Medicare Advantage · Risk Adjustment · False Claims Act
Before Someone Else Finds It
A compliance officer's guide to Medicare Advantage risk adjustment: why it is in OIG's crosshairs, how the money moves, and five questions to ask your own program this week
The first call you get about risk adjustment will not come from CMS. It will come from counsel, and the person who reported the problem will have worked for you. Every risk adjustment resolution of 2026 but one began that way.
Your health system holds risk-share contracts with two Medicare Advantage plans, so each diagnosis coded for those members changes what the system collects every month for a year. For three years the program has relied on physician encounters and a vendor's quarterly sweep of closed charts. Claims have paid, and no audit has ever been opened.
Then someone runs a single query. Taking each payment category in turn, it asks how many of last year's submitted diagnoses are backed by a note from the treating physician written that same year. In most categories the answer is better than nine in ten. In two, it is far worse, and almost all of the shortfall leads back to the vendor's sweep.
The vendor had been lifting conditions out of older documentation and submitting them as active, with no one confirming they still existed, were still treated, or were evaluated that year. Its report shows what it added and nothing it got wrong; finding errors was never its job. A gap that wide against the rest of the program is precisely what a reviewer's screening tool is designed to catch.
The scene is a composite, and its numbers are illustrative. The pattern, though, sits behind this year's two largest risk adjustment resolutions, at $556 million and $541.5 million. In the second, the organization discovered the problem in its own program before anyone else did, and that alone separates that figure from a worse one.
01
Why Risk Adjustment Is an OIG Priority
The money is large and the evidence is easyHHS-OIG estimated that plans received about $7.5 billion in 2023 in risk-adjusted payments for diagnoses supported by nothing but a health risk assessment or an assessment-linked chart review, with no other encounter that year. MedPAC estimates that coding intensity, the gap between how plans and fee-for-service code comparable people, raises plan payments by tens of billions of dollars a year. And unlike most fraud, this one leaves a clean audit trail: OIG has spent five years auditing plans for specific high-risk diagnoses and publishing what it finds unsupported, and the codes it picks are not random.
2026 was the year it reached providersKaiser Permanente affiliates paid $556 million in January. The Villages Health System, a provider paid under a risk-share, paid $541.5 million in August. A management services organization paid $14.1 million and an in-home provider paid $2.4 million the same month. None admitted liability, and every one except Villages began with a whistleblower. The theory in each is the same: diagnoses that were found in a record, or added to one, and never managed by anyone.
The document with your name on it
The annual risk adjustment data certification under 42 C.F.R. §422.504(l) is signed by the plan's chief executive or chief financial officer, not by yours. That is not a comfort. What your organization signs is the contractual attestation to its plan partners, and where its data flows to the plan as a related entity, the §422.504(l)(3) certification. When the plan is sued, it will produce your attestation, and you will be the one explaining it.
Before Someone Else Finds It
October 7, 2026
Knowing that the government is looking is only half of it. To see where your own program is exposed, follow a single diagnosis from the chart to the payment, because every failure in this brief happens somewhere along that path.
02
How the Money Moves, and Where It Goes Wrong
Why it is commonMedicare Advantage pays a monthly amount per member, adjusted by a risk score built from that member's coded diagnoses. Every additional condition raises the payment for every month of the year. A code found in a closed chart with no treatment and no follow-up pays exactly as much as one the physician managed. That arithmetic is the motive, for the system and for a vendor paid on the lift. The rule that stands between the chart and the payment is 42 C.F.R. §422.310: the diagnosis must come from a face-to-face encounter, including real-time video since 2020, and conform to the ICD-10-CM Official Guidelines, whose Section IV.J says to code conditions that require or affect care at the encounter, not those previously treated that no longer exist.
The three ways it goes wrongOne-way chart review: a vendor sweeps closed charts and submits new codes but never deletes unsupported ones already paid, which is the pattern at Kaiser, at Cigna in 2023, and at Villages. In-home health risk assessments: a vendor nurse captures high-weight conditions in a living room and nothing follows. Retrospective query campaigns: leading queries months after the visit, and an addendum for a condition nobody evaluated at the time. Under §422.326 every dollar paid on an unsupported code is an overpayment you must report and return within 60 days of identifying it, and keeping it past that window is a reverse false claim under 31 U.S.C. §3729(a)(1)(G).
OIG's audits are not random. They return to the same short list of high-weight conditions, and four of them recur across the series; each is shown below with how it typically enters a record and the check that would find it in yours.
| The diagnoses OIG keeps finding unsupported | How it gets into the record | What to check in your own data |
|---|
| Vascular disease and embolism |
A "history of" condition coded as current and acute. |
No anticoagulant on file. Match every vascular or embolism code against pharmacy fills. |
| Acute stroke and acute myocardial infarction |
A past event mined from history and resubmitted as current. |
No hospitalization, imaging, or cardiology or neurology encounter in the period. |
| Morbid obesity |
Added during an in-home assessment from a visual estimate or an old baseline. |
No body mass index documented at the same encounter. |
| Major depressive and bipolar disorders |
Added from a checklist during a brief assessment with no psychiatric evaluation. |
No psychiatric care, counseling, or psychotropic prescription in the record. |
These are the orphan diagnoses, and the right-hand column is a test you can run on your own claims in a week.
What the courts have and have not said
You will read that courts have consistently held one-way audits to be reckless disregard. They have not. In Poehling v. UnitedHealth, the one case to reach the merits, the Special Master recommended judgment against the government in March 2025; the government objected, and the ruling should be confirmed before anyone relies on it. That does not help you. The two-way audit obligation is a regulation, §422.326.
$556M
Kaiser, January 2026
Physician queries encouraging addenda months to more than a year after the visit; allegations disputed
$541.5M
Villages, August 2026
A provider under a risk-share; self-disclosed in 2024, which OIG cited as an important factor
60 days
To report and return
From identification of an overpayment; keeping it longer is an independent false claim
Before Someone Else Finds It
October 7, 2026
Everything above can be tested against records your organization already holds, without waiting for an auditor to ask. The five questions below are where that testing starts.
03
Five Questions to Ask Your Program This Week
If you cannot answer one of these, that is the answerFive questions, each answerable from data you already hold, and each one mapped to a fact pattern in this year's resolutions.
| The question | What the answer tells you |
|---|
| 1 | For every code your chart review program added in the last three years, how many did it delete? | Zero, or a number nobody can produce, means a one-way program. That is the finding. |
| 2 | How is your coding vendor paid? | Any fee tied to risk score lift, codes captured, or revenue realized is the incentive the enforcement record keeps describing. |
| 3 | Pull every addendum on a Medicare Advantage member from the last year. How long after the visit was each one signed? | Anything measured in months is the Kaiser fact pattern. |
| 4 | Take the four conditions on page 2 and match them against your pharmacy and lab data. How many orphans? | Each one is a diagnosis with no treatment behind it, which is what OIG audits for. |
| 5 | Who signed the last attestation to your plan partners, what did they rely on, and did compliance and medical leadership sub-certify first? | If finance signed alone, that is the next question a relator's lawyer asks. |
Any of those questions can turn up something you would rather not have found. What happens next depends almost entirely on one fact: whether you found it, or someone else did.
| If you find it | What happens next, and who decides |
|---|
| You found it first |
Report and return within 60 days of identification. Decide the route early: Stark issues to the CMS Self-Referral Disclosure Protocol, kickbacks to the OIG protocol. Justice Manual §4-4.112 credits timeliness, completeness, extent of assistance, and usefulness. Villages self-disclosed in 2024 and OIG named that an important factor; three of the four provider-side matters this year turned on cooperation credit. |
| Someone else found it first |
Kaiser, Complete Health Partners, Monogram, Cigna, and Sutter all began with a whistleblower, usually a coder, a physician, or a compliance employee who raised it internally and was not heard. The complaint will describe your program from the inside. Every option available before the filing is gone, and the number is treble damages plus per-claim penalties before any credit. |
What you do before that is not complicated. Decouple compensation from risk score lift and end vendor contingency fees. Run the two-way audit and report the deletion ratio to the board quarterly. Require compliance and medical leadership to sub-certify before anyone attests to a plan.
| Window | A ninety-day plan for the person who just took the job |
|---|
| Days 1 to 30 | Pull every diagnosis that originated solely from a chart sweep or in-home assessment and test it against the four conditions on page 2. Set the internal addenda window. Audit query templates against the 2026 AHIMA and ACDIS standard. Read every vendor contract for contingency fees. |
| Days 31 to 90 | Deploy diagnosis-to-pharmacy and diagnosis-to-lab matching. Operationalize the two-way audit and the 60-day pipeline. Decide, using the Justice Manual factors, whether anything found warrants self-disclosure. Begin quarterly board reporting. |
| Day 91 onward | Blinded third-party validation on a random sample. Decouple compensation from risk score lift. Institutionalize problem-list reconciliation. Monitor the top V28 categories against regional benchmarks. |
Before Someone Else Finds It
October 7, 2026
The difference between the two rows of the last table is not the conduct. It is who found it and what they did in the week after, and that part is still entirely yours.
The Terms You Will Meet in This Brief
| Term | What it means, plainly |
|---|
| Medicare Advantage | Medicare delivered through private plans, paid a fixed monthly amount per member. |
| Risk adjustment, RAF | The monthly payment is scaled by each member's risk adjustment factor, built from age, sex, and coded diagnoses. Sicker on paper means a higher payment every month for a year. |
| HCC | Hierarchical condition category. CMS groups diagnosis codes into payment categories; only diagnoses that map to one change the score. V24 had 86; V28, at full weight since January 1, 2026, has 115. |
| Risk-share contract | A health system is paid a share of what the plan receives for its members, and inherits the plan's incentive and exposure. |
| Retrospective chart review | A vendor reads closed charts for diagnoses documented but never coded, and submits them. "One-way" means it adds codes and never deletes unsupported ones already paid. |
| Health risk assessment | An in-home or virtual visit, often by a vendor nurse, that records conditions no one ever treats. |
| Query and addendum | A query asks a physician to clarify or add a diagnosis; an addendum is the later entry. Legitimate when the condition was managed at the visit; evidence when it was not. |
| Overpayment, 60-day rule | Money received on a diagnosis the record does not support. Report and return it within 60 days of identification; keeping it longer is a reverse false claim. A whistleblower, called a relator, can sue on the government's behalf and keep a share; most are employees. |
Where MHMDAA Comes In
MHMDAA (Michael Hill, MD and Associates) is a revenue cycle consulting and payor-provider dispute resolution firm, retained by hospital and payor clients alike, which is why this reads as method rather than argument. The work is the same from either chair: physician-led clinical validation and forensic review of disputed coding, level-of-care, and medical necessity determinations, benchmarked against the clinical criteria, statutory standards, and coverage policies that govern the claim, to arrive at the diagnoses the record substantiates and the reimbursement tier that follows from them.
The five questions in this brief are the ones that review runs first. We also work with clinical, documentation, and audit teams to bring their workflows into line with the CMS regulations behind them, so that diagnoses, addenda, and attestations hold up before anyone outside the organization reads them.
Michael Hill, MD & Associates
Revenue cycle consulting and payor-provider dispute resolution
(877) 464-4556 · info@mhmdaa.com
Neutrality. This brief is educational commentary; it is not legal, coding, or clinical advice, and it is not a determination about any specific claim, payor, provider, or matter. Scenarios described as composites are illustrative of method only. Settlements resolve allegations without admission of liability unless stated; where a party self-disclosed or disputes the allegations, that is stated. MHMDAA is an independent revenue cycle consulting and payor-provider dispute resolution firm; its principals provide dual-perspective analysis and independent expert services to payors and providers alike, and nothing in this publication constitutes advocacy for either side of any dispute or prejudges any question on which they may serve as independent experts.
Authorship. This document was drafted with human authorship and may include AI-assisted formatting or summarization. All analysis, conclusions, and opinions are solely those of Dr. Michael Hill.
Sources
- SSA §1853(a)(1)(C); 42 C.F.R. §§422.310, 422.326, 422.504(l); 42 U.S.C. §1320a-7k(d); 31 U.S.C. §3729(a)(1)(A), (B), (G); ICD-10-CM Official Guidelines, FY2026, §IV.J; CMS CY2024 Rate Announcement (V28 phase-in). U.S. ex rel. Poehling v. UnitedHealth Group, No. 2:16-cv-08697 (C.D. Cal.), Special Master's Report, March 3, 2025; government objection, April 2, 2025.
- HHS-OIG, OEI-03-23-00380, and high-risk diagnosis audits, 2020 to 2025; MedPAC, March 2026. DOJ releases: Kaiser, Jan. 14, 2026; Villages, Aug. 26, 2026; Complete Health Partners, Aug. 3, 2026; Monogram, Aug. 24, 2026; Cigna, Sept. 30, 2023; Sutter, Aug. 30, 2021. Justice Manual §4-4.112.
- MHMDAA, Navigating Risk-Adjustment Integrity, v2.13, September 21, 2026, with its verification register; supersedes v2.12 and the HCC addendum.
