Real-time fraud prevention software-as-a-service (SaaS) products include computer instruction sets to enable a network server to receive medical histories, enrollments, diagnosis, prescription, treatment, follow up, billings, and other data as they occur. The SaaS includes software instruction sets to combine, correlate, categorize, track, normalize, and compare the data sorted by patient, healthcare provider, institution, seasonal, and regional norms. Fraud reveals itself in the ways data points deviate from norms in nonsensical or inexplicable conduct. The individual behaviors of each healthcare provider are independently monitored, characterized, and followed by self-spawning smart agents that can adapt and change their rules as the healthcare providers evolve. Such smart agents will issue flags when their particular surveillance target is acting out of character, outside normal parameters for them. Fraud controls can therefore be much tighter than those that have to accommodate those of a diverse group.