My VisualA  |   Newsletter  |   Partners         Welcome
Technical Articles
Knowledge Base

Link Charts
V5I1206 - Financial Intelligence Units (FIUs)
V5I0806 - Money Laundering: The Exception
V5I0406 - Network Monitoring
V5I0106 - Filing Compliance
V4I0405 - Terrorism Financing
V4I0305 - Telephone Toll Analysis
V4I0205 - Wire Transfers for Alien Smuggling
V4I0105 - Bust-out Schemes
V3I1204 - Structuring Financial Transactions
V3I1104 - Finished Intelligence (Proactive Analysis)
V3I1004 - Exposing Mortgage Fraud
V3I0904 - MIND Lab Integrates Course Data
V3I0804 - Suspicious SAR-MSB Filing Data
V3I0704 - Integrating Multiple Data Sources
V3I0604 - Analyzing Airline Profitability
V3I0504 - Corporate Fraud
V3I0404 - Employee Master File Analysis
V3I0304 - Prescription Fraud Patterns
V3I0204 - Social Network Analysis (SNA)
V3I0104 - Fraud Detection System (FDS)
V2I1203 - Integration with our Digital Information Gateway
V2I1103 - Financial Transactions Investigation
V2I1003 - Compliance Analysis
V2I0903 - Medical Insurance Claims Analysis
V2I0803 - Corporate Fraud Investigation
V2I0703 - Possible Domestic Terrorist Shooting
V2I0603 - Suspicious Activity Report (SAR) Filing
V2I0503 - Detecting Financial Crimes
V2I0403 - "Referential" Data Sources
V2I0303 - Proactive Analyses
V2I0203 - Transactional Activities
V2I0103 - Temporal Grid

White Papers

Frequently Asked Questions


Referenced in our Newsletter Volume 2, Issue 9 - September 2003

Medical Insurance Claims Analysis
This month's Link Chart of the Month discusses medical insurance claims analysis. This is sample data that will demonstrate the results one can expect to see when using a simple model for medical insurance claims.

The model we are using is shown in Figure 1. Although this sample model is quite simple, a production model would probably include other identifiers (SSN, for instance) and might include additional objects that could serve to provide additional trends. For instance, including diagnostic and/or treatment codes would allow an analyst to detect whether or not certain treatments are preferred by fraudsters.

Our simple model includes claims and information related to each claim. Each CLAIM object is identified (keyed) by an ID generated by the source claims management system. The PHYSICIAN and PATIENT objects are identified by their names. The PATIENT_PHONE object is keyed on the phone number itself and the PATIENT_ADDRESS object uses the Street, City, State and Zip Code as a composite key.

In our model, we will be looking for patients that are sharing either phone numbers or addresses. We might expect to see this for spouses and dependents, but in general, each individual patient should have a single address and, perhaps, two or three phones (home, work and mobile).

To begin our analysis, we queried our database for a particular date range and region to make the quantity of data manageable. The result is shown in Figure 2.

As you can see, we have found a number of networks. In this Figure, each network is laid out with a PHYSICIAN object to the far left of each group, a CLAIM object in the second column followed by the PATIENT object, and finally, the PATIENT_PHONE and PATIENT_ADDRESS objects on the right.

Figure 3 (below) shows a more detailed illustration of this arrangement.

If we examine the large network diagram, the two networks in the upper-left display interesting structures. In Figure 4, we zoomed in on the six networks in the upper left.

The entire bottom row and the network in the upper-right show normal structures. In each network we have a single physician connected to claims that are, in turn, connected to patients that all have single phones and addresses. Further, none of these patients has more than a single claim. These networks are normal and show no indication of fraudulent activity.

The top-center network shows some interesting crossed lines. Closer examination of this network reveals that these crossed lines are due to patients having filed multiple claims for the period we are investigating. The number of claims is low, and all of the patients have a single phone and address. This network warrants no further investigation.

This brings us to the top-left network. This network shows a very interesting structure. We can see from this structure that some of the patients are connected to more than one phone or address object. This is indicated by the fifth and sixth columns to the right of the network. Additionally, some of the patients have submitted multiple claims for the analysis period. We need to take a closer look at this network.

In Figure 5, we have zoomed in on the network and have rearranged the objects to make a little more sense. We can clearly see four distinct network structures. Each of these structures is detailed below. In the discussion that follows, the PHYSICIAN object is moved closer to the section under discussion and the other sections of the network are hidden for clarity.

The upper section of this network, magnified in Figure 6, is actually a normal network, showing a number of patients who are connected to a single claim and just one phone and/or address. We can discount this section of the network from our analysis.

The next section of the network, magnified in Figure 7, is also indicative of normal activity and shows no indication of fraud. The distinguishing characteristic in this group is that the patients have submitted multiple claims for the period. Since the number of claims is low, we need spend no further time on this section of our network.

The section of our network shown in Figure 8 shows a number of PATIENT objects that share a single PATIENT_PHONE object. Though this could be indicative of fraud, it could also be due to data entry errors. It could also be a large family that uses the same phone number in their patient records.

However, in this case, drilling down on the objects shows that the names are not at all similar. This would suggest that further investigation is in order for this section of the network.

We come now to the final section of our network diagram. In Figure 9 we see a group of patients that share an address. The possible explanations for this condition are the same as with phone numbers: name misspellings or these are members of the same family.
In this case, when we examine this group in detail, we find that these are college-aged patients. In fact, they appear to belong to the same fraternity and live together in the same residence, thus explaining the shared address. This reminds us that due diligence is required to ascertain the true nature of the data.

This leaves us with the section of our network shown in Figure 8. What might we do to extend our analysis? Following are just a few suggestions.

Additional steps might include deleting all of the objects from the full network diagram that are not shown in Figure 8. This will clean up the diagram and allow us to focus on the objects of interest. Next, we could expand our analysis on this network by executing single-level data walks on the objects displayed. This would add additional objects to the diagram for these patients and for this physician.

After each data walk, the objects returned can to be examined to determine if they contribute to our analysis, or if they are "noise" objects. "Noise" objects should be deleted.

Additional analysis activities might also include walking these objects to other data sources (models) or we might plot the objects on a temporal matrix to look for repeating temporal patterns. It may even be necessary to review the original source documentation for the objects in question.



If you found this link chart helpful you can subscribe to our newsletter to receive a new link chart each month in your email.