Administrative standard · reimbursement audit

SUT billing audit

How a hospital claim is checked against the Health Implementation Communiqué (SUT) before it goes to SGK, Turkey's Social Security Institution: Shield's rule engine, audit planes and risk score.

Status

Shield is in development. This page documents the rule engine design. The R- rules below come from the example rule set; they are not SUT article numbers or official procedure codes.

Rule engine: pre-submission

The SUT is the communiqué that sets which health services SGK pays for, and under which conditions. An item that misses a condition comes back as a deduction or a rejection. Shield runs the claim through versioned rules before submission. The same claim and the same rule version always give the same result.

Input	Claim and provision data, diagnosis codes, physician and specialty
Pre-check	Versioned rules check code consistency, missing documents, limits and duplicate items
Risk score	Contributions of the triggered rules are added up
Review	Claims scoring 40 or more go to the specialist queue
Decision	The specialist approves, returns for correction or holds
Record	Every step is written to an append-only record

Four audit planes

The SUT works by payment category: EK-2B fee-for-service procedures and EK-2C diagnosis-based package procedures. Rules are bound to these categories.

Plane	What is checked	Example rule
1. Specialty and physician authority	The SUT ties some procedures and drugs to specific specialties or to a specialist report. The billing physician's specialty must match that condition.	R-002 · Physician specialty code missing
2. Duplicate procedures and package overrun	A test repeated on the same day, an item included in the package price billed separately, and a length of stay beyond the package limit.	R-156 · Duplicate test on the same day R-310 · Out-of-package supply item R-088 · Length of stay exceeds package limit
3. Diagnosis–procedure consistency	The procedure must be justified by the ICD-10 diagnosis on the claim. Example: I20.9 (angina pectoris) justifies coronary angiography; M54.5 (low back pain) does not.	R-112 · Diagnosis–procedure mismatch
4. Medical supply and drug conditions	Report requirement, prior authorisation, usage limit and repeat interval. An item missing its document is caught before submission.	R-047 · Prior authorisation missing R-203 · Procedure repeated within 30 days

Risk score (0–100)

The score is not a predictive model. Each rule has a fixed contribution; the score is the sum of the triggered rules' contributions, capped at 100. Every point is shown with its rule ID, so the specialist sees where the score comes from.

Example claim · fictional data
Rule	Contribution
R-112 · Diagnosis–procedure mismatch	+34
R-047 · Prior authorisation missing	+26
R-203 · Procedure repeated within 30 days	+18
Total score	78

Thresholds

Range	Outcome
≥70	High risk · specialist review
40–69	Caution · specialist review
<40	Low risk · not queued

Shield does not make the submission decision on its own. The threshold is set to the institution's policy; the review specialist makes the final decision.

SUT risk simulator · example rule set

1. Specialty and physician authority

R-002Physician specialty code missing+13

2. Duplicate procedures and package overrun

R-156Duplicate test on the same day+21R-310Out-of-package supply item+29R-088Length of stay exceeds package limit+22

3. Diagnosis–procedure consistency (ICD-10)

R-112Diagnosis–procedure mismatch+34

4. Medical supply, drug and document conditions

R-047Prior authorisation missing+26R-203Procedure repeated within 30 days+18R-019Discharge summary unsigned+10

Risk score78/ 100 points

04070100

34 + 26 + 18 = 78

Risk bandHigh risk

QueueGoes to the specialist review queue· Threshold 40

Shown on the example rule set · fictional data. R- codes are not SUT article numbers. The final decision rests with the institution's specialist.

To try the rules on an example claim, open the claim simulator or the review console.

Data security and audit trail

Claim data is personal health data and falls under KVKK, Turkey's personal data protection law. The deployment and logging options below are design targets of the platform architecture; they have not yet been validated in the field for Shield.

Deployment	On-premises or an isolated VPC dedicated to the institution
Isolation	Each institution's data, queue and record are kept separate; the institution ID is required on every query
Access	Role-based, least privilege (institution admin, revenue analyst, review specialist, auditor)
Record	Append-only audit trail · forwarding to the institution's log system over Syslog (RFC 5424)
Reproduction	The record carries the rule version behind each decision; the same input reproduces the same result

References

1Sosyal Güvenlik Kurumu. Sağlık Uygulama Tebliği (SUT) ve ekleri. https://www.sgk.gov.tr/
2World Health Organization. International Statistical Classification of Diseases and Related Health Problems, 10th Revision (ICD-10). https://icd.who.int/browse10/
3IETF. RFC 5424: The Syslog Protocol. https://www.rfc-editor.org/rfc/rfc5424

This page is for information only and is not for clinical decisions. Decisions rest on the product information (SmPC/PIL), current guidelines and the physician's judgement. Last updated: 13 October 2026