On May 21, 2025, the Centers for Medicare & Medicaid Services ("CMS") announced its intent "to crush[] fraud, waste, and abuse across all federal healthcare programs" through aggressive audits of Medicare Advantage ("MA") plans. CMS indicated these audits will begin immediately and that CMS will review all eligible MA contracts for each payment year. CMS's goal is to expedite the completion of audits for payment years 2018 through 2024 by early 2026.
Background
MA plans receive risk-adjusted payments from CMS based on the diagnosis codes of their enrollees and collect higher payments for enrollees with more serious or chronic health conditions. CMS conducts Risk Adjustment Data Validation ("RADV") audits to verify the accuracy of the diagnoses submitted by the MA plans.
CMS acknowledged that the agency is several payment years behind for RADV audits. The Trump Administration, however, has prioritized these audits. CMS's audits for payment years 2011 through 2013 revealed 5% to 8% in overpayments to MA plans. CMS cited a federal estimate indicating that overbilling by MA plans could amount to $17 billion lost federal funds annually, but also noted that it could be as high as $43 billion per year, according to the Medicare Payment Advisory Commission.
MA risk adjustment has been a focal point not only for CMS, but also the Department of Health and Human Services Office of Inspector General ("HHS-OIG") and the Department of Justice ("DOJ"). HHS-OIG has long been critical of MA risk adjustment, citing the significant increase in risk adjustment scores based on in-home health risk assessments and chart reviews. Likewise, the DOJ has investigated alleged MA risk adjustment abuses and False Claims Act violations.
Beginning with Payment Year 2018, CMS's RADV audits may extrapolate audit findings to all RADV-eligible beneficiaries in the Medicare Advantage Organization's ("MAO's") contract. The 2023 final rule announcing this indicated that extrapolation will be the standard practice, but CMS may use its discretion not to extrapolate in certain circumstances, such as if medical records have been lost because of a natural disaster or if CMS performs a probe sample of RADV reviews without a statistically valid sample. See our previous alert for more details on the RADV final rule.
The New Program-Wide Audits
CMS announced it will be partnering with HHS-OIG to recover outstanding overpayments discovered during a RADV audit. CMS will also dedicate new resources into ferreting out fraud, waste, and abuse, including implementation of:
- "Enhanced technology," including the potential use of artificial intelligence, to efficiently review medical records and identify improper enrollee diagnoses;
- Investment in workforce to increase the CMS team of medical coders from 40 to approximately 2,000 individuals by September 1, 2025; and
- Increased audit volume with the goals of auditing each of the approximately 550 MA contracts annually and expanding the number of MA plan records analyzed during the course of an audit from 35 to up to 200.
On May 30, 2025, CMS published a memo instructing MAOs to submit data corrections for PY 2020 – 2024 and establishing deadlines for each payment year. Some of these deadlines impose significantly shorter time periods for MAOs to have identified and corrected errors. For example, the deadline for PY 2020 is June 16, 2025, giving MAOs several years to have identified and corrected errors for PY 2020. But the deadline for PY 2024 is July 15, 2025, leaving only six-and-a-half months since the end of the payment year for MAOs to identify and correct errors.
Potential Challenges
MA plans may incur additional administrative costs preparing for and responding to the program-wide RADV audits, particularly given the threat of extrapolation. MA plans will need to tighten oversight and take corrective actions to reduce or eliminate common coding errors, such as coding histories instead of active diseases. Similarly, plans should work with their providers to eliminate documentation gaps. Plans may also consider claw-back provisions, indemnification, and other measures in their provider and vendor contracts to mitigate the financial impact of RADV recoupments.
It is unclear how CMS will use enhanced technology to identify unsupported diagnoses. This introduces more uncertainty about not only the RADV audit process, but also the level of transparency plans will have regarding these technologies. This may open up additional arguments to challenge adverse audit findings or preemptive challenges to the program-wide audits. In the meantime, MA plans should continue to review and correct diagnosis codes to the extent possible.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
