TOCA in Action
DOGE Medicaid Fraud Analysis

Why This Exists

On February 13, 2026, the Department of Government Efficiency (DOGE) and the Department of Health and Human Services released the largest open-source Medicaid billing dataset in history — 10.32 gigabytes of provider spending data spanning 2018–2024. They invited the public to help find fraud.

We accepted.

Not because we expect a bounty. Because this dataset is the first public test of whether the structure we spent fifteen years recovering from Aristotle's ἐπιστήμη can do what we claim it can: detect structural invalidity that conventional methods miss.

Within 48 hours, our methodology independently identified a provider that the Department of Justice had indicted for $10 million in Medicaid fraud — without knowing the indictment existed. We found it from the data alone. Eleven of the twelve co-clustered providers remain apparently uninvestigated.

This page documents everything: what we found, how we found it, and how you can apply the same methodology. We would rather everyone know how to detect fraud than somehow profit from this. That would be more profit than we would ever hope for.

The Methodology: TOCA

The Tetrahedral Ontological Closure Architecture applies four constraints derived from Aristotle's theory of complete knowing. When applied to billing data, these constraints test not whether a claim is statistically unusual, but whether it is structurally possible.

Conventional fraud detection sorts by billing volume and investigates the largest billers. This catches the obvious. TOCA catches the rest — because it tests against limits that cannot be explained by legitimate variance.

Learn the full Hexis architecture →

Methodology Validation

What We Did

Step 1: Acquisition

The dataset (10.32 GB CSV) was downloaded from the DOGE/HHS public data portal. Each row represents a provider-code-month combination with columns for NPI, HCPCS code, month, beneficiary count, claim count, and total paid amount.

Step 2: Segmentation

The dataset was processed in 50MB tranches (~1 million rows each), sorted by total payment descending. This allowed systematic coverage from highest-billing to lowest-billing providers, with the top tranches capturing the highest-exposure entities first.

Step 3: TOCA Battery

Each tranche was subjected to a four-constraint battery:

K-Constraint scan: Calculate claims-per-beneficiary ratios. Any ratio exceeding physical service limits (accounting for code-specific service durations) is flagged as impossible.

T-Constraint scan: Compare 2018–2019 baseline billing to 2023–2024 billing. Growth exceeding 500% with no corresponding market explanation is flagged.

R-Constraint scan: Identify single-code providers (billing only one HCPCS code with zero diversification) and taxonomy-code mismatches where available.

S-Constraint scan: Cross-reference flagged entities by geography, code family, growth timing, and entity creation date. Clusters of coordinated behavior are escalated.

Step 4: Validation

Every finding was cross-referenced against public DOJ records, state Medicaid fraud reports, and news sources to determine whether patterns had been previously identified.

Step 5: Documentation

Findings were catalogued in sequential submissions, each covering a batch of tranches. This page aggregates all submissions into a single reference.

The Six System-Level Patterns

These are not individual anomalies. These are structural features of the Medicaid billing system that suggest endemic, organized fraud operating at scale.

Select Findings: The Physically Impossible

These are not statistical outliers. These are billing volumes that violate the laws of physics.

Analysis Log

Each submission covers a batch of tranches. Analysis began February 15, 2026 and is ongoing.

Updates

How We Filed with the OIG — A Walkthrough

Transparency is a core principle of this project. Below is the exact text we submitted to the HHS Office of Inspector General Hotline on February 17, 2026. We publish this for three reasons: to document what was filed, to demonstrate that the filing actually occurred, and to give anyone who identifies additional anomalies a template for their own submission.

The OIG does not provide confirmation numbers or receipts for hotline complaints. This public record is our proof of filing.

Important: The OIG portal rejects special characters and emojis. All filed text uses plain ASCII only — double hyphens instead of dashes, spelled-out “dollars” and “percent,” and “and” instead of ampersands. If you use our template, maintain this convention.

Step 1: Category Selection

At tips.oig.hhs.gov, select “Healthcare fraud” → “Improper billing”. This routes your complaint to the team that handles Medicaid billing anomalies.

Step 2: Describe the Fraudulent Action (10,000 characters max)

This is the main complaint field. OIG says: provide details about when it happened, where, how it was committed, and how you learned about it. Here is what we submitted:

SUBJECT: Systematic Medicaid Billing Fraud -- 805 Statistical Anomalies
Across 289+ Providers Identified via Data Analysis of DOGE/HHS Dataset

SUMMARY OF COMPLAINT:

I am reporting systematic Medicaid billing fraud identified through
constraint-based statistical analysis of the medicaid-provider-spending.csv
dataset (10.32 GB), released February 13, 2026, by DOGE/HHS via
opendata.hhs.gov. Analysis of 40 percent of the dataset (approximately
70 million rows covering 1.04 trillion dollars in Medicaid claims) has
identified 805 statistical anomalies across 289+ unique National Provider
Identifiers (NPIs) consistent with indicators of fraud as defined by OIG
(42 CFR 455.2), ACFE, AICPA (AU-C Section 240), GAO Yellow Book standards,
and CMS Program Integrity Manual (Chapter 4).

This is Submission II (Tranche 2), covering bytes 2.0-4.1 GB of the
dataset (42.1 million rows, 79.5 billion dollars). A prior submission
(Submission I, 26 findings, 960 billion dollars, 20 percent coverage) was
filed February 16, 2026.

METHODOLOGY:

Three constraint-based tests were applied systematically:

K-Constraint (Volume Impossibility): Identifies providers whose
claims-per-beneficiary ratios exceed what is physically possible,
for example billing more service hours per patient than exist in a day.

R-Constraint (Single-Code Concentration): Identifies providers billing
exclusively one HCPCS/CPT code above a dollar threshold over sustained
periods. Single-code billing at high volumes is recognized by the ACFE
and OIG as a primary indicator of phantom billing, upcoding, or service
fabrication.

T-Constraint (Temporal Surge): Identifies providers with year-over-year
billing increases exceeding 300 percent, which CMS and OIG recognize as
fraud indicators.

FINDINGS -- SUBMISSION II (40 Percent Milestone):

1. R-CONSTRAINT (Single-Code Providers): 95 findings across 95 NPIs.
Providers billing exclusively one procedure code above 100,000 dollars
per year. T1015 (Medicaid clinic visits) and T1017 (targeted case
management) continue to dominate, confirming Pattern 1 identified in
Submission I. This pattern now extends across all payment tiers, not
just high-volume providers.

2. T-CONSTRAINT (Surge Growth): 682 findings across 209 NPIs.
The dominant finding: Evaluation and Management (E and M) codes account
for 78.3 percent of all surge-growth findings. Designated System Pattern
6: E and M Upcoding Epidemic.
- 99214 (Level 4 office visit): 191 providers surging average 446 percent
- 99213 (Level 3 office visit): 88 providers
- 99285 (Level 5 ED visit): 62 providers
- 99283 and 99284 (Level 3-4 ED visits): 78 providers combined
Highest surge: NPI 1730491945, 2,921 percent increase on code 99214.

3. K-CONSTRAINT (Volume Impossibility): 2 findings.

CONFIRMED SYSTEM PATTERNS (Cumulative):
Pattern 1: T1015/T1017 Phantom Clinic Network -- 13.3 billion dollars+
Pattern 2: DC Behavioral Health Cluster -- 380 million dollars+ / 13 providers
Pattern 3: Drug Testing Mills -- 190.6 million dollars
Pattern 4: Physically Impossible Billing Ratios
Pattern 5: New Entity Flooding -- 3.07 billion dollars / 16,677 entities
Pattern 6: E and M Upcoding Epidemic -- 534 surges / 78 percent of findings (NEW)
Pattern 7: National H-Code Behavioral Health -- emerging

DOJ VALIDATION: Prestige Healthcare Resources, LLC (NPI 1144516824,
Washington, D.C.) validated against DOJ indictment after TOCA flagged it.

SUPPLEMENTAL VERIFICATION: Business license, property, NPPES identity,
and public review checks conducted on subset of flagged providers --
all consistent with detected anomalies.

PROJECTION: 30-50 billion dollars total fraudulent/abusive billing
estimated at full dataset coverage.

Filed in good faith under False Claims Act (31 U.S.C. 3729-3733).
Steven Easley, Founder/CEO, Echosphere.io

Step 3: Attach Supporting Documents (50MB per file)

The portal accepts csv, doc, docx, gif, jpg, jpeg, pdf, png, tif, tiff, txt, xls, and xlsx. We attached:

• TOCA_Submission_II.pdf (26 KB) — Full 10-page report with legal disclaimer
• TOCA_Submission_II.txt (16 KB) — Plain text version

Step 4: Evidence Description (2,000 characters max)

A secondary text field for listing evidence. Here is what we submitted:

ATTACHED DOCUMENTS:

1. TOCA_Submission_II.pdf -- Full 10-page report: 779 findings from
40 percent dataset milestone (42.1M rows, 79.5 billion dollars).
Includes methodology, all three constraint analyses (95 single-code,
682 surge-growth, 2 volume-impossible), Pattern 6 confirmation
(E and M Upcoding Epidemic), DOJ validation detail, and
legal/methodological disclosure.

2. TOCA_Submission_II.txt -- Plain text version for archival.

ADDITIONAL EVIDENCE AVAILABLE UPON REQUEST:
- Submission I report (20 percent coverage, 26 findings, filed Feb 16, 2026)
- Full Treasury submission document (17 billion dollars+ flagged exposure)
- Raw analysis scripts and intermediate outputs
- Open-source verification documentation (business licenses, property
  records, NPPES cross-references, patient review screenshots)
- Complete methodology specification for the TOCA constraint architecture

All materials also available at:
https://echosphere.io/pages/proof-medicaid.html

This is Submission II of a planned five-submission series covering the
complete 10.32 GB DOGE/HHS Medicaid dataset. Submissions III-V (60,
80, 100 percent) will be filed as analysis progresses.

What Happens Next

OIG states that every report is reviewed but not every submission results in an investigation. They do not contact every complainant. However, hotline tips are used to build cases, corroborate existing investigations, and identify patterns. Multiple independent reports about the same providers or patterns strengthen the case for formal investigation — which is why your participation matters.

Open Investigation — Join the Analysis

The TOCA constraint battery identifies where to look. Confirming what happened requires eyes on the ground. We are recruiting analysts, investigators, journalists, and concerned citizens to help verify and expand these findings using publicly available data.

What We’ve Already Verified Beyond the Data

For a subset of flagged providers, we conducted supplemental open-source verification. These checks are not part of the TOCA statistical methodology — they represent independent corroboration:

• Business license verification: Several flagged NPIs are registered to entities with expired, suspended, or revocable business licenses — yet continue to bill Medicaid.
• Property and address validation: Billing addresses for certain flagged providers correspond to residential properties, vacant lots, or spaces inconsistent with claimed clinical services.
• Identity and registration checks: NPPES data shows authorized officials appearing across multiple flagged entities — consistent with shell organization networks.
• Online presence and public commentary: Patient reports consistent with billing anomalies — including claims of services never received and pressure to sign documentation for visits that did not occur.

How You Can Help

Every flagged NPI is searchable through the CMS NPPES Registry. Here is what independent investigators can check:

Report What You Find

1. Document everything. Screenshots, URLs, dates accessed. Public records can change.
2. Contact us. Share findings with Echosphere.io for incorporation into cumulative analysis.
3. Report to authorities. File with the HHS OIG Fraud Hotline (1-800-HHS-TIPS) or your state’s Medicaid Fraud Control Unit.
4. Protect yourself. Whistleblower protections exist under the False Claims Act. If evidence exceeds $1M, consult a qui tam attorney — you may be entitled to 15–30% of recovered funds.

For Journalists

805 anomalies across 289+ providers. Seven system patterns. One DOJ-validated entity. The dataset is public. The methodology is documented. Every NPI is searchable. Every claim is verifiable. We welcome scrutiny.

For Data Scientists

Our K/R/T constraint battery is deliberately simple — three tests at scale. Network analysis, Benford’s Law, geographic clustering, and cross-program joins would extend these findings. The DOGE dataset is 10.32 GB of structured CSV — manageable with DuckDB on any modern laptop. If you want to contribute, reach out.