Still Out There: 500 Providers Who Bill Like Convicted Fraudsters

Published February 2026 · OpenMedicare Investigation

Most fraud detection uses rules: flag anyone who bills above a threshold, sees too many patients, or charges too much. That catches the obvious cases. But the providers who study the system — who know exactly where the tripwires are — slip through.

We tried something different. We collected the billing fingerprints of 2,198 providers confirmed as fraudsters — every provider on the HHS OIG exclusion list (LEIE) and those prosecuted by the Department of Justice for healthcare fraud. Real criminals. Real convictions.

Then we asked a machine learning model one question: "What does a fraudster's billing look like?"

It scored 1,719,625 Medicare providers. Five hundred of them came back above 86% fraud-match probability.

The Model: 83% Accuracy at Identifying Fraud

Our Random Forest classifier achieved an AUC of 0.8298 — meaning it correctly distinguishes between fraudulent and legitimate providers 83% of the time. That's not perfect, and we don't pretend it is. But it's far better than chance, and far better than most rule-based systems.

The model analyzed billing features across every Medicare provider in the country, learning which combinations of behaviors separate convicted fraudsters from everyone else. What it found was revealing.

What the Algorithm Learned

The three most predictive features weren't the ones you'd guess. It's not just about billing big numbers:

Years active was the single most important feature — accounting for 16.3% of the model's decision-making. Fraudsters tend to operate within a specific window: long enough to build a billing pattern, but the data captures their trajectory differently than career physicians. The model picks up on this temporal signature.

Services per beneficiary (11.9%) captures patient churning — how many procedures a provider bills per patient. Legitimate high-volume providers see many patients. Fraudulent ones tend to bill many services per patient, padding each encounter.

Markup ratio (8%) measures how aggressively a provider charges above Medicare rates. Some markup is normal. But convicted fraudsters consistently push this further than their peers.

The model learned that it's the combination that matters. A high markup alone means little. High markup plus inflated services-per-patient plus the right temporal pattern? That's what convicted fraudsters look like.

The Top Flagged Providers

At the top of the list sits Ramesh Thimmiah, an internal medicine physician in West Virginia, with a 95.9% fraud-match probability. His billing profile — $789K in Medicare payments, a 2.28x markup ratio, and 2.4 services per beneficiary — closely mirrors patterns the model learned from convicted providers.

Right behind him:

Four of the top five are in internal medicine. That's not a coincidence — it's a pattern that runs through the entire dataset.

The Specialty Problem: Internal Medicine Dominates

Of the 500 flagged providers, 263 practice internal medicine — more than half. Another 135 are in family practice. Together, these two specialties account for nearly 80% of all flags.

This makes sense when you understand how Medicare fraud works. Internal medicine and family practice are high-volume, office-visit-heavy specialties with enormous billing flexibility. A provider can see dozens of patients a day, upcode visit complexity, order unnecessary tests, and bill for services that are nearly impossible to audit from claims data alone. The same features that make these specialties essential to healthcare make them vulnerable to exploitation.

The remaining flags scatter across specialties including anesthesiology, endocrinology, cardiology, and others — but the concentration in primary care is striking.

The Geography of Fraud Patterns

The geographic distribution tells its own story:

California and Florida tie at 56 flagged providers each — together representing more than a fifth of the entire list. These are the same states that have historically dominated DOJ healthcare fraud prosecutions. Southern Florida, in particular, has long been called the "Medicare fraud capital of America." Our model, trained on the billing patterns of people caught there and elsewhere, is finding more providers in the same regions with the same signatures.

New York (39), Texas (36), and New Jersey (33) round out the top five — all states with large Medicare populations and, historically, significant fraud enforcement activity.

$400 Million Still Flowing

The 500 flagged providers collectively received approximately $400 million in Medicare payments. That's taxpayer money flowing to providers whose billing patterns are statistically indistinguishable from convicted criminals.

To be clear: we don't know how much of that $400 million is fraudulent. Some of these providers may be entirely legitimate. But the model is saying something simple and important: these billing profiles look like fraud. If even a fraction of these flags are real, tens of millions of dollars are walking out the door.

Validation: The Model Already Works

This isn't theoretical. In our "Our Data Predicted It" investigation, we showed that our earlier statistical approach had flagged providers who were later charged by the DOJ in June 2025 — months before the indictments were unsealed.

This v2 model is more sophisticated. It was trained directly on the billing fingerprints of confirmed fraudsters, not just statistical outliers. An 83% AUC means it's learned real discriminative patterns — the kind of signal that should be informing enforcement decisions.

A Tool, Not a Verdict

We publish this data because transparency matters. The public has a right to see how their healthcare dollars are spent, and to understand which billing patterns raise questions. But a flag from a machine learning model — even a good one — is a starting point for investigation, not a conclusion.

The question we're asking is simple: If 500 providers bill exactly like people who went to prison for Medicare fraud, shouldn't someone at least look?

→ Explore the full "Still Out There" list of 500 flagged providers →