The situation
The payer was processing a high volume of claims through a rules-based integrity engine that had accumulated years of accreted logic. It worked, in the narrow sense that it caught the things it had been told to catch. The difficulty was structural: a rules engine can only find the patterns somebody has already articulated, and the leakage that matters most is usually the leakage nobody has thought to describe yet.
Leadership knew the recovery numbers were below where they should be. What they did not have was a way to find the unknown patterns without drowning the review team in false positives, which had been the outcome of previous attempts.
The approach
The program built anomaly detection across two dimensions that the rules engine treated separately.
- Coding coherence. Procedure and diagnosis codes carry an implicit grammar, and combinations that are individually valid are frequently implausible together. Modeling the joint distribution surfaced claim lines where the service billed did not cohere with the condition documented.
- Provider behavior. Comparing each provider against a peer baseline built from similar practices, specialties, and patient mixes revealed billing patterns that were unremarkable in isolation and clearly atypical in context.
Both required hierarchical modeling rather than flat comparison. A low-volume specialist will look like an outlier against any population average, and the model had to borrow strength across related groups so that genuine signal was not buried under the noise of small samples.
The outcome
The program recovered $12 million in its first year, and it did so with an alert volume the existing review team could actually work. The second-order result mattered nearly as much: the anomalies that recurred became candidates for new deterministic rules, which meant the rules engine improved as a by-product of running the detection layer alongside it.
What made it work
The modeling was the straightforward part. The difficult part was calibrating alert volume against review capacity, because a detection system that generates more work than the organization can absorb produces no recoveries at all. Sizing the program to the people who had to act on it was the decision that made the numbers real.