Database sharing system

A non-transitory computer storage medium storing computer executable instructions that when executed by at least one hardware computer processor perform operations comprising:

• receiving first healthcare fraud data from a first entity, the first healthcare fraud data comprising a first quantity of a first drug, the first quantity representing distribution of the first drug at a first set of drug establishments;
• receiving second healthcare fraud data from a second entity, the second healthcare fraud data comprising a second quantity of the first drug, the second quantity representing distribution of the first drug at a second set of drug establishments;
• determining a percentage from the first quantity and the second quantity, the percentage indicating at least a number of the first quantity and the second quantity divided by a count of at least a number of drug establishments;
• receiving third healthcare fraud data from a third entity, the third healthcare fraud data comprising data associated with the first drug;
• accessing first redaction configuration data for the third entity, wherein the first redaction configuration data indicates data to be redacted;
• identifying a portion of the third healthcare fraud data to be redacted according to the first redaction configuration data;
• generating redacted third healthcare fraud data, wherein the portion of the third healthcare fraud data is not detectable in the redacted third healthcare fraud data;
• applying a healthcare fraud detection scheme at a third entity to one or more healthcare-related data objects from the third entity associated with a particular drug establishment of the third entity, wherein the healthcare fraud detection scheme comprises instructions to identify a potential or actual healthcare fraud attack pursuant to:
• determining a third quantity of the first drug distributed from the particular drug establishment from the redacted third healthcare fraud data and the one or more healthcare data objects from the third entity, and
• determining that the third quantity exceeds the percentage, wherein exceeding the percentage indicates that the third quantity is an outlier with respect to distribution of the first drug by the particular drug establishment relative to the distribution of the first drug at the first set of drug establishments and the second set of drug establishments;
• determining an establishment object indicating a name of the particular drug establishment, and a drug object indicating a drug name of the first drug;
• designating the establishment object as a seed;
• in response to determining that the third quantity exceeds the percentage, automatically generating a cluster, wherein generating the cluster comprises:
• adding the seed to the cluster;
• adding the drug object to the cluster according to a pre-defined cluster strategy;
• querying a data source of the third entity to identify a procedure code object associated with at least one of the first drug or the particular drug establishment, the procedure code object indicating a healthcare procedure name;
• adding the procedure code object to the cluster according to the pre-defined cluster strategy;
• performing cluster analysis by scoring the cluster according to a pre-defined scoring strategy to formulate a new cluster score, the new cluster score indicating importance of the cluster with respect to other clusters;
• accessing a database containing a cluster list of previously-generated other clusters representing potential or actual healthcare fraud attacks, each other cluster having an individual cluster score;
• and
• generating a ranking of the cluster with respect to the previously-generated other clusters based on the new cluster score as compared to the individual other cluster scores;
• in response to determining that the third quantity exceeds the percentage, automatically generating a fraud alert;
• causing display of the fraud alert in a user interface;
• causing display of the ranking;
• and
• causing display of the cluster related to the potential or actual healthcare fraud attack, the name of the particular drug establishment, the drug name, and the healthcare procedure name in the user interface, wherein objects of the cluster are visually represented as connected in the display.

A system comprising:

• at least one computer hardware processor;
• and
• data storage comprising instructions executable by the at least one computer hardware processor to cause the system to:
• receive first healthcare fraud data from a first entity, the first healthcare fraud data comprising a first quantity of a first drug, the first quantity representing distribution of the first drug at a first set of drug establishments;
• receive second healthcare fraud data from a second entity, the second healthcare fraud data comprising a second quantity of the first drug, the second quantity representing distribution of the first drug at a second set of drug establishments;
• determine a percentage from the first quantity and the second quantity, the percentage indicating at least a number of the first quantity and the second quantity divided by a count of at least a number of drug establishments;
• receive third healthcare fraud data from a third entity, the third healthcare fraud data comprising data associated with the first drug;
• access first redaction configuration data for the third entity, wherein the first redaction configuration data indicates data to be redacted;
• identify a portion of the third healthcare fraud data to be redacted according to the first redaction configuration data;
• generate redacted third healthcare fraud data, wherein the portion of the third healthcare fraud data is not detectable in the redacted third healthcare fraud data;
• apply a healthcare fraud detection scheme at a third entity to one or more healthcare-related data objects from the third entity associated with a particular drug establishment of the third entity, wherein the healthcare fraud detection scheme comprises instructions to identify a potential or actual healthcare fraud attack pursuant to:
• determining a third quantity of the first drug distributed from the particular drug establishment from the redacted third healthcare fraud data and the one or more healthcare data objects from the third entity, and
• determining that the third quantity exceeds the percentage, wherein exceeding the percentage indicates that the third quantity is an outlier with respect to distribution of the first drug by the particular drug establishment relative to the distribution of the first drug at the first set of drug establishments and the second set of drug establishments;
• determine an establishment object indicating a name of the particular drug establishment, and a drug object indicating a drug name of the first drug;
• designate the establishment object as a seed;
• in response to determining that the third quantity exceeds the percentage, automatically generate a cluster, wherein generating the cluster comprises:
• adding the seed to the cluster;
• adding the drug object to the cluster according to a pre-defined cluster strategy;
• querying a data source of the third entity to identify a procedure code object associated with at least one of the first drug or the particular drug establishment, the procedure code object indicating a healthcare procedure name;
• adding the procedure code object to the cluster according to the pre-defined cluster strategy;
• performing cluster analysis by scoring the cluster according to a pre-defined scoring strategy to formulate a new cluster score, the new cluster score indicating importance of the cluster with respect to other clusters;
• accessing a database containing a cluster list of previously-generated other clusters representing potential or actual healthcare fraud attacks, each other cluster having an individual cluster score;
• and
• generating a ranking of the cluster with respect to the previously-generated other clusters based on the new cluster score as compared to the individual other cluster scores;
• in response to determining that the third quantity exceeds the percentage, automatically generate a fraud alert;
• cause display of the fraud alert in a user interface;
• cause display of the ranking;
• and
• cause display of the cluster related to the potential or actual healthcare fraud attack, the name of the particular drug establishment, the drug name, and the healthcare procedure name in the user interface, wherein objects of the cluster are visually represented as connected in the display.