12 min

read

Business Rules Engines for Health Claims Anti-Fraud: A 2026 Guide

Written by

Marcin Nowak

Published on

28 Mar 2025

Last update

22 Jul 2026

Why health claims fraud detection is its own discipline

In my experience, the health insurance fraud conversation is different from P&C fraud in three ways most vendor pitches miss. First, the patterns aren’t claim amount or geographic - they’re medical coding patterns (upcoding, unbundling, phantom billing, kickback schemes) that require domain expertise to encode. Second, the regulatory stack includes HIPAA on top of state fraud bureau requirements, which changes how audit trails must be structured. Third, the dominant fraud detection vendors in health (Optum, Cotiviti, Change Healthcare) play in a different category from the rules engines and SIU platforms that dominate P&C.

This article covers what business rules engines actually do in the health claims anti-fraud stack - and where they fit alongside the health-specialist platforms. Most mid-market health payers and TPAs ($500M-$5B premium equivalent) run hybrid stacks: a specialist medical claims editor for CPT/ICD-10 code validation, plus a BRMS layer for the broader fraud rule library, plus ML scoring for novel-pattern detection. Higson sits in the BRMS layer. We don’t replace Optum or Cotiviti. We’re the foundation underneath the medical-specialist tooling.

The National Health Care Anti-Fraud Association estimates health insurance fraud at $68 billion annually in the US - most of it driven by upcoding, unbundling, phantom billing, and provider kickback schemes. That’s the scale of the problem. The architecture below is what mid-market payers and TPAs actually deploy against it.

What a business rules engine does in health claims fraud detection

A business rules engine in health claims fraud detection applies deterministic logic - CPT code matching rules, ICD-10 cross-reference checks, provider behavior baselines, frequency thresholds, duplicate claim detection - to flag suspicious claims in real-time before adjudication completes. Modern health fraud detection systems combine rules with ML scoring (hybrid architecture) and medical-specialist editors. Rules handle known fraud patterns, NHCAA-aligned audit trails, and sub-millisecond execution inside the adjudication path. ML handles provider profiling, utilization analytics, and behavioral anomaly detection. Medical claims editors handle CPT/ICD-10 code edits, NCCI bundling rules, and medical necessity checks.

The four health claims fraud patterns rules engines catch

Health insurance fraud isn’t one problem. NHCAA categorizes it into four pattern families, each with its own rule architecture.

Upcoding. Provider bills a higher-paying CPT code than the service actually rendered - billing CPT 99215 (45-minute complex office visit) when the actual visit was CPT 99213 (15-minute moderate visit). Rules catch upcoding by cross-referencing CPT code distribution against provider peer baselines and against the supporting ICD-10 diagnosis codes. A cardiology practice billing 80% of visits as level 5 complexity when the peer baseline is 35% triggers SIU review.

Unbundling. Provider bills component CPT codes separately when NCCI (National Correct Coding Initiative) bundling rules require them billed together at a lower combined rate. The classic example: surgical procedure code with separate billing for pre-op evaluation, intra-op imaging, and post-op visit, when NCCI requires the global surgical package. Rules apply NCCI edits inline; medical claims editors (Optum CES, Cotiviti) handle the deeper bundling logic that requires CMS-updated medical knowledge.

Phantom billing. Provider bills for services never rendered. Patterns: deceased patients, patients in different facilities at billing time, services to patients without matching electronic medical record documentation, providers billing impossible volumes (more than 24 hours of services per day). Rules catch the deterministic patterns; ML catches the subtle behavioral ones (provider velocity drift, geographic clustering).

Kickback schemes. Provider referrals tied to financial incentives - typically detected through utilization pattern analysis. A specialist receiving 90%+ of referrals from one primary care provider, with treatment patterns that don’t match condition severity, suggests kickback patterns. The Stark Law and Anti-Kickback Statute make this both a fraud issue and a criminal compliance issue. Rules flag candidates; SIU + General Counsel + Compliance Officer investigate.

I’ll be direct about category boundaries: pure rules-based detection catches the deterministic patterns (upcoding above peer baseline, unbundling NCCI violations, deceased patient billing, impossible volumes). Pure ML detection catches novel and subtle patterns (kickback rings, organized billing fraud, treatment pattern drift). Hybrid catches both. Anyone selling rules-only or ML-only for health fraud is undersized for the problem.

Why health fraud detection is different - HIPAA and medical coding complexity

The two structural differences that change how a BRMS deploys in health vs P&C contexts.

HIPAA compliance changes the audit trail format. Every fraud flag involves Protected Health Information (PHI) - patient identifiers, diagnosis codes, treatment details. The audit trail per flag must be HIPAA-compliant: access logged, PHI minimum-necessary scoped, audit log encryption at rest and in transit. SIU access to flagged claims requires HIPAA training certification per investigator. This isn’t optional. NAIC market conduct exams in health intersect with HHS Office of Civil Rights enforcement around HIPAA breach.

Medical coding complexity exceeds typical P&C fraud rule scope. CPT (Current Procedural Terminology) has 10 000+ active codes maintained by AMA. ICD-10-CM (diagnoses) has 70 000+ codes; ICD-10-PCS (procedures) adds another 80 000+. NCCI edits update quarterly. CMS medical necessity Local Coverage Determinations (LCDs) vary by Medicare Administrative Contractor. The rule library for health fraud detection is an order of magnitude larger than P&C - typically 8 000-15 000 active rules vs 1 500-4 000 in P&C.

The architectural implication: the rules engine has to handle higher rule complexity, deeper decision table inheritance (CMS national → MAC regional → payer-specific override), and faster CMS update cycles. Decision table inheritance pattern matters more in health than in P&C.

Provider directory and credentialing data integration matters more. A fraud flag for “provider billing impossible volumes” requires integration with credentialing data, provider directory accuracy, and NPI registry lookups. Health BRMS deployments depend on these external integrations more than P&C deployments depend on NICB or ISO ClaimSearch.

The rules + ML + medical-editor hybrid architecture

The architecture pattern that wins in 2026 mid-market health payer deployments has three layers, not two:

Claim event (claim 837 submission) 
  ↓ 
Medical claims editor        ← CPT/ICD-10 edits, NCCI bundling, medical necessity 
  (Optum CES, Cotiviti, etc.) 
  ↓ 
Rules engine (BRMS)          ← fraud rules library, provider behavior, duplicate detection 
  (Higson or alternative) 
  ↓ 
ML scoring inline            ← ONNX runtime, provider profiling, novel-pattern detection 
  ↓ 
Decision routing             ← auto-adjudicate | SIU flag | medical review | decline 
  ↓ 
Audit log                    ← rule version + ML model + SHAP attribution + HIPAA log

‍

The medical claims editor layer handles the CMS-aligned CPT/ICD-10 edit work - bundling, modifier validation, medical necessity LCD application. This is specialist work the dedicated medical editor vendors do well. The BRMS layer handles the broader fraud rule library: provider behavior baselines, frequency rules, duplicate detection across submission channels, cross-claim correlation, watchlist matches. The ML scoring layer handles novel patterns and provider profiling.

I’ll be honest about Higson’s position in this stack: we’re the BRMS layer, not the medical editor. We integrate with Optum CES, Cotiviti, Change Healthcare, or other medical claims editor vendors as the layer above. We don’t replicate their CMS-aligned CPT/ICD-10 edit libraries - that’s their domain expertise, regularly updated against CMS publications. We add the broader fraud rule library, the provider behavior rules, the ML scoring integration via ONNX, and the unified audit trail across all three layers.

The performance math for health payer mid-market deployments:

False positive rate: 80%+ legacy rules-only health systems → 25-40% hybrid (60-70% reduction)

SIU hit rate: 15-25% rules-only → 30-50% hybrid

Adjudication path latency: rules + ML inline under 50ms total (Higson 0.23ms per rule set, ML scoring sub-50ms with ONNX)

Rule library scale: 8 000-15 000 active fraud rules + 50 000+ CMS-aligned CPT/ICD-10 edits in the medical editor layer

CPT/ICD-10 code-based rules - the health-specific pattern

This is the section where the BRMS for health diverges most from P&C. Rules in health fraud detection are heavily structured around medical codes and code combinations.

Code-frequency rules. Provider billing CPT 99214 (moderate office visit) 85% of the time when peer baseline is 45%. Cross-reference to specialty + geography + patient case mix. Flag if 2+ standard deviations from peer baseline. Decision table structure: provider specialty × CPT code × frequency threshold × peer baseline.

Code-combination rules. CPT 11042 (debridement, subcutaneous tissue) billed with CPT 11043 (deeper debridement) for the same encounter when NCCI rules require single billing. Decision table inheritance from base NCCI rules, with payer-specific overrides for edge cases.

ICD-10 to CPT consistency rules. Provider bills CPT 27447 (total knee arthroplasty) with diagnosis ICD-10 M17.0 (osteoarthritis, primary). Consistent. Same CPT 27447 billed with diagnosis ICD-10 J20.9 (acute bronchitis). Inconsistent - flag for SIU review. The rule library encodes thousands of these CPT-ICD consistency checks; medical necessity edits in Optum CES or Cotiviti handle the deeper version.

Modifier abuse rules. Modifier 25 (significant, separately identifiable E/M service) overused - appended to E/M visits to bypass bundling rules. Modifier 59 (distinct procedural service) abused to unbundle services. Rules cross-reference modifier usage frequency against peer baselines.

Time-based rules. Provider billing more services than physically possible per day - total time-based CPT minutes exceeding clinical work hours. CMS publishes time-based code definitions; the rule library enforces sums per provider per day.

The rule authoring pattern that works: medical coding specialists author the health-specific rules in no-code Studio interfaces. SIU analysts review and approve. Compliance Officer signs off. IT governs the deployment pipeline. The platform makes authoring accessible to clinical-side teams; governance discipline keeps the rules deployable safely.

NHCAA and state anti-fraud compliance for health

The regulatory stack for health fraud detection differs from P&C and warrants its own discussion.

NHCAA Anti-Fraud Standards. NHCAA (National Health Care Anti-Fraud Association) publishes anti-fraud standards adopted by most major health payers. Core requirements: active fraud detection program, SIU with credentialed investigators (CFE/AHFI designations), provider-level investigation capabilities, federal fraud reporting alignment.

State fraud bureau requirements. 48+ US states require health insurers to maintain Special Investigations Units and report suspected fraud. State requirements vary; California, Texas, Florida, and New York have the strictest reporting requirements.

HIPAA Privacy and Security Rules. Every fraud investigation involves PHI. Investigation activities must be HIPAA-compliant: minimum necessary PHI access, access logging, breach notification protocols if PHI is improperly disclosed during fraud reporting.

Federal False Claims Act + Anti-Kickback Statute. Health fraud cases often cross from civil to criminal. The False Claims Act and Anti-Kickback Statute make kickback schemes and false claims federal crimes. SIU referrals to law enforcement must be documented with audit trail integrity that survives criminal evidentiary standards.

CMS Medicare/Medicaid fraud reporting. Health payers participating in Medicare Advantage and Medicaid Managed Care report fraud findings to CMS via specific reporting workflows. Audit trails must align with CMS Program Integrity reporting formats.

The BRMS audit trail per fraud flag must satisfy all four regulatory contexts simultaneously: NHCAA standards, state fraud bureau requirements, HIPAA logging, and CMS reporting alignment. This is more complex than P&C fraud audit trails. Carriers that deploy fraud rules without HIPAA-compliant audit logging fail their first compliance audit.

AI models for health fraud - provider profiling and utilization analytics

Where ML earns its keep in health fraud detection: novel patterns and behavioral analytics that pure rules can’t capture.

Provider profiling. ML models score provider behavior against peer cohorts - specialty, geography, patient case mix adjusted. Outliers surface for SIU review. The features that drive these models: CPT code distribution, ICD-10 code distribution, modifier usage patterns, time-based code totals, billing velocity, geographic patient pull, referral patterns.

Utilization analytics. ML models detect unusual utilization patterns - patient case mix that doesn’t match panel demographics, treatment frequency exceeding clinical baselines, prescription patterns outside formulary norms. These patterns often surface organized fraud rings before individual rules can.

Cross-claim correlation models. Graph-based ML models detect coordinated fraud rings across providers, patients, and pharmacies. This is where AI-native fraud vendors like Shift Technology, Cotiviti’s analytics suite, and Optum’s behavioral analytics earn their fit.

SHAP attribution for fraud flags. Every ML-influenced flag carries SHAP factor attribution in the audit log. When SIU investigator opens a flagged claim, the audit panel shows the top features that drove the score - provider velocity z-score, peer baseline deviation, modifier usage frequency. This is what passes HIPAA-compliant audit requirements when investigators escalate cases to law enforcement.

I’ve seen this work. A regional health insurer I worked with in 2024 deployed pure ML fraud detection without SHAP attribution. Production FP rate hit 87% - investigators couldn’t justify reviews because they didn’t know what features were driving scores. The fix: hybrid rules + ONNX XGBoost + SHAP attribution. Six months post-deployment: FP rate 31%, SIU hit rate doubled to 44%, regulator audit passed. The Medical Director told me afterwards: “AI is only as good as the audit trail you can defend in front of CMS and state regulators.”

Real example - anonymized $1.2B premium health insurer

I’ll anchor the architecture conversation on an anonymized deployment because it illustrates the three-layer stack at mid-market scale.

A regional health insurer with $1.2B premium running Medicare Advantage and individual marketplace plans had three fraud detection problems: 87% FP rate from legacy rules-only system, manual provider profiling done quarterly (lagging fraud rings by 90+ days), and audit trail fragmentation across claims editor and SIU workflow tools.

The architecture they deployed over 7 months: Optum CES as the medical claims editor layer (CPT/ICD-10 edits, NCCI bundling, medical necessity LCD application), Higson as the BRMS layer for the broader fraud rule library (8 400 active rules at go-live), ONNX-deployed XGBoost model for provider profiling, SHAP attribution per flag in the consolidated audit log.

Outcomes at 6 months post-go-live:

FP rate from 87% to 31%

SIU hit rate from 22% to 44%

Provider profiling cycle from quarterly to weekly

Audit trail consolidated across three layers

CMS Program Integrity reporting automated from BRMS audit log

The Medical Director’s framing: “The medical claims editor catches what CMS publishes. The BRMS catches what our SIU team has learned. The ML catches what we haven’t named yet. We needed all three.”

This is the pattern. Higson doesn’t replace the medical editor. We don’t replace AI-native provider profiling platforms either. We’re the BRMS layer that connects the medical knowledge to the fraud rules to the ML scoring with one audit trail that satisfies NHCAA, HIPAA, state fraud bureau, and CMS reporting requirements.

Honest vendor positioning for health fraud

The vendor landscape for health fraud is structured differently from P&C. Quick map.

Medical claims editors - Optum CES, Cotiviti, Change Healthcare, ClaimsXten (Cognizant). These are CPT/ICD-10/NCCI edit specialists. They update against CMS publications quarterly, maintain medical necessity LCD libraries, and handle the bundling logic that requires medical knowledge depth. Higson doesn’t compete here. Carriers with established medical editors keep them. Carriers without should evaluate this category separately from BRMS.

AI-native fraud analytics - Cotiviti’s analytics suite, Optum Behavioral Health Analytics, SAS Fraud Framework (health module), SCIO Health Analytics. These are provider profiling and utilization analytics specialists. Carriers prioritizing AI-native pattern discovery on the provider side often use these as primary. Higson integrates as the BRMS layer underneath.

BRMS platforms - Higson, IBM ODM, InRule, FICO Blaze. These are the general-purpose rules execution and governance platforms. Health payers use them for the fraud rule library that sits between the medical editor (above) and ML scoring (below or alongside).

Health-specialist SIU workflow - DataMart Solutions, HealthEdge, specialty vendors. These are SIU case management tools. They integrate with the BRMS flag output to manage investigator workflow.

I’ll be direct about Higson’s fit: we’re a strong fit for mid-market health payers and TPAs ($500M-$5B premium equivalent) building a BRMS layer between their medical claims editor and their AI provider profiling tooling. We’re not the right fit for carriers who want a full health-specialist platform; for those, Optum, Cotiviti, or Change Healthcare integrated suites are better starting points. We’re not the right fit for carriers who haven’t yet selected a medical claims editor; that’s a separate procurement decision that should be made first.

FAQ

What is health insurance fraud and how big is it?

Health insurance fraud includes upcoding (billing higher-paying CPT codes than the service rendered), unbundling (separating procedures that should be bundled), phantom billing (billing for services never rendered), and kickback schemes (referrals tied to financial incentives). The National Health Care Anti-Fraud Association estimates US health insurance fraud at $68 billion annually - driven primarily by these four pattern families.

How does a business rules engine detect health claims fraud?

A business rules engine in health claims fraud applies deterministic logic to claims data - CPT code frequency rules, CPT-ICD-10 consistency checks, provider behavior baselines, duplicate detection across submission channels, modifier abuse rules, time-based code totals. Rules execute in milliseconds inside the adjudication path, produce per-flag audit trails for NHCAA and HIPAA compliance, and integrate with medical claims editors (Optum CES, Cotiviti) and ML scoring layers for novel-pattern detection.

What’s the difference between a medical claims editor and a BRMS for health fraud?

Medical claims editors (Optum CES, Cotiviti, Change Healthcare) specialize in CPT/ICD-10 code edits, NCCI bundling rules, and medical necessity LCD application - maintained against quarterly CMS publications. A BRMS handles the broader fraud rule library: provider behavior baselines, frequency rules, cross-claim correlation, watchlist matches, and integration with ML scoring. Mid-market health payers typically run both layers in a hybrid architecture, with the medical editor handling code-specific edits and the BRMS handling fraud-specific rules.

How does HIPAA affect health fraud detection rule engines?

HIPAA Privacy and Security Rules require that every fraud flag involving Protected Health Information (PHI) maintain minimum-necessary access scoping, encrypted audit logging at rest and in transit, and access controls per investigator. SIU staff accessing flagged claims must hold HIPAA training certification. Fraud detection rule engines deployed in health contexts must produce audit trails that satisfy both NHCAA fraud standards and HIPAA compliance simultaneously - including breach notification protocols if PHI is improperly disclosed during fraud reporting workflows.

What is the false positive rate for hybrid health fraud detection systems?

Legacy rules-only health fraud systems pre-2020 commonly ran 80%+ FP rates. Modern hybrid rules + ML + medical editor systems achieve 25-40% FP rates with 30-50% investigation hit rates - a 60-70% reduction. Anyone promising zero false positives in health fraud is selling marketing fiction. The math doesn’t work: pushing FP to zero crushes hit rate. Realistic mid-market target is 25-40% FP at 30-50% hit rate.

Can rules engines handle CPT and ICD-10 code complexity?

Yes - with decision table inheritance patterns. CPT has 10 000+ active codes; ICD-10-CM has 70 000+ codes; NCCI edits update quarterly. The pattern that scales: base decision tables for CMS-aligned national rules, regional override tables for Medicare Administrative Contractor variations, payer-specific override tables for plan-specific rules. Health BRMS deployments typically maintain 8 000-15 000 active fraud rules in the BRMS layer plus 50 000+ CMS-aligned edits in the medical claims editor layer.

Does health fraud detection require AI/ML or just rules?

Both. Pure rules catch deterministic patterns (upcoding above peer baseline, NCCI unbundling violations, deceased patient billing, impossible volumes). Pure ML catches novel patterns and behavioral analytics (kickback rings, organized billing fraud, treatment pattern drift). The architecture that wins is hybrid: rules for known patterns + audit trails, ML for novel-pattern discovery + provider profiling, medical claims editor for CPT/ICD-10 code-specific edits. Anyone deploying rules-only or ML-only is undersized for the problem.

What compliance requirements apply to health fraud detection systems?

Health fraud detection systems must satisfy four regulatory contexts simultaneously: NHCAA Anti-Fraud Standards (industry-aligned), state fraud bureau reporting requirements (48+ US states), HIPAA Privacy and Security Rules (PHI handling), and CMS Program Integrity reporting for Medicare Advantage and Medicaid Managed Care participants. The Federal False Claims Act and Anti-Kickback Statute additionally apply when fraud cases cross from civil to criminal - audit trail integrity must survive criminal evidentiary standards.

Talk to Higson

If you’re a Medical Director, VP SIU, or Compliance Officer at a mid-market health payer or TPA, and the question on the table is “how do we add a BRMS layer between our medical claims editor and our ML provider profiling without breaking HIPAA audit” — that’s the architecture conversation we have with health payer teams.

Schedule a 45-minute health fraud architecture review - walk through the three-layer stack (medical editor + BRMS + ML), SHAP attribution audit trail, HIPAA-compliant logging patterns, and CMS Program Integrity reporting alignment.

Self-serve a PoC - Higson is available on AWS Marketplace at $0.63/hour for proof-of-concept deployments.