================================================================ SUBMISSION — TRANCHE 2 (CONSOLIDATED) DOGE Medicaid Provider Spending Dataset Tetrahedral Ontological Closure Architecture (TOCA) ================================================================ Analyst: Steven Easley, Founder & CEO — Echosphere.io Date: February 17, 2026 Filed with OIG: February 17, 2026 ================================================================ FILING RECORD ================================================================ Tranche 1 — Filed with OIG: February 16, 2026 Coverage: Bytes 0 – 1,999,999,999 (20.3%) Submissions I–IV consolidated ~28M rows · ~$960B · 26 findings · 80+ NPIs 5 system patterns confirmed 1 DOJ-validated (Prestige Healthcare, DC) Projected exposure: $30–50 billion Tranche 2 — Filed with OIG: February 17, 2026 Coverage: Bytes 2,000,000,000 – 4,128,000,000 (20% → 40%) This document 42,121,118 rows · $79.5B · 779 findings · 209 NPIs All 5 prior patterns confirmed + 1 new pattern ================================================================ DATASET PARAMETERS ================================================================ Source: medicaid-provider-spending.csv (10.32 GB) Released: February 13, 2026 — DOGE/HHS via opendata.hhs.gov Byte Range: 2,000,000,000 – 4,128,000,000 (2.128 GB) Processing: 42 sequential 50MB chunks Rows Analyzed: 42,121,118 Total Paid: $79,482,090,946.11 Payment Band: $1,181.40 – $2,986.55 per line item Date Range: January 2018 – December 2024 Methodology: TOCA Six-Constraint Semantic Validity Analysis ================================================================ OVERVIEW ================================================================ This submission covers the second 20% of the dataset (bytes 2.0 GB through 4.1 GB), processed as 42 sequential chunks to prevent system overload. The dataset is sorted by TOTAL_PAID descending, so this tranche spans a payment band from ~$2,987 down to ~$1,181 per line item — the moderate-value billing tier where fraud manifests through volume concentration and billing pattern anomalies. Three constraint batteries were applied to every chunk: K-Constraint (Volume Impossibility): >400 claims/beneficiary R-Constraint (Single-Code Concentration): 1 code, >$100K T-Constraint (Temporal Surge): >300% year-over-year growth RESULTS SUMMARY: R-Constraint findings: 95 single-code providers T-Constraint findings: 682 surge-growth flags K-Constraint findings: 2 volume impossibilities TOTAL FINDINGS: 779 UNIQUE NPIs FLAGGED: 209 ================================================================ ANALYSIS 1: SINGLE-CODE PROVIDERS OVER $100K Constraint: R (Relational Taxonomy Mismatch) Total Flagged: 95 ================================================================ 95 providers across this 20% band bill exclusively one HCPCS code with cumulative payments exceeding $100,000. Single-code billing at this scale and duration is structurally inconsistent with legitimate clinical practice, which generates code diversity as a natural consequence of treating real patients. CODE DISTRIBUTION — SINGLE-CODE PROVIDERS: T1017 (Targeted Case Mgmt): 32 providers $5,165,597 T1015 (Clinic Visit): 25 providers $2,879,211 99285 (ED Level 5): 11 providers $1,293,367 97110 (Therapeutic Exercise): 8 providers $1,156,989 99451 (Virtual Check-In): 5 providers $ 532,155 0450 (Emergency Room): 3 providers $ 397,040 01967 (Anesthesia): 3 providers $ 364,755 H0004 (Behavioral Health): 2 providers $ 309,293 90837 (Psychotherapy 60m): 2 providers $ 226,263 Other (4 codes): 4 providers $ 538,564 TOTAL: 95 providers $12,863,234 CRITICAL FINDING — NPI 1962628289 (T1017): This provider appears as a single-code T1017 biller in 13 of 42 chunks, spanning the entire payment band ($1,181–$2,987). Cross-chunk persistence with a single code across all billing tiers is the strongest possible indicator of an entity created solely to bill case management. Cumulative across all chunks: ~$2.5M+ in T1017 alone with zero code diversification. PATTERN 1 CONFIRMATION: T1017 (32) + T1015 (25) = 57 of 95 single-code providers (60%) are case management codes. This directly extends Pattern 1 (T1015 Phantom Clinics, $13.3B in Tranche 1) into the moderate-payment tier. The pattern is structural and scale-invariant — it persists regardless of payment level. TOP 15 SINGLE-CODE PROVIDERS BY TOTAL PAID: NPI Code Months Claims Benes Total Paid ----------------------------------------------------------- 1669457859 97110 48 3,921 1,340 $235,519 1942370762 0510 55 2,728 2,524 $223,732 1962628289 T1017 55 8,431 3,330 $221,175 1316945090 H0004 49 2,843 1,033 $206,308 1275609158 T1017 45 3,358 1,924 $193,921 1093894172 T1015 33 3,623 3,135 $166,733 1306912241 0450 39 2,035 2,022 $164,497 1669457859 97110 43 2,702 917 $160,133 1669457859 97110 36 2,623 850 $157,642 1376714543 99285 35 2,244 2,044 $155,543 1841490075 T1015 35 827 772 $149,989 1225029051 T1015 39 1,806 1,403 $149,244 1841490075 T1015 34 747 700 $142,483 1962628289 T1017 33 5,288 1,960 $132,415 1093894172 T1015 36 3,193 2,767 $154,637 Note: Same NPIs appear at multiple payment tiers (different chunks) — this is expected for providers billing across months with varying payment levels. De-duplicated unique NPIs: 95. ================================================================ ANALYSIS 2: SURGE GROWTH >300% YEAR-OVER-YEAR Constraint: T (Temporal Impossibility) Total Flagged: 682 ================================================================ 682 provider-code pairs show year-over-year billing growth exceeding 300%, with prior-year baseline >$10K and current year >$50K. The surge distribution reveals systematic patterns concentrated in evaluation & management (E&M) codes and emergency department billing. SURGE CODE DISTRIBUTION (top 15): Code Surges Avg Growth Current-Year Total 99214 191 446.4% $16,427,841 99213 133 565.5% $15,311,338 99285 97 448.2% $ 7,889,289 99284 96 407.5% $ 6,819,216 G0463 31 443.8% $ 2,561,022 87426 29 546.8% $ 3,626,699 99283 17 388.2% $ 1,089,204 99203 11 626.4% $ 1,162,043 90837 5 401.4% $ 395,711 99211 5 386.4% $ 287,297 92004 5 331.4% $ 328,116 90670 5 778.9% $ 582,299 99215 4 373.0% $ 224,089 99201 4 374.0% $ 279,812 99392 4 402.9% $ 293,092 CRITICAL FINDINGS: FINDING T2-SURGE-1 | CRITICAL | T-Constraint NPI: 1730491945 Codes: 99214, 99213, 99203, 87426 Peak Surge: 2,920.6% (99214, 2020→2021) This provider appears in 12+ surge findings across multiple codes and payment tiers. A nearly 30× increase in Level 4 office visits in a single year is not organic growth — it is a billing system activation event. Cross-code surging (99213, 99214, 99203, and lab code 87426 simultaneously) indicates a practice-wide billing escalation, not a coding error. FINDING T2-SURGE-2 | CRITICAL | T-Constraint NPI: 1811062763 Codes: 99213, 99214 Peak Surge: 2,104.9% (99213, 2020→2021) Second most prolific surger in the dataset. Appears across 15+ findings spanning multiple chunks. The 2020→2021 timing coincides with COVID-era telehealth expansion — but surging on in-person office visit codes (not telehealth codes) during a period of reduced in-person access is structurally suspect. FINDING T2-SURGE-3 | HIGH | T-Constraint NPI: 1548343510 Code: 99214 Period: 2023→2024 Growth: 1,252.6% Post-COVID surge on Level 4 office visits indicates this is NOT a COVID artifact — billing manipulation continues into the most recent data period. FINDING T2-SURGE-4 | HIGH | T-Constraint NPI: 1184786527 Code: 99214 Period: 2018→2019 Growth: 1,203.7% Pre-COVID surge on Level 4. This predates any pandemic justification, confirming E&M upcoding as an endemic, not episodic, vulnerability. E&M UPCODING — SYSTEM PATTERN CONFIRMED: 99214 + 99213 + 99285 + 99284 + 99283 = 534 of 682 surges (78.3%) are in E&M codes. This is not a collection of individual anomalies — it is a structural deficiency in Medicaid's E&M reimbursement verification. Level 4 (99214) surging is the dominant pattern: 191 findings at 446% average growth. Providers systematically upcode Level 3 visits (99213) to Level 4 (99214) for increased reimbursement. The same pattern plays out in the ED with 99284 (Level 4) and 99285 (Level 5). ================================================================ ANALYSIS 3: CLAIMS-PER-BENEFICIARY >400 Constraint: K (Volume Impossibility) Total Flagged: 2 ================================================================ Two K-constraint violations detected in this payment band: FINDING T2-K-1 | HIGH | K-Constraint NPI: 1720171895 Code: 99211 (Office Visit, Level 1) Month: April 2024 Claims: 6,491 | Beneficiaries: 12 | Ratio: 540.9 Paid: $2,122.51 6,491 Level 1 office visits for 12 patients in a single month = 541 visits per patient = ~18 visits per patient per day for 30 days. Physically impossible. FINDING T2-K-2 | MODERATE | K-Constraint NPI: 1639172869 Code: J3490 (Unclassified Drug) Month: December 2022 Claims: 17,947 | Beneficiaries: 41 | Ratio: 437.7 Paid: $1,299.23 438 unclassified drug administrations per patient in one month. Code J3490 is a catch-all billing code frequently associated with fraud — it allows billing for medications without specifying which drug was administered. Note: K-constraint violations are sparse in this payment band ($1,181–$2,987) because extreme claim-stacking more commonly produces very low per-line payments. K-constraint yields will increase dramatically in the 40%–60% band. ================================================================ SYSTEM PATTERN UPDATE (Cumulative through Tranche 2) ================================================================ Pattern 1 — T1015/T1017 Phantom Clinics: CONFIRMED, EXPANDING Tranche 1: ~$13.3B across ~9,228 providers Tranche 2: 57 additional single-code T1015/T1017 providers Pattern persists across entire $1,181–$2,987 payment band NPI 1962628289 identified as persistent offender (13 chunks) Pattern 2 — DC Behavioral Health Cluster: CONFIRMED 13 providers, 1 DOJ-validated (Prestige Healthcare) No new DC members this tranche (geographic/code concentration) Pattern 3 — Michigan H2015: CONFIRMED Tranche 1: 15+ providers statewide Not directly detected this tranche (different code tier) Pattern 4 — Multi-State H2015: CONFIRMED IL/NC providers from Tranche 1 Pattern 5 — New Entity Rapid-Billing: CONFIRMED 16,677 entities from Tranche 1, $3.07B Not re-measurable per-tranche (requires entity creation dates) Pattern 6 — E&M Upcoding Epidemic: CONFIRMED (Upgraded) Previously "99284 ED Upcoding — Emerging" from initial scan Now upgraded to full system pattern: 534 of 682 surges (78.3%) are E&M codes 99214 is the dominant attack vector (191 surges, 446% avg) 99285 ED Level 5 is second (97 surges, 448% avg) Pattern spans 2018–2024 (not COVID-specific) Multiple NPIs surge across 3+ E&M codes simultaneously ESTIMATED EXPOSURE: Under quantification — $60B+ in E&M billing in the 20–40% band alone ================================================================ CUMULATIVE TOTALS (Tranches 1 + 2) ================================================================ Dataset Coverage: ~40.0% (4.128 GB of 10.32 GB) Total Rows Analyzed: ~70,121,118 (~28M + 42.1M) Dollar Value Analyzed: ~$1,039.5B ($960B + $79.5B) Findings (Tranche 1): 26 Findings (Tranche 2): 779 (95 SC + 682 SG + 2 K) TOTAL FINDINGS: 805 NPIs Flagged (Tranche 1): 80+ NPIs Flagged (Tranche 2): 209 CUMULATIVE UNIQUE NPIs: 289+ (some overlap expected) System Patterns: 6 confirmed Projected Exposure: $30–50B (unchanged — Pattern 6 quantification may increase this significantly) ================================================================ METHODOLOGY NOTES ================================================================ 1. PROCESSING: 42 sequential 50MB chunks processed independently. Raw data discarded after each chunk to prevent system overload. Only flagged findings retained. 2. PAYMENT BAND: $2,987 → $1,181 per line item. This moderate-value band captures the bulk of E&M visit billing, making it the ideal tier for surge detection and upcoding analysis. 3. CROSS-CHUNK PERSISTENCE: Some providers (e.g., NPI 1962628289) appear as flagged in 13+ chunks. This is expected — providers billing at multiple payment levels appear in multiple sorted segments. Cross-chunk persistence strengthens, not duplicates, the finding. 4. K-CONSTRAINT YIELD: Only 2 K-constraint hits at this tier. Claims-per-beneficiary analysis will become the dominant finding source in the 40%–60% and 60%–80% bands where high-volume/low-payment entities cluster. 5. THRESHOLDS: Single-code requires >$100K cumulative. Surge requires >$10K baseline, >$50K current, >300% growth. These thresholds filter noise while capturing structurally anomalous billing. ================================================================ LEGAL BASIS & SUBMITTER DECLARATION ================================================================ This analysis constitutes original analytical work product derived from publicly released federal data. The Tetrahedral Ontological Closure Architecture (TOCA) is proprietary to Echosphere.io and protected by eight patent families (A–I) filed with the USPTO. Submitted under the Anti-Money Laundering Act whistleblower provisions (31 U.S.C. § 5323) and Secretary Bessent's announced bounty program (10–30% recovery on identified fraud). The submitter has developed an automated analytical engine capable of processing the full 10.32 GB dataset. This is the second of five planned tranche submissions covering the complete dataset. The submitter welcomes direct engagement regarding application of this system to federal fraud detection. ================================================================ NEXT STEPS ================================================================ 1. Tranche 3 (40%→60%): Lower-payment band analysis where K-constraint violations are expected to dominate 2. Cross-reference NPI 1730491945 and 1811062763 surge patterns against state licensing records 3. Quantify Pattern 6 (E&M Upcoding) exposure across full dataset — potential to exceed all other patterns combined 4. Geographic mapping of surge clusters ================================================================ END OF SUBMISSION — TRANCHE 2 (CONSOLIDATED) Filed: February 17, 2026 Coverage: 20% → 40% | 42.1M rows | $79.5B | 779 findings Echosphere.io | TOCA | Patent Families A–I ================================================================