Ghost providers: verifying the human behind an NPI
The June 2026 National Health Care Fraud Takedown charged 455 defendants. A recurring element across schemes of this kind is not a fabricated provider but a real one — whose identifier was stolen, rented, or used without their knowledge.
How do you verify the human behind an NPI?
At enrolment, once, and then never again. Claims carry a provider number, and schemes bill under stolen or rented provider identities for services never rendered. Credentialing verifies the provider exists and is qualified; nothing connects a specific claim to a specific clinician having been present.
- A claim identifies the rendering provider by number. Attribution is an assertion by the billing entity, and detection relies on statistical outliers that sophisticated schemes avoid.
- Time to detection dominates loss magnitude far more than scheme frequency does.
- Clinician burden is the binding constraint on any attestation model, and it has to be measured rather than dismissed.
Part of Insurance and payer identity
The clinician who did not know
A physician in a mid-sized practice received a letter from a Medicare contractor about billing patterns under her NPI in a state she had never practised in. She had not moved, had not added a location, and had not seen the patients.
Her identifier had been used by an entity she had no relationship with. Untangling it took eleven months, involved a lawyer, and affected her ability to enrol with other payers while the matter was open.
She was the victim, and for most of those eleven months she was treated as a suspect.
Why the identifier is the weak point
A National Provider Identifier is a public identifier. It appears in directories, on claims, in credentialing documents and in referral correspondence. It was designed as an identifier, not a secret, and that design is correct.
The problem is that the claims standard treats the identifier as sufficient to attribute a service. The rendering provider field says who performed the service; nothing verifies that they did.
| What is verified | When | By whom |
|---|---|---|
| Provider identity and licensure | At enrolment | Payer credentialing |
| Provider remains licensed | At revalidation, periodically | Payer |
| Provider rendered this service | Never | Nobody |
Detection and its limits
Program integrity analytics look for outliers: impossible service volumes, geographic implausibility, billing patterns inconsistent with specialty. These work, and they have produced substantial recoveries.
They work against schemes that generate outliers. A scheme designed by someone who has read the same literature bills within normal parameters, across multiple identifiers, at volumes that do not flag. The detection floor is set by the sophistication of the operator, and the operators have improved.
Time to detection is the real variable
Loss magnitude in these schemes is roughly the product of billing rate and duration. Billing rate is constrained by the need to avoid outlier detection. Duration is constrained only by when someone notices.
That makes detection interval the dominant term, and it is the one least tracked. A payer that reduces median time-to-detection from nine months to four has halved its loss without detecting a single additional scheme.
The Rendering Attestation
An episode-level statement, signed by the clinician who rendered the service:
{
"type": "manav-stmt/1",
"action": "rendering_attestation",
"render": [
"Provider: [name, NPI]",
"Service date: [date] Location: [facility, address]",
"Patient: [identifier]",
"Services: [codes, descriptions]",
"Rendered by: [self | under supervision, supervising NPI]"
],
"clinician": "[credential assertion]"
}A claim submitted without a corresponding attestation, for a service category where attestation is required, is visible immediately rather than in nine months.
The burden problem, measured rather than waved away
Clinician administrative burden is a genuine crisis, not a talking point. Any proposal adding a per-encounter action must be measured against it honestly.
- Measure the gesture: seconds per attestation, on the device clinicians actually carry, in a clinical setting.
- Multiply by encounters per clinician per day. A one-second gesture across forty encounters is forty seconds; across two hundred it is a different conversation.
- Compare against existing documentation burden. If it is a rounding error against note-writing, say so. If it is not, scope harder.
- Scope to service categories where scheme risk concentrates — durable medical equipment, certain diagnostic services, telehealth in high-risk categories — rather than to all care.
Attestation on every encounter in primary care would be indefensible. Attestation on the service lines that appear repeatedly in enforcement actions is a different and much smaller ask.
Supervision and incident-to
A design that ignores supervised and incident-to arrangements would be unusable. The attestation must express them: the rendering party signs, referencing the supervising provider's delegation, which the supervising provider issued.
That is more honest than the current state, where supervision is asserted in a claim modifier and verified by nobody.
Who benefits most
The clinician whose identifier is misused. Today they have no way to demonstrate they did not render a service. The absence of their attestation is evidence, and it converts an eleven-month ordeal into a query.
Two distinct schemes, one gap
| Scheme | Provider's involvement | Detection |
|---|---|---|
| Stolen NPI | None — they are a victim | Provider complaint, eventually |
| Rented NPI | Complicit | Statistical only |
| Ghost clinic | Fabricated or coerced provider | Site visit, rarely |
Both are answered by the same missing artefact: evidence that a specific clinician was present for a specific encounter. Attestation at the encounter also protects the honest provider whose number was stolen, which is why it is not purely a payer control.
Objections and honest limits
“Analytics catch billing outliers.” After a pattern forms, and against a scheme that paces itself below the outlier threshold. Statistical detection is the right tool for volume and the wrong one for the first claims.
“Providers will not sign every encounter.” They already sign the clinical record. The change is binding that signature to the claim rather than treating the two as unrelated records.
Binding the encounter to the claim
- Attest at the encounter, not at credentialing. Credentialing is a one-time check of a durable fact.
- Bind the clinician's signature to the encounter record. Which most systems already capture.
- Carry that binding into the claim. One field, linking claim to attestation.
- Give providers a way to see claims under their NPI. The stolen-identity case is solved by visibility.
Terms used here
- NPI
- National Provider Identifier — a durable number identifying a provider on claims.
- Credentialing
- Verifying a provider's licence, training and history, performed at enrolment and periodically.
- Phantom billing
- Claims for services that were never rendered.
Frequently asked questions
Is this feasible in high-volume primary care? Not on every encounter, and the article does not propose that. Scope to service categories with concentrated scheme risk.
How does it handle supervised services? The rendering party signs under a delegation from the supervising provider, which makes supervision an artefact rather than a modifier.
Does this require changes to claims standards? No. The attestation travels alongside rather than inside the claim, and the payer correlates.
What about telehealth across state lines? The attestation carries the service location and the clinician's credential, which is more information than a claim currently carries about where care was delivered.
What does credentialing establish? That the provider exists and is qualified. It is a one-time check of a durable fact and says nothing about any specific claim.
Does this help honest providers? Yes. The stolen-NPI case is a provider being victimised, and attestation plus visibility into claims under their number is their protection too.
Why aren't analytics enough? They detect patterns after they form, against schemes that pace themselves below the outlier threshold.
Where this fits in Manav
Manav binds the authorising person to the exact change or payout instruction, and produces a receipt a carrier, a beneficiary or a court can verify without calling the issuer.
Sources and further reading
- HHS Office of Inspector General enforcement
- CMS — Medicare provider enrollment
- NAIC — property and casualty claims resources
- Published program integrity analytics methodology and enforcement case studies.