Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Silver City sentence and what it tells operators to fix now
Behavioral health operators can prevent identity theft and diagnosis fraud in Medicaid billing by hardening four controls: guardian-verified intake identity attestation for every minor beneficiary, contemporaneous clinician sign-off on each diagnosis code, monthly LEIE and SAM.gov screening of every employee and contractor, and a 60-day overpayment refund workflow tied to the compliance officer. Skip any one and you inherit the same exposure the Kee family just modeled in New Mexico.
On September 9, a Sixth Judicial District Court judge sentenced Susanne Kee and her daughter Bethanne Kee to four and a half years each for running a Medicaid billing scheme through a Silver City afterschool program called Kids in Need of Support Services. The pair stole children’s identities, fabricated psychological diagnoses, and fraudulently billed Medicaid for services that were never provided. The prison time comes in addition to the $6.6 million in restitution that was secured by the New Mexico Department of Justice’s (NMDOJ) Medicaid Fraud and Elder Abuse Bureau in April.
Read the charging language carefully. Both defendants pled guilty earlier this year to felonies including Medicaid Fraud, Conspiracy to Commit Medicaid Fraud, 35 counts of Theft of Identity and Theft of Identity Conspiracy. Thirty-five identity counts. Those were children.
Why DOJ and HHS-OIG are treating this pattern as a priority
The Kee case is not a one-off. It sits inside an enforcement wave that behavioral health operators should be tracking quarterly. The Department of Justice recently announced the largest National Health Care Fraud Takedown in its history, charging 455 defendants, including 90 physicians and other licensed medical professionals, in schemes involving more than $6.5 billion in alleged false claims. This coordinated enforcement action spans 56 federal districts and 45 states and territories, and reflects significant coordination among DOJ, HHS-OIG, CMS, DEA, state Medicaid Fraud Control Units, and international law enforcement partners.
Behavioral health is squarely in scope. DOJ described the operation as including the largest participation by state Medicaid Fraud Control Units in the history of the annual takedown, and many of the charged schemes involved Medicaid managed care, behavioral health services, personal care services, and pharmacy fraud. The Maryland attorney general recently sentenced another mother-daughter operation running two behavioral health companies, where the defendants accomplished the fraud by systematically forging signatures, composing fake patient records, and stealing the identities of unwitting healthcare providers and Medicaid recipients alike, causing Maryland Medicaid to reimburse $3,672,958.66 for services that were not provided.
The receipts on the federal side are stark. The Fall 2024 Semiannual Report to Congress highlights over $7 billion in expected recoveries and receivables resulting from HHS-OIG investigations and audits conducted during fiscal year 2024. In FY 2024, HHS-OIG reported 1,548 criminal and civil enforcement actions and excluded 3,234 individuals and entities from participation in Federal health care programs. If your compliance officer is not screening against that exclusion list every month, you will hire an excluded provider. It is arithmetic.
Attorney General Raúl Torrez put the operator message plainly in the New Mexico announcement: “Today’s sentences reflect the seriousness of what these defendants did and the harm they caused to children, families, and New Mexico taxpayers.”
The three fraud vectors and the artifacts that stop them
Map each vector in the Kee indictment to a specific control document your COO owns this quarter.
Vector 1: stolen minor PII used as a billable beneficiary. The Kee operation operated Kids in Need of Support Services (KISS), a nonprofit afterschool program in Silver City, and fraudulently billed for services that were never rendered while illegally using both adult and children’s social security numbers, falsely representing psychological disorders and more. The control is a guardian identity attestation form executed at intake, cross-verified against the state Medicaid eligibility file, with the guardian’s government ID scanned into the chart. No signed attestation, no service delivery, no billable encounter. Period.
Vector 2: fabricated diagnosis codes to justify a service line. ICD-10 F-codes for mood and anxiety disorders are easy to type and hard to disprove without corroborating clinical documentation. Require a licensed clinician’s signed diagnostic assessment, dated the same day as the diagnosis, with a differential and clinical rationale in the note. Random monthly audits should pull ten charts and confirm the note supports every F-code billed.
Vector 3: phantom encounters and forged signatures. In the Maryland case, investigators found the operation during the investigation, state officials searched email records, cellphones and data storage accounts, revealing a system for generating fake patient records. Officials also talked to several Medicaid recipients who did not know about the companies billed under their names. The control is a two-signature attendance protocol at each visit (client or guardian plus rendering clinician) and a monthly reconciliation of billed units against EHR audit-trail timestamps. If the timestamps do not exist, the claim does not go out.
Personal liability, LEIE cadence, and the 60-day clock
Owners and executive directors ask me whether they can be personally reached when a billing clerk or a mid-level manager runs a scheme without their knowledge. The honest answer: yes, more often than you think. The False Claims Act reaches anyone who “knowingly” causes a false claim, and “knowingly” includes reckless disregard and deliberate ignorance. Weak intake controls, no LEIE screening, and no diagnosis audit cadence are exactly the facts DOJ uses to argue reckless disregard.
Three governance actions to put in board minutes this quarter:
- Monthly LEIE and SAM.gov screening of every W-2, 1099, and vendor with patient contact or billing access. Print the results, date them, file them. HHS-OIG excluded thousands of individuals last year alone. The HHS-OIG General Compliance Program Guidance (November 2023) lays out the expected structure.
- A written 60-day overpayment refund protocol under Section 1128J(d) of the Social Security Act. From the moment the compliance officer identifies a credible overpayment, the clock starts. Escalation path, dollar quantification method, and return mechanism to the state Medicaid agency must be documented.
- Quarterly diagnosis substantiation audit owned by the medical director, not the billing manager. Ten charts, all F-codes, all sessions, all signatures. Report to the board.
Do not skip the mandatory reporting question. Under 42 CFR Part 455, state Medicaid agencies impose provider disclosure and reporting obligations, and most state Medicaid provider agreements make the operator affirmatively report credible allegations of fraud within a defined window. Know your state’s window before you need it.
Frequently asked questions
What identity verification steps satisfy Medicaid program integrity expectations at intake for minor beneficiaries?
At minimum: government-issued guardian ID scanned into the chart, a signed guardian consent naming the minor and listing the services authorized, cross-verification of the minor’s Medicaid ID against the state eligibility system on the date of service, and a two-signature attendance record. Store the artifacts inside the EHR, not on a shared drive.
Can an owner or executive director be held personally liable when staff fabricate diagnoses?
Yes. The False Claims Act reaches reckless disregard and deliberate ignorance, and DOJ regularly names individual executives in civil complaints and criminal informations. The Silver City and Parkville cases both charged the operating principals, not just the billing clerks. Weak controls are the evidence.
How often must we screen employees and contractors against the OIG LEIE and SAM.gov?
Monthly is the operator standard and the expectation reflected in the HHS-OIG General Compliance Program Guidance. Screen at hire, screen at contract execution, then monthly for the duration of the relationship. Retain dated screenshots.
What documentation does DOJ typically use to prove a diagnosis was fabricated?
Prosecutors work from EHR audit trails, clinician calendars, session notes (or the absence of them), interviews with the named beneficiary or guardian, and cross-references between billed CPT codes and clinician credentials on the date of service. In the Maryland case, the two defrauded Medicaid by forging signatures, creating fake patient records and stealing the identities of healthcare providers and recipients, prompting Medicaid to reimburse $3.6 million for services that were not provided. The forged signatures were the proof.
What are the mandatory reporting obligations if we discover suspected internal Medicaid fraud?
Two tracks run in parallel. First, the 60-day overpayment refund obligation under Section 1128J(d) of the Social Security Act once the amount is quantified. Second, most state Medicaid provider agreements require notification to the state Medicaid Fraud Control Unit or program integrity office within a defined window. Route both through the compliance officer with legal counsel involved from day one.
References
- New Mexico Department of Justice: Mother-Daughter Duo Sentenced in $6.6 Million Medicaid Fraud and Child Identity Theft Scheme
- HHS-OIG Enforcement Notice: $6.6 Million Restitution in Silver City Afterschool Program Case
- HHS-OIG Fall 2024 Semiannual Report to Congress: $7.13 Billion in Expected Recoveries
- Maryland Office of the Attorney General: Parkville Mother and Daughter Sentenced in $3.6 Million Medicaid Fraud Scheme
- U.S. Department of Justice Criminal Division: National Health Care Fraud Enforcement Actions
- HHS-OIG General Compliance Program Guidance (November 2023)
- 42 CFR Part 455: Medicaid Program Integrity