Alleged $90 Million Medicare Advantage DME Fraud Scheme Involving Dublin Helping Hand

Unauthorized Claims, Stolen Provider Attribution, and the Industrialization of Durable Medical Equipment Fraud

On March 20, 2026, the U.S. Attorney’s Office for the Northern District of California announced that Anar Rustamov, a 38-year-old Azerbaijani national formerly of Sunnyvale, California, had been charged in connection with a scheme that allegedly used an entity he created, Dublin Helping Hand, to submit thousands of fraudulent durable medical equipment claims to Medicare Advantage Organizations between October 2024 and June 2025, seeking more than $90 million for blood glucose monitors, orthotic braces, and related equipment that was allegedly not provided, not medically necessary, and not authorized by a medical provider.

DOJ also stated that the listed beneficiaries were unaware of the claims, that the referring provider listed on the submissions had not authorized them, and that Rustamov was at large as of the announcement. HHS-OIG simultaneously published a parallel enforcement page confirming the action. [1]

The case matters beyond its dollar figure because it appears to target a claims-side fraud vector in Medicare Advantage, not the better-known risk-adjustment coding cases that have dominated recent Medicare Advantage enforcement. In other words, the public allegations are not that a Medicare Advantage plan inflated diagnosis codes to obtain higher CMS capitated payments; they are that a purported DME supplier submitted false claims to the plans themselves on behalf of unsuspecting beneficiaries. That distinction is central. It places the alleged failure point inside the fragmented anti-fraud environment of Medicare Part C plan operations and DME supplier controls, rather than the traditional Medicare fee-for-service MAC environment or the civil risk-adjustment arena. [2]

Publicly accessible materials remain materially incomplete. I was able to verify the DOJ press release, the HHS-OIG enforcement page, and several reputable reports repeating or lightly elaborating on those allegations. I was not able to verify a public indictment PDF, a case-specific PACER/CM-ECF docket URL, an unsealed docket sheet, exact statutory counts beyond what secondary reports described, an arrest or extradition update, any seizure amount, any restitution demand, or any plan-specific payment/recovery figure. Because of those gaps, this report distinguishes sharply between verified facts, high-confidence inferences, and unknowns. [3]

The strongest analytic conclusion is straightforward: the allegations describe a classic DME fraud architecture adapted to the Medicare Advantage environment—front entity creation, unauthorized use of beneficiary identity, unauthorized use of referring-provider information, high-volume claim submission, and exploitation of fragmented plan-level controls. What the public record does not yet show is equally important: named co-conspirators, billing companies, clearinghouses, telemarketers, sham telemedicine vendors, specific HCPCS codes, bank accounts, laundering routes, or actual paid loss. Those omissions limit precision, but they do not erase the structural lesson. [4]

Source Base and Procedural Status

The table below separates what is publicly verifiable from what remains inaccessible in open-web materials reviewed for this report. Direct links are included inline where I could verify them. [5]

The public reporting is not perfectly aligned on the charging structure. The DOJ press release openly discusses “criminal charges” and repeatedly describes an indictment for health care fraud, while the San Francisco Chronicle reports 14 counts involving aiding and abetting health care fraud and money laundering. Local News Matters, by contrast, compresses the matter as an indictment “on a charge of health care fraud.” Without the actual indictment or docket sheet, the exact count structure and money-laundering statute number remain unverified in this report. [6]

A second procedural caution follows from what is missing. HHS-OIG tags the matter as involving “Criminal and Civil Actions,” but I did not locate a verified civil complaint, False Claims Act filing, administrative exclusion, seizure warrant, forfeiture complaint, or restitution order in accessible public materials. That does not mean those proceedings do not exist; it means I could not verify them from the sources available here. [7]

Timeline and Case Reconstruction

The verified time axis is sparse but usable. DOJ places the alleged scheme start in October 2024 and its end in June 2025. The grand jury returned an indictment on March 19, 2026, inferred directly from DOJ’s March 20 statement that Rustamov “was indicted yesterday.” DOJ and HHS-OIG announced the case on March 20, 2026. Secondary reporting published on March 21, March 22, and March 24 added count language and repeated that Rustamov was still at large. No later arrest, extradition, plea, seizure, or sentencing update surfaced in the materials reviewed through May 22, 2026. [5]

No publicly verified post-announcement enforcement milestone located in reviewed materials

Open-web review result

Moderate

The timeline below visualizes the verified and near-verified sequence. Dates and endpoints come from DOJ, HHS-OIG, and the named secondary reports. [5]

The reconstruction between October 2024 and June 2025 cannot yet be granularly sequenced month by month. The public record does not disclose when the company was formed, when MAOs first paid or rejected claims, whether a provider complaint or beneficiary complaint triggered detection, 2whether claim submission velocity spiked, or when law enforcement first obtained records. That missing middle section is where the indictment and docket would matter most. [8]

Actors and Organizational Footprint

The actor map is unusually thin for a $90 million alleged health-care fraud case. One alleged operator is publicly named: Anar Rustamov, age 38, described by DOJ as a national of Azerbaijan and formerly of Sunnyvale, California. One entity is publicly named: Dublin Helping Hand, described as an entity Rustamov created and used to submit claims. The direct victims named in the charging narrative are unsuspecting Medicare beneficiaries, the MAOs that received the claims, and at least one referring medical provider whose authorization was allegedly falsely represented. The investigative agencies publicly attached to the matter are HHS-OIG and the FBI. DOJ identified Assistant U.S. Attorney Maya Karwande, with assistance from Lynette Dixon, as the prosecution team named in the press release. [9]

A critical negative finding deserves emphasis: I found no high-confidence public identification of billing companies, clearinghouses, telemarketing vendors, sham telemedicine companies, call centers, or foreign financial conduits in this case. Those features are common in other DME fraud prosecutions, but the accessible public record here does not support attributing any of them to Rustamov or Dublin Helping Hand. [10]

The foreign footprint is therefore narrow at present. The only verified foreign element is the defendant’s Azerbaijani nationality, plus DOJ’s statement that he “appears to have entered the United States illegally.” The public materials reviewed do not verify foreign-origin call centers, foreign shell suppliers, foreign beneficiary-targeting campaigns, or foreign laundering nodes. [8]

Scheme Mechanics and Financial Flow

The verified operative mechanics are simple and direct. DOJ alleges that Rustamov created Dublin Helping Hand and used it from October 2024 through June 2025 to submit large volumes of claims to Medicare Advantage Organizations for DME items including blood glucose monitors and orthotic braces. The claims allegedly used the identities of beneficiaries who did not know claims were being submitted on their behalf, and they listed a referring medical provider who had not authorized them. DOJ further alleges that the equipment was not provided, not needed, and not authorized. Those are the core public facts from which the technical reconstruction must proceed. [8]

That evidence supports a high-confidence process model: the alleged scheme required a supplier-facing claims identity, beneficiary identifiers sufficient to generate member-specific claims, provider identifiers sufficient to make the claims appear ordered or referred, and enough claims-submission infrastructure to push thousands of claims into MAO payment systems over roughly nine months. What it does not yet establish is the precise submission rail: direct plan portal entry, outsourced billing company, 837P/clearinghouse flow, payer gateway, or some hybrid arrangement. [8]

The diagram below shows the verified path and the control points that appear, from the public allegations, to have failed. The known facts come from DOJ and reporting that tracks the indictment allegations; the red-flag nodes are analytical inferences, not separately charged acts. [8]

Technical reconstruction

Because public materials do not disclose HCPCS or CPT detail, the most rigorous statement is a negative one: specific claim codes are not publicly identified in the sources I could verify. The DOJ and secondary reports name only DME categories—blood glucose monitors and orthotic braces. That means any code-level discussion beyond those categories would be speculative unless grounded in the indictment or claims data. [8]

The beneficiary-identity component is clearer. A functioning DME claim requires enough patient data to link the item to a covered member. DOJ’s allegation that the beneficiaries were unaware means the scheme likely bypassed patient-facing consent and ordinary order confirmation. The provider-identity component is equally central: because DOJ says the “referring medical provider” did not authorize the claims, the case squarely includes alleged misuse of provider-order attribution, whether through forged orders, unauthorized reuse of provider data, or some comparable false-order mechanism. The public record does not yet distinguish among those possibilities. [8]

Equally important is what the record does not show. I found no verified public evidence of telemarketing, call-center lead generation, stolen EMR access, manipulated recordings, kickbacks, sham telemedicine consults, or clearinghouse abuse in this particular case. Those are well-known DME fraud methods in other prosecutions, but they are not yet attributable here on the record reviewed for this report. [10]

Financial flow and scenario analysis

The only publicly verified top-line money figure is the more than $90 million sought in reimbursement. DOJ did not publicly state how much, if any, was actually paid, how much was intercepted, whether any of it came from federal reinsurance or plan reserves, or whether accounts were frozen. Because Rustamov was reportedly at large when charges were announced, and because secondary reporting referenced money-laundering counts without public statutory detail or a forfeiture figure, actual proceeds must be treated as unknown in this report. [11]

Still, the public allegation that the scheme involved “thousands” of claims permits a bounded arithmetic exercise. The table below uses simple scenarios to show the implied average billed amount per claim if the intended billings exceeded $90 million. This is not a finding about actual claim counts; it is a sensitivity table illustrating the density of the alleged billing. The calculation uses the public allegation of >$90 million and thousands of claims. [8]

Even with a 10,000-claim scenario, the implied average billed amount remains high for ordinary single-item DME episodes. That does not prove any particular coding pattern, but it strongly suggests one or more of the following: repeated claims per beneficiary, multi-item or accessory billing, higher-dollar orthotic lines, a claim count closer to the lower end of “thousands,” or combinations of those factors. That is an inference from the public totals, not a disclosed claims dataset result. [12]

A second arithmetic frame is time. Spread across the verified public window of October 2024 through June 2025, the alleged intended billings imply more than $10 million per month on average. That is consistent with industrialized rather than opportunistic submission behavior. It suggests velocity itself should have been a detection signal, especially if Dublin Helping Hand was newly created or thinly credentialed. [12]

Systemic Vulnerabilities in Medicare Advantage and DME

The broader Medicare Advantage environment helps explain why this case matters. Medicare Advantage is administered by private Medicare Advantage Organizations, and CMS pays those organizations under a distinct managed-care structure rather than processing every claim through the traditional Medicare fee-for-service machinery. Reuters’ reporting on recent Aetna and Kaiser matters emphasizes that MAOs receive federal payments tied to enrollee risk and that private insurers now receive more than $530 billion annually to care for Medicare Advantage patients. Market reporting this year places Medicare Advantage enrollment at roughly 35.5 million people, or about 51% of the Medicare market, with estimated costs around $83 billion to $84 billion more annually than comparable traditional Medicare coverage in current critiques based on MedPAC/JEC-style analyses. That scale means claims-side failures inside Part C matter fiscally, not merely operationally. [13]

The Rustamov allegations point to a different Medicare Advantage weakness than the one dominating headlines. The Aetna and Kaiser matters focused on diagnosis and risk-adjustment inflation—plans or affiliates allegedly increasing CMS reimbursement by overstating patient morbidity. Rustamov’s alleged conduct instead targeted provider claims payment rails inside MA plans by using a front-end DME supplier identity, beneficiary data, and allegedly unauthorized provider attribution to send high-volume claims to the plans. Put bluntly: the Aetna/Kaiser line is about how plans bill the government; the Rustamov line is about how outside actors allegedly bill the plans. The control failures and remedial tools are related, but they are not the same. [2]

Prior authorization and plan-level utilization management do not eliminate that exposure. AP’s coverage of the June 2025 insurer pledge reports that nearly all Medicare Advantage customers require prior authorization for some services and that insurers denied about 6% of requests in recent KFF data. Reuters reports that, in June 2025, major insurers and HHS publicly committed to standardize electronic submissions and reduce authorization burdens. The policy signal is revealing: Medicare Advantage operates through numerous plan-specific, still-evolving administrative systems. In that environment, anti-fraud performance is necessarily fragmented across carriers, delegated vendors, and network-management infrastructures. A fraud pattern that slips through one plan’s onboarding or edit logic may replicate across others before cross-plan intelligence catches up. [14]

The DME categories named here are especially instructive. Blood glucose-monitoring equipment and orthotic braces are code-driven, medically-necessity-sensitive items that can be billed at scale if a bad actor has access to beneficiary and provider identifiers and can present a facially valid supplier profile. DOJ’s allegations show exactly those features: item categories that look reimbursable on paper, beneficiary identities attached to the claims, and a provider attribution layer that allegedly gave the submissions an appearance of authorization. This is the kind of fraud that exploits administrative plausibility, not sophisticated medicine. [8]

The enforcement background also matters. Reuters’ summary of DOJ Criminal Division’s 2025 year in review describes a record-setting Health Care Fraud Unit year, including the largest-ever National Health Care Fraud Takedown and more than $15 billion in intended losses charged. That backdrop suggests increasingly data-driven enforcement against fraud architectures that can be detected from billing, beneficiary, and transaction anomalies even when public court filings remain sparse. The Rustamov case fits that trend. [15]

Enforcement and Policy Implications

At the prosecution level, the case appears to reflect a deliberate choice to keep the public-facing narrative simple: one named defendant, one named entity, clear product categories, straightforward false-claim allegations, and a fugitive posture. That has advantages. It allows the government to announce the matter, warn plans and beneficiaries, preserve investigative flexibility around unnamed co-conspirators, and avoid prematurely disclosing the internal signals by which MAO-targeted fraud was detected. What it sacrifices, at least publicly, is operational transparency. Without the indictment or docket, outside analysts cannot yet evaluate venue choices, forfeiture strategy, sealing decisions, or the degree of cooperation from victim plans. [9]

Civil and administrative remedies remain conceptually available even if not yet publicly verified here. Given the allegations, one would ordinarily look for parallel recoupment by affected MAOs, payment suspensions, provider termination from plan networks, HHS exclusion consequences, forfeiture efforts tied to realized proceeds, and possibly False Claims Act or unjust-enrichment style civil theories if paid claims can be traced. HHS-OIG’s own page labels the matter under “Criminal and Civil Actions,” which at minimum signals that the case sits inside an enforcement ecosystem broader than the single criminal announcement. But because I could not verify any such parallel filing, they should be treated as potential avenues, not confirmed developments. [16]

The policy implications are sharper. First, CMS oversight of Medicare Advantage anti-fraud controls remains substantially less legible to outsiders than traditional Medicare program-integrity controls. The Rustamov allegations suggest the need for minimum CMS-imposed antifraud expectations for MAO claims operations in high-risk DME categories: new-supplier enhanced due diligence, beneficial-ownership checks, bank-account validation, prepayment review triggers for high-velocity billing, plan-to-plan anomaly sharing, and rapid suspension protocols when beneficiary or provider complaints surface. Those recommendations follow directly from the alleged failure points and the scale of the MA market. [17]

Second, provider-order authentication is the weakness most clearly illuminated by the public allegations. DOJ says the listed referring provider did not authorize the claims. That means the core administrative safeguard should move from passive data acceptance to active order validation. In practical terms, plans and CMS should push toward authenticated electronic ordering, NPI-order attestation workflows, outlier monitoring for first-time order-provider/supplier pairings, and automatic holds when a new DME supplier suddenly generates claims under a provider who has no established ordering relationship with that supplier. Those are analytical recommendations, but they are directly anchored to the provider-authority spoofing alleged here. [8]

Third, beneficiary confirmation remains underused as a fraud-control tool. DOJ alleges that the beneficiaries did not know claims were being submitted on their behalf. For high-risk DME categories, especially from new or low-history suppliers, plans should treat post-adjudication explanations of benefits as too late. A stronger design is first-use beneficiary verification—text, phone, portal, or mailed confirmation—before payment or before release from prepayment review when risk signals cluster. That recommendation is consistent with the public allegations, even though the record does not reveal whether any affected plan already used such a process. [12]

Finally, the Medicare Advantage reform agenda should stop treating utilization management and antifraud architecture as separate problems. Reuters and AP describe insurer and HHS efforts in 2025 to standardize electronic prior authorization and reduce administrative burden. Those same data pipes can support better antifraud telemetry if regulators insist on it: authenticated order provenance, normalized supplier identifiers, interoperable anomaly flags, and comparable reporting across plans. Administrative simplification without antifraud standardization leaves the same fragmented surface exposed. [18]

Open Questions and Limitations

The table below captures the major unresolved issues that prevent a fuller forensic reconstruction.

The effect of those gaps is concrete. They prevent a definitive answer to the user’s most technical questions about code-level claim engineering, precise money movement, and downstream enforcement steps. The strongest parts of the present case file are the who, when, top-line amount sought, item categories, identity misuse theory, and at-large status at announcement. The weakest parts are the charging-document granularity, actual loss, asset trace, and network map of accomplices/intermediaries. [5]

On the merits, that still yields a defensible bottom line: the public record supports describing this as an alleged high-volume Medicare Advantage DME claims fraud centered on a single front entity, unauthorized beneficiary/provider identity use, and more than $90 million in intended billings. It does not yet support a confident public description of telemarketing, sham telemedicine, EMR compromise, specific code sets, seizure amounts, or completed laundering pathways in this particular case. Any report that goes further without the indictment would be filling silence with stereotype. [8]

---

CITATIONS

[1] [2] [3] [4] [5] [6] [8] [9] [10] [11] [12] [17] Northern District of California | Foreign National Charged with Orchestrating Health Care Fraud Scheme Targeting Medicare Advantage Programs | United States Department of Justice

https://www.justice.gov/usao-ndca/pr/foreign-national-charged-orchestrating-health-care-fraud-scheme-targeting-medicare

[7] [16] Foreign National Charged with Orchestrating Health Care Fraud Scheme Targeting Medicare Advantage Programs | Office of Inspector General | Government Oversight | U.S. Department of Health and Human Services

https://oig.hhs.gov/fraud/enforcement/foreign-national-charged-with-orchestrating-health-care-fraud-scheme-targeting-medicare-advantage-programs/

[13] https://www.reuters.com/legal/litigation/us-doj-says-aetna-pay-1177-million-resolve-false-claims-act-allegations-2026-03-11/

https://www.reuters.com/legal/litigation/us-doj-says-aetna-pay-1177-million-resolve-false-claims-act-allegations-2026-03-11/

[14] https://apnews.com/article/e8814aa509028c45e34cf11aa9fe0809

https://apnews.com/article/e8814aa509028c45e34cf11aa9fe0809

[15] https://www.reuters.com/legal/legalindustry/2025-doj-criminal-division-fraud-section-year-review--pracin-2026-01-30/

https://www.reuters.com/legal/legalindustry/2025-doj-criminal-division-fraud-section-year-review--pracin-2026-01-30/

[18] https://www.reuters.com/legal/litigation/us-health-chief-kennedy-met-with-insurers-prior-authorization-requirements-2025-06-23/

https://www.reuters.com/legal/litigation/us-health-chief-kennedy-met-with-insurers-prior-authorization-requirements-2025-06-23/