AINPI 2026-05-22 update — H40 published, one confirmed strict-post-exclusion case, three SAM-NPI false positives caught

For: AINPI subscribers Date: 2026-05-22 Methodology version: 0.7.0-draft Source data: CMS Medicare Physician & Other Practitioners by Provider AND Service (RY2025, CY 2023 service year)

What's new

Two weeks ago we shipped the claims-side cross-audit (H29–H36). This week we sharpened the most actionable finding in that batch — H30a (federally-excluded NPIs billing Medicare Part B) — into the unit-of-work that State Medicaid PI offices actually write recoupment letters against: per-claim, per-HCPCS, per-place-of-service.

• H40 — granular (NPI, HCPCS, POS) cross-audit against the CMS "by Provider AND Service" file (3.06 GB, 9.66M rows). Per-state CSVs at /api/v1/states/<state>/h40-excluded-partb-by-hcpcs.csv.
• H42 — telehealth-dominant filter on H40 (CMS Telehealth Services List HCPCS codes). Null result, honestly framed.
• Confirmed case (lead finding). One federally-excluded physician — primary-source verified across LEIE + SAM.gov + NPPES — billed Medicare Part B for approximately $880,000 in CY 2023, eight years post-exclusion.
• Cohort-builder data-quality finding. Three other candidate strict-post-exclusion NPIs turned out to be SAM-NPI-join false positives on primary-source verification. The methodology is working — the primary-source URLs on every row are doing their job — but the cohort needs a name-match validation step.

The methodology version bumps to 0.7.0-draft to reflect both the new findings and the cohort-builder caveat.

H40 headline numbers

The strict-post-exclusion candidate count (4) is what the automated cross-audit produces. The confirmed count (1) is what stands after primary-source verification of each candidate's LEIE and SAM records by name + NPI. We publish the candidate number with the verification status next to every row — auditors should treat AINPI as a triage tool, not a fraud determination.

H40 vs H30a: −12 NPIs (194 vs 206) is the expected delta from CMS's <11-beneficiary cell-suppression in the granular by-Service file. The aggregate by-Provider file rolls those low-volume cells up; the granular file hides them. H40 is therefore a lower bound on per-claim activity — H30a remains the more inclusive denominator-for-comparison.

The one confirmed case

NPI 1285673012 — Eduardo Siria Miranda, MD (NPPES)

Top HCPCS codes billed in CY 2023 (eight years after federal exclusion took effect):

Section 1128(a)(1) of the Social Security Act mandates exclusion from all Federal health care programs upon conviction of a Medicare/Medicaid-related crime. That exclusion bars payment, billing, and ordering of services across Medicare, Medicaid, and all other Federal health care programs (42 USC § 1320a-7(a)(1); 42 CFR § 1001.1901). The published claim data is on data.cms.gov; the exclusion is on the OIG's public list; the NPI is active in NPPES.

This is a single case. It is publicly verifiable in roughly three minutes by any subscriber clicking the three URLs above.

The three SAM-NPI-join false positives

Three other candidates surfaced strict-post in the automated cross-audit:

The SAM.gov Public Extract sometimes carries an NPI field that does not actually belong to the excluded party — clerical errors at SAM data-entry, or NPIs reused across unrelated records. The AINPI cohort builder currently treats any non-empty npi field on an active SAM row as a match without cross-checking the name against NPPES.

Fix path (separate PR): add a NPPES name-match step to the cohort builder's SAM join. If the SAM-row name and the NPPES-row name for that NPI don't share a token, downgrade the row to "needs review" rather than including it in the published critical cohort. We'll publish a corrected high-risk-cohort-export.csv and re-run downstream H29/H30a/H30b/H32/H40 as a separate update.

This finding strengthens the published audit, not weakens it: the primary-source URLs on every cohort row are exactly what caught these false positives. The published cohort is a triage tool, not a fraud determination — the methodology assumes downstream readers will verify against the linked LEIE + SAM + NPPES portals.

H42 — null hypothesis supported

Zero federally-excluded NPIs in CY 2023 show ≥80% of post-exclusion Medicare Part B services billed under telehealth-specific HCPCS codes.

The published headline is honest about two competing readings:

1. Federal exclusion screening for telehealth-specific Part B is working — LEIE/SAM screening is catching telehealth-credentialed excluded providers pre-payment.
2. The post-exclusion cohort billing Part B is too small for the dominant-share threshold to register at all (4 NPIs / 57 service-rows national, of which 1 is confirmed).

H42 was always intended as a sharpened sub-test, not a headline cohort. H40 remains the actionable file.

Data quality + methodology

Both items below are documented in the provenance doc landing at docs/methodology/runs/2026-05-22-h40-h41-h42-baseline.md:

• CMS cell suppression — any (NPI, HCPCS, POS) cell with <11 beneficiaries is suppressed in the by-Service file but rolled up into the by-Provider aggregate. H40's NPI count is therefore a lower bound vs H30a's. Documented per-finding.
• SAM-NPI false positives in the cohort builder — flagged above. Fix in a follow-up PR.
• LEIE-NPI join quality — every published row carries the LEIE / SAM / NPPES verification URLs so readers can do the same 3-source primary-source check we did for Miranda above. Treat every candidate as a candidate, not a confirmed case.

H41 — running but not yet complete

The third planned finding (NPPES taxonomy vs Medicare-billed-specialty drift) ran for ~4 minutes before its BigQuery NPPES query stalled mid-iteration and the process hung. We killed it and will retry; the script is committed and the methodology entry is pre-registered. Numbers in the next update.

What state Medicaid PI offices should do

Per-state CSVs are at https://ainpi.dev/api/v1/states/<state-abbrev>/h40-excluded-partb-by-hcpcs.csv. Each row is one (NPI, HCPCS, place-of-service) tuple — the unit your team writes a recoupment letter against. Every row carries the primary-source LEIE + SAM + NPPES verification URLs. Treat any single row as a candidate, not a finding, until you've verified the name match against LEIE/SAM.

For the Miranda case specifically: any Medicare Part B activity by NPI 1285673012 between June 18, 2015 and today is on the table per § 1320a-7. Texas Medicaid's PI office can pull the same file and check whether any state activity occurred on the same NPI; we have not run that cross-audit ourselves.

Links

• H40 finding: https://ainpi.dev/findings/excluded-billing-medicare-partb-by-hcpcs
• H42 finding: https://ainpi.dev/findings/excluded-telehealth-dominant-post-exclusion
• Confirmed case (LEIE): https://exclusions.oig.hhs.gov/
• Confirmed case (SAM.gov): https://sam.gov/search/?index=ex
• Confirmed case (NPPES): https://npiregistry.cms.hhs.gov/provider-view/1285673012
• Provenance + reproducibility: docs/methodology/runs/2026-05-22-h40-h41-h42-baseline.md
• Methodology: https://ainpi.dev/methodology

— AINPI, 2026-05-22