The Crooked Catheter Caper

The case of the crooked catheters, a $2 Billion fraud, exposes many of the failures of nerve and lack of oversight in our system. 

U.S. investigates alleged Medicare fraud scheme estimated at $2 billion - The Washington Post

It also demonstrates that nobody on the inside has any incentive to tame out-of-control costs.

Even with all cases like this, fraud recoveries as a percentage of Medicaid spending have fallen by 74% since 2008.  The disincentives have taken hold and will not let go until Congress changes them.  Increased fraud means increased health care claims costs, which means higher premiums and a larger pool of funds after the Medical Loss Ratio is met.  Reducing fraud means reduced dollars to insurers.  The public and private health insurers profit from increased fraud. 

First, a note about this case.  It would not make headlines if the amount of the fraud was much smaller.  The desired reaction to a story like this is shock and awe that a massive fraud was busted.  Instead, the question our overseers and legislators- and the public- should be asking is “how the hell did this get to $2 Billion before action was taken?”  The fraudsters seem to understand the shortcomings in the anti-fraud process. 

A fundamental failing is that anti-fraud efforts are primarily enforcement-led.  Castlestone has talked about prevention for years, and it has filtered into the language of the industry, but the health insurance industry does not want prevention.  The Congressional Budget Office (CBO)has aided and abetted this stance.  Four bills in the years 2016-2018 that would have implemented true fraud prevention were scored by the CBO at zero.  I have a data base of cases that are readily prevented; the current value is $24 Billion.

A CBO executive told me that they could not ascribe value to prevention, only to recoveries.  In plain English, that means supporting only ‘pay-and-chase.’  Prosecutors are evaluated and rewarded by the volume and value of cases they close.  This catheter case is an example, and the loser is the taxpayer.  The headline value of the fraud case of $2 Billion dwarfs the actual recovery amount.  Even if the recovered amount is 10% of that, the reports about the efficiency of Medicare and Medicaid fraud units will be glowing.  Congress and state legislatures will pass more laws, agencies will hire more analysts and pay-and-chase budgets will grow.  Meanwhile, the taxpayer is unnecessarily out of $1.8 billion, which does not include the costs of investigation and prosecution, another six figures.  The 10% figure is close to the actual amount of recoveries from fraud cases. 

That is a reason nothing but further investigation happens until a case reaches massive proportions; the pay and chase complex is adhering to the incentives they have been given.  Prevention would also take away at least 1/4 of the low hanging fruit of available cases.  Prevention also does not generate headlines.  There are thousands of fraud cases to go around.  This approach just costs taxpayers more than it should. 

Washington Post article also lists the second aspect of the catheter case that enabled massive fraud.  Catheters are a simple, low cost, commonly used device which is off the radar screen of the enforcement complex.  They have their eyes trained on more expensive items such as power wheelchairs and beds.  Finally, $2 Billion of catheters, even with the math saying that would be highly unlikely, raised suspicions, at an industry group, not a governmental agency. 

HHS recently proposed cybersecurity guidelines which, if implemented to the letter, would not prevent this fraud.  Catheters require a prescription, and nothing in the HHS guidelines suggests how they would verify that a physician wrote an order for catheters for one of their patients after an examination in the office.  Although CMS held an online seminar in February 2022 about the 46 DME (Durable Medical Equipment) codes that would require a face-to-face visit for authorization, a mandate originally written into the Affordable Care Act in 2012, no such verification has ever been implemented.  This also contributed to the catheter fraud; it is more likely that a high percentage of the 406,000 Medicare beneficiaries whose identities were used never had catheters prescribed during an office visit with their physician.

The HHS guidelines propose basic cybersecurity guidelines such as multi-factor authentication.  In health insurance claims, there is zero-factor authentication; no claim system can verify that the provider and patient were in the same place at the same time.  This is the best enabler of identity theft in health benefits.  It is at work in this case.  Health care claims and anti- fraud efforts assume the only things to look at are the codes on the claim.  Date of service occasionally pops up, but everything else is taken as factual.

This assumption of probity also contradicts another cybersecurity tenet, and one not mentioned in the HHS guidelines.  Zero trust architectures would prevent this and many other frauds.  Health plans rely on statistical methods to determine whether the enforcers need further investigation after looking at claims data.  There is either a belief or an unwillingness to apply a basis test to all outpatient claims –(were the provider and patient present when an order for catheters was written?) that a zero-trust approach would implement.  It's noticeably absent.  It’s also readily implemented, and, contrary to misconceptions, inexpensive. 

For Medicare, catheters, like other Durable Medical Equipment, have another structural vulnerability which we pointed out 12 years ago.  One set of MACs (Medicare Administrative Contractors) processes the claim authorizing face-to-face visit, and a completely separate set of MACs process DME supposedly authorized.  Not only can the ‘authorizing’ claim be false, the data between the two systems does not match up in CMS’ systems for months.

The DME contractor will pay claims for catheters containing a legitimate provider identifier and active Medicare number.  Supplier easily obtain those identifiers and often have them on file.  And there is, as the Post points out, minimal scrutiny on catheter claims.  After all, they are a a cheap disposable item. 

Verification of authorizing visits, zero trust for claims and other available fixes will stop this.  It has never been a question of technology, only political will.  It is time for the public to demand their legislators- state and Federal- address this today.