Case Study  ·  Power BI  ·  Healthcare Analytics

Medicaid Provider
Billing Anomaly
Detection

Which Medicaid providers bill unlike their peers, and how much of the program’s spend runs through them? From six public data sources, I built an unsupervised three-component risk ensemble to score 617,503 providers across $1.09 trillion in spend, with no labeled data, then checked it against the government’s own exclusion list. OIG-excluded providers were 2.2x as likely as the average provider to land in the top risk tiers. The 30,991 statistically flagged providers, 5% of the total, account for $362B, a third of the spend analyzed. Built with Claude via Model Context Protocol (MCP) and delivered as a 6-page Power BI report with a custom HTML visual layer.

Power BI DAX Unsupervised Anomaly Detection Healthcare Claims Analytics Geospatial Analysis (Azure Maps) Claude via MCP
$1.09T
Total Spend Analyzed
617.5K
Providers Scored
$362.2B
Flagged Spend
2.2x
OIG Validation Lift
▶  Live Interactive Report Powered by Microsoft Power BI · 6 pages
Load Interactive Report
Research project only · statistical outliers in billing behavior · does not indicate or allege fraud
01

What This Demonstrates

I started from the data and let the statistical patterns set the story. Working with Claude via Model Context Protocol (MCP), and with no prior healthcare background, I built an end-to-end analytics platform on $1.09T in Medicaid claims from a cold start.

What it proves: the ability to design a complex multi-source model, bring ML scoring into a BI layer, and build a custom visual design system from scratch, all built around a real end-user workflow.

02

The Challenge

Medicaid program integrity is a needle-in-a-haystack problem at massive scale. With 617,503 scored providers across 7 years of claims history, identifying which providers warrant closer review requires more than simple rules or threshold filters. The signal-to-noise ratio demands a statistical approach.

The goal was to build a system that could score every provider by anomaly risk, surface the specific behavioral patterns driving those scores, and present findings in a way that a non-technical reviewer could act on immediately, without needing a data science background to interpret the output.

Before any of that was possible, six heterogeneous public datasets that were never designed to work together had to be assembled into a single coherent analytical layer. That data integration problem was the real challenge.

●  Key Finding
The top 30,991 flagged providers (just 5.0% of all scored providers) account for $362.2 billion, or 33.1% of all spend in the dataset. Surfacing this concentration is the central analytical output of the platform.
03

Data Integration

Six public datasets (seven years of CMS Medicaid claims files, the NPI provider registry, HCPCS procedure codes, ZIP demographics, and geographic reference tables), each built for separate administrative purposes with different identifiers. Joining them into a single analytical layer required building the key bridges manually and resolving provider identity conflicts across address and name variants before any analysis could begin.

■  Source Data · 6 Datasets
CMS Medicaid (7 annual releases), NPPES NPI Provider Registry, HCPCS procedure code reference files, Census ACS ZIP demographics, HUD/USPS ZIP crosswalk, and state/county reference tables.
■  Python Pipeline
Merges and normalizes seven annual CMS release files, resolves provider identity conflicts, and computes, across each provider's full claims history, the behavioral features that drive risk scoring: growth rates, billing volatility, concentration ratios, gap indicators, and spend patterns.
■  Semantic Model
A purpose-built analytical layer spanning provider billing facts, longitudinal year-over-year records, ML score outputs, geographic risk layers, ZIP demographics, procedure code references, and plain-language risk summaries Claude wrote for 836 high-risk providers and 1,321 flagged addresses, joined into one model covering the full provider population.
■  Address-Level Risk Profiling
A separate profiling layer analyzes every shared billing address, flagging clusters of providers with coordinated entry patterns, sequential NPI registration, billing Gini concentration, and flag rates benchmarked against national, state, specialty, and ZIP averages. Surfaces address-level patterns that individual provider scoring alone would miss.
04

ML Scoring Pipeline

A 3-component unsupervised ensemble scores all 617,503 providers without training labels. Components run independently and combine via rank fusion, with no circular dependency and no ground truth required. OIG exclusion data used only as blind post-hoc validation.

●
Component 1: Behavioral Anomaly (40% weight). Isolation Forest + Local Outlier Factor run on 20 billing and Z-score features per provider. All features normalized within specialty peer groups, so a cardiologist is only compared to other cardiologists. Contamination rate 0.02. Flags providers statistically extreme relative to their specialty peers.
●
Component 2: Billing Exposure (25% weight). Severity-weighted spend concentration in 10 high-risk billing categories, amplified by a specialty mismatch multiplier. Critical categories apply a 5.5x multiplier when billed outside the provider's specialty. Flags concentrated spend in these categories regardless of behavioral anomaly score.
●
Component 3: Geographic Ring (35% weight). High-risk specialty density within 5 miles, normalized to urban/suburban/rural local baseline using BallTree spatial indexing. CBLOF geographic clustering adds a secondary anomaly signal. Flags dense local clusters of high-risk specialties, even when each provider bills within its own specialty.
05

Report Architecture

The platform is structured as six purpose-built pages, each answering a distinct analytical question at a different level of granularity, from the $1.09T program overview down to a single provider's behavioral fingerprint.

Page 01
Medicaid Provider Spending
Top-level program overview. KPI cards, risk tier concentration analysis, year-over-year trends, top states and procedure codes by elevated spend. Azure map with provider density overlay.
Page 02
Medicaid Anomaly Explorer
Risk tier deep-dive with spend concentration breakdowns. Unsupervised ensemble methodology documentation, OIG validation results (2.2x the random baseline), and full model performance disclosure.
Page 03
Provider Anomaly Map
Geographic anomaly view. Bubble map sized by anomaly score across all 617K scored providers. Filter by state, tier, and specialty. Surfaces geographic clustering patterns in billing behavior.
Page 04
Provider Explorer
Filterable table of all 617K providers. Sort by anomaly score, total spend, paid per claim, or years active. Filter by state, specialty, tier, and OIG status. Right-click any row to drill through to Provider Details.
Page 05
Provider Details (Drillthrough)
Individual provider investigation page. KPI benchmarks, anomaly score panel, behavioral signal breakdown, top HCPCS procedure analysis, spend trend, peer comparison matrix, and Azure Maps location panel. Fully dynamic across all 617K providers.
Page 06
About This Project
Project purpose, data sources, key assumptions, methodology limitations, tech stack, and full research disclaimer. Designed to give any reviewer complete context before acting on the analysis.
06

Technical Highlights

●
DAX measure layer. Dynamic HTML rendering, benchmark deviation calculations against national and state averages, multi-year trend logic, ML score interpretation, and conditional signal thresholds. Most measures go beyond simple aggregation: they are contextual, filter-aware, and drive a visual directly.
●
Custom HTML visual design system. Most of the front end is built in HTML/CSS rendered inside the HTML Content visual; the maps use Azure Maps. A consistent design token system replaces native cards and panels. KPI cards, panel headers, signal indicator rows, verdict bars, benchmark comparisons, all built as DAX measures that return complete HTML documents.
●
Fully dynamic drillthrough provider card. The Provider Detail page regenerates completely for any of the 617,503 scored NPIs. Signal indicators color red/orange/green against computed statistical thresholds. A verdict bar calculates concern level from the live signal count. HCPCS breakdown, spend trend, benchmark KPIs, and an Azure Maps location panel all update simultaneously from a single drillthrough click.
●
Dual-mode geographic visualization. Azure Maps integration with a provider-level bubble map sized by anomaly score and a ZIP-level choropleth risk layer. Both rendering modes are driven by computed map tables in the semantic model, not raw coordinate columns, enabling filter-context awareness across both views.
●
Measure architecture organized by function. Measures are structured across named display folders covering KPI cards, chart tooltips, drillthrough panels, map layers, geographic views, ML score outputs, methodology documentation, and header visuals. Each folder is its own self-contained system. The tooltip layer alone spans KPI tooltips, chart tooltips, map tooltips, and ZIP-level context panels, each rendering a complete HTML document on hover.
07

Tech Stack

Power BI Desktop
DAX
Power Query / M
Python
Claude via MCP
HTML / CSS
Azure Maps
08

Why This Matters

The Medicaid data is incidental. What this proves is the method.

From a cold start in an unfamiliar field, I fused six mismatched public datasets into a single source of truth, layered ML scoring on top, and shipped a decision-ready product, built end-to-end with Claude via MCP. I can do the same with your organization’s data: turn the systems that were never built to talk to each other into one coherent picture, and go beyond dashboards to the scoring and models that show you where to look, with no data-science team required.

Book a Call →