of flags that lead to findings tells the team whether the model is improving.
Providers should hear about a lead early, before a payment hold becomes long. A notice that explains what drew attention lets an honest provider correct a data error or supply records quickly. It also gives a dishonest one less room to argue later that the process was unfair.
The fifth step is the one most programs skip. Without it, a payer knows how many providers it flagged but not how many of those flags were right. Precision is the number that tells a payer whether its analytics are finding fraud or generating work.
Speed still matters. A lead that waits months for review lets a real scheme keep billing. The answer is a review clock, with high-priority leads reviewed within days, not a shortcut that skips review entirely.
Where Redlake stands
Redlake builds tools that health plans use in utilization review, and our rules carry over to payment integrity. A machine can say yes, but only a person can say no. In fraud work, a model can clear claims to pay and can open a review. Stopping payment to a provider is a decision for a person.
Every recommendation shows its reasons, so the reviewer sees what drove the score and the provider can learn why a review began. Every decision can be reconstructed, so a payer can measure how often its leads become findings. We think that measure belongs in every payment integrity report, next to the dollars recovered. A program that cannot say how many of its flags were right cannot say whether it is catching fraud or burdening honest care. The providers on the wrong side of a false flag are usually the ones with the least capacity to fight it, such as small practices and rural clinics.