## 3 Material and Methods
### Association Scores Computation and Threshold Application  
The three main elements of the proposed framework are patients, providers (doctors, pharmacy, hospitals) and services. These three elements are actually associated with each other. There is a need to find out the association score of each element with another element. The association scores are computed based on the frequency of visits or frequency of the prescriptions. If a patient visits frequently to avail a specific service (e.g., X-rays, ECGs). In this case, a patient is prescribed X-rays again and again from one doctor. This is considered as outlier. We compute association scores based on the frequency of the patient visits to the providers and services. The purpose of this step is to forward only those patient records to rule engine, which are identified as the \"outliers\" or \"need to be investigated\". We computed the association scores by using Equations (1)-(4). * Doctor (Association score) Y is computed by denoting i as number of times patient \(P_{k}\) checked by doctor \(D_{j}\) and \(D_{n}\) is representing total number of patients checked by doctor \(D_{j}\). As shown in Equation (1) \[Y=(i/D_{n})\] (1)
* Patient with services (Association score) is also computed by denoting \(m\) as number of patients availed service \(S_{h}\) and \(S_{x}\) is representing number of times patient \(P_{k}\) availed \(S_{h}\) service. (for all patients) \[S_{p}=(m/S_{x})\] (2)
* Service with Doctor (Association score) is also computed by denoting \(T\) as number of times doctor \(D_{j}\) prescribed service \(S_{h}\) and \(S_{n}\) is representing number of times all doctors prescribed service \(S_{h}\) (for all services) \[S_{d}=(T/S_{n})\] (3)
* Patient (Association score) is computed by denoting \(G\) as number of times doctor \(D_{j}\) examined patient \(P_{k}\) and \(P_{n}\) is representing total number of patient \(P_{k}\) visits. \[F=(G/P_{n})\] (4)  
The association scores are between 0 and 1. After the computation of the association scores, we calculate threshold by computing an average of all the association scores for each provider, service or patient. All those transactions which are less than average but greater than the minimum threshold and equal to the average, are considered as the normal cases whereas all the association scores which are greater than the average but less than the maximum threshold, are considered as the \"need to be investigated\". The minimum threshold value and maximum threshold value is set up to identify the outliers. The minimum threshold indicates that anything that has happened just once is an anomaly. It means that if any patient, visits a provider only once that can be an anomaly (or any doctor prescribing any service just once to only one patient). Thus, we have kept the minimum threshold as 0.011. Similarly, we have chosen the maximum threshold by considering the fact that if a patient is visiting the same doctor and out of a total of his 100 visits, he visits the same doctor more than 70 times, there could be an anomaly. That is why, we have kept the association scores greater than 0.7, as the maximum threshold. All those association scores which are less than the minimum threshold and greater than the maximum threshold, are identified as the outliers. The flowchart of this phase is shown in Figure 3. Patient association scores are denoted as F, doctor's association scores are denoted as Y and association scores of services with respect to doctors or patients are denoted as \(S_{p}\) and \(S_{d}\) respectively. We set threshold for all association scores as discussed above. Figure 3 explains the flow of the first phase of proposed framework. A hash algorithm is applied for the de-identification of patient records. The variables \(Y\), \(S_{p}\), \(S_{d}\) and \(F\) holds association scores of patient with respect to doctors, service with respect to doctor, service with respect to patient and doctor with respect to patient. The threshold is computed separately for each type of association scores.