Official scrutiny is growing. The Department of Justice called policing Medicare Advantage an important priority on its anti-fraud agenda. The agency said in February that it pursued health plans that gamed the system “by submitting unsupported diagnosis codes to make their patients appear sicker than they actually were,” and cited Ross’s case as an example. Ross’s attorneys estimate the scope of such frauds reaches into the billions of dollars.

Ross filed her complaint against Group Health under seal a decade ago, and it remained a secret for seven years. With the aid of other whistleblowers, the Justice Department has also sued industry giants including UnitedHealth, Anthem Inc. and  Cigna Corp. over similar allegations in recent years. The companies are fighting the cases.

Now it’s up to the courts to decide which practices are legitimate and which constitute fraud. Ross remains shaken by her experience. Coming forward wasn’t easy, she said. “The easy thing would've been to sit down and just let it happen.”

Ross, 57, grew up outside Seattle, a math whiz in a family that kept busy with music lessons and school activities. Her father had a heart attack while she was in high school, and she spent a lot of time at the hospital, pressing his doctors for information. That early exposure coupled with her mathematical acumen led Ross into a career in an obscure corner of the health-care industry. In 1998, she arrived at a nonprofit insurer called Group Health Cooperative to lead a division building statistical models of patient risk.

In the 2000s, these models became central to the growing Medicare Advantage industry. Money hinged on the illnesses that plans documented for their members. Traditional Medicare pays doctors and hospitals directly for each test or service. In Medicare Advantage, health plans get a fixed payment from the government for each member they take on. The program will spend on average about $14,000 per enrollee this year. Through a process called risk adjustment, added diagnoses typically bump payments by $1,000 to $5,000, sometimes even $10,000, according to MedPAC. It’s meant to compensate insurers for taking on sicker patients and discourage them from cherry-picking healthy people.

Health-care companies developed increasingly sophisticated methods to maximize payments. A cottage industry of vendors emerged to help them. They mine data from patient charts, send staff to do health-risk assessments in patients’ homes and prod doctors to review potentially missed diagnoses.

Ross said she and Group Health originally embraced the system as a way to identify patients who needed care but weren’t getting it. “It’s not just digging for dollars,” she said. “It’s improving care.”

Her whistleblower suit and the Justice Department complaint that followed describe a growing pressure within the company to engineer higher risk scores for greater payments. She rebuffed one vendor called Leprechaun LLC hired in 2008 that wanted to submit claims “based on documentation that was clearly inadequate,” according to Ross’s complaint.

By 2011, Group Health’s finances deteriorated, and it was facing downgrades from credit raters. That fall, Group Health’s chief executive officer met a counterpart from a Buffalo plan called Independent Health, which had just formed a new subsidiary focused on risk adjustment called DxID, according to Ross’s complaint. In an early pitch, DxID CEO Betsy Gaffney told one of Ross’s colleagues that Group Health’s internal approach to risk-adjustment “is really putting you back financially,” according to the Justice Department complaint. “I get what the purpose of the policies are theoretically, and even kind of agree philosophically, but it is very restrictive,” she wrote in a November 2011 email.

Group Health hired DxID the next month on a contingency basis. The vendor would keep 20% of any new revenue it brought in from combing old patient charts to uncover missed diagnoses. Gaffney proposed new ways to identify patients who suffered from illnesses like chronic kidney disease or low oxygen levels, a condition called hypoxia, according to the Justice Department complaint.

Ross recalls her managers lit up when they realized how much money it might bring in. Reviewing two years of data, DxID added thousands of potential diagnoses that increased Group Health’s revenue by $32 million, the U.S. alleged. But when Ross checked DxID’s work, she found that three-quarters of the diagnostic codes it submitted for payment lacked proper documentation and didn’t stand up to scrutiny, according to her complaint.

The plan got paid for one patient’s depression diagnosis even though a physician said it had resolved and the patient now had “an amazingly sunny disposition,” according to Ross’s complaint. It claimed another patient had kidney complications from diabetes even after a doctor had explicitly ruled that diagnosis out.

DxID would pull illnesses from the “problem list” doctors maintained in electronic medical records, a section of the chart that sometimes contained old or resolved conditions, Ross said. The company also used lab tests or other orders as proxies to infer diagnoses, even when clinicians had not documented the illnesses. For example, patients getting supplemental oxygen were assumed to have hypoxia, even though oxygen can be prescribed for less serious problems like sleep apnea, the complaint says. Later DxID would send physicians “addendum” forms to update charts with suggested diagnoses, paying them $25 to fill them out, the U.S. alleged.

This approach produced some unlikely results. One patient’s depression was supposedly documented during a visit to an ophthalmologist, according to Ross’s complaint. In another case, when Gaffney was working for Independent Health, a woman was coded for prostate cancer, because “when a married couple has any disease, both were assigned to that disease,” she wrote in an email, according to the Justice Department complaint.