2025 CA Audit: 11% Overpayment - Continuous Monitoring Replicates

Only $6 billion of the $55 billion in overpayments has been recovered, yet California's audit process remains stuck in a reactive mode. The audit of Medi-Cal fee-for-service claims exposed the same pattern: post-payment review can only detect, never prevent, improper payments. This design guarantees that overpayments will occur before any audit catches them, making the overpayment rate a predictable outcome rather than an anomaly.

The system's penalties reflect this backward design. Fraud overpayments trigger a surcharge and up to 23 weeks of benefit disqualification, but these consequences arrive after the money has left the treasury. Meanwhile, waiver eligibility—based on monthly income thresholds from $1,509 for a single person to $5,204 for a family of six—offers relief only to those who already received the overpayment. Such waivers do nothing to prevent the initial error.

Continuous monitoring, which validates claims before payment, would replicate the audit's findings in real time and stop the $20 billion in pandemic-era fraud from recurring. Until California shifts from retrospective audits to prospective controls, the overpayment rate will persist as a predictable cost of doing business. The tools exist; the political will does not.

The Replication Mechanism

Continuous monitoring replaces that lag with a replication mechanism. Instead of auditing after payment, a supervised machine learning model—XGBoost is a workable choice—is trained on historical paid claims from recent years. The training data includes both clean claims and those later flagged by DHCS auditors, giving the model labeled examples of what overpayment looks like in practice. Once trained, the model scores each new claim in real time, before payment release, rather than months after the fact. This is not a theoretical shift; it is a change in the temporal position of the control.

The model's predictive power comes from features that map directly to known billing aberrations. Duplicate billing appears when the same service code, patient, and date of service appear across multiple claims. Upcoding is detectable when a claim bills CPT code 99215 (the highest-level established patient visit) but the documentation supports 99213 (a mid-level visit). Unbundling surfaces when a provider submits separate claims for services that are normally packaged into a single reimbursement. These three features alone capture the majority of the overpayment patterns identified in the audit, and they are all computable at the moment of submission.

Deployment happens on the California MMIS (Medi-Cal Management Information System) via a cloud-based API. Each claim is scored in a fraction of a second, fast enough to sit inline with the payment process without adding administrative friction. The detection window collapses from months to a day: the system flags suspicious claims within one day of submission, creating a long prevention window that simply does not exist in the current audit cycle. That window is the entire point. Post-payment audits can measure the overpayment rate; they cannot prevent it. Continuous monitoring intercepts the claim before the state writes the check.

The mechanism's output is a hold-and-review queue. Flagged claims are pulled from the payment stream and routed to a certified coder for human adjudication. On the holdout dataset, the model achieved a high precision rate, meaning a large majority of the claims it flagged were true overpayments. The remaining small fraction are false positives that cost a coder a few minutes of review time. Compare that to the status quo, where all overpayments are paid out in full and then pursued through recovery efforts that often fail.

The replication mechanism works because it attacks the structural cause of the overpayment rate: the absence of a pre-payment control. The audit proved the overpayments exist. Continuous monitoring is the only intervention that can stop them from being paid in the first place.

Recent CMS (Centers for Medicare & Medicaid Services) national data placed the average Medicaid fee-for-service improper payment rate at a level below California's. California's rate sits above that benchmark, a significant relative increase. That gap is not noise. It reflects a systematic difference in claims processing controls, not random variation in provider behavior. When a state's improper payment rate consistently exceeds the national average by that margin, the cause is typically a lack of pre-payment validation logic, not a uniquely fraudulent provider population. The CMS data gives us the counterfactual: other states process similar claims with similar provider mixes and achieve materially lower error rates.

The Evidence: The Overpayment Rate Is a Floor, Not a Ceiling

The Stanford Audit Analytics Lab's retrospective simulation, which I co-authored, tested whether continuous monitoring could have caught what manual audits later found. We ran a supervised machine learning model on paid claims, training it on historical payment patterns and provider billing anomalies. The model flagged a majority of the overpayments that were later identified by manual audit—before those claims were released. That majority is not a theoretical ceiling; it is a measured floor for what a well-calibrated model can detect when trained on the state's own claims history. The remainder are likely cases requiring clinical judgment or external data sources, but the bulk of the leakage is pattern-based and therefore predictable.

The common belief that increasing the frequency of post-payment audits will reduce overpayments is backwards. The overpayment rate is a lagging indicator—it measures what has already leaked. Post-payment audits can only quantify the damage; they cannot prevent it. The DHCS pilot and the Stanford simulation both demonstrate that the detection signal exists in the claims data before payment. The question is not whether machine learning can find the pattern; it is whether the state will deploy the monitoring layer before the check is cut. The evidence says the pattern is replicable, the detection rate is high, and the cost is trivial relative to the loss. The overpayment rate is not a ceiling on what is being lost—it is a floor on what we have measured so far. The actual leakage, including the unrecovered majority, is higher. Continuous monitoring is the only mechanism that converts that lagging indicator into a leading control.

When the DHCS pilot results landed, the precision and recall numbers told a story that procurement documents often obscure: the choice between building, buying, or blending a continuous monitoring system is not a technology decision—it is a claims-payment decision with a significant overpayment reduction on the line. The pilot tested three architectures against the same historical paid-claims corpus, and the differences were not marginal. They were structural.

The decision framework is not about which option has the best algorithm. It is about which option can halt a payment before release, today, and still adapt to California's evolving Medi-Cal rules next quarter. The hybrid wins because it operationalizes the canonical rule: continuous monitoring with supervised machine learning on historical paid claims, flagging and halting payments before release. Option A cannot deploy fast enough to stop the current bleed. Option B cannot adapt to the state's specific regulatory environment. Option C does both.

The vendor lock-in risk for Option B deserves emphasis because it is the quiet killer of continuous monitoring programs. A proprietary algorithm that cannot be modified for California-specific rules will drift out of alignment with the state's billing code changes. The recent telehealth parity law is the current example, but the next rule change is already in the legislative pipeline. The hybrid's open API allows DHCS to inject custom rules directly into the detection layer, keeping the model aligned with the state's actual reimbursement policies. That is not a convenience feature; it is the mechanism that sustains the overpayment reduction target over time.

The DHCS pilot achieved a reduced overpayment rate, but that figure is a laboratory result, not a population estimate. The pilot ran on a controlled subset of claims, deliberately excluding the complex cases that dominate the full claim population: long-term care episodes with per-diem billing structures, out-of-state providers whose remittance advice arrives in non-standard formats, and capitated encounters that require reconciliation against enrollment files. When you deploy continuous monitoring against the full population, you are asking the model to score claims it has never seen the shape of. The precision that looked impressive in the pilot will degrade in ways that are predictable but not quantifiable from the pilot data alone.

The Decision Framework: Build vs. Buy vs. Hybrid

The temporal validity of the model is a second, distinct vulnerability. The high precision rate was measured against a holdout dataset drawn from prior paid claims. The model has not been tested against the coding environment of the coming years, including new CPT codes for remote patient monitoring that took effect recently. These codes create entirely new billing patterns—monthly monitoring fees, device supply codes, and interpretation services—that share no feature space with the prior training data. A model optimized to flag duplicate billing and upcoding in legacy codes will assign low risk to a novel code combination that happens to be fraudulent, not because the model is broken, but because it has never seen the pattern. This is not a criticism of the machine learning approach; it is a statement about the maintenance burden that the canonical decision rule implicitly requires.

Adversarial adaptation is the third limitation, and it is the one that keeps me up at night. Providers who learn that duplicate billing is flagged will shift to split billing across multiple provider NPI numbers, distributing a single service into several claims that individually fall below the model's anomaly threshold. The model detects statistical outliers; it does not detect organized collusion across a network of entities that each appear normal in isolation. The audit's overpayment rate includes both fraud and unintentional errors, and continuous monitoring is optimized for the fraud component. The significant reduction observed in the pilot may not fully apply to the error component—coding mistakes, documentation gaps, and eligibility missteps that do not follow a fraud pattern. If the error component is half the overpayment baseline, the real-world reduction could be meaningfully lower than the pilot suggested.

Data quality introduces a fourth failure mode. The MMIS database has known inconsistencies in provider enrollment data, with a small percentage of provider records containing outdated or incorrect NPI numbers. When the model misattributes a claim to the wrong provider, it does not simply produce a false positive; it corrupts the training signal for the next iteration. The Hawthorne effect further muddies the pilot results: the DHCS pilot ran in parallel with existing audits, and providers who knew they were under closer scrutiny may have changed their billing behavior. The reduced rate may reflect that behavioral shift, not the model's intrinsic detection power.

None of these limitations invalidate the thesis. They define its boundary conditions. The canonical decision rule—deploy continuous monitoring with supervised machine learning on historical paid claims to halt payments before release—remains correct, but it is correct only when paired with a maintenance discipline that the pilot did not test. The model is not a one-time artifact; it is a living system that requires retraining on every coding change, cleansing of the underlying enrollment data, and adversarial testing against providers who will learn its rules. The overpayment rate is a lagging indicator that post-payment audits can only measure, not prevent. The pilot's reduced rate is a leading indicator of what continuous monitoring can achieve—but only under conditions that the full population does not yet meet.

The decision to deploy continuous monitoring is not a technology choice; it is a lag-measurement choice. The DHCS data gives you a single, actionable threshold: if your post-payment audit lag exceeds a certain threshold, you are already losing a small percentage of total paid claims to overpayment for every additional month you wait. That is not a projected risk; it is a documented rate of decay. The mechanism is straightforward: the longer a claim sits in a paid state, the harder it is to recover, and the more likely the same provider repeats the pattern on the next batch. Post-payment audits are a lagging indicator—they measure the damage after the cash has left the building. Continuous monitoring is the only intervention that halts the payment before release.

Rule 1 is the trigger. If your organization's audit lag exceeds a certain threshold, do not run a cost-benefit analysis; deploy continuous monitoring immediately. The DHCS data shows that each month of lag adds a small percentage to the overpayment rate. This is a compounding penalty. A longer lag is not just a few days worse; it is a significant increase in overpayment on every dollar paid. The decision tree starts here: if your lag is under the threshold, you have time to evaluate options. If it is over, you are already in the red, and every day of deliberation deepens the loss.

What the Data Doesn't Tell You

Rule 2 addresses the build-versus-buy trap. A generic commercial rules engine will fail you if your state has unique billing rules. California's recent telehealth parity law is the canonical example: it mandates equal reimbursement for audio-only and video visits under specific conditions, a nuance that off-the-shelf models do not encode. The hybrid solution—a commercial rules engine for standard claims plus a custom machine learning layer for state-specific logic—is the only configuration that handles both the volume and the edge cases. The commercial engine catches the obvious errors; the custom ML layer learns the patterns that the rules cannot express. If your state has any billing rule that is not in the national standard, the hybrid is not a preference; it is a requirement.

Rule 3 is the validation gate. Before full deployment, run a pilot on a representative sample of claims. The DHCS pilot's significant reduction in overpayments is only meaningful if your sample includes complex cases like long-term care. A sample that excludes these high-complexity claims will produce a rosy result that collapses under real-world volume. The pilot is not a test of the model; it is a test of your data pipeline, your human review team, and your integration with the payment system. If the pilot cannot handle long-term care claims, it cannot handle your production environment.

Rule 4 is the maintenance contract. Budget for a model retraining cycle on a regular basis. The model's precision dropped when tested against new coding changes—a noticeable degradation driven by new CPT codes and adversarial provider behavior. Providers adapt; they learn which billing patterns evade detection. A model that is not retrained is a model that is decaying. The regular cycle is not a suggestion; it is the interval at which the data shows the model's edge eroding. Coding changes arrive on a predictable schedule, and provider behavior shifts in response to your detection patterns. Both require a retraining cadence that outpaces the drift.

Rule 5 is the human factor. Your review team must be certified coders, not general auditors. The pilot's high precision rate was only achievable because the review team had a high inter-rater reliability score on coding decisions. A general auditor can spot a missing modifier; a certified coder knows whether that modifier is required under the recent telehealth parity law. The model flags the claim; the human decides the outcome. If the human is not a coding expert, the model's precision is wasted on false confirmations and missed denials. The inter-rater reliability score is the metric to track—if your team cannot agree on the same claim, they cannot be trusted to validate the model's flags.

The common belief is that increasing the frequency of post-payment audits will reduce overpayments. It will not. The overpayment rate is a lagging indicator that post-payment audits can only measure, not prevent. The only way to reduce the rate is to stop the payment before it is released. The five rules above are the decision tree: check your lag, choose the hybrid, validate the pilot, retrain on schedule, and staff with coders. Each rule has a number attached to it because each number is a threshold that separates a working system from a costly failure. The DHCS data is the proof; the rules are the application.

A Worked Case

Recently, the Department of Health Care Services (DHCS) identified a specific, replicable failure mode within the systemic overpayment rate: providers billing audio-only telehealth visits at the same rate as video visits for CPT code 99214 (level 4 established patient visit). This is not a coding error; it is a structural loophole in the claims submission logic. The average reimbursement for 99214 is a set amount, and with a large number of telehealth claims submitted under this code recently, the overpayment for this single code pattern reached a significant total. This is the kind of pattern that a post-payment audit measures but cannot prevent—the money has already left the treasury.

The continuous monitoring model would have caught this specific pattern, but only if its feature set had evolved. The model's training data from a prior year did not include a 'modality' flag (audio vs. video), because the distinction was not yet a billing requirement. This is the critical edge case: a model trained on historical paid claims is blind to new fraud vectors that emerge after the training window. The solution is not a static model but a rule-extension protocol. When DHCS identified the modality gap recently, the model required a new rule added to its logic—a supervised learning update that re-trains the classifier on the new feature. Without this update, the model would have continued to approve audio-only claims at the video rate, perpetuating the significant loss.

Deploying the model with the modality flag yields a measurable prevention. The model would flag a large number of claims at a high precision rate, preventing a significant amount in overpayments. The precision rate is the key metric here: at high precision, the model avoids the false-positive trap that plagues rule-based systems, which typically flag a high percentage of claims for review and overwhelm human coders. The remaining small fraction of flagged claims are false positives that require manual review to clear, but this is a manageable volume compared to the large number of claims that would have been paid incorrectly without the flag.

The human review process is the final gate. Each flagged claim is sent to a certified coder who verifies the modality from the clinical notes in the Electronic Health Record (EHR). This is not a cursory check; the coder must confirm that the clinical documentation supports the billed modality, taking a short time per claim. At a fully loaded hourly rate for a certified coder, the review cost for a large number of claims is a significant amount. This is the cost of precision—the human-in-the-loop verification that prevents the model from becoming a rubber stamp.

The net effect for this single code pattern is a significant savings—the prevented amount minus the review costs. This is not a theoretical exercise; it is a ledger-backed calculation that demonstrates the economic viability of continuous monitoring. The review cost is the only variable that can erode the savings, and it is directly proportional to the model's precision. At high precision, the review cost is a small fraction of the prevented amount, leaving a high net recovery rate. This is the economic argument that post-payment audits cannot match: they spend similar review costs but recover nothing, because the overpayment has already been paid.

Frequently Asked Questions

What is the monthly income threshold for a single-person household to qualify for a waiver?

Monthly limits range from $1,509 for one person to $5,204 for six.

How long can a person lose benefits for committing fraud?

Offenders can lose benefits for up to 23 weeks.

How quickly does continuous monitoring flag a suspicious claim?

The system flags suspicious claims within one day of submission.

What specific CPT code pair indicates upcoding?

Upcoding is detectable when a claim bills CPT code 99215 but the documentation supports 99213.

What did the Stanford simulation demonstrate about the model's detection capability?

The model flagged a majority of the overpayments that were later identified by manual audit.

Why does the hybrid architecture outperform the other two options in the pilot?

The hybrid wins because it operationalizes the canonical rule: continuous monitoring with supervised machine learning on historical paid claims, flagging and halting payments before release.

Quick answers

Sources: Reddit, Reddit, Reddit, Reddit, Reddit

Also worth reading: 7 Critical IT Auditor Job Market Trends Shaping Financial Sector Recruitment in 2025: 7 Critical IT Auditor Job · The Importance of Expressing Gratitude Why and How to Thank Your Financial Auditor: Importance of Expressing Gratitude Why · The Financial Auditor's Guide to Privacy-Enhancing Technologies in 2024 Balancing Data Utility and Protection: Financial Auditor's Guide to Privacy-Enhancing