Health Law Advisor

On May 21, 2025, the Centers for Medicare & Medicaid Services (CMS) announced^[1] an aggressive plan (Plan) to expand its efforts to address fraud, waste, and abuse in Medicare Advantage (MA). By engaging with enhanced technology and significantly expanding its workforce, CMS states that it intends to audit every eligible MA contract for Payment Years (PY) 2018 through 2024 and recover on all prior audits conducted by CMS and the Office of Inspector General (OIG).  Historically, CMS has only selected a small subset of contracts (approximately sixty) for each PY audited. CMS is currently completing PY2018 Risk Adjustment Data Validation (RADV) audit but has yet to issue findings or payment recovery demands for any audit completed. CMS has similarly not taken material action regarding the so called “OIG audits”.

Background

CMS Audit Methodology. CMS officially launched its RADV audit program in 2008. The audit methodology employed by CMS has evolved over the years through various rule making efforts and sub-regulatory issuances. CMS’s proposed rule in 2010 set forth an audit methodology to review a risk stratified 201-member sample, where all risk adjusted Hierarchical Condition Categories (HCCs) for each member would be reviewed and checked for errors.^[2] Finalizing this methodology in 2012[3], CMS then conducted audits on PY2012 and 2013 utilizing this approach. The presumption was that CMS would extrapolate and recoup such amounts. However, CMS did not issue final agency actions requiring substantial repayments or extrapolation.

The Centers for Medicare and Medicaid Services (CMS) is issuing, what will amount to be, very significant Risk Adjustment Data Validation (RADV) Audit notices for PY2018 to Medicare Advantage Organizations (MAOs).

These notices follow the issuance of CMS’s final rule (88 Fed. Reg. 6643 (Feb. 1, 2023), amending 42 C.F.R. 422.310(e). Pursuant to the rule, CMS has the authority to extrapolate audit findings for PY2018 and beyond. CMS has noted that the extrapolation methodology it adopts for RADV audits will be focused on MAO contracts that, through statistical modeling ...

On February 1, 2023, the Centers for Medicare & Medicaid Services (CMS) published a final rule outlining its audit methodology and related policies for its Medicare Advantage (MA) Risk Adjustment Data Validation (RADV) program. The final rule codifies long-awaited regulations first proposed by CMS in 2018.

On April 19, 2021, the Office of Inspector General’s (OIG) Office of Audit Services (OAS) released the results of an audit conducted on the accuracy of diagnosis codes submitted to CMS by Humana, Inc. for 2015 dates of service. Based on the audit results, the OIG recommended Humana return a whopping $197.7 million in alleged overpayments and enhance its policies and procedures to prevent, detect and correct noncompliance with Federal requirements for diagnosis codes that are used to calculate risk-adjusted payments.

Under the Medicare Advantage (MA) program, the Centers for ...