/fraud-detection

name: fraud-detection
description: Screen a Medicare/Medicaid claims corpus for fraud, waste, and abuse and produce ranked, fully-cited investigation referrals for an SIU / program-integrity team. Use when asked to run a fraud sweep, screen claims for FWA, find billing anomalies, or generate investigation referrals over a claims dataset.

Fraud Detection — claims screening → cited investigation

Screens a Medicare/Medicaid claims corpus against the public rulebook (NCCI MUE, OIG LEIE, CMS enrollment, PFS) and produces **ranked, fully-cited investigation referrals** for an SIU. The skill **orchestrates a three-tier investigation**: a deterministic floor does the detection, the model judges and narrates on top, and every dollar/rule allegation traces back to the floor.

Output framing

• **"Indicators consistent with [scheme]," not "fraud."** A pattern match doesn't establish intent

— that's a downstream investigative/legal determination. This is standard SIU language and the framing the renderers use.

• **Render for review.** The skill writes packets to `$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/`; the payer's SIU workflow

decides what to do with them. The model does not send/publish on its own.

Inputs

• **The payer's claims** in `corpus.duckdb` (canonical 6-table schema: `claims-schema.sql`). Getting

this is **step 1** below — without it nothing else matters.

• **Quarter** (the NCCI/PFS rule set to cite against, e.g. `2026q3`).
• **Line of business** (`medicare` / `medicaid`).

Data root

All fetched/generated state lives **outside** the plugin install path (which is wiped on upgrade) at `~/.claude/data/healthcare/fraud-detection/` — override the parent dir with `$CLAUDE_HEALTHCARE_DATA` (each skill appends its own name). Below, `data-cache/` and `out/` are subdirectories of `$CLAUDE_HEALTHCARE_DATA/fraud-detection`. Resolve it once at the start of a run:

export CLAUDE_HEALTHCARE_DATA="${CLAUDE_HEALTHCARE_DATA:-$HOME/.claude/data/healthcare}"

Steps

1. **Get the payer's claims into `corpus.duckdb`.** Open with: *"Where do your adjudicated claims live?"* and follow `${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/LOAD-CLAIMS.md` — it walks you and the user from "I don't know" to a populated `$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/corpus.duckdb`. If they already have a `.duckdb` with the canonical tables (schema: `${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/claims-schema.sql`), use it directly.

Draft the brief (corpusDb path, quarter, line of business) and confirm scope. 2. **Seed the public reference layer (first run / new quarter only).** Detectors cite against `$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/reference/<quarter>/reference.duckdb`. If that file is missing for the requested quarter, fetch it now — this prints per-source `✓ name (size)` progress as ~34 sources land:

   node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-reference.js" 2026q3
   node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-enrichment.js"

Requires `unzip` and `pdftotext` (poppler) on PATH; both ship with most distros / `brew install poppler`. Needs real network egress — if you see "Could not resolve host" for cms.gov / oig.hhs.gov, the command sandbox is blocking it; re-run with sandbox disabled. Policy PDFs (NCCI manual, MLN articles) land under `reference/<q>/policy/*.txt` for grep; everything keyed lands in `reference.duckdb`. Skip if already present. If a fetch fails or a table is missing, see `REFERENCE-DATA.md` for source URLs and recovery. 3. **Create the run directory.** Each invocation lands in its own minute-stamped directory so prior runs are preserved side-by-side. Every script honors `FRAUD_OUT_DIR`:

   export FRAUD_OUT_DIR="$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/run-$(date +%Y%m%d-%H%M)"
   mkdir -p "$FRAUD_OUT_DIR"
   echo "$FRAUD_OUT_DIR"

Use the printed absolute path verbatim as `outDir` in the next step. 4. **Run the investigation** by calling the **Workflow** tool with:

• `scriptPath`: `${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/workflows/investigate.js`
• `args`: `{ "corpusDb": "<abs path to corpus.duckdb>", "quarter": "2026q3", "lob": "medicaid", "pluginRoot": "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection", "dataRoot": "<abs $CLAUDE_HEALTHCARE_DATA/fraud-detection>", "outDir": "<abs FRAUD_OUT_DIR from step 3>" }`

The workflow runs three stages (see "How it works"):

• **Detect** — runs the deterministic sweep (`scripts/screen.js`, zero model) → `$FRAUD_OUT_DIR/referrals.detect.json`.
• **Adjudicate** — one agent per judgment-required finding (D2/D4/D7/D13) sets `status` + `adjudication.reason`; mechanical detectors auto-confirm. Adjudicate may dismiss or downgrade, never add.
• **Synthesize** — one agent per provider writes the investigator narrative, plus novel-lead discovery with adversarial verification.

Tell the user they can watch the fan-out live with `/workflows`. 5. **Materialize the stage snapshots + render** (required — this is the reviewable deliverable). The workflow sandbox has no filesystem, so write its return to disk and let `apply-stages.js` produce the auditable spine. **`FRAUD_OUT_DIR` does not persist across separate Bash calls** — re-export it (to the same absolute path you printed in step 3) at the top of every shell block that needs it: Use the **Write** tool to save the workflow's return JSON verbatim to `$FRAUD_OUT_DIR/workflow-result.json` (it can be 50KB+ — don't heredoc it through Bash). Then:

   export FRAUD_OUT_DIR="<abs path from step 3>"
   node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/apply-stages.js"

This writes `$FRAUD_OUT_DIR/referrals.adjudicated.json`, `referrals.final.json`, `referrals.json` (canonical, = final), and the renderer sidecars (`source-excerpts.json`, `providers.json`).

Then render the packe