CMS credits its fraud prevention with $42 billion a year: AI flags, but the decision remains human

By ExecutiveGov · November 9, 2026.

Bethany Messick, deputy director of the data analytics and systems group at the Center for Program Integrity (CPI) of the U.S. Centers for Medicare & Medicaid Services (CMS), says the center achieves $42 billion in annual savings. She sets this against spending of about $2 trillion a year on Medicare and Medicaid, as reported by Federal News Network and picked up by ExecutiveGov. That is around 2% of total spending, based on the agency's own figure.

The system works like this, according to Messick: more than 300 models monitor healthcare providers around the clock and generate alerts when their activity deviates from usual patterns. Investigators then review those alerts in detail. If there is a credible allegation of fraud, CMS can suspend payments while the investigation is ongoing, within its authority. Providers with confirmed fraud can be expelled from the programs. "We don't want to let the money go out the door while we investigate," she said.

The AI work is concentrated in two centers: the Fraud Defense Operations Center (known as the Medicare Fraud War Room, created in 2025) and the Medicaid Fraud War Room, launched in April alongside the White House Task Force to Eliminate Fraud. The latter identifies high-risk providers and helps states apply payment suspensions more quickly. The Department of Health and Human Services Office of Inspector General (HHS OIG) investigates cases, issues exclusions and seeks penalties. Messick stressed that analysts, not AI tools, remain responsible for final payment decisions.

More moves are under way. In October, Deputy Administrator Kimberly Brandt said CMS will soon publish the results of an AI pilot against Medicaid fraud, conducted with Oracle in Indiana, and that she expects a new exclusion authority to quadruple suspensions within six months. Brandt had previously credited AI with $2 billion in savings since March 2025. CMS is also considering an outcomes-based contracting model, in which the agency sets priorities and contractors carry out the investigations. The request for information (RFI) closes on November 27.

**Our take.** The $42 billion figure is self-reported, and the article does not explain how it is calculated. "Savings" can mean avoided payments, recoveries or estimates of deterred fraud, and those categories are not equivalent. Nor does it say how much is attributable to AI versus classic rules and analytics, or how many alerts turn out to be false positives. Until the Indiana pilot is published, the number is best taken as an order of magnitude rather than an audited result.

The most interesting part is the design. Suspending payments before the investigation is resolved shifts oversight from "pay and chase" to "stop and verify." It is more effective, but also more sensitive: a false positive leaves an honest doctor or clinic unpaid. That is why it matters that the final decision remains human and that there are clear avenues for appeal. If the goal is to quadruple suspensions, the quality of those safeguards will weigh as much as the accuracy of the models.

This case fits a thesis we hold: fraud is the arena where AI is used as both weapon and shield. In general, the same automation that makes it cheaper to fabricate fake paperwork allows governments to detect anomalous patterns at scale. Public payers with sufficient proprietary data win, and small-time fraudsters lose. In the short term, the race will be uneven: attackers adopt tools faster than bureaucracies do. In the long term, a healthcare system that spends less on fraud can devote those resources to real care, a small step toward the abundance we seek, as long as efficiency does not turn into unfair denial.

What to watch: the publication of the Oracle pilot, whether CMS breaks down savings by method, and whether the new outcomes-based contracting model aligns incentives without rewarding the volume of sanctions.