Death Fraud Aug 2010
Death Fraud Aug 2010
Nikada/iStockphoto
24        FRAUDMAGAZINE
                          Fraud
                             www.fraud-magazine.com
     This
                         It might be impossible to eradicate this pervasive
                         fraud, but cross-referencing documents with the U.S.
                         Social Security Administration’s Death Master File
Identity
                         might be the key to significantly reducing the
                         success rates of perpetrators.
   Theft
                         photo below, taken with a security camera at a department of motor
                         vehicles’ office in New York City, the elderly woman is actually a man
                         impersonating his deceased mother. Thomas Parkin (shown in a wig and big
                         sunglasses) defrauded the U.S. government out of more than $100,000 by
 is Alive
                         stealing his mother’s identity after she died. Parkin’s accomplice, the man to
                         the right in the photo, posed as a helpful nephew.
                               Parkin committed the fraud by giving his mother’s funeral home an
                         incorrect date of birth and Social Security number (SSN) for her and then
                         using the actual identification numbers to steal her monthly $700 Social
     and
                         Security benefits and rent subsidies.1
                               Death can be big business for fraudsters. Imagine the societal conse-
                         quences if theft of decedents’ identities becomes mainstream. A caregiver,
                         entrusted with financial oversight for an ailing loved one or client, could ob-
                         tain and use that person’s identification for illicit purposes. Or a physician
 Kicking
                         could use a deceased physician’s SSN and then bill insurance companies for
                         services never rendered to the decedent’s former patients.
                               These actual cases, playing out across the globe, often remain under the
                         radar until it’s too late and damage has been done. Using a decedent’s SSN
                         is really nothing more than an emerging form of identity theft.
    In this article, we’ll:                                               the security and confidentiality of personal information held at
• Describe identity theft in its native forms                             the institution. In addition, the GLB act “… prohibits ‘pretex-
• Explain the concept of death fraud and introduce the Social             ting,’ the use of false pretenses, including fraudulent statements
Security Administration’s (SSA) Death Master File (DMF)                   and impersonation, to obtain consumers’ personal financial
• Explore the evolution of death fraud                                    information, such as bank balances.”4
• Propose proactive measures to employ in your practice and to            • The Identity Theft Penalty Enhancement Act of 2004 added two
suggest to your clients for their protection                              years to the identity theft perpetrator’s prison sentence, and five
                                                                          years if the crime involved terrorist activities.
DEFINING IDENTITY FRAUD
You’re probably aware of identity theft, but you might not be             DEATH FRAUD
aware that effective Nov. 1, 2008, the U.S. Federal Trade Com-            Death fraud, at its roots, is simply a new spin on an old scam. As
mission (FTC) and several other federal agencies now require              we continue to discover and enjoy technological advances, person-
financial institutions and creditors to have identity theft pre-          al data theft will only become more prevalent. And identity theft
vention programs in place to help prevent, detect, and mitigate           against folks who are unable to speak for themselves threatens to
identity theft occurrences – primarily when the accounts are              increase in such a data-driven environment.
opened but also for the duration.2 This is just one reason why                  There are two common strategies to illegally obtain personal
understanding identity theft risk involving decedents is more             information, each of which presents its own problems. In the first
critical than ever.                                                       scenario, a trusted friend or loved one gains access to another’s
      Identity theft, in broad terms, is the unauthorized and illicit     SSN. In the second scenario, which is growing in popularity, the
use of another person’s personal identification information – typi-       perpetrator obtains a decedent’s SSN from discarded documents,
cally an SSN or driver’s license – for the impostor’s personal gain.      databases, health claim files, or even the SSA’s Death Master File
      In the United States, it’s unlawful for any person to:              (DMF). The DMF is a central database that contains more than
1) Knowingly and without lawful authority produce an identifica-          84 million records on deceased U.S. citizens. Each entry includes
tion document, authentication feature, or a false identification          the person’s SSN, full name, date of birth, date of death, and
document                                                                  city/state.
2) Knowingly transfer an identification document, authentication                Because decedents obviously aren’t able to detect or pro-
feature, or a false identification document knowing that such docu-       test the unauthorized use of their identification credentials, the
ment or feature was stolen or produced without lawful authority           responsibility falls to their executors, surviving family members,
3) Knowingly possess with intent to use unlawfully or transfer            or other interested parties, if there are any. Anti-fraud profession-
unlawfully five or more identification documents (other than              als should help the general public understand that vigilance over
those issued lawfully for the use of the possessor), authentication       one’s identity doesn’t end when a person enters into a guardian-
features, or false identification documents                               ship arrangement or even with one’s last breath.
4) Knowingly possess an identification document (other than                     Fraudsters have long known about stealing the identities
one issued lawfully for the use of the possessor), authentication         of deceased or incompetent individuals to commit fraud. What
feature, or a false identification document with the intent for such      makes this topic hotter than ever is that data can be sold and dis-
document or feature be used to defraud the United States3                 tributed quickly, and SSNs of the dead are more readily available
      The third and fourth prongs give the law teeth in that unau-        than SSNs of the living (and absent the use of the DMF or similar
thorized possession of another person’s identifying information,          tool, they are less likely to be detected). Collecting payments
or fraudulent information, with intent to either use it personally        intended for the dead or in the name of the deceased is big business
or to transfer it to another party for unlawful purposes (includ-         that touches several sectors of the economy including health care,
ing intent to defraud the United States) is a crime. While this           life insurance, investments, retirement benefits, and others.
language gives prosecutors additional tools to obtain a conviction,             Among the incarnations of death fraud, Social Security fraud
they also must prove one’s intent, which is never as clear as it          – using a deceased person’s SSN to obtain their Social Security ben-
might seem.                                                               efits – will be examined first, after we address in detail the DMF.
      Keep in mind that identity theft and its attendant risk can’t
realistically be legislated out of existence, but it’s an exposure that   DEATH MASTER FILE
can, with regulatory support, be managed. In the past 12 years            The SSA created the DMF in 1980 following a private citizen’s
we’ve seen many legislative deterrents to identity theft including:       lawsuit via the Freedom of Information Act.5 The database’s
• The Identity Theft and Assumption Deterrence Act, which was ef-         purpose is to help prevent payments of SSA benefits to deceased
fective Oct. 30, 1998. It makes identity theft a federal crime with       parties. For a fee, users can either search individual names online
penalties up to 15 years of imprisonment and a maximum fine of            at www.ssdmf.com, or they can purchase the entire database
$250,000.                                                                 and run their queries. The SSA maintains this comprehensive
• The Gramm Leach Bliley (GLB) Act of 1999 makes it manda-                database in conjunction with the National Technical Information
tory for any financial institution to assign one person to safeguard      Service branch of the Department of Commerce (www.ntis.gov/
26         FRAUDMAGAZINE                                                                                          www.fraud-magazine.com
                                                                                                                               DEATH FRAUD
44         FRAUDMAGAZINE                                                                                       www.fraud-magazine.com
DEATH FRAUD
another segment of the health-care industry – a governmental           necessarily easy. The Centers for Medicare and Medicaid Services
agency that’s subsidizing the underlying care or the care recipient.   (CMS), for instance, has the inherent ability to retroactively (or
      Health-care fraud is big business, as is fighting health-care    proactively) cross-reference physician files with the DMF, discover
fraud. The National Health Care Anti-Fraud Association recently        payments made to deceased physicians, and attempt to recover
estimated that approximately 3 percent of all U.S. health-care         associated payments. This is time consuming in either case, and it
spending – or $68 billion annually – is lost to fraud.9                might complicate things to proactively withhold payment or deny
      There are several ways to commit health-care fraud by using      a claim, but it would also slow the pace of the fraud loss.
a decedent’s identifying information. Some of the more common                CMS’ electronic Medicare Prospective Payment System al-
include:                                                               ready has electronic safeguards in place to either deny or approve
• Services purportedly rendered by a deceased provider and             a claim based on its characteristics. We don’t believe that adding
billed to an insurer                                                   an automated cross-reference to the DMF (a data set containing
• Services purportedly rendered to a deceased patient and billed       84 million-plus records) is a practical solution to the health-care
to an insurer                                                          fraud loss dilemma; instead, we believe a data query this large
• Purchases of durable medical equipment purportedly made              might slow the claim approval process to a crawl.
on behalf of a decedent (and billed by the physician using that              A viable alternative might be adding a field/column titled
person’s identifying information)                                      “doctor date of death” to the CMS’ National Provider Identifier
      Deceased Providers Health insurers are becoming in-              database and cross-referencing this data to the DMF periodically
creasingly proactive in their fight against                                                     in an automated query that generates
health-care fraud. Insurers and analysts run                                                    exceptions in a timely manner. This would
hundreds of algorithms to analyze huge              Typically, no                               enable CMS to validate claims against its
volumes of data to identify possible health-                                                    National Provider file, which at 800,000
care fraud, waste, and abuse.                   proactive process is                            files, is substantially smaller than the DMF.
      One of insurers’ typical practices is to                                                  Assuming the National Provider file con-
run an analysis to detect payments made          in place to detect                             tains current death information for each
for services rendered after the date of a                                                       physician, this procedure would enable
physician’s death. This sort of scheme is      submitted claims with                            CMS to identify decedent physicians in
generally undertaken by an insider – usu-                                                       a timely manner and deny claims associ-
ally a practitioner in the same medical         a service date after                            ated with them. Insurers could use similar
practice as the decedent or a third-party                                                       protocols.
administrator who provides medical-billing        the patient date                                    Deceased Patients Fraud schemes
services for that physician. In these cases,
the fraudster – with access to the practi-
                                                      of death.                                 that involve submitting false claims to
                                                                                                insurers for services allegedly rendered to
tioner’s SSN and mailing information – is                                                       deceased patients appear to be on the rise.
able to control both the reimbursement submission and the col-         As with all of the scams discussed in this article, fraud examiners
lection. Government and private industry analysts can cross-refer      must be cognizant of the logical possibility that an input error
provider submissions against the DMF so they can identify these        is behind the detected anomaly – possibly the purported service
inappropriate payments and conduct recovery actions.                   date, date of death, or even the DMF.
      In July 2008, the U.S. Senate Permanent Subcommittee on                Typically, no proactive process is in place to detect submitted
Investigations held a hearing to examine claims made to Medicare       claims with a service date after the patient date of death. CMS
for durable medical equipment that contained identification            and private insurers currently are able to retroactively identify pay-
numbers of physicians who died at least one year prior to the al-      ments made for services rendered after the patient date of death,
leged date of service.10 According to the subcommittee’s findings,     typically using one of two methods: 1) compare the service date
Medicare overpaid an estimated $60 million to $92 million to           on the patient claim form to the patient’s death date, and flag the
these deceased doctors during the period of 2000 through 2007.         claim if the service date is after the date of death and 2) cross-
      Had the study included the most recent 12 months follow-         reference the patient eligibility file (which contains the SSN) with
ing the physicians’ deaths, it’s estimated that the fraud loss would   the DMF to determine the accurate date of patient death, and
have increased to more than $100 million. This is a conserva-          then compare service date and death date.
tive estimate because the subcommittee’s analysis only included              This type of fraud has plagued state Medicaid agencies and
alleged dates of service more than one year after the physicians’      CMS for years. The Health and Human Services Office of the
dates of death. In some cases, the doctors had been dead for more      Inspector General estimated in 2006 that $27.3 million was paid
than 10 years. This further illustrates the need to analyze not only   to providers on claims dated subsequent to the dates of patients’
patient claim records but also physician files.                        deaths.11 That $27.3 million, based on eight out of the 10 audit
      Preventing this type of fraud is straightforward, but not        states, was extrapolated. However, the enormity of the inspector
46         FRAUDMAGAZINE                                                                                        www.fraud-magazine.com
                                                                                                                                 DEATH FRAUD
general’s estimate strongly suggests that death fraud – specifically      mit. While it can’t be totally prevented and not all cases can be
billing for services to deceased individuals – needs to be on the         detected, leveraging the DMF as a resource will certainly enable
radar.                                                                    organizations to minimize their risk of falling prey to an orches-
      Although the concept is simple, getting the DMF death dates         trated death-fraud scheme.
to line up exactly with other sources of death dates, such as state
eligibility files and Bureau of Vital Statistics files, continues to
present a challenge.                                                      Cheryl B. Hyder, CFE, MT, CPA, CVA, CFF, is the principal
      Stark Law Violations The Stark Law (42 U.S.C. 1395),                at Hyder Consulting Group, a litigation consulting firm based in
named after Rep. Fortney “Pete” Stark (D-CA), prohibits a physi-          Alexandria, Va. She’s the president of the ACFE’s Metropolitan-DC
cian from referring patients to a practice in which the provider          Chapter and holds leadership positions in other professional organi-
has a financial interest. Individual Stark Law violations (i.e., each     zations. Hyder has been designated as an expert witness in matters
claim or referral) are subject to financial penalties, which are sig-     involving forensic accounting, financial fraud investigations, ac-
nificantly increased if it’s determined that the physician engaged        counting malpractice and standard of care, commercial damages, and
in conduct to conceal the relationship. With this perspective, con-       business valuation. Her e-mail address is: chyder@hydercpa.com.
sider the increased risk of using a decedent’s personal informa-
tion to obfuscate the true ownership of a practice and the Stark          Christine Warner is a director of quality assurance for Thomson
noncompliance. Consider the consequences if a physician or                Reuters, at which she conducts Medicaid fraud detection analyses
physician’s practice created a referral practice using a decedent’s       using SAS software. Her e-mail address is: info@autoaudit.com.
SSN to mask ownership interest in that referral entity.