CMS Pilots AI to Detect Medicaid Upcoding Before Payment in Push to Quadruple Provider Suspensions

The Centers for Medicare and Medicaid Services (CMS) is deploying artificial intelligence to stop fraudulent Medicaid billing in its tracks, with a stated goal to quadruple provider suspensions over the next six months. Speaking at the ADAPT conference in Santa Fe, New Mexico, on October 15, 2026, CMS Deputy Administrator Kimberly Brandt detailed a highly aggressive, technology-enabled drive to root out fraud, waste, and abuse before a single dollar is paid.

Unprecedented Exclusion Authority

This accelerated timeline is backed by unprecedented new enforcement power. On October 14, 2026, Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr. published a notice in the Federal Register formally delegating permissive exclusion authority under Section 1128(b) of the Social Security Act directly to CMS Administrator Mehmet Oz. Previously, this authority was the exclusive domain of the HHS Office of Inspector General (OIG). Now, CMS can unilaterally exclude providers from Medicare, Medicaid, TRICARE, and other federal healthcare programs.

The financial stakes are massive. Brandt's presentation revealed that CMS’s program integrity efforts yielded $41.9 billion in savings for fiscal year 2025—a 59% increase over the previous year. Furthermore, the agency’s “Medicaid War Room,” launched in April 2026, blocked $342 million in improper payments through September 2026 and issued 124 notices of intent to exclude providers.

How the AI Pilot Works

At the core of this crackdown is a predictive AI pilot currently operating in Indiana—in partnership with Oracle—and expanding to five additional states. The machine learning algorithms are designed to flag suspicious billing patterns in near real-time, catching upcoding, billing for phantom services, and geographic anomalies prior to Medicaid claims being processed. CMS is also utilizing a shared platform where agency staff, states, law enforcement, Medicaid Fraud Control Units (MFCUs), and program integrity contractors can collaborate on high-risk cases.

Coding Implications: The End of "Pay and Chase"

For medical coders, billers, and revenue cycle management (RCM) leaders, the integration of this AI means that clinical documentation must be flawless. The AI models actively scan for ICD-10 upcoding and HCPCS code upcoding by comparing provider billing frequencies against geographic and peer averages.

High-risk, complex diagnoses are prime targets. For instance, if an inpatient facility frequently bills ICD-10-CM code A41.9 (Sepsis, unspecified organism) or ICD-10-CM code E43 (Unspecified severe protein-calorie malnutrition) without robust clinical evidence in the electronic health record, the AI will immediately suspend the claim. Similarly, the algorithms are trained to catch "phantom billing" associated with telehealth services—such as those billed under HCPCS code G0425—and durable medical equipment.

Looking toward the future, these dynamic AI models are being built with adaptability in mind, ensuring they can seamlessly integrate future ICD-11 coding guidelines and adapt to evolving regulatory frameworks.

Conclusion

With CMS now holding the keys to both pre-payment AI scrutiny and permissive exclusion authority, the message to healthcare organizations is clear: the era of post-payment audits is evolving into pre-payment enforcement. Providers must proactively audit their coding practices and ensure strict compliance, as the margin for error has effectively been eliminated.