Near $1 billion: *health insurer blames AI* for suspect hospital charges

Blue Cross Blue Shield, one of the largest health insurers in the United States, has accused hospitals of using AI billing systems to generate close to $1 billion in questionable charges ^[1]. The insurer claims that AI tools designed to code medical treatments and generate claims have been systematically upcoding procedures and billing for services not actually provided.

The case is a sharp reminder that when AI makes decisions about money, someone eventually has to show what it did. Think of it like a till receipt: nobody checks it on the day, but when the bank statement arrives and the numbers don't match, that slip of paper becomes the only proof of what you bought. In healthcare billing, the AI's output is the receipt, and disputes often come months later.

What Blue Cross alleges

According to the insurer, AI systems at multiple hospitals have flagged treatments for higher reimbursement codes than the care actually warranted ^[1]. In some instances, the systems allegedly billed for procedures that never happened. Blue Cross says the pattern is widespread enough to amount to nearly $1 billion in suspect claims.

The hospitals have yet to respond publicly in detail, but the dispute raises a question that applies beyond the US: when an AI system generates a bill, who keeps the record of what it decided, and can that record be trusted months later when someone questions it?

The evidence question

In a billing dispute, the side without its own records starts on the back foot. If a hospital's only proof is a log it could have edited, or a claim it says the AI made but cannot show unchanged, an insurer or a court has reason to doubt it.

Under the AI Act, high-risk AI systems must technically allow for automatic logging of events over their lifetime ^[2]. For systems in Annex III, including those used in healthcare and insurance pricing, that requirement applies from 2 December 2027 ^[3]. Article 12 says what to log. It does not say how to protect the logs, so the question of whether they hold up as evidence is left to the people who build and run the systems.

A log the operator can quietly edit is a diary. A log you can prove hasn't changed is evidence.

How a digital witness fits here

Here, the thing to seal is each billing decision as the AI writes it to the log: the patient reference, the model version, the procedure code, the reimbursement amount and the reviewer, if there was one. A digital witness takes a fingerprint of that record, not the record itself, so patient data never leaves the hospital's systems.

The fingerprint is sealed on WitniumChain, where any later change would show, even one made by us. When a claim is questioned, anyone the hospital shares the record with can calculate the fingerprint again and check it against the sealed one. If it matches, the record hasn't changed since the day it was written. Change a single character and it won't match.

A witness doesn't show that the billing code was correct, or that the procedure happened. It shows that the record is the one written at that time. That's a narrower claim, but it's one you can check.

How it would work

1. The AI writes a billing decision to the log.
2. The hospital's system sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. Months later, when the insurer questions the charge, the hospital shares the record and the witness ID. The insurer calculates the fingerprint and checks it. If it matches, nothing has changed.

Your system sends the fingerprint through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free.

Software as a product

From 9 December 2026, the EU's new Product Liability Directive treats software placed on the market as a product, AI systems included ^[4]. Liability is strict, and courts can order defendants to hand over relevant evidence under certain conditions.

For a hospital or a software vendor, that means a dispute over an AI billing system may not just be about what went wrong. It may also be about proving which version ran on a given day, and what it decided. Version control was built for collaboration, not for evidence, so sealing each release and each decision closes that gap.

What this means for you

If you run or build AI systems that make billing decisions, price insurance or assess people:

• Can you show what your AI decided on a specific day, in a way nobody can quietly rewrite?
• Who keeps the logs, and could they edit them if they wanted to?
• If a regulator, an auditor or a court asked for proof, would your records hold up?

A digital witness per decision is one answer. It is not the only one, but it is the one that lets you prove a record hasn't changed without asking anyone to trust you.

What to watch

• 2 December 2027: High-risk AI requirements, including automatic logging under Article 12, apply to Annex III systems ^[3].
• 2 August 2028: The same requirements apply to legacy high-risk systems already on the market ^[3].
• 9 December 2026: Software becomes a product under the EU's Product Liability Directive ^[4].