> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Provider identity theft and NPI misuse
> What happens legally when someone bills under a clinician's NPI: overpayment liability, Medicare and Medicaid payment suspension, revocation, the criminal statutes that reach the fraudster, and why the burden of denial lands on the victim.
**Provider identity theft** is the use of a clinician's or an entity's National Provider Identifier, license number, and tax identification number to submit claims the clinician never rendered, ordered, or authorized. The fraudster takes the money. The provider whose NPI appears on the claim takes the overpayment demand, the payment suspension, and the enrollment consequences — and has to affirmatively prove a negative to get out from under them.
That asymmetry is the whole subject. Everything below is a description of the machinery that runs at a victim by default, and the reason the victim's own written denial is the pivot on which it stops.
## Why NPIs are trivially available
The NPI is not a secret and was never designed to be one. It is a **standard unique health identifier** established under HIPAA's administrative simplification provisions and implemented at 45 C.F.R. part 162, subpart D.1 Its entire purpose is to be quoted on transactions between parties who do not otherwise know each other.
CMS publishes the **NPPES** registry — every active NPI, with the provider's name, taxonomy, and practice address — as a public, downloadable file. That is a deliberate design choice: payers, clearinghouses, and referring practices need to look each other up. The consequence is that the first ingredient of provider identity fraud costs nothing to obtain.
**Treat your NPI as a public identifier, not a credential.** Anything that relies on knowledge of the NPI as proof of identity is broken. What actually gates access is the credential set around it, your NPPES and PECOS login, your I\&A account, your EDI submitter IDs, and your enrollment record. Those are what an attacker has to reach, and what you have to defend.
## Rendering versus ordering: the distinction that decides your exposure
Two very different things get called "billing under my NPI."
| Role on the claim | What the fraudster claims | Typical scheme |
| --------------------------------- | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Rendering / billing provider** | That you performed the service and should be paid | Requires reaching your enrollment and payment details; rarer, and generates a payment trail toward the fraudster's bank account |
| **Ordering / referring provider** | That you ordered or referred a service someone *else* renders and bills | The common case. A DME supplier, lab, or pharmacy is the payee; your NPI merely supplies the medical-necessity signature the claim needs |
The ordering/referring case is the one most clinicians encounter, and it is counterintuitive in two ways. **You never see any money**, so cash reconciliation will not catch it. And **the claims are not in your billing system**, so no report you run internally will show them. Your NPI is functioning as a signature on someone else's claim.
🩺 **Primary care and any specialty that orders is the target profile.** Schemes built on durable medical equipment, genetic and toxicology testing, and telehealth consults all need an ordering physician's NPI, because the claim is not payable without one. High-volume, broadly-licensed, multi-state clinicians are disproportionately harvested.
## The scale, as documented
In the **2025 National Health Care Fraud Takedown**, DOJ charged 324 defendants across schemes with more than $14.6 billion** in intended loss. Its largest component, **Operation Gold Rush**, was a transnational scheme in which foreign straw owners purchased dozens of existing US medical supply companies with active Medicare billing privileges and submitted roughly **$**10.6 billion** in claims for urinary catheters and other DME, **exploiting the stolen identities of more than one million Americans**, beneficiaries and providers alike.2
GAO's 2026 review of CMS fraud analytics describes the CMS side of the same problem: providers attempted to bill more than **\$4 billion** for urinary catheters never supplied during 2023–2024; CMS suspended payments to and later revoked the enrollment of **15 providers**, preventing over **99 percent** of the payments. Across fiscal years 2022–2024, CMS imposed payment suspensions on **1,160 providers** and revocations or deactivations on **569**.3
Two things follow from those numbers. The detection is real and increasingly fast, which is good. And the instruments CMS uses to stop a scheme mid-flight are **suspension and revocation**, which are entity-level and identifier-level, not intent-level. They land on whoever the enrollment record names.
## The four machines that run at the victim
### 1. Overpayment demand and recoupment
If claims paid out under your NPI, the enrolled provider of record is who Medicare bills to get it back. A demand letter starts a clock that does not care whose signature was forged:
| Day | What happens |
| ---------- | ----------------------------------------------------------------- |
| **Day 31** | Interest begins accruing if the overpayment is not paid in full |
| **Day 41** | Recoupment begins, offset against your other, legitimate payments |
Filing a **redetermination by day 30** stops recoupment before it starts; filing a **reconsideration with the QIC within 60 days** of the redetermination decision stops it again. This is the statutory limitation on recoupment at **42 U.S.C. § 1395ddd(f)(2)**, and it reaches only the first two appeal levels — at level three and beyond, recoupment proceeds while you appeal. Interest accrues throughout, and is refunded with the principal if you win.4
**The recoupment deadlines are shorter than the appeal deadlines, and that trap catches people.** You have 120 days to file a redetermination, but only 30 to stop recoupment. A victim who spends six weeks assembling a thorough response has filed a timely appeal into an account that is already being offset.
### 2. Payment suspension, and the Medicaid version is mandatory
This is the difference that matters most, and it is the reason a Medicaid-side theft is more dangerous than a Medicare-side one.
| | Medicare | Medicaid |
| -------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| **Authority** | 42 C.F.R. § 405.371(a)(2) | 42 C.F.R. § 455.23(a)(1) |
| **Trigger** | A credible allegation of fraud, after consultation with OIG | A credible allegation of fraud for which an investigation is pending |
| **Discretion** | CMS **may** suspend | The State agency **must** suspend, unless good cause exists |
| **Scope** | In whole or in part | All Medicaid payments, unless good cause to suspend only in part |
| **Notice** | Per § 405.372 | Within **5 days** of the action, unless law enforcement asks that notice be withheld |
| **Duration** | Good cause not to continue is **deemed** to exist at 18 months without resolution; reviewed every 180 days | Continues while the investigation is pending |
A **credible allegation of fraud** is defined at 42 C.F.R. § 455.2 as an allegation from any source — hotline tips, claims data mining, audit patterns, law enforcement — that has been verified by the State and bears indicia of reliability. Note what that definition does *not* require: any finding about who actually submitted the claims.5
The good cause exceptions at § 455.23(e) and (f) are the escape hatch, and one of them is written for exactly this situation — the State may find good cause where it determines, **based on written evidence**, that the suspension should be removed or imposed only in part. Written evidence is the operative phrase, and it is why the denial statement exists.
**A Medicaid suspension can cascade into Medicare.** Under 42 C.F.R. § 405.371(a)(4), CMS may suspend Medicare payment because the provider is subject to a Medicaid payment suspension under § 455.23(a)(1). A single state's determination can therefore stop payment on the federal side as well.
Separately, § 455.416 requires State Medicaid agencies to deny or terminate enrollment for any provider **terminated** under Medicare or another state's Medicaid or CHIP program. Termination is a different action from suspension, but for a multi-state group the direction of travel is the same: an adverse action in one program propagates.
### 3. Revocation of enrollment
**42 C.F.R. § 424.535(a)(8)** authorizes revocation for abuse of billing privileges, including claims for services that could not have been furnished — the beneficiary was deceased, the provider was not in the state, the equipment was not present — and for an established pattern of improper claims.6
Revocation is generally effective 30 days after CMS mails notice, and it carries a **reenrollment bar of at least 1 year**, up to 10, and up to 20 for a second revocation. For a clinician, revocation is not merely a Medicare problem: commercial payer contracts and hospital privileges routinely include Medicare enrollment as a condition, so one revocation propagates across the whole book.
Appeal rights run under **42 C.F.R. part 498**: reconsideration within **60 days** of receipt of the initial determination, then an ALJ hearing, then Departmental Appeals Board review, then judicial review. A **corrective action plan** under 42 C.F.R. § 405.809 is available only for revocations based on noncompliance — it is not the route for a revocation predicated on billing abuse, which is what an identity-theft revocation will be styled as.7
### 4. Tax and Treasury consequences
CMS itself describes victimized providers as being "victimized twice," and enumerates the second injury: demand letters, debt referral to the Department of the Treasury, **Form 1099 issued for funds never received**, and deductions from Social Security payments.8
The 1099 is the one people underestimate. It reports income to the IRS under your TIN that you did not receive, and left alone it becomes a tax liability layered on top of the overpayment demand.
## Why the burden of denial falls on you
There is no mechanism by which a payer discovers on its own that the enrolled provider named on a claim did not authorize it. The claim carries a valid NPI, a valid TIN, and, in the ordering/referring case, no other party who can speak to whether the order was real. From the program's side, the record is complete.
Two legal facts sit underneath this:
**The government has to prove your state of mind, and your denial is the evidence about it.** The False Claims Act reaches only those who act "knowingly," defined at **31 U.S.C. § 3729(b)(1)** as actual knowledge, deliberate ignorance, or reckless disregard.9 A clinician who documented the theft, denied it in writing, reported it, and cooperated has built the record that negates every branch of that definition. A clinician who received demand letters and filed them has, over time, built the opposite record, because *continued* silence after notice starts to look like deliberate ignorance.
**The 60-day rule has no identity-theft carve-out.** If any part of what surfaced is actually yours and actually wrong, the report-and-return obligation at 42 U.S.C. § 1320a-7k(d) applies to that part on its own timetable. See [Report and return overpayments](/guides/compliance/report-and-return-overpayments).
The practical consequence is that **the written, specific, dated denial is not a formality**. It is the document that converts you from the party of record into a documented victim, and it is what the good-cause analysis, the rebuttal, and the appeal all run on. See [Respond to NPI identity theft](/guides/compliance/respond-to-npi-identity-theft) for what it has to contain.
## What the fraudster is charged with
Useful to know, because it tells you what investigators are building and therefore what they want from you.
| Statute | Offense | Maximum |
| --------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------ |
| **18 U.S.C. § 1347** | Health care fraud, a scheme to defraud any health care benefit program | 10 years; 20 if serious bodily injury; life if death results |
| **18 U.S.C. § 1035** | Materially false statements in connection with health care benefits | 5 years |
| **18 U.S.C. § 1028** | Fraud in connection with means of identification | Varies by subsection |
| **18 U.S.C. § 1028A** | Aggravated identity theft | **2 years, mandatory and consecutive** |
| **42 U.S.C. § 1320a-7b(a)** | False statements in applications for program benefits or payments | 5 years |
| **31 U.S.C. §§ 3729–3733** | False Claims Act (civil) | Treble damages plus per-claim penalties |
The § 1028A charge is the one with a recent twist worth understanding. In **Dubin v. United States**, 599 U.S. 110 (2023), a unanimous Supreme Court narrowed it: a defendant "uses" a means of identification "in relation to" a predicate offense only when that misuse is **at the crux of what makes the conduct criminal**, not when it is an ancillary feature of the billing method. Dubin had overbilled Medicaid for psychological testing that was actually performed, using a real patient's identifier; the Court held the crux was the inflated billing, not the identifier.10
**Dubin narrowed the charge for overbilling cases, not for impersonation cases.** Where a fraudster bills for services that were never rendered at all, under a clinician's identity, the misuse of that identity *is* what makes the conduct criminal, there is no underlying service whose value was merely inflated. If anything, Dubin sharpens the distinction between a coding dispute and an impersonation, in a direction that favors a victim clinician trying to establish which one they are looking at.
## The MSO-PC dimension
A group structure multiplies the attack surface and changes who is responsible for watching it.
**You have two classes of NPI, and both are exposed.** Each clinician holds a **Type 1** individual NPI that travels with them across every entity and state; each PC holds a **Type 2** organizational NPI. A Type 1 compromise follows the clinician into every PC they are credentialed under. A Type 2 compromise is contained to one entity but implicates that entity's entire payer book. See [Get an NPI](/guides/enrollment/get-an-npi).
**Monitoring is an MSO function that nobody assigns.** The clinician cannot see claims submitted by strangers under their ordering NPI. The PC's biller only sees the PC's own claims. In a group of eleven PCs, the only party positioned to notice that a clinician's NPI is generating denials, audit letters, or beneficiary complaints across entities is the MSO, and it is generally not in anyone's job description. Put it in the MSA's scope of services and give it an owner.
**Correspondence routing is the failure mode.** Demand letters, revocation notices, and rebuttal windows arrive by mail at the address in the enrollment record. A group that formed eleven PCs at a registered agent and never built a monitored intake for enrollment mail will discover a 30-day rebuttal window after it closes. See [Maintain corporate formalities](/guides/formation/maintain-corporate-formalities).
**A friendly owner's exposure is the PC's exposure.** The friendly clinician is typically the owner of record and often the enrolled provider on the PC's Medicare and Medicaid applications. An adverse enrollment action against them is an adverse action against the entity that holds every payer contract. See [The friendly PC](/concepts/model/the-friendly-pc) and [Vet a friendly clinician](/guides/formation/vet-a-friendly-clinician).
## Sources
1. HIPAA administrative simplification, standard unique health identifier for health care providers, 45 C.F.R. part 162, subpart D; National Provider System duties including deactivation, [45 C.F.R. § 162.408](https://www.law.cornell.edu/cfr/text/45/162.408); provider implementation specifications, [45 C.F.R. § 162.410](https://www.law.cornell.edu/cfr/text/45/162.410). NPPES data is published by CMS as a public downloadable file.
2. U.S. Department of Justice, 2025 National Health Care Fraud Takedown (June 2025), 324 defendants, over $14.6 billion in intended loss; Operation Gold Rush, approximately $10.6 billion in claims using the stolen identities of over one million Americans. Summarized in Womble Bond Dickinson, [2025 National Health Care Fraud Takedown Sets Record as Largest in U.S. History](https://www.womblebonddickinson.com/us/insights/alerts/2025-national-health-care-fraud-takedown-sets-record-largest-us-history-charging), and Mintz, [Health Care Fraud Enforcement Developments: the 2025 Takedown](https://www.mintz.com/insights-center/viewpoints/2146/2025-07-07-health-care-fraud-enforcement-developments-2025-takedown).
3. U.S. Government Accountability Office, [Medicare: CMS's Use of Data Analytics to Identify and Prevent Fraud](https://www.gao.gov/products/gao-26-107799), GAO-26-107799, over \$4 billion attempted in urinary catheter billing 2023–2024; 15 providers suspended and revoked; over 99% of payments prevented; 1,160 payment suspensions and 569 revocations or deactivations in FY 2022–2024.
4. Limitation on recoupment, [42 U.S.C. § 1395ddd(f)(2)](https://www.law.cornell.edu/uscode/text/42/1395ddd); recoupment at day 41 and interest at day 31, CMS, [Medicare Overpayments](https://www.cms.gov/files/document/medicare-overpayments.pdf) (MLN006379, July 2025) and CMS Medicare Financial Management Manual, Pub. 100-06, ch. 4.
5. Definitions, [42 C.F.R. § 455.2](https://www.law.cornell.edu/cfr/text/42/455.2); Medicaid suspension of payments in cases of fraud, [42 C.F.R. § 455.23](https://www.law.cornell.edu/cfr/text/42/455.23); Medicare suspension bases, [42 C.F.R. § 405.371](https://www.law.cornell.edu/cfr/text/42/405.371); notice, § 405.372; opportunity for rebuttal, [42 C.F.R. § 405.374](https://www.law.cornell.edu/cfr/text/42/405.374). See also CMS, [Medicaid Payment Suspension Toolkit](https://www.cms.gov/medicare-medicaid-coordination/fraud-prevention/fraudabuseforprofs/downloads/medicaid-paymentsuspension-toolkit-0914.pdf).
6. Revocation of enrollment, [42 C.F.R. § 424.535](https://www.law.cornell.edu/cfr/text/42/424.535), including (a)(8) abuse of billing privileges, the effective-date rules, and the reenrollment bar.
7. Appeals procedures, [42 C.F.R. part 498](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-498); reconsideration and its 60-day filing period, [42 C.F.R. § 498.22](https://www.law.cornell.edu/cfr/text/42/498.22); appeal rights of prospective providers and suppliers, [42 C.F.R. § 498.5](https://www.law.cornell.edu/cfr/text/42/498.5); reinstatement following corrective action, [42 C.F.R. § 405.809](https://www.law.cornell.edu/cfr/text/42/405.809).
8. CMS Center for Program Integrity, [Victimized Provider Project](https://www.cms.gov/about-cms/components/cpi/victimizedproviderproject), describing demand letters, Treasury debt referral, Forms 1099 for funds never received, and Social Security deductions.
9. False Claims Act, [31 U.S.C. §§ 3729–3733](https://www.law.cornell.edu/uscode/text/31/3729); the knowledge standard at § 3729(b)(1). Report-and-return obligation, 42 U.S.C. § 1320a-7k(d).
10. [Dubin v. United States, 599 U.S. 110 (2023)](https://supreme.justia.com/cases/federal/us/599/22-10/) (Sotomayor, J., unanimous). Criminal statutes: 18 U.S.C. §§ 1028, 1028A, 1035, 1347; 42 U.S.C. § 1320a-7b(a).
## Related topics
- [Respond to NPI identity theft](/guides/compliance/respond-to-npi-identity-theft.md)
- [Report and return overpayments (the 60-day rule)](/guides/compliance/report-and-return-overpayments.md)
- [Handle recoupments and takebacks](/guides/compliance/handle-recoupments.md)
- [Respond to payer audits and record requests](/guides/compliance/respond-to-payer-audits.md)
- [Billing compliance: the lines you never cross](/concepts/compliance/billing-compliance-basics.md)
- [Enforcement, and what happens when structures fail](/concepts/model/enforcement-and-risk.md)
- [When to call a lawyer (a triage map)](/concepts/compliance/when-to-call-a-lawyer.md)
- [Medicare (fee-for-service)](/reference/payers/profiles/medicare.md)
- [Medicaid](/reference/payers/profiles/medicaid.md)