No-fault medical mill fraud: what New York's rules aim to stop

A "medical mill" is a clinic that exists mainly to bill an insurer, not to treat patients. New York's no-fault system made that business attractive because it pays medical bills quickly after a crash, whoever caused it, and lets the patient hand the claim to the provider. The state's answer came in layers: a rule that withholds payment from fraudulently licensed clinics, upheld by New York's highest court in 2005; strict insurer deadlines paired with the right to demand proof; arbitration for honest disputes; mandatory fraud reporting; and, in 2026, new criminal tools aimed at the organizers of staged crashes.

This article walks through that design as a case study in how a benefit built for speed invites fraud, what each rule is meant to stop, and how other no-fault states went a different way. It describes allegations and rules, not any particular clinic.

How New York no-fault pays

New York is a no-fault state: after a crash, your own auto policy pays certain losses up to a limit, without anyone proving who was at fault. The core benefit is called basic economic loss. Under New York Insurance Law, it pays reasonable medical expenses, a share of lost earnings and some other costs, up to a per-person cap. In a February 2012 statement, the U.S. Attorney for the Southern District of New York described the cap as $50,000 in medical treatment for anyone injured in a car accident, regardless of which car was at fault. Confirm the current amount with the Department of Financial Services (DFS), the state's insurance regulator, before relying on it. Our guide to personal injury protection and the comparison in no-fault vs at-fault states cover the general idea.

Four features of the design matter for fraud.

Fee schedules. Medical charges are paid under fee schedules, which cap what a provider may collect for each service. The state's no-fault regulation, 11 NYCRR 65-3.16, says payment follows the schedules adopted under Insurance Law section 5108 and set out in Regulation 83 (Part 68).

Assignment to providers. A patient can assign benefits to the provider so the provider bills the insurer directly. Section 65-3.11 of the regulation says that on assignment the insurer pays benefits directly to the provider, using prescribed forms. Patients rarely see a bill. For a longer look at what you sign, see repair authorizations and assignment of benefits explained.

A 30-day clock. Under section 65-3.8, benefits are overdue if not paid within 30 calendar days after the insurer receives proof of claim, which includes verification of the information it requested. The insurer must pay or deny within that window, and unexcused deviations from the regulation's own steps shorten the time it has.

No adverse party. Because payment does not depend on who caused the crash, no at-fault driver or liability insurer has a reason to challenge the treatment. The patient is not paying, the provider is paid directly, and the insurer must pay fast. That mix, speed plus assignment plus fee-for-service billing, is the opening a mill uses.

What a medical mill looks like, as alleged

The clearest public description comes from a prosecutor's account, which is an allegation, not a verdict. In February 2012, the U.S. Attorney's Office in Manhattan announced an indictment of 36 people and called it the largest no-fault insurance fraud case in history. According to the prepared remarks of U.S. Attorney Preet Bharara, the indictment alleged:

• more than 100 clinics in New York City, which the prosecutor called "fraud mills";
• intended fraud of more than $275 million and actual loss of more than $113 million;
• licensed medical professionals paid to say they owned and controlled clinics that non-doctors in fact funded and ran;
• nearly every patient receiving the same package of treatments and referrals regardless of the injury, including acupuncture, physical therapy and chiropractic treatment as often as five times a week, followed by referrals for MRIs, x-rays, psychological treatment and neurological testing;
• billing for treatments patients did not need and, in many cases, never received, including audiology testing described as necessary to treat car-crash injuries;
• a kickback arrangement and money laundering through check cashers, shell companies and structured transactions; and
• defendants who included ten doctors and three lawyers.

The table links each alleged feature to the control that targets it.

The ownership rule and the Mallela decision

The most distinctive New York response goes after the clinic's ownership, not each bill. New York law generally requires medical professional corporations to be owned by licensed professionals. A mill avoids that by using a nominal owner while someone else controls the business and collects the profit.

The state's no-fault regulation addresses this directly. Section 65-3.16(a)(12) says a provider of health care services is not eligible for reimbursement if it fails to meet any applicable New York State or local licensing requirement necessary to perform the service. The Superintendent of Insurance added the paragraph effective April 4, 2002.

In State Farm Mutual Automobile Insurance Co. v. Mallela, 4 N.Y.3d 313, decided March 29, 2005, New York's Court of Appeals considered a question certified by the federal Second Circuit. The facts as alleged by State Farm: non-physicians paid doctors to put their names on filings establishing medical corporations, operated the corporations themselves, and drained profit through management companies that billed the corporations inflated rates. State Farm did not claim that the care was unnecessary or improper. The court's opinion held that:

• carriers may withhold payment from fraudulently incorporated medical corporations to which patients assigned their claims;
• the Superintendent's regulation is valid and has the force of law;
• carriers may look beyond the face of licensing documents to identify willful and material failure to follow the law; and
• the right is limited: carriers can delay payment to investigate only for good cause, and the court said that in the licensing context, good cause requires behavior tantamount to fraud, with technical violations such as missing an annual meeting or filing fees not enough.

The court also said that because the holding rested on the amended regulation, no fraud or unjust-enrichment claim could reach payments the carriers made before the regulation took effect on April 4, 2002, and it declined to decide whether such claims could be pleaded for later payments.

The decision shows the balance. The state accepted that a clinic's corporate shape can itself be the fraud, because the reimbursement flows to an entity that exists only because of false filings with state regulators. But it warned insurers not to turn the right to investigate into a tool for delay.

How insurers test a claim

New York's regulation is not only about fraud. It is mostly about timing, and it lets insurers ask for proof inside strict limits.

1. Forms out the door. Within 10 business days after receiving the application for no-fault benefits, the insurer must send the verification forms it will require (section 65-3.5).
2. Additional verification. Any further verification must be requested within 15 business days after the insurer receives the prescribed forms.
3. Medical examination. If the insurer wants an exam, it must schedule it within 30 calendar days after receiving the forms. Examinations and examinations under oath must be at a time and place reasonably convenient to the applicant, and a sworn examination of an applicant must rest on objective standards.
4. Decision. The insurer pays or denies within 30 calendar days after it has proof of claim. A denial goes on a prescribed form, and a copy of any medical examination or peer review report that is the reason for the denial must be released on written request (section 65-3.8).
5. No payment where no service. Section 65-3.8(g) provides that for medical services rendered on or after April 1, 2013, no payment is due where the services were not provided to an injured party, or where fees exceed the schedule's limits.
6. Limits on stalling. An insurer may not stop paying benefits just to arrange a medical exam, unless the applicant caused the delay, and it generally may not deny before the verification it requested is received. After 120 days from its first request without the applicant supplying the proof under the applicant's control, it may deny.

A worked example of the clock

Say a patient is injured on March 1 and a clinic that received an assignment submits a $2,400 bill for a month of treatment, which the insurer receives on April 3. The insurer's 30 calendar days run from then, but the regulation counts the insurer's own delays against it: if it takes longer than the allowed time to ask for verification, the 30 days shrink by the same amount. Say it requests the clinic's records and asks for an independent exam. The clinic ignores the request. The claim is not overdue while the requested proof is outstanding. If the exam finds the treatment unnecessary, the insurer denies on the prescribed form. The clinic may then seek arbitration or sue. These numbers are invented to show the sequence. The real calculation depends on dates, forms and the exact regulation text.

What arbitration and fraud reporting add

Arbitration. Insurance Law section 5106 sets up simplified dispute resolution for no-fault claims, and the regulation says optional arbitrations are administered by an organization designated by the superintendent. An applicant who disputes a denial, or whose claim is overdue after a demonstrable attempt to get payment or an explanation, can start arbitration. This gives honest claimants a route that does not require a lawsuit.

Mandatory reporting. DFS's 2023 health fraud annual report explains that Insurance Law section 405 requires insurers to report suspected fraud to DFS, and section 409 requires larger insurers to file a Fraud Prevention Plan that includes a separate special investigations unit. In 2023, DFS received 44,998 suspected fraud reports, 75% of which (33,646) involved no-fault claims, and insurers submitted about 98% of them electronically. DFS opened 49 no-fault investigations that year. Read those two numbers carefully: a report is an insurer's suspicion, not a finding. For the reporting rules, see mandatory fraud reporting and immunity laws for insurers.

Consumer reports. The same DFS report says consumers can report suspected fraud through a toll-free hotline and an electronic form on the department's website. It also lists the kinds of conduct DFS sees: billing for services never rendered, upcoding, medically unnecessary treatment and diagnostic testing performed to generate payments, and accepting kickbacks for patient referrals.

The 2026 changes

In 2026 the state moved on the criminal side. According to a DFS press release of October 20, 2026, reforms enacted in the FY27 budget let prosecutors seek criminal penalties against people who organize staged accidents, not only the people behind the wheel. The same release says the reforms limit certain damages for people acting unlawfully at the time of a crash, tighten the standards for serious injury claims, limit recoveries by people mainly responsible for causing an accident, and strengthen oversight of rates and excess insurer profits. It also says carriers reported 43,811 incidents of suspected motor vehicle insurance fraud to DFS in 2025, an increase of 80% in five years, with a majority linked to suspected no-fault fraud. It announced 16 arrests by State Police and DFS in a joint investigation, with nearly $500,000 in attempted claims.

Two cautions. These are statements from the governor's and DFS press offices, which present their own policy, and the release does not claim to have measured the effect of the reforms yet. And the enacted budget language itself should be read for the exact terms. The changes to damages and serious injury standards mostly concern lawsuits over non-economic loss, which sit alongside the no-fault benefit payments rather than replacing them.

How other no-fault states handled the same temptation

New York mostly limited who can be paid and then tightened verification. Others have tried different levers, and they show the design problem is general.

Florida requires personal injury protection of $10,000 in medical and disability benefits, and its statute restricts when and from whom benefits are payable. As of the 2026 Florida Statutes, medical benefits are paid at 80% of reasonable expenses if the person receives initial services and care within 14 days of the crash; follow-up care may be provided only by listed types of provider; reimbursement is capped at $2,500 unless a physician, dentist, physician assistant or advanced practice registered nurse determines there was an emergency medical condition; massage and acupuncture are excluded; and follow-up care from a clinic is payable only if the clinic is licensed under Part X of Chapter 400 and meets conditions the statute lists. Florida's fraud statute makes organizing or knowingly participating in an intentional crash or a scheme to create paperwork for a crash that did not occur a second-degree felony with a minimum two-year prison term, and a licensed practitioner found guilty of insurance fraud involving PIP loses the license for five years and cannot receive PIP reimbursement for ten. In Florida the controls sit on the treatment window and the provider type; in New York, on ownership and verification.

Michigan went after price. It has a statutory fee schedule for treatment of injured people. Under MCL 500.3157, as of the version posted in November 2026, providers are not eligible for more than 200% of the Medicare amount for treatment from July 2021, 195% from July 2022 and 190% for treatment after July 2023, with higher ceilings for certain providers the statute defines. Michigan's approach caps what can be billed, whatever the clinic's ownership. See michigan's no-fault reform explained and Michigan.

Every no-fault design trades prompt payment against scrutiny, and each state chooses where to put the friction: at the clinic's door, at the treatment, or at the price. State rules differ, so use state car insurance requirements lookup or your state insurance regulator to check what applies where you drive. For New York specifically, see New York.

What this means if you are hurt in a crash

• Choose your own provider. Be wary of anyone who offers cash, rides or free treatment for choosing a clinic. See cappers, runners and illegal accident-case solicitation for the legal line on solicitation.
• Read what you sign. An assignment lets the clinic bill your insurer directly. Ask what treatment it covers.
• Keep your own log of each visit, what was done and how long it took. Your insurer may send you a form to confirm visits. See independent medical exams and injury bill audits.
• Go to scheduled examinations. Missing an insurer-requested exam can lead to a denial for the treatment.
• Report anything that looks wrong, such as a bill for visits you did not make, to your insurer or to the state regulator.

Common questions

Does a fraud investigation mean my honest treatment will be denied?

No. The rules let the insurer ask for proof, but they also set deadlines and require a prescribed denial form with reasons. Honest claimants can use the arbitration route to contest a denial.

What did Mallela decide in plain terms?

It decided that an insurer can refuse to pay a medical corporation that was fraudulently incorporated, even if the patient really got care from a licensed practitioner, because the regulation makes such providers ineligible. It also warned insurers that technical paperwork errors are not enough.

Are medical mills only a New York problem?

No. Fraud involving no-fault or personal injury protection benefits has been reported in other states, and Florida's statutes show how it responded. Triple-I's overview of insurance fraud notes that in many no-fault states, unscrupulous medical providers, attorneys and others pad the costs of legitimate claims, for example by billing for a procedure never performed.

Does insurance fraud in a no-fault system raise everyone's premiums?

Fraud costs are generally priced into premiums, and a DFS-posted statement of April 2026 says staged crashes and associated fraud inflate premiums by up to $300 a year, according to some estimates.

Where do I report suspected no-fault fraud in New York?

DFS accepts reports from consumers and says it runs a toll-free hotline and an online form. The regulator's site lists the current contact details. Your insurer's special investigations unit also takes reports.

Key takeaways

• New York's no-fault benefits pay quickly and directly to providers regardless of fault, which is what made them a target for clinics that bill without treating.
• The state's central tool is the ownership rule in 11 NYCRR 65-3.16(a)(12), upheld in Mallela in 2005, which lets insurers withhold payment from fraudulently licensed clinics, but only on proof of behavior tantamount to fraud.
• Insurers can verify, examine and deny within strict deadlines, and honest claimants can arbitrate. DFS data show most fraud reports come from no-fault, but a report is a suspicion, not a conviction.
• In 2026 New York added criminal penalties for organizers of staged crashes, according to DFS.
• Florida and Michigan attack the same risk with treatment windows, provider-type limits and price caps, so check your own state's rules.