Maria Abbasi
Picture a night watchman on a street of a thousand houses. He carries one torch. He is diligent, unbribable and genuinely committed to his work. Every night he walks the lane, chooses three houses at random, checks their locks, and files a report at dawn confirming that three houses were secure.
He is not lazy. He is not corrupt. He is simply outnumbered by arithmetic, and arithmetic has never cared about anyone’s character. That watchman is the modern healthcare audit function, and the street gets longer every year.
Traditional audit rests on one quiet assumption: you cannot look at everything, so you look at a slice and reason outward. That was perfectly reasonable when claims moved on paper, and a hospital’s billing department could be walked end to end in an afternoon. That world has left the building. A mid-sized insurer today processes claims in volumes no sampling frame can honestly represent. Pulling a few hundred files out of several million is not oversight. It is theatre with good production values. It leaves the overwhelming majority of transactions untouched by any judgment at all.
Worse, that slice is drawn after the money has already moved. Retrospective review is post-mortem work. It can tell you with beautiful precision exactly what went wrong. It cannot undo it. The industry even has a phrase for the arrangement – pay and chase. Pay first, ask questions later. Strip away the professional gloss, and it stops sounding like a strategy and starts sounding like a confession.
To be fair, insurers do run automated checks at the front door. If a code sits beside an incompatible diagnosis, flag it. If frequency crosses a threshold, hold it. Rules work. Rules also advertise themselves. Every denial is a free tutorial, and those inclined to game a system are attentive students. A pattern blocked on Monday is reshaped by Wednesday – the code nudged one digit sideways, the volume parked politely beneath the ceiling, the billing spread so thinly that no single claim looks unusual. Fixed rules are a written description of last year’s behaviour. To anyone determined to work around them, they are not a wall. They are a map with the gaps helpfully marked.
Then there is the asymmetry nobody puts on a slide. An abusive billing operation can be conceived, staffed, monetised and dissolved in weeks. An audit cycle, an investigation, a referral and a recovery action routinely consume years. When one side moves in weeks and the other in years, the result is not in question. Only the size of the hole is.
Recovery, when it arrives, is thinner comfort than the press releases suggest. Money that has left a system has strong opinions about coming back. It moves offshore, layers through shell entities, or is simply spent. American enforcement agencies have become genuinely sophisticated, dismantling transnational billing networks with real analytical muscle, yet even their most celebrated actions recover a fraction of what left. The public sees a podium and a number and assumes the wound has been closed. In truth it has been photographed.
There is a second cost that almost never appears in compliance reporting. When detection is blunt, a system compensates by tightening everything – heavier pre-authorisation, broader denials, documentation requirements that expand like damp. So the hospital that has never filed a questionable claim in its institutional life now employs three people whose entire job is arguing with somebody else’s algorithm. Physicians burn out completing paperwork designed to catch a stranger. Patients wait while approvals crawl through a queue built for suspicion. A control system that cannot distinguish wrongdoing from complexity ends up taxing integrity in order to punish its opposite.
Ask a compliance officer what the function does, and you will hear about policies, attestations, training modules and hotline logs. All necessary. None of it, by itself, stops a bad claim from being paid. Over three decades, compliance drifted from a control function into a documentation function. Its central question changed – quietly, without a memo – from did we prevent the loss to can we demonstrate that we tried. The structural reason is unglamorous. Clinical data, coding data, claims data and payment data live in separate systems that were never introduced to one another. Bad billing behaviour respects no such boundaries. It lives in the seams between departments, because that is where nobody is standing.
Several health systems elsewhere, building later and carrying less legacy baggage, made a different architectural choice. Saudi Arabia routes claims through a national exchange where eligibility, coding logic and clinical plausibility are tested at the moment of submission. Dubai and Abu Dhabi run centralised platforms on the same principle: validate on the way in, not on the way out. Britain’s counter-abuse authority has pushed towards intelligence-led prevention, while Germany and the Netherlands built cross-payer data sharing that makes unusual patterns visible while they are still small. None is flawless, and that is not the point. Each treated validation as infrastructure – part of the rail every claim travels on – rather than an inspection performed later on files chosen by lottery.
It would be comfortable to file all of this under other people’s problems. It is not. Pakistan is in the middle of the largest expansion of publicly financed healthcare in its history. Provincial health card schemes push enormous sums through empanelled private hospitals on a fee-for-service basis. That is precisely the financing model that produces billing leakage everywhere on earth it has been deployed, and we adopted it quickly, at scale, while our validation capacity is still finding its feet.
The early signals are familiar to anyone working in the sector. Procedures billed at a higher acuity than the one delivered. Admissions whose necessity would not survive a second opinion. Surgical volumes at certain facilities that no epidemiology can explain. Claims filed with impressive confidence against people who were never in the building. None of this is exotic. These are the standard opening moves, and they will be tried against any system that pays first and verifies later.
I have spent my career inside revenue integrity, and this is what I believe. Pakistan’s real opportunity is not to build a better recovery apparatus. It is to skip that stage entirely. We do not have thirty years of tangled legacy infrastructure to unwind. We can build validation into the rail now – automated eligibility verification, clinical plausibility scoring, provider behaviour baselines, real-time flags at the point of submission – for a fraction of what it costs to retrofit later. Every rupee spent guarding the front door saves several spent chasing shadows out the back. And unlike recovery, prevention protects something recovery never touches: the patient at the end of the queue, whose district budget was quietly drained long before she reached the counter.
The traditional model is not failing because the people inside it are careless. Most are the best-intentioned professionals in the building. It is failing because it was built for a slower, smaller, more trusting environment than the one it now polices, and because it grades itself on effort rather than outcome. An audit that samples cannot see scale. A rule that never changes cannot follow a moving target. A recovery action that begins after the money is gone is not a control. It is a condolence.
Which leaves one road open. If human review cannot match the volume, and machines following fixed rules cannot match the adaptation, the only remaining option is systems that learn. Not as a buzzword. Not as a procurement fashion. As plain arithmetic. We have spent a generation becoming excellent at describing our losses. It is time to get good at preventing them.
The writer is a health economics researcher and healthcare specialist working in revenue integrity and health financing policy. She can be reached on X at @mariaabbasi688.
Courtesy
