Provider identity theft and NPI misuse

Provider identity theft is the use of a clinician’s or an entity’s National Provider Identifier, license number, and tax identification number to submit claims the clinician never rendered, ordered, or authorized. The fraudster takes the money. The provider whose NPI appears on the claim takes the overpayment demand, the payment suspension, and the enrollment consequences — and has to affirmatively prove a negative to get out from under them. That asymmetry is the whole subject. Everything below is a description of the machinery that runs at a victim by default, and the reason the victim’s own written denial is the pivot on which it stops.

​

Why NPIs are trivially available

The NPI is not a secret and was never designed to be one. It is a standard unique health identifier established under HIPAA’s administrative simplification provisions and implemented at 45 C.F.R. part 162, subpart D.¹ Its entire purpose is to be quoted on transactions between parties who do not otherwise know each other. CMS publishes the NPPES registry — every active NPI, with the provider’s name, taxonomy, and practice address — as a public, downloadable file. That is a deliberate design choice: payers, clearinghouses, and referring practices need to look each other up. The consequence is that the first ingredient of provider identity fraud costs nothing to obtain. Treat your NPI as a public identifier, not a credential. Anything that relies on knowledge of the NPI as proof of identity is broken. What actually gates access is the credential set around it, your NPPES and PECOS login, your I&A account, your EDI submitter IDs, and your enrollment record. Those are what an attacker has to reach, and what you have to defend.

​

Rendering versus ordering: the distinction that decides your exposure

Two very different things get called “billing under my NPI.” The ordering/referring case is the one most clinicians encounter, and it is counterintuitive in two ways. You never see any money, so cash reconciliation will not catch it. And the claims are not in your billing system, so no report you run internally will show them. Your NPI is functioning as a signature on someone else’s claim.

​

The scale, as documented

In the 2025 National Health Care Fraud Takedown, DOJ charged 324 defendants across schemes with more than $14.6 billion** in intended loss. Its largest component, **Operation Gold Rush**, was a transnational scheme in which foreign straw owners purchased dozens of existing US medical supply companies with active Medicare billing privileges and submitted roughly **$10.6 billion in claims for urinary catheters and other DME, exploiting the stolen identities of more than one million Americans, beneficiaries and providers alike.² GAO’s 2026 review of CMS fraud analytics describes the CMS side of the same problem: providers attempted to bill more than $4 billion for urinary catheters never supplied during 2023–2024; CMS suspended payments to and later revoked the enrollment of 15 providers, preventing over 99 percent of the payments. Across fiscal years 2022–2024, CMS imposed payment suspensions on 1,160 providers and revocations or deactivations on 569.³ Two things follow from those numbers. The detection is real and increasingly fast, which is good. And the instruments CMS uses to stop a scheme mid-flight are suspension and revocation, which are entity-level and identifier-level, not intent-level. They land on whoever the enrollment record names.

​

The four machines that run at the victim

​

1. Overpayment demand and recoupment

If claims paid out under your NPI, the enrolled provider of record is who Medicare bills to get it back. A demand letter starts a clock that does not care whose signature was forged: Filing a redetermination by day 30 stops recoupment before it starts; filing a reconsideration with the QIC within 60 days of the redetermination decision stops it again. This is the statutory limitation on recoupment at 42 U.S.C. § 1395ddd(f)(2), and it reaches only the first two appeal levels — at level three and beyond, recoupment proceeds while you appeal. Interest accrues throughout, and is refunded with the principal if you win.⁴

​

2. Payment suspension, and the Medicaid version is mandatory

This is the difference that matters most, and it is the reason a Medicaid-side theft is more dangerous than a Medicare-side one. A credible allegation of fraud is defined at 42 C.F.R. § 455.2 as an allegation from any source — hotline tips, claims data mining, audit patterns, law enforcement — that has been verified by the State and bears indicia of reliability. Note what that definition does not require: any finding about who actually submitted the claims.⁵ The good cause exceptions at § 455.23(e) and (f) are the escape hatch, and one of them is written for exactly this situation — the State may find good cause where it determines, based on written evidence, that the suspension should be removed or imposed only in part. Written evidence is the operative phrase, and it is why the denial statement exists. A Medicaid suspension can cascade into Medicare. Under 42 C.F.R. § 405.371(a)(4), CMS may suspend Medicare payment because the provider is subject to a Medicaid payment suspension under § 455.23(a)(1). A single state’s determination can therefore stop payment on the federal side as well. Separately, § 455.416 requires State Medicaid agencies to deny or terminate enrollment for any provider terminated under Medicare or another state’s Medicaid or CHIP program. Termination is a different action from suspension, but for a multi-state group the direction of travel is the same: an adverse action in one program propagates.

​

3. Revocation of enrollment

42 C.F.R. § 424.535(a)(8) authorizes revocation for abuse of billing privileges, including claims for services that could not have been furnished — the beneficiary was deceased, the provider was not in the state, the equipment was not present — and for an established pattern of improper claims.⁶ Revocation is generally effective 30 days after CMS mails notice, and it carries a reenrollment bar of at least 1 year, up to 10, and up to 20 for a second revocation. For a clinician, revocation is not merely a Medicare problem: commercial payer contracts and hospital privileges routinely include Medicare enrollment as a condition, so one revocation propagates across the whole book. Appeal rights run under 42 C.F.R. part 498: reconsideration within 60 days of receipt of the initial determination, then an ALJ hearing, then Departmental Appeals Board review, then judicial review. A corrective action plan under 42 C.F.R. § 405.809 is available only for revocations based on noncompliance — it is not the route for a revocation predicated on billing abuse, which is what an identity-theft revocation will be styled as.⁷

​

4. Tax and Treasury consequences

CMS itself describes victimized providers as being “victimized twice,” and enumerates the second injury: demand letters, debt referral to the Department of the Treasury, Form 1099 issued for funds never received, and deductions from Social Security payments.⁸ The 1099 is the one people underestimate. It reports income to the IRS under your TIN that you did not receive, and left alone it becomes a tax liability layered on top of the overpayment demand.

​

Why the burden of denial falls on you

There is no mechanism by which a payer discovers on its own that the enrolled provider named on a claim did not authorize it. The claim carries a valid NPI, a valid TIN, and, in the ordering/referring case, no other party who can speak to whether the order was real. From the program’s side, the record is complete. Two legal facts sit underneath this: The government has to prove your state of mind, and your denial is the evidence about it. The False Claims Act reaches only those who act “knowingly,” defined at 31 U.S.C. § 3729(b)(1) as actual knowledge, deliberate ignorance, or reckless disregard.⁹ A clinician who documented the theft, denied it in writing, reported it, and cooperated has built the record that negates every branch of that definition. A clinician who received demand letters and filed them has, over time, built the opposite record, because continued silence after notice starts to look like deliberate ignorance. The 60-day rule has no identity-theft carve-out. If any part of what surfaced is actually yours and actually wrong, the report-and-return obligation at 42 U.S.C. § 1320a-7k(d) applies to that part on its own timetable. See Report and return overpayments. The practical consequence is that the written, specific, dated denial is not a formality. It is the document that converts you from the party of record into a documented victim, and it is what the good-cause analysis, the rebuttal, and the appeal all run on. See Respond to NPI identity theft for what it has to contain.

​

What the fraudster is charged with

Useful to know, because it tells you what investigators are building and therefore what they want from you. The § 1028A charge is the one with a recent twist worth understanding. In Dubin v. United States, 599 U.S. 110 (2023), a unanimous Supreme Court narrowed it: a defendant “uses” a means of identification “in relation to” a predicate offense only when that misuse is at the crux of what makes the conduct criminal, not when it is an ancillary feature of the billing method. Dubin had overbilled Medicaid for psychological testing that was actually performed, using a real patient’s identifier; the Court held the crux was the inflated billing, not the identifier.¹⁰

​

The MSO-PC dimension

A group structure multiplies the attack surface and changes who is responsible for watching it. You have two classes of NPI, and both are exposed. Each clinician holds a Type 1 individual NPI that travels with them across every entity and state; each PC holds a Type 2 organizational NPI. A Type 1 compromise follows the clinician into every PC they are credentialed under. A Type 2 compromise is contained to one entity but implicates that entity’s entire payer book. See Get an NPI. Monitoring is an MSO function that nobody assigns. The clinician cannot see claims submitted by strangers under their ordering NPI. The PC’s biller only sees the PC’s own claims. In a group of eleven PCs, the only party positioned to notice that a clinician’s NPI is generating denials, audit letters, or beneficiary complaints across entities is the MSO, and it is generally not in anyone’s job description. Put it in the MSA’s scope of services and give it an owner. Correspondence routing is the failure mode. Demand letters, revocation notices, and rebuttal windows arrive by mail at the address in the enrollment record. A group that formed eleven PCs at a registered agent and never built a monitored intake for enrollment mail will discover a 30-day rebuttal window after it closes. See Maintain corporate formalities. A friendly owner’s exposure is the PC’s exposure. The friendly clinician is typically the owner of record and often the enrolled provider on the PC’s Medicare and Medicaid applications. An adverse enrollment action against them is an adverse action against the entity that holds every payer contract. See The friendly PC and Vet a friendly clinician.

​

Sources

1. HIPAA administrative simplification, standard unique health identifier for health care providers, 45 C.F.R. part 162, subpart D; National Provider System duties including deactivation, 45 C.F.R. § 162.408; provider implementation specifications, 45 C.F.R. § 162.410. NPPES data is published by CMS as a public downloadable file.
2. U.S. Department of Justice, 2025 National Health Care Fraud Takedown (June 2025), 324 defendants, over $14.6 billion in intended loss; Operation Gold Rush, approximately$10.6 billion in claims using the stolen identities of over one million Americans. Summarized in Womble Bond Dickinson, 2025 National Health Care Fraud Takedown Sets Record as Largest in U.S. History, and Mintz, Health Care Fraud Enforcement Developments: the 2025 Takedown.
3. U.S. Government Accountability Office, Medicare: CMS’s Use of Data Analytics to Identify and Prevent Fraud, GAO-26-107799, over $4 billion attempted in urinary catheter billing 2023–2024; 15 providers suspended and revoked; over 99% of payments prevented; 1,160 payment suspensions and 569 revocations or deactivations in FY 2022–2024.
4. Limitation on recoupment, 42 U.S.C. § 1395ddd(f)(2); recoupment at day 41 and interest at day 31, CMS, Medicare Overpayments (MLN006379, July 2025) and CMS Medicare Financial Management Manual, Pub. 100-06, ch. 4.
5. Definitions, 42 C.F.R. § 455.2; Medicaid suspension of payments in cases of fraud, 42 C.F.R. § 455.23; Medicare suspension bases, 42 C.F.R. § 405.371; notice, § 405.372; opportunity for rebuttal, 42 C.F.R. § 405.374. See also CMS, Medicaid Payment Suspension Toolkit.
6. Revocation of enrollment, 42 C.F.R. § 424.535, including (a)(8) abuse of billing privileges, the effective-date rules, and the reenrollment bar.
7. Appeals procedures, 42 C.F.R. part 498; reconsideration and its 60-day filing period, 42 C.F.R. § 498.22; appeal rights of prospective providers and suppliers, 42 C.F.R. § 498.5; reinstatement following corrective action, 42 C.F.R. § 405.809.
8. CMS Center for Program Integrity, Victimized Provider Project, describing demand letters, Treasury debt referral, Forms 1099 for funds never received, and Social Security deductions.
9. False Claims Act, 31 U.S.C. §§ 3729–3733; the knowledge standard at § 3729(b)(1). Report-and-return obligation, 42 U.S.C. § 1320a-7k(d).
10. Dubin v. United States, 599 U.S. 110 (2023) (Sotomayor, J., unanimous). Criminal statutes: 18 U.S.C. §§ 1028, 1028A, 1035, 1347; 42 U.S.C. § 1320a-7b(a).