The Company Auditing Your Charts Makes more by saying no.
The Company Auditing Your Charts Is a Portfolio Asset that Earns More By Saying No
CMS did not hire a federal employee to review your wound care charts. It contracted a vendor. The vendor's parent company is owned by a private equity firm, which earns more when the vendor says no. Here is what that means for the physician at the fax machine.
Tuesday morning. A podiatrist in Phoenix. The fax machine wakes up before the front desk does and spits out a request for records on twelve patients she treated for diabetic foot ulcers in the last eighteen months. Twelve full charts. Conservative care notes. Ulcer measurements. Product justification. Thirty days to respond.
She has seen records requests before. This one is different. The letterhead at the top is not Medicare. It is a vendor name she does not recognize, a vendor contracted by CMS to run a new prior authorization pilot called WISeR,1 a vendor whose parent company is owned by a private equity firm2 she has also never heard of. She does not know the name of the algorithm. She does not know the criteria. She knows she has thirty days.
This is the new shape of Medicare. Not a federal employee in a federal office reading your charts. A portfolio company reading your charts on behalf of investors who will sell that company to other investors inside of five years.
Dr. Eric Lullove published a two-part series last week that maps how this happened. Part one3 covers the data infrastructure under federal healthcare. Part two4 covers the audit contractor ecosystem and who owns it. Read both. What follows is what those pieces mean for the physician at the fax machine.
Your Reviewer Is a Portfolio Asset
Cotiviti holds Medicare RAC contracts for most of the country. Cotiviti is not owned by a clinical organization. Cotiviti is owned by Veritas Capital and KKR.2 Veritas Capital also owns or has owned Truven Health Analytics, athenahealth, and a portfolio of other government-services companies. Veritas describes the assets in its portfolio as mission-critical to government customers. That is investor language for hard to remove once embedded.
RACs are paid on contingency.10 They earn a percentage of every dollar they recover from a physician's practice. The fee runs nine to twenty percent.
The company reviewing your charts earns more money when it decides your charts are wrong. The investors behind that company expect a return. The return depends on recovery yield. Recovery yield depends on denials.
This is not corruption. It is structure. Nobody is breaking the law. Everyone is doing what the structure tells them to do. The physician on the wrong end of that structure is doing the only sensible thing she can do, which is not enough.
Lullove's reporting walks the ownership chains in detail. Every contractor name a Florida physician sees on a records request — SafeGuard Services,9 Cotiviti, the WISeR vendors — traces upward through a holding structure. Some of those structures are public. Some are private. None of them have a clinical organization at the top.
The Algorithm You Cannot See Is Reading Your Chart
CMS has not disclosed the algorithms WISeR vendors use.5 The vendors themselves have not disclosed them. The pilot launched January 1 and runs through December 31, 2031. CMS has called WISeR a roadmap for incorporating more private sector innovations into agency operations.6 That is plain language for plans to expand.
The vendors are technology companies.7 Cohere Health, Genzeon Corporation, Humata Health, Innovaccer, Virtix Health, and Zyter.8 They are not your specialty society. They are not your peer review committee. They are software vendors operating under contracts that pay them more when they say no.
Here is what that means for the physician in Phoenix on a Tuesday morning. Her clinical decision is being reviewed by code she cannot inspect, written by employees she cannot identify, working for a company whose ownership she has not researched. If the code returns a nonaffirmation, she will get the outcome. She will not get the reasoning.
You can submit again. You can resubmit unlimited times. You can appeal. None of that gets you the source code, and none of it gets you a clinical conversation with a peer.
The conversation has been pulled out of the clinical frame and into a procurement frame. The physician thinks of WISeR as a billing problem. WISeR is not a billing problem. WISeR is a clinical authority problem.
And Then There Is Palantir
Palantir Technologies holds a five-year, $90 million blanket purchase agreement with HHS.11 That makes its Foundry platform available to every HHS agency through a single procurement vehicle. CMS has awarded Palantir a proof-of-concept contract for the National Directory of Healthcare Providers and Services.12 NIH and FDA deploy Foundry. CDC used it during the pandemic. ARPA-H signed a $19 million contract with Palantir in 2024.13
The Electronic Frontier Foundation documented that ICE used Palantir's ELITE tool to access HHS Medicaid enrollment records.14 Subsequent reporting and leaked procurement documents describe the same pattern.15 Palantir has denied building cross-database functionality for that purpose. The denial is on the record.
In New York City, the public hospital system paid Palantir about $4 million between 2023 and 2026 to scan physician notes for what the contract called "charges captured from missed opportunities." The Intercept reported on that contract in February.16 The contract ends in October 2026.17
The legal walls between these datasets exist. The technical walls do not. That is not speculation. That is what cross-system query infrastructure does by design.
What does this mean for the physician at the fax machine? It means her data, her notes, her billing patterns, the patterns of every physician she shares a region with, all sit on platforms designed for the kind of queries she has not been told are running. Audit defense is no longer a matter of pulling a chart out of a folder. It is a matter of trusting that the platforms holding her data are operated by parties whose incentives align with hers. None of the parties involved have published anything that would let her make that judgment.
What This Looks Like in Practice
The map of the wound care market in 2026 looks like this.
A pilot program with explicit expansion plans is reviewing skin substitute claims in six states. The vendors running the pilot earn a percentage of denials. Their algorithms are not disclosed. The states where the pilot does not yet operate sit under contractors whose ownership traces to private equity firms cycling assets on five-year holds. The data infrastructure underneath all of it is operated, in part, by a company that has been documented assisting federal immigration enforcement using databases the company has publicly denied connecting.
The physician at the fax machine is the smallest party in that map. She is also the party that takes the loss when any link in the chain decides her charts are wrong. The structure of the system has put her clinical authority in a position where it is easier to overrule than to defend.
There are physicians in this country reading this and thinking the system has not come for them yet. The structure says it will. The pilot is a roadmap. The plan is to scale.
What the Operator-Class Physician Does Now
What you can do is make sure your distribution relationships, your compliance team, and your record-keeping infrastructure are operated by people who will tell you the truth when something looks off. The first signal of a coming audit is rarely the audit. It is something a rep saw three months earlier in another practice and never mentioned because it was not yet his job to mention it.
If your distributor is delivering product and not delivering signal, you are operating without an early warning system. The system you are operating against has too many parts and too much capital aimed at recovery yield to be defended without one.
Let's Talk Through What You Have and What You Don't
If you want to talk through what your current distribution relationships are giving you and what they are not, email me directly. I will tell you what I see.
Email Ty at Bionavix- 1CMS.gov. "WISeR Innovation Model." cms.gov/priorities/innovation/innovation-models/wiser
- 2Veritas Capital. "Cotiviti Completes Recapitalization with KKR and Long-Standing Owner Veritas." veritascapital.com
- 3Blue Amp Media / Eric Lullove, DPM. "The Architecture of Surveillance." Part 1. blueamp.co
- 4Blue Amp Media / Eric Lullove, DPM. "Who's Auditing Your Claims — and Who Owns Them?" Part 2. blueamp.co
- 5Morgan Lewis. "CMS Is Getting WISeR About Medicare Waste, But at What Cost to Providers?" July 2025. morganlewis.com
- 6CMS.gov. "WISeR Model Frequently Asked Questions." cms.gov
- 7BHM Healthcare Solutions. "WISeR Model Vendor List." November 2025. bhmpc.com
- 8Zyter|TruCare. "WISeR in Arizona." zyter.com
- 9Maynard Nexsen. "SGS Gets the UPIC Auditing Contract." maynardnexsen.com
- 10Kalantar Law. "Types of Healthcare Audits." kalantar.law
- 11FedScoop. "HHS Palantir Platform BPA." fedscoop.com
- 12FedScoop. "Palantir CMS Healthcare Directory Prototype." fedscoop.com
- 13FedScoop. "ARPA-H Enters Data AI Contract with Palantir." fedscoop.com
- 14Fed-Spend.com. "Palantir Government Contracts Deep Dive." fed-spend.com
- 15State of Surveillance. "Palantir Government Surveillance Ecosystem." stateofsurveillance.org
- 16The Intercept. "Palantir Contract, New York City Health and Hospitals." February 2026. theintercept.com
- 17The Intercept. "Palantir New York City Hospitals Contract." theintercept.com
Ty Harvey is the founder of Bionavix, a wound care distribution and consulting company serving private practice physicians in Florida and across the United States.
This article is independent commentary and analysis of publicly reported developments in Medicare payment integrity, including reporting by Eric Lullove, DPM, in Blue Amp Media, and reporting by The Intercept, FedScoop, and the Electronic Frontier Foundation.
Nothing in this article constitutes legal, compliance, or clinical advice. Providers facing active audits or records requests should retain qualified healthcare counsel and consult their own compliance advisors.