In health insurance, there is often a party that remains invisible to the insured, does not always receive sufficient attention from the insurer, and is noticed by the regulator only indirectly. It does not assume insurance risk, yet it manages the entire process: claims, healthcare providers, member inquiries, and turnaround times. This party is commonly referred to as a TPA.

A TPA (Third-Party Administrator) is an independent administrator to which an insurance company outsources the servicing of its health insurance portfolio, including claims processing, provider network management, and member support. The insurance risk itself is not transferred: it remains entirely on the insurer’s balance sheet.

Some large administrators have their own clinical analytics teams capable of reviewing claims as thoroughly as an insurer. For most TPAs, however, the objective is different: to deliver the core servicing functions – to meet deadlines, process the required volumes, and maintain the provider network. Assessing whether a particular treatment or procedure was medically justified is generally not a priority. The administrator is responsible for the process; the insurer is responsible for its financial outcome. The conclusion is clear: medical claims auditing should be a separate function retained by the insurer.

How Control is Organized in Four Countries

Switching TPA Turnover: The Insurer's Lever of Influence

South Africa

Each medical scheme usually has a single TPA, and it is rarely changed. Switching administrators is a complex process that can stretch over years: while the new TPA is getting up to speed with the client base and processes, scheme members can face delays in authorizations, reimbursements, and claims processing. Because of this, competition between administrators is rarely used as a tool for managing payouts.

UAE

An insurer works with not one but several TPAs – typically three or more. At the same time, over 95% of insurers in the market work through TPAs rather than building in-house processes: the administrator model still clearly dominates. TPAs split portfolios, regions, and products. This creates natural competition: the insurer sees who performs better and reallocates volume accordingly. TPAs know they are being checked and compared.

Saudi Arabia

An insurer usually works with a single TPA, but switching administrators is a common practice. Currently, most of the market – around 80% – has already moved away from the TPA model in favor of its their own in-house structures. As long as the insurer stays with a TPA, moving from one administrator to another is accepted practice if quality or oversight falls short. This gives TPAs a constant incentive to perform well.

Russia

The “switch administrators” lever works differently, because the model itself is different. In VHI (voluntary health insurance), large insurers administer claims themselves and run medical review using in-house medical experts and case managers – this is, from the start, an in-house model, the same model Saudi Arabia is now moving toward.

Regulatory Oversight: Who Sees the Data

South Africa

The regulator does not have direct access to raw data – it sits with the TPA, not the regulator. Oversight here is built differently: not through data access, but through process requirements – reporting on service coverage, mandatory limits, compliance checks. In terms of data access, this oversight is lighter than in Saudi Arabia, but in terms of requirements placed on administrators, it is fairly strict.

UAE

The regulatory landscape is fragmented: each emirate has its own rules. In Dubai, the regulator (DHA) requires reporting and is developing digital platforms to detect anomalies, but there is no single national system yet. The regulator's access to data is limited, but the insurer compensates for this by using multiple TPAs and regular audits.

Saudi Arabia

All transactions run through a single national platform. The regulator (CCHI) sees the data in real time, licenses TPAs, sets the rules, and can revoke a license. A TPA cannot be a “black box” – the regulator has direct access to the data.

Russia

For voluntary health insurance in Russia, the Bank of Russia (CBR) requires insurers to have in-house medical review, but there is no precise standard for how much checking is required – the insurer decides for itself how many cases to check and how to check them.

Trends: Where the Market is Heading

South Africa

Remains TPA-dominated for now. Large administrators are building more detailed medical-bill audits into their processes, and a number of schemes are also starting to set up their own forensic units to audit bills on their side.

UAE

Keeping the TPA model but tightening control – through regulatory directives, reporting requirements, and the development of analytics platforms. Multiple TPAs are not just “extra hands” but a tool for managing quality.

Saudi Arabia

A market moving rapidly toward in-house administration. More than 80% of insurers already operate without external administrators, building their own units. This lets them keep full control over data and processes.

Russia

Moving toward tighter control. Automated systems for medical-economic review are developing – checking tariffs and registers against each other is increasingly done algorithmically, which is expanding the reach of this first, technical level of review. Large insurers are also investing in their own analytics and anti-fraud units.

This division of responsibility exists in every “insurer + TPA” model, but it is structured differently across markets. Saudi Arabia has chosen transparency: the regulator has direct access to the data, without intermediaries. The UAE has chosen competition: portfolios are divided among several TPAs, whose performance is continuously benchmarked against one another. South Africa has focused on process discipline, with strict requirements and regular audits.

Russia has embedded control into law through mandatory multi-level claims review.

Four different approaches, reflecting four different regulatory cultures. Each examines a particular dimension: the claim, the processing time, or formal compliance. Yet they all share one limitation: none of these mechanisms analyses the relationships between visits, providers, and treatments. As real-world investigations across several countries have shown, the most costly schemes are not hidden within a single claim – they exist within these connections.

The “insurer + TPA” model offers significant advantages, which is why insurers choose it. But it also has an inherent structural feature that market mechanisms can mitigate only partially – and one that requires dedicated attention from the insurer itself. Let us examine how this model works in four different countries.

Advantages, and What Needs the Insurer's Separate Attention

The “insurer + TPA” model didn't become the standard by accident – it has real advantages. But it does not, on its own, close the gap on controlling medical costs: that remains the insurer's responsibility, and market mechanisms in different countries only help with this partially.

Advantages

The insurer doesn't need to build and maintain its own claims-processing infrastructure, staff of operators, and network of provider contracts – building this from scratch is expensive and slow.

1 A TPA operates on the combined volume of several insurers and millions of insured members, so it can secure terms and rates from clinics and pharmacies that a single insurer could almost never negotiate alone.

2 Operational risk and responsibility for service quality partly shift to the TPA: the insurer has someone to hold accountable for turnaround times, network availability, and service quality – this doesn't rest entirely on the insurer.

3

What Needs Separate Attention

The TPA's target function is operational service: process the claim, meet deadlines, keep the provider network running. In-depth checking of whether prescriptions are medically justified is usually not part of that function —– it remains the insurer's task.

1 As a result, TPAs typically invest in basic operational and technical checks – completeness of documents, compliance with tariffs, duplicate claims —– and much less in analyzing provider behavior at the level of relationships: who works with whom as a pair, which prescriptions repeat as a template, which codes follow one another too regularly. Some large TPAs have strong in-house medical-analytics teams that also covers this level of review. But this is more the exception: most administrators in the market don't have the resources for this kind of work, and keeping a separate team of analysts and experts for it is often not cost-effective.

2 Where the insurer has few levers of influence over the TPA – as in South Africa, where switching administrators is fairly labor-intensive – the insurer's own focus on medical-bill audits becomes even more important.

3 Even where the depth of review is set by law rather than the market, coverage is still incomplete. The sample selected for medical review only covers part of all cases, and that isn't enough to spot a suspicious scheme or to analyze it at the level of relationships.

4

How an Insurer Can Strengthen Control

No market fully solves this problem for the insurer, but each one offers its own set of tools

Regulatory access to data – as in Saudi Arabia, where the regulator sees all transactions directly and can revoke a TPA's license.

1 Competition between several TPAs – as in the UAE, where the insurer splits the portfolio between administrators and reallocates volume toward those that perform better.

2 Regular audits of TPA performance – not only financial, but also medical and analytical, carried out by the insurer itself.

3

These mechanisms help TPAs and other administrators work faster and more carefully at the level of individual claims. But they don't replace an in-depth analysis of the relationships between providers and patients. There is one way for an insurer to raise the quality of control above its current level —– analyze the data at the level of relationships. For this, an insurer can either build its own team of experts to audit all bills, or bring in an independent expert provider with extensive international experience and proven expertise, established models, and operational capacity.

For Relationship-Level Analysis to Work at All, Data Needs High-Quality Preprocessing

Wanting to “look at relationships, not individual claims” isn't enough on its own. Raw data usually arrives fragmented: the same service is named differently by different providers, a drug's composition and dosage are buried in free text rather than a structured code, and diagnoses from the same treatment episode are scattered across different claims and different dates. For patterns like the ones described below to even become visible, the data first needs to be brought to a common standard:

Classification of services

1 A complete picture of the patient's diagnoses within a treatment episode

2 The correct quantity of services rendered

3 Attribution of services and prescriptions to a specific physician – who exactly prescribed a given service or drug

4 Classification of medications by composition and dosage, rather than by brand name

5

Without this preprocessing, even the most advanced relationship-level analytics won't work: the system will end up comparing things that aren't comparable and will miss exactly the patterns that cost the insurer the most.

What the Real Data Shows

We want to share a small selection of examples found in real data. These are cases from different countries and different control systems – cases that were paid and went unnoticed at the time the bills were checked. In every case, each individual claim looks normal. The schemes only become visible when using advanced data-analysis methods, interpretable relationship visualization, well-trained models of normal behavior, and anomaly-detection techniques.

Links Between Physicians (South Africa)

A dentist has more than 100 patients over the reporting period, and more than 80% of them come from the same general practitioner. No other patient source comes close to that share. The two doctors also bill the same person on the same day in 30% of cases.

One case shows the mechanics especially clearly: the GP diagnoses the patient with “gingivitis” (gum inflammation, code K05.0) and bills a consultation – and on the same day, the dentist cleans the same patient's teeth and takes an X-ray. In effect, the GP billed separately for the very problem the dentist is treating right then. In other cases, the GP records a harmless diagnosis of “common cold” and prescribes no medication at all – the consultation exists only to create a reason for the visit, after which the patient goes on to see the dentist for treatment, which is highly questionable during a cold.

Templated Treatment (Botswana)

One general practitioner prescribes the same set of eight drugs to a large number of patients: several antibiotics, an opioid painkiller, an antihistamine, a cough suppressant. It doesn't matter whether the patient comes in with a cough or back pain – the set barely changes, only the diagnoses change.

The most telling case is a one-year-old child with an ordinary cold. The child is prescribed an almost adult dose: two antibiotics at once, a steroid, and a painkiller containing codeine – a drug that should never be given to a child that age.

In numbers: this doctor's per-patient spending is almost 2.5 times the market average, and the number of services per visit is one and a half times the norm.

The Pharmacy “Adds” Diagnoses (UAE)

A patient comes in with a sore throat. The doctor records five diagnoses in the chart and sends a prescription. On the same day, at the affiliated pharmacy of the same provider, the bill is issued for an even larger number of diagnoses. And each new diagnosis code allows an additional drug to be added: an inhaler and an anti-nausea medication are added on top of the antibiotic and cough medicine. Why this wasn't in the record at the doctor's visit is unclear; whether these drugs were actually dispensed or just billed still needs to be established.

This is a systemic pattern, not a one-off error. At this provider, the diagnosis of “asthma” comes up almost three times more often than the market average – and is never confirmed by the required test (spirometry). A similar story with gastritis: the test for the bacterium that causes ulcers is done for only one patient in forty, while the diagnosis itself comes bundled with a prescription for an expensive acid-suppressing drug in almost half the cases.

This doctor's average bill per patient is nearly four times higher than colleagues in the same market.

Justifying Services by Expanding the Diagnosis List (UAE)

One doctor has a distinctive pattern: if you break out the statistics by knee code, it turns out the knee that “hurts” is always the right one. The left knee and “knee, unspecified” never appear once over the whole period. Meanwhile, the patients complaining about their knee are mostly people who came in with a sore throat. The diagnosis is simply tacked onto the visit – and it opens up a prescription for a painkiller.

A similar pattern shows up with skin conditions: he diagnoses bacterial and fungal infection at the same time in almost half of “skin” patients – even though the only way to tell the two apart is lab testing, and the necessary tests don't appear on his bills. The patient ends up prescribed both an antibiotic and an antifungal together, “just in case.”

A telling diagnosis is pyoderma (a bacterial skin infection): this doctor records it almost 10 times more often than roughly fifty colleagues at the same clinic. At the same time, each individual bill looks modest – on average no higher than other doctors' bills – so the pattern doesn't stand out when checked claim by claim.

Hospital Admissions Without Matching Treatment (South Africa)

Private

A GP referred a seriously ill patient to a cardiologist, who admitted the patient and ordered tests – standard medical logic.

General

60% of this GP's patients end up at the emergency department, and 40% of those are then admitted to a general ward. From there, patients almost always move on to one of two “regular” specialists at the same hospital: 85% of the nephrologist's patients and 77% of the cardiologist's patients came from this same GP – no other source comes close to that share.

One case from this group: a 29-year-old man is admitted with gastroenteritis. Over three days in hospital, he receives no IV fluids, no anti-nausea medication, no antibiotics – nothing that treats gastroenteritis. Meanwhile, the cardiologist runs a full cardiology package – ECG, echocardiogram, treadmill stress test, spirometry – and bills all of it under a diagnosis of “dyspepsia” rather than the condition the patient was actually admitted for. The bed and the tests are paid for; the illness that put the patient in hospital is never treated.

A similar but larger case: a patient with COPD spends 10 days on the ward and receives nothing but saline the entire time – not a single bronchodilator, steroid, or antibiotic. Instead of treatment: an echocardiogram, a Doppler study, a treadmill stress test, and spirometry – the same cardiology package given to this specialist's other patients, regardless of what they were admitted for.

None of these cases is visible at the moment the claim is billed – each individual line item passes any standard check. The pattern only comes to light once hundreds of visits are put together and the structure becomes visible: who pairs up with whom, which combination repeats too often, which diagnosis is never confirmed by a test. This level of analysis is rarely built into medical-bill audits today.

Empty Follow-Up Visits After 4–6 Days (Russia)

After an initial consultation, a follow-up visit 4–6 days later is scheduled almost every time. In 88.7% of cases, this is the only line item billed that day – no tests, no procedures, no new prescriptions. This isn't monitoring the course of an illness; it's an extra billable visit.

For every 600 initial consultations, there are 500 follow-ups

1 More than 85% of follow-up visits come with no other services or additional tests

2 The median interval is 5 days; for half of patients it falls within 4–6 days

3

A Routine Check-Up Disguised as Chronic Disease Treatment (Russia)

A clinic runs standard preventive check-ups but bills them as treatment for serious chronic conditions. The same combinations of diagnoses repeat word for word across dozens of patients, and services are scheduled on a fixed calendar (for example, a GP visit on the 8th, an ultrasound on the 13th, lab tests on the 19th, a follow-up on the 25th). The months change, but the dates stay the same – that's a schedule, not clinical progression.

Template Diagnosis Pairs

I83.2 + N11.0

Varicose veins with a trophic ulcer, and reflux pyelonephritis. Yet the clinic has no surgeon, no wound dressing, no venous Doppler ultrasound – only the urinary system is actually examined.

N20 + I11.0

Kidney stones and hypertension with heart failure. In most cases there is no kidney ultrasound and no echocardiogram to confirm the heart failure.

M53.0 + G44.9

Cervicocranial syndrome and headache. Two codes for one complaint; 90% of patients get this pair at a neurologist visit alongside the N20 + I11.0 pair.

K81 + M42

Cholecystitis and spinal osteochondrosis. Both codes are recorded before any ultrasound and without any spinal exam (the clinic has no X-ray). Of all patients with this pair, only 10% ever saw a neurologist.

Markers of a Systemic Pattern

For 75% of female patients with the I83.2 + N11.0 pair, every step falls on the same dates each month: visit on the 8th, ultrasound on the 13th, blood test on the 19th, urine test on the 20th, follow-up on the 25th.

The N20 + I11.0 pair has its own schedule: GP on the 10th, neurologist on the 12th, test panel on the 19th, neurologist follow-up on the 28th or 30th.

For 95% of patients with the M53.0 + G44.9 pair, this pair follows the N20 + I11.0 pair – so in just two visits, the patient picks up four chronic diagnoses at once.

What This Means for an Insurance Company

These examples show that controlling medical costs requires advanced, in-depth data analysis on the insurer's side. Different markets offer different tools, but a few things are worth keeping or building under any model:

Keep access to full data.

1 Analyze data at the level of relationships between providers, treatment episodes, and prescribing patterns.

2 Have your own tools, or bring in independent expertise.

3 Audit medical bills regularly – not just financially, but medically and analytically.

4

We recognize that building an in-house team is expensive and takes time. It requires not just hiring specialists but also building up expertise and fine-tuning algorithms on local data. External companies that specialize in medical-data analytics can offer ready-made solutions, already proven in other markets, with faster rollout and lower cost. They bring not just technology but also knowledge of different models and patterns of abuse – which is especially valuable for insurers who are just starting to build independent oversight.

What this approach delivers

A reduction in excess payouts (an estimated 10–15% of claims contain unjustified prescriptions).

1 Transparency, and the ability to monitor the performance of clinics and administrators.

2 Protection from reputational risk – systemic errors won't go unnoticed.

3 Savings on building and maintaining in-house analytical infrastructure.

4

Conclusion

Regardless of country or model, the conclusion is the same: controlling the loss ratio and auditing medical bills is an important task for the insurer. It's essential to run regular medical-bill audits – not sample-based, but built on analysis of full data: relationships between providers, treatment episodes, clinical logic, and patterns. Because excessive prescriptions are only visible in relationships, not in isolated line items.

Not every insurer can afford to build its own analytics team for this work. Independent companies with this kind of expertise offer ready-made solutions that help quickly get an independent picture of what's happening with payouts, spot hidden anomalies, and assess how efficiently money spent on medical services is being used. This gives the insurer the ability to make informed decisions: whether to change administrators, reallocate the portfolio, or require additional audits. In a world where data is becoming the key asset, access to the right analytics is not a luxury – it's a necessity for keeping costs under control.

About Mains Lab

Mains Lab is a global provider of artificial intelligence and machine learning solutions focused on improving integrity and efficiency within health insurance systems. The company operates across the Middle East, Europe, Latin America, and Africa. To date, Mains Lab’s technology has enabled insurers and TPAs to achieve over USD 1 billion in total savings, helping organisations detect fraud, reduce waste, and optimise claims management through advanced real-time analytics.

www.mainslab.com

BACK TO NEWS