GM, Welcome Back to the Dead Drop.

A parent walks into a Twin Cities autism center with a child who has been waiting on services for months. The intake is friendly. The paperwork is mostly handled. There will be a small monthly cash payment, the staff explains, in exchange for keeping the child enrolled. $300 to start. Up to $1,500 if the authorized service hours are high enough. If the child does not yet have an autism diagnosis, the center can assist with getting one. If a competing center across town offers a higher kickback later, the parent is welcome to come back and renegotiate. Several families did exactly that. The DOJ filing notes them.

The center was Smart Therapy LLC. The owner of record was Asha Farhan Hassan, age 28, although DOJ documents establish that other unnamed partners held undisclosed ownership stakes, including one who had previously been excluded from running an adult daycare. From November 2019 through December 2024 the operation pulled $14 million from the Minnesota Early Intensive Developmental and Behavioral Intervention program, a Medicaid benefit designed to pay for one-on-one applied behavior analysis for children diagnosed with autism. Smart Therapy did not deliver one-on-one ABA. It employed 18 and 19 year old relatives as "behavioral technicians," billed the maximum number of hours permitted per child whether services were rendered or not, and submitted claims under provider names without those providers' knowledge. Hassan pleaded guilty to wire fraud in September 2025. Her partners have not been charged. Some of the proceeds left the country and bought real estate in Kenya.

A second operation, Star Autism Center LLC, ran the same playbook and pulled $6 million before Abdinajib Hassan Yussuf, age 27, was charged in December 2025. The Acting U.S. Attorney for Minnesota, Joseph Thompson, framed both indictments as the first wave of an investigation that would expose what he called a web of schemes stealing billions across the state's public programs. He said it was not isolated. He was right, although not in the way the press release intended.

800 miles southeast, in Indianapolis, a woman named Meghann Mitchell was running an autism therapy company called Piece by Piece. In 2023 the State of Indiana paid Piece by Piece $29 million to provide ABA therapy to 84 children. That works out to $340,000 per child for a single year of treatment, more than Medicaid typically spends on a year of cancer care or nursing home placement. Piece by Piece was billing as much as $640 an hour for sessions delivered by staff who needed only a high school diploma and 40 hours of training to qualify, and who were earning, in many parts of Indiana, under $20 an hour to deliver them. Mitchell told the Wall Street Journal her company complied with Indiana's rules and that no audit had found fraud.

She was telling the truth. That is the problem.

Indiana, between roughly 2019 and 2023, reimbursed ABA providers at 40% of whatever the provider chose to bill. The state set no ceiling and enforced no rate floor. A clinic that decided to charge $800 an hour for the labor of a high school graduate received $320 an hour from the public treasury, and the only thing the clinic had to do to make that math work was raise the printed price. Indiana's Medicaid spending on ABA went from $21 million in 2017 to $611 million in 2023. 9 of the country's 10 highest-billing ABA providers per patient that year operated in Indiana. The state shut Piece by Piece down last month and now demands that every Indiana provider self-report any fraud, waste, or abuse. A nonprofit advocate in northern Indiana, Susan Crowell of My Autism Ally, said it cleanly. Indiana Medicaid knew who was billing in excess. The state paid them anyway. It was legal.

The Department of Health and Human Services Office of Inspector General began auditing four state Medicaid programs to see how widely the rot had spread. Each state's audit followed the same protocol: federal investigators pulled a random statistical sample of 100 enrollee-months, meaning 100 individual months of billed service for individual children selected at random from the state's full claim universe, and reviewed every line of every claim in the sample for compliance with federal and state requirements. The first audit, of Indiana, was published in December 2024. Of the 100 randomly selected enrollee-months, every single one contained at least one improper or potentially improper payment. The OIG estimated $56 million in improper payments and recommended Indiana refund $39.4 million in federal share. Indiana has not refunded a dollar.

Wisconsin's audit landed in July 2025. The same 100 enrollee per month methodology. Every single sampled month contained at least one improper or potentially improper claim. $18.5 million in improper payments. And one fact that defines the entire failure: the Wisconsin Medicaid program had not conducted a single post-payment review of an ABA claim since the program began in 2016. Nearly a decade of paying out for a therapy whose entire compliance regime depends on session notes, and not a single notes audit. The honor system in a billing-code economy is not an oversight. It is a policy choice.

Maine's audit, January 2026, found $45.6 million improper. 100 randomly sampled months, every one of them noncompliant. Colorado's, two months later, found $77.8 million in improper payments and another $207 million in payments classified as potentially improper. 100 randomly sampled months, every one of them noncompliant. The Colorado report cited a single provider that had billed 151 hours of therapy in one month. There are 720 hours in a 30-day month, including the ones in which the patient is asleep. Colorado is appealing the federal share recommendation.

What the four audits have in common is not just the dollar figures. It is the pattern that emerges when 4 different federal teams pull 4 different random samples in 4 different states and arrive at the same finding 400 times in a row. Every single sampled month, in every state audited, contained billing that did not comply with federal and state rules. That is not a sampling error. That is the program.

Across the four state audits, the OIG documented session notes that had been photocopied between patients, signed before the sessions had concluded, and in some cases generated for sessions during which the child was napping, eating lunch, watching a tablet, or watching a movie. Behavior technicians in some states had felony weapons convictions and prior assault convictions and were treating children because the state did not require background checks for the credential. One Indiana child, identified in audit findings, accumulated more than $600,000 in Medicaid payments between the ages of 2 and 11 on the strength of a single 2014 referral that no one ever bothered to reassess. The same child grew up in the documentation as if frozen in amber, never reevaluated, never discharged, perpetually billable.

The fraud being prosecuted is Smart Therapy and Star Autism Center, two operations in Minneapolis that ran a kickback scheme and got caught. The fraud being legitimized is Indiana's 40% reimbursement rule, Centria Healthcare's "25 to Thrive Model" that required 25 to 40 hours of weekly therapy regardless of clinical need, the private equity rollup that acquired more than 500 ABA centers in a decade, and the Colorado audit appeal that says the state should not have to refund what it paid because the auditors did not produce enough paperwork. One of those columns ends in handcuffs. The other ends in shareholder distributions.

If your business, your foundation, your trust, or your family has any exposure to a Medicaid-billing healthcare provider, including in any role that touches the operations of one, the controls below are not optional.

If a provider's per-patient annual billing approaches the cost of a year of cancer treatment, ask the question. The answer in 2023 was that 9 of the 10 highest-billers in the country operated in one state, under one reimbursement formula, with no one asking the question. The question costs nothing. The silence is what cost $611 million in a single year.

Naptime was billable. Movies were billable. A single 2014 referral kept billing for 9 years. A Colorado provider invoiced 151 hours of therapy in a 30-day window and was paid. 40% of whatever you charge was the law in Indiana for 4 years and produced a 30-fold increase in spending and zero state-level audits to match it. The fraud control unit caught Hassan and Yussuf. It did not catch the rule that paid Piece by Piece $340,000 per child, because the rule was the law. The most expensive fraud in this story is the one no prosecutor will ever charge, because someone, somewhere, signed a state Medicaid manual that made it permissible.

Fraud is not an immigrant phenomenon. Fraud is not a private equity phenomenon. Fraud is not a Twin Cities phenomenon. Fraud is the predictable behavior of human beings inside payment systems that reward billing and never check delivery, and the only variable that matters is which actor figures out the system first. Hassan figured out kickbacks. Mitchell figured out percentage reimbursement. Thomas H. Lee Partners figured out the "25 to Thrive Model." Each was responding to the same gravity. The state agencies that designed the gravity wrote checks for 9 years and called it healthcare.

The honor system in a billing-code economy is not a system. It is a transfer mechanism with a public-relations department.

If you sit on the board of any organization that pays a third party for documentation-dependent services, ask one question at the next meeting and refuse to leave the room until you have an answer. When was the last post-payment audit, what was the sample size, and what did it find. If the answer is "we don't do those," you now know what kind of system you are funding.

Deepfakes are forging your face, your voice, and your consent. While you debate which party is lying less, economic policy is looting your purchasing power in broad daylight. The threat doesn't always wear a ski mask; sometimes it wears a suit, a badge, or a campaign pin.

The Dead Drop is the fraud intelligence briefing 6,500+ professionals use to stay informed on fraud, power, and persuasion. Spot the threat before it sees you.

The criminals are already reading this. Your friends should be, too.

On the morning of January 28, 1986, the Space Shuttle Challenger lifted off from Kennedy Space Center in Florida carrying 7 astronauts, including a 37-year-old high school social studies teacher from Concord, New Hampshire named Christa McAuliffe, who had been selected from more than 11,000 applicants to be the first ordinary American civilian sent to space. Her students were watching from a classroom decorated with paper rockets. Her parents were watching from the bleachers at the Cape. Schoolchildren across the country were watching on television sets that teachers had wheeled into auditoriums for the occasion. 73 seconds after liftoff, at an altitude of roughly 48,000 feet, the shuttle disintegrated in a fireball that left a forking white plume against the Florida sky. All 7 astronauts died. The footage played on every network in America for the rest of the week. It is, for anyone who lived through it, the kind of memory that does not leave.

The cause, established by the Rogers Commission later that year, was a rubber O-ring seal in one of the solid rocket boosters. The seal had lost elasticity in the unusually cold Florida morning, failed to hold a joint under pressure, and allowed superheated gas to burn through the booster's external tank. The proximate engineering question was simple. Why had a known O-ring vulnerability, identified and discussed by engineers at the contractor Morton Thiokol the night before launch, not been sufficient to delay the mission.

A sociologist named Diane Vaughan spent the next 9 years answering that question. Her 1996 book, The Challenger Launch Decision, is the definitive postmortem, and her central finding was not what anyone expected. She did not find reckless engineers. She did not find willful executives. She found that nobody at NASA on the morning of January 28, 1986 believed they were authorizing an unsafe launch. Every individual decision in the chain that ended 73 seconds after liftoff had been made by competent professionals, applying the standards in front of them, against the data they had. The standards themselves were the problem. Every prior launch in which the O-rings had eroded slightly more than expected, and the shuttle had returned anyway, had quietly redefined what "expected" meant.

Erosion that would have horrified an engineer in 1981 was, by 1985, the documented norm.

She called it the normalization of deviance, and it is the most important framework in the world for understanding what happened in Indiana, in Colorado, in Maine, in Wisconsin, and in every state Medicaid agency where applied behavior analysis billing went from a regional line item to a billion-dollar industry without a single person, anywhere, deciding to commit fraud.

Consider the Indiana mechanism in slow motion. A provider in 2019 bills $150 an hour for ABA services. The state, under its 40% rule, pays $60. Nobody objects. Six months later the same provider bills $200. The state pays $80. Nobody objects. The provider's competitors notice. They raise their printed rates too, because the math is obvious and nobody is enforcing anything. Within two years the floor in the market is $300 an hour. Within four years a center is billing $640 for the labor of someone earning $18, and the owner can tell a Wall Street Journal reporter, with a straight face and no factual error, that her practice complies with state rules and no audit has ever found fraud. She is correct. The deviance has normalized. The fraud, in the only sense that institutions can recognize fraud, has ceased to exist.

This is how every catastrophic billing failure in the public health system metastasizes. It is how Wisconsin went nine years without a single post-payment review of an ABA claim, because the absence of review was, by year three, simply how Wisconsin ran the program. It is how Colorado can stand up in 2026, after a federal audit found 151 hours of therapy billed in a single 30-day month, and tell the federal government in writing that it disagrees with the recommendation to refund $42 million, because the auditors did not produce sufficient documentation to satisfy the state's standards. The state is not lying. The state has spent the last decade calibrating its standards to the conduct in front of it, and the conduct in front of it now includes 151 hours of billed therapy in a month containing 720 hours of clock time.

The terrifying thing about Vaughan's framework is that it does not require villains. It does not require a single bad actor. It only requires a system in which small deviations are not punished, which describes every multi-party oversight regime in modern American government, every compliance-by-attestation industry in the private sector, and every internal control function in any organization where the people doing the checking report, eventually, to the people generating the revenue. The deviance does not announce itself. It accumulates. The graph is rising the entire time and nobody plots it because the graph would embarrass everyone.

What Challenger teaches the modern operative is that catastrophe is not the failure of a system. It is the success of a system that has been quietly redefining itself for years. The seven astronauts who died on that morning in 1986 were killed by an organization in which every individual was doing their job correctly, against standards that had drifted 100 yards from where the standards had started, and where no one along the chain was empowered to look up from the rules in front of them and ask whether the rules themselves still made sense. The Indiana children whose Medicaid files generated $340,000 in annual billing apiece were treated by an organization in which every individual was doing their job correctly, against standards that had drifted 1,000 yards from where the standards had started, and where no one along the chain was empowered to look up from the reimbursement formula in front of them and ask whether the formula itself still made sense.

The defense is not vigilance. Vigilance fades. The defense is fixed reference points that do not bend to the data in front of them. A standard that has been the standard for 10 years and will be the standard in 10 more, against which any drift is immediately visible. NASA did not have one. Wisconsin did not have one. Indiana did not have one.

Drift is not an accident. Drift is what happens when a standard is asked to keep up with the conduct it is supposed to govern. The only thing standing between any institution and a fireball at 48,000 feet, or a $340,000 annual bill for a single child, is a number, written down somewhere, that nobody is willing to move.

Pick one critical control in your organization and ask when its threshold was last set. If the answer is "it has been adjusted as conditions evolved," the threshold no longer exists. You are operating without one and you do not know