Two more people were indicted on Wednesday for defrauding Medicaid programs out of millions of dollars.
Shamso Ahmed Hassan and Hanaan Mursal Yusuf are facing one count of conspiracy to commit healthcare fraud, seven counts of healthcare fraud and two counts of money laundering, according to federal court records.
The court filings state Hassan was one of the owners of Smart Therapy Center LLC and Star Autism Center LLC, while Yusuf was an employee of the former but still recieved financial benefits from the alleged fraud.
The indictment alleges Hassan and Yusuf billed the Department of Human Services (DHS) Medicaid program for services not provided from November 2019 through December 2024.
Court records go on to say the pair gave illegal kickbacks of about $300 to $1,500 per month, per child, to parents of Medicaid-eligible children in exchange for the enrollment of their child.
Hassan…
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.