On May 21, 2025, the Centers for Medicare & Medicaid Services (CMS) announced^[1] an aggressive plan (Plan) to expand its efforts to address fraud, waste, and abuse in Medicare Advantage (MA).

By engaging with enhanced technology and significantly expanding its workforce, CMS states that it intends to audit every eligible MA contract for Payment Years (PY) 2018 through 2024 and recover on all prior audits conducted by CMS and the Office of Inspector General (OIG). Historically, CMS has only selected a small subset of contracts (approximately sixty) for each PY audited. CMS is currently completing PY2018 Risk Adjustment Data Validation (RADV) audit but has yet to issue findings or payment recovery demands for any audit completed. CMS has similarly not taken material action regarding the so called “OIG audits”.

Background

CMS Audit Methodology. CMS officially launched its RADV audit program in 2008. The audit methodology employed by CMS has evolved over the years through various rule making efforts and sub-regulatory issuances. CMS’s proposed rule in 2010 set forth an audit methodology to review a risk stratified 201-member sample, where all risk adjusted Hierarchical Condition Categories (HCCs) for each member would be reviewed and checked for errors.^[2] Finalizing this methodology in 2012^[3], CMS then conducted audits on PY2012 and 2013 utilizing this approach. The presumption was that CMS would extrapolate and recoup such amounts. However, CMS did not issue final agency actions requiring substantial repayments or extrapolation.

In 2018, CMS proposed certain revisions to its RADV rule including adjustments to its methodology and payment calculation.^[4] As to methodology, CMS suggested a shift to focus on “sub-cohorts” of members. While the industry waited for CMS to finalize the proposed rule, CMS rolled out audits for PY2014 and 2015 that focused on specific disease cohorts, diabetes and chronic kidney disease respectively. This cohort focused methodology was a significant departure from the macro audit universe of “all HCCs” envisioned by the earlier audits. CMS finalized its proposed rule in February of 2023, but chose not to align with any one specific methodology, stating it had discretion to apply the methodology of choice for identifying eligible contracts and determining audit focus.^[5] For the most recent round of RADV audits, on PY2018, CMS focused on a new sub-cohorts of members, either (1) Version A – enrollees ranked in the top decile of one or both of CMS’s “improper payment predication models” or (2) Version B – enrollees who had all of their HCCs submitted by the MA Organization (MAO) derived from a linked or unlinked chart review. Below are the methodologies applied over the years. Of note, CMS has not yet conducted RADV audits on PYs 2009 -2010, PY2016 and PYs 2018-2024 DOS. MAOs have been subject to CMS’s ping pong and ever shifting sands regarding its RADV audits for more than a decade now without a reliable understanding of how CMS intends to approach, implement and ultimately collect on RADV.

OIG Audit Methodology. Congress tasked OIG with the oversight of agency programs and operations, including CMS and its Medicare Advantage Program.^[6] OIG has interpreted this responsibility as granting them the authority to audit MAO-specific risk adjustment data. After an early effort to audit 2007 DOS using an analogous methodology to CMS’s original 201-risk stratified member sample, OIG more recently shifted to a targeted audit of what it deems as “high-risk” diagnosis codes. For example, OIG has focused on acute myocardial infarction (heart attack) or cerebral vascular accident (stroke) diagnoses that originate from an office visit without a corresponding hospital visit and various cancer diagnoses without specific contemporaneous treatment identified in claims. Based on publicly available information, OIG has completed over 30 audits on MA contracts for 2015 through 2018 DOS.^[7]

Audit Recoveries. CMS has not yet finalized or recovered on any CMS RADV or OIG audit. Some delay may be attributed to the fact that CMS recently finalized payment recovery related rules in 2023^[8], in which CMS purports to grant itself the broad discretionary authority to extrapolate error rates on both CMS and OIG audits for PY 2018 and beyond. In 2024^[9], it finalized a rule establishing clarity on the timing of the audit appeals process related to coding determinations and payment error calculations.

Current Plan and Potential Challenges

CMS’s current Plan is not only focused on addressing the backlog of audits, but on audit expansion and recovery efforts from prior audits.

Backlog of Audits. Audits for DOS 2018 through 2024 DOS remain outstanding. Given prior notice, it does not appear that CMS will review any PYs prior to 2018.^[10] To address the backlog, CMS outlined certain key elements of the Plan - to utilize “enhanced technology” to review medical records and expand its workforce of medical coders. However, as the risk adjustment industry knows, the audit process is much more complex than a simple date of service (DOS) medical record review, as annual records for a given member are determinative, not necessarily a single encounter. Moreover, given the complexities inherent in a macro-population based payment, to initiate a RADV audit, CMS must: (1) ensure the data universe is accurate; (2) identify a sampling frame and sample; (3) conduct the audit through medical record review; and (4) calculate a payment error amount that reflects a complex series of rates and factors that vary from plan to plan.

Data Accuracy. To ensure the data is accurate, CMS must account for all code corrections submitted by an MAO over the years through a reconciliation process. Unlike the submission deadline for adding additional codes, MAOs can submit delete files to CMS for diagnosis codes it has identified as not validated at any time. CMS does not act with immediacy in recouping these codes. By way of example, for 2020 DOS codes, an MAO may have sent in corrections (i.e. deletes) to CMS in 2022 and again in 2023, through the delete / overpayment process. However, to date, CMS has not recouped these amounts. CMS typically processes this data and reconciles any associated payment adjustments one time before the roll out of a new PY RADV audit, not each time there is a delete submitted. CMS will typically notify MAOs of the intent to “re-run” the relevant PY, providing a deadline for the MAO to submit any deletes for purposes of data accuracy and payment adjustment. CMS has issued two such notices in the last year regarding 2017 and 2018 DOS for PYs 2018 and 2019.^[11]

Based on what many speculate are real-world resources constraints, CMS has slowly and methodically reconciled about one PY each year. Assuming resources remain the same, it would be a Herculean task to process corrections and reconcile payment for six years of deletes before September. It appears CMS took this into consideration with its most recent HPMS memo, issued on May 30, 2025, where it announced the deadlines for RA data submissions only for the purposes of “RADV Sampling” for PY 2020 through 2024.^[12] CMS made clear that it would not be making related payment adjustments at this time based on deletes submitted by the deadline and, instead, plans to issue additional notices for PY reruns at a later time. Submission deadlines for RADV sampling purposes are outlined below.

Construction of Sample/Sampling Frame. Once the data is reconciled to ensure diagnoses already deleted are removed from any potential RADV universe, CMS will determine the sampling frame and resultant sample which will depend on audit focus, and now, on audit size. Recently, CMS has focused on a 30/35-member sample, with an even higher number of HCCs audited depending on the audit methodology imposed. While not stated clearly, CMS noted in its Plan to increase “from auditing 35 records per health plan per year to between 35 and 200 records per health plan per year…based on the size of the health plan” [sic]. We assume CMS meant to say “members” or “diagnosis codes”, instead of “health records”. As any MAO in the industry who has participated in prior RADV audits knows, a plan typically submits between 3-5 medical records for every HCC audited, this can result in 100s of records for CMS to review for a single 30-member sample. CMS might be severely underestimating the work it will incur if sampling 200 members and related HCCs per year for 6 years. Regardless, it does appear that CMS intends to create more statistically appropriate samples based on plan size.

Medical Record Review. Two key elements, as noted above, spoke specifically to medical record review with enhanced technology and an increase in coder specific workforce. The technology mentioned by CMS appears to be an AI-driven program that will quickly identify “unsupported codes” and flag where diagnoses are supported. While these efficiencies may be helpful, without appropriate manual oversight, the program may not flag supporting documentation that a coder might have deemed acceptable for RADV purposes.

CMS also intends to increase its coder workforce by 50x (from 40 to over 2,000 coders) in the next three months. To achieve this seems near impossible. Unless CMS intends to significantly expedite the government contracting process with external vendors, it is going to be difficult for CMS to recruit 2,000 coders who are appropriately trained in risk adjustment medical documentation, in an industry already plagued by shortages, by September of this year. Any apparent quick fix may lead to numerous appeals regarding coding determinations depending on the reliability of the applied technology and the level of expertise of coders hired by CMS.

Audit Expansion. CMS intends to not only expand the audit sample, depending on size of the plan, but also plans to audit all eligible MA plans, approximately 550 contracts, for each year, again assisted with the enhanced technology CMS has put in place. Historically, all MAOs have participated in the annual national RADV audits where CMS audits the HCCs associated with 1-2 members for each contract. For the contract-level RADVs, only a sample of contracts have been selected, typically landing somewhere around 60 MAO contracts. Not only is every MAO going to receive an audit notice but will be subject to an audit for each PY between 2019 and 2024 with a sample between 30 and 200 members.

In the past, CMS has provided plans approximately five months to collect, review and submit medical records for the 30-member sample for one PY. CMS’s commitment to “complete all remaining RADV audits for PY 2018 to PY 2024 by early 2026”, is going to place significant strain not only on CMS but more importantly on the MAOs. An MAO, typically subject to 30-member sample for one PY, could now be subject to 1200-member sample (200 members x 6 years) in that same 5-month period.

Recovery Efforts. CMS also noted in its Plan that it intends to recover uncollected payments identified in past audits, even collaborating with OIG to do so for its audit findings. To initiate this process, CMS must first issue its results on all prior CMS RADV audits, which they have yet to do. Once issued, MAOs will have an opportunity to appeal either or both the coding determinations and payment calculation. The appeals process alone could take months to years, depending on how quickly CMS responds, and may still not lead to a final satisfactory resolution. That combined with a lack of transparency on audit methodology and the imposition of extrapolation on PY 2018 forward will lead to disputes that will need to be resolved through litigation. These are all roadblocks to CMS recovering in any expedited manner on past audits.

While OIG has issued findings as to coding determinations and payment calculations, CMS will still need to issue a final agency action to the MAOs regarding the results. Many MAOs continue to disagree with OIG’s coding methodology and, assuming similar appeal rights are granted, will be appealing both the coding determinations and payment calculations.^[13] Given the chance that CMS may also extrapolate OIG findings for PY2018 and beyond, this dispute will likely also lead to litigation.

RADV Preparedness – What Should MAOs Do

While CMS’s ability to scale its audit operations so dramatically remains to be seen, the agency’s strategic intent under the current administration is clear: aggressive enforcement to find and deter MA fraud, waste, and abuse. Even if CMS does not move with the speed and ferocity it is promising, MAOs need to consider how best to prepare its organization for these impending audits, particularly if the MAO has not been subject to any recent RADV audits.

1. Build a RADV Team: Internal resources, external vendors and counsel should be considered now. Although every MAO approaches RADV response differently, some opting to proceed using internal resources, others offloading much of the laboring ore to attorneys and consultants, a plan should be in place now. MAOs should also consider ensuring that their rights are preserved for challenges to RADV findings, or possible litigation.
2. Comply with Submission Deadlines: CMS issued submission deadlines for the purposes of creating the RADV Sampling for PYs 2019 through 2024. To the extent the MAO is aware of any known unsupported diagnosis codes, it should submit these codes to CMS by the submission deadline. If the MAO misses the deadline, these codes may be included in the sampling frame and sample, which could result in a greater financial impact to the MAO than just the delete.
3. Review Internal Processes and Identify Gaps: A response to RADV audits will require engagement with various departments such as data analytics, provider engagement, record retrieval, coding, submissions, actuarial services, etc. Depending on the size of the plan, MAOs will need to consider if they have the resources and operations to effectively respond to the proposed CMS audits in a timely fashion. MAOs must also keep in mind the intended completion of these audit efforts aligns with submission deadlines for 2024 DOS and all related efforts to meet that important deadline.
4. Resurrect Prior CMS and OIG RADV Audits: Although unclear as to when CMS will start to issue final agency actions for prior audits, it is not beyond CMS to issue them simultaneously with audit notices. MAOs should resurrect and refamiliarize itself with either its internal findings on the CMS RADV audits and the internal and OIG findings and payment calculations for OIG audits. MAOs will have 60 days to appeal coding determinations or payment calculations. If appealing a coding determination, the MAO must wait until that is resolved before appealing the new payment calculation based on the outcome of the prior appeal.

Even if CMS does not move as swiftly as planned, it is clear all MAOs will be dealing with several audits over the next few years either through audit response, the administrative appeals process or in litigation, as CMS makes every effort to catch up and finally collect on recoveries for the government’s efforts.

ENDNOTES

[1] See Press Release, Ctrs. for Medicare & Medicaid Servs., CMS Rolls Out Aggressive Strategy to Enhance and Accelerate Medicare Advantage Audits (May 21, 2025).

[2] See Ctrs. for Medicare & Medicaid Servs., Request for Comment: RADV Sampling & Payment Error Calculation Methodology (Dec. 20, 2010).

[3] See Ctrs. for Medicare & Medicaid Servs (February 24, 2012), Notice of Final Payment Error Calculation Methodology for Part C Medicare Advantage Risk Adjustment Data Validation Contract-Level Audits.

[4] 83 FR 55039. 

[5] 88 FR 6644.

[6] Inspector General Act of 1978, as amended, (5 U.S.C. App. 3).

[7] See U.S. Dep’t of Health & Human Servs., Office of Inspector Gen., Medicare Advantage Risk-Adjustment Data – Targeted Review of Documentation Supporting Specific Diagnosis Codes, W-00-20-35079 (2025).

[8] 88 FR 6643.

[9] 88 FR 30448.

[10] See 88 FR 6643 (CMS will not extrapolate RADV audit findings for PYs 2011 through 2017).

[11] See Memo, Ctrs. for Medicare & Medicaid Servs, Rerun of Payment Year (PY) 2018 (August 29, 2024); Memo, Ctrs. for Medicare & Medicaid Servs, Medicare Advantage/Prescription Drug System (MARx) April 2025 Payment – INFORMATION (February 28, 2025).

[12] See Memo, Ctrs. for Medicare & Medicaid Servs., Deadlines for the Submission of Risk Adjustment Data for Risk Adjustment Data Validation Sampling (May 30, 2025).

[13] See 42 CFR 422.311(c).