For years, Spyros Panos seemed like a successful orthopedic surgeon, seeing dozens of patients a day and bringing in millions of dollars in fees for his suburban New York medical group.
In fact, he was inflating charges and billing for surgeries he didn't perform, perpetrating a years-long fraud that culminated in a guilty plea on a single count in federal court in 2013.
That was the end of his surgical practice. But even as he was waiting to be sentenced, federal prosecutors say, Panos was beginning a new criminal scheme that would go undetected for years until he was arrested again in April.
Over the past five months, thousands of patients have received notices from several insurance companies that Panos had posed as another doctor in order to review their medical records in coverage disputes. At least 2,500 people nationwide were affected, according to data compiled by Bloomberg, but the full reach of the alleged fraud hasn't been made public.
Panos is charged with infiltrating an obscure but essential piece of the American health care business: a $4 billion industry that provides independent doctors to render expert opinions on which treatments are appropriate.
Whether Panos's reviews resulted in claims being denied remains unknown. But the fact that his alleged fraud went undetected for years raises concerns about oversight in the independent medical review industry.
Those physicians weigh in when insurance companies and patients disagree about what medical care should be covered. If a health plan declines to pay for an expensive therapy to help a car crash victim learn how to walk again, the patient can appeal for an independent review. Same goes for a cancer patient refused an experimental treatment.
Panos collected $876,000 since 2013 working on medical and workers' compensation claims, according to his most recent indictment on charges of wire fraud, health care fraud and aggravated identity theft. In Connecticut, where he reviewed more than 200 claims, he recommended denying most of the them, according to state officials.
He has pleaded not guilty. Lawrence Fisher, an attorney for Panos, declined to comment.
It's not clear if all the patients whose claims were reviewed by Panos have been notified or whether their cases have been reopened.
"The right recourse is to have a new independent review for every single case," said Elisabeth Benjamin, vice president for health initiatives at the Community Service Society, a New York-based organization that helps consumers appeal health-insurance denials.
While some of the independent review companies involved have told authorities that they've taken steps to prevent unqualified people from posing as reviewers, they haven't publicly said how they've changed their vetting processes to avert other frauds. None of the companies known to have directly contracted with Panos agreed to interviews or to respond to written questions from Bloomberg News.
Some insurance companies that indirectly used his services, including Anthem Inc., Health Care Service Corp. and The Hartford, said they've notified patients and are evaluating cases that Panos may have swayed.
Other insurers notified consumers that their privacy had been violated—disclosures often required by law—without mentioning whether they would examine the claims that Panos worked on.
UnitedHealthcare recently sent one such letter to a Texas man named Stephen Johnson.
On a Friday evening in February 2017, the car in which Johnson was a passenger ran off the road and flipped into a creek. The driver died at the scene, and Johnson, four days shy of his 23rd birthday, suffered brain trauma and broken bones. He spent weeks unconscious in a Texas hospital, hooked to a feeding tube and ventilator.
After he emerged from the coma, his parents tried to get him therapy to help restore his ability to function. But they encountered a series of roadblocks from their insurer, UnitedHealthcare, which declined to cover rehabilitation while Johnson lived in a nursing home, according to court filings and an online journal kept by Cindy Johnson, his mother.
"Stevie continues to improve and UnitedHealthcare continues to deny him brain trauma rehab," she wrote in September 2017.
In June, the letter from UnitedHealthcare revealed that its vendor, a company called Advanced Medical Reviews, had unwittingly hired a former doctor who "was impersonating another licensed physician" to conduct reviews of patient records. The insurer said the impostor, who wasn't named, had been arrested. To the Johnsons, that seemed to explain the string of denials, which ended in October 2017—two months after UnitedHealthcare said the fake doctor ceased working for AMR.
It hasn't been disclosed which of Johnson's multiple appeals Panos may have been involved in, or whether the reversal was related.
The insurer, a unit of UnitedHealth Group Inc., offered Johnson a free year of identity-theft protection, a standard corporate response after data breaches. But its letter said nothing about whether the incident had influenced its decisions on Johnson's care, or whether it would review the impostor's rulings.
"We are NOT treating this as a privacy issue," Cindy Johnson wrote at the time. "We are treating this as a denial of service that will cause Stevie additional disabilities that could have been avoided."
In August, the Johnson family sued UnitedHealthcare and Advanced Medical Reviews in federal court in the Eastern District of Texas. The suit alleges that denials based on the tainted reviews contributed to Johnson's lasting disability, including difficulty speaking and using his right hand and foot.
Asked for comment on the case, UnitedHealthcare spokeswoman Tracey Lempner said in an email, "Independent, external review is an option for people seeking a third-party review of certain clinical coverage decisions. We contract with multiple independent review organizations to provide this important resource."
Advanced Medical Reviews declined to comment.