Somewhere in a state system there may be an account with your name on it that you did not open. If there is, you have no way to find out, no log to request, and no button to press. In American healthcare, possession of the identifier is the authorization. Everything below follows from that one design choice.
Everyone who looks at healthcare billing reaches for the same word. Fraud. It is the wrong frame, and the wrongness is not academic. Fraud is a thing you catch after the money moves, if somebody happens to be looking, and the entire apparatus built around it is retrospective by design.
Look at the same facts as an access control problem and the picture reorganizes itself. You stop asking who was dishonest and start asking a question with an answer: what does the system require before it lets someone act in your name?
The answer, in American healthcare, is a number. Not a number plus something. A number.
Security people have a term for a credential that works on possession alone, with no proof that the holder is entitled to hold it. They call it a bearer token. Bearer tokens are considered acceptable in exactly two circumstances: when they expire in minutes, and when the thing they unlock is worth almost nothing. A Medicaid member identification number does not expire and unlocks an unbounded line of credit against the federal government.
A bearer credential is one where possession equals authorization. Cash is a bearer instrument. So is a movie ticket. Neither one knows who you are, which is fine, because neither one can put you in a hospital for eighty-two days.
The first thing a competent identity system does is control who may create an identity. Not who may use one. Who may make one. In federal benefit programs this control does not exist in any form a security auditor would recognize.
Here is what that looks like on paper. In August 2022, while a man was held in a psychiatric hospital in the District of Columbia, a commercial billing company operating out of suburban Philadelphia filed an appeal in his name. The appeal was of a denial. The denial had been of an earlier Medicaid application. The application had been made on his behalf too.
He signed none of it. He was not told about any of it. He learned it existed later, the way you learn about these things, which is by asking.
Read the withdrawal line again. The appeal was not granted or denied on the merits. It was withdrawn, because it had already worked. The filer got what the filing was for and closed the ticket. That is not the behavior of someone pursuing a benefit for a person. That is the behavior of someone clearing a queue.
And notice what the word "Homeless" is doing in that box. It is not a description. It is a key. Homelessness attestation opens a payment pathway and simultaneously severs the address of record, which is the one field that determines which court has jurisdiction over you if anyone ever tries to hold you somewhere. One handwritten word, two locks.
An identity is not yet an instrument. It becomes one when something starts billing against it. In this case the something was a psychiatric hospital, and the rate was $1,593.00 per patient per day.
Eighty-two days. One hundred and thirty thousand, six hundred and twenty-six dollars.
What makes the record remarkable is not the total. It is the pattern of which boxes on the government's own instruments were filled in and which were left empty, because the two sets do not overlap at all.
People reach for conspiracy here and they do not need to. Nobody sat down and decided to leave the review fields blank. The fields were blank because nothing in the workflow stops on a blank one. The claim submits either way. A form field that is not enforced is not a control, it is a suggestion, and a suggestion that costs money to follow will be followed exactly as often as you would expect.
Every field that releases money was filled in. Every field that proves someone looked at the patient was left empty. Nobody had to decide that. Nothing stops on a blank field.
Here is where the bearer-token property stops being a metaphor. An identifier created in August did not stay where it was made. By November it was in the hands of physicians who had never met the person it belonged to.
Two of them are documented by name, date and drug. One wrote ibuprofen, six hundred milligrams, on the seventh and eighth of November. Another wrote doxycycline monohydrate, one hundred milligrams, on the fourteenth and the thirtieth. A third appears on the same record with nothing attached to their name but a telephone number.
Both prescriptions were rejected. Not by an investigator, not by a fraud unit, not by any part of the elaborate integrity apparatus that exists for exactly this. They were rejected at a pharmacy counter, automatically, because the date of birth on the claim did not match the date of birth on the file.
| Transaction | Identity check performed | Amount | Outcome |
|---|---|---|---|
| Create an eligibility record on someone's behalf | none | n/a | processed |
| Assert homelessness to unlock a payment pathway | none | n/a | processed |
| Detain a person on a stranger's telephone call | none | n/a | executed |
| Bill 82 inpatient days against that record | none | $130,626 | paid |
| Dispense doxycycline against the same number | date of birth | ~$14 | DENIED |
A pharmacy system in 2022 declined to hand over fourteen dollars of antibiotic without matching a birth date. In the four months before that, the same identifier moved a hundred and thirty thousand dollars and nothing anywhere compared anything to anything.
That is the whole argument. It is not that the control is hard. The control is trivially easy, it already exists, it runs at scale, it works, and it is installed at the cheapest point in the system and nowhere else.
Any identity system worth the name gives the subject two capabilities. See who has used your credential. Turn it off. Neither exists here, and the second one is missing in a way that should embarrass somebody.
You cannot get the log. There is no facility by which a beneficiary requests a list of every provider that has presented their identifier. HIPAA's accounting of disclosures looks, for one hopeful moment, like it might be that facility. Then you read the exemptions. Disclosures for treatment, payment and healthcare operations are carved out. That is the corridor. That is the entire corridor. The right you would reach for to reconstruct the chain has the chain removed from it.
You cannot turn it off. There is no deprovisioning path for an eligibility record you did not create. You may dispute a claim. You may complain to an agency, which will tell you, in writing, that it does not handle "the Medicaid issue alleging that you were assigned a Medicaid number wrongfully," and that this is something to take up with Medicaid or the facility directly. Take it up how, using what mechanism, is left as an exercise.
Consider the position this puts a person in. He never enrolled. He also cannot un-enroll. The account exists, it is his, it is not his, and the only proof he has that it was ever misused is a rejection notice from a pharmacy that he had to go find himself, four months late.
There is an oversight layer. It is called a Corporate Integrity Agreement, and it is what a large provider signs instead of being excluded from federal programs after settling a False Claims Act case. One national psychiatric operator settled in July 2020 for $122 million and signed a five-year agreement.
The settled conduct, listed in the government's own press release, covers improper admission of patients who did not require inpatient care, delayed discharge, excessive lengths of stay driven by billing, inadequate staffing, improper chemical restraint, and therapy that was billed and not provided.
The events described in this piece occurred in year three of that agreement, and produce conduct in every one of those categories.
So it is worth asking what a Corporate Integrity Agreement actually consumes. It has three inputs.
| Input | Design intent | Observed state |
|---|---|---|
| Provider self-reporting | the operator reports its own reportable events | The District's behavioral health agency received seven major unusual incident reports in sixteen months from the facility that takes roughly 60% of the city's involuntary commitments. The District's designated protection and advocacy agency found the facility has failed to send required reports for years. |
| Independent review organization | an outside reviewer audits compliance | The reviewer is selected and paid by the provider under review. No public data exists on IRO findings, IRO turnover, or how often an IRO surfaces something the provider did not self-report. |
| State licensure and adverse action data | state inspectors generate findings that flow up | Virginia's inspection office was found by the legislature's own research arm to lack the staff to perform state-mandated hospital inspections, investigate complaints, or complete federally required work. An executive order put its inspector vacancy above 40%. A 2023 Senate report found 32 states at or above 20% vacancy, nine above 50%. |
You can test this. Between December 2024 and April 2026, serious misconduct at that facility did surface. It surfaced five separate times: a federal citation, a class action, two long investigative newspaper pieces, an occupational safety citation, and a federal indictment of three former staff.
Five routes. None of them the integrity agreement that existed for this exact purpose.
An integrity agreement that receives nothing does not record a problem. It records a compliant provider.
The reason to insist on the access-control frame rather than the fraud frame is that the fraud frame generates prosecutions and the access-control frame generates fixes. Every remedy below already exists somewhere in the federal government. None of them is novel. They are simply not installed here.
Require a consent artifact and a notice to the subject whenever any party creates or amends an eligibility record on someone else's behalf. Flag records created retroactively by third-party billing entities on appeal of a denial, and subject claims billed against those records to review before payment rather than after. This is a rule, not a technology.
The pharmacy point-of-sale edit compares fields already present in the transaction. Run the same comparison when a claim is submitted for inpatient services. If the objection is cost, note that the control currently runs at fourteen dollars and does not run at a hundred and thirty thousand, and ask which way that argument actually points.
Publish, to the beneficiary, every provider that has presented their identifier. Close the treatment-payment-operations gap for the beneficiary's own accounting, or create a parallel right that does not have the corridor carved out of it. And build a deprovisioning path for an eligibility record the subject did not create, because at present the answer to "somebody opened an account in my name inside a federal program" is that there is no answer.
The one control that would have stopped all of it sits before any of it. A person with no clinical relationship to the patient can initiate an involuntary psychiatric detention, and no rule obliges anyone in the chain to check that account against any other record before custody occurs. The emergency custody instrument has no field for verification because verification was never part of the design. Everything downstream, including every dollar in this piece, inherits a premise that was never tested once.
None of this requires anyone in the sequence to have acted in bad faith, and that is the part worth sitting with. Each actor did what their role permitted. The billing company was permitted to file. The hospital was permitted to bill. The prescribers were permitted to prescribe. The inspectorate was permitted to be empty. The permission model is the defect, and you cannot prosecute a permission model.
Which is presumably why nobody has.