CMS wants to audit every Medicare Advantage contract every year

CMS wants to audit every Medicare Advantage contract every year. For most of the past 2 decades, a Medicare Advantage plan could reasonably expect its risk adjustment coding to go unaudited in any given year, because CMS reviewed about 60 contracts a year out of roughly 550. In May 2025, the agency said it would audit every eligible contract for every payment year and review up to 200 medical records per contract instead of 35. To do it, CMS said it would expand its coding staff from 40 people to about 2,000.

In September 2025, a federal court in Texas vacated the 2023 rule that would have let CMS extrapolate audit findings across whole contracts without a long-standing adjustment for errors in Traditional Medicare’s own data. CMS appealed in November. As 2026 begins, the agency has not said how the vacatur will shape the audits it plans to run this year.

This analysis explains what risk adjustment data validation (RADV) audits test and what the court decided. It then shows why the scale CMS describes would change how plans and providers handle diagnosis coding, even if the extrapolation question is resolved against the agency.

Key takeaways

• The plan is universal audits. CMS said in May 2025 that it would audit all eligible Medicare Advantage contracts each payment year, up from about 60, and finish audits for payment years 2018 through 2024 by early 2026.
• The stakes are large. CMS cited federal estimates that MA plans may be overpaid by about $17 billion a year for unsupported diagnoses and a MedPAC estimate as high as $43 billion.
• Extrapolation is in court. On September 25, 2025, the Northern District of Texas vacated the 2023 RADV final rule, which eliminated the fee-for-service adjuster and allowed extrapolation from payment year 2018. CMS filed a notice of appeal on November 21.
• Audits continue in the meantime. Payment year 2018 and 2019 audits were underway at the end of 2025. Audits for 2020 and later had not been formally started.
• Enforcement points the same way. Cigna’s $172 million settlement in 2023 and Independent Health’s agreement to pay up to $98 million in 2024 both resolved allegations about diagnoses the records did not support.
• Home assessments are the pressure point. HHS’s inspector general found that diagnoses reported only on health risk assessments and linked chart reviews generated an estimated $7.5 billion in MA payments for 2023.

What a RADV audit tests

Medicare pays MA plans a monthly amount for each enrollee, adjusted for how sick that enrollee is expected to be. The adjustment depends on diagnoses. A plan submits diagnosis codes from the enrollee’s encounters, and CMS maps them into hierarchical condition categories (HCCs). Each category raises the enrollee’s risk score and the payment that follows.

The system rewards documentation. A diagnosis that is real but never coded does not raise payment. A diagnosis that is coded but not supported by the medical record raises payment it should not. The second problem is what RADV audits look for.

In a contract-level RADV audit, CMS selects a sample of enrollees from a contract and asks the plan to submit medical records supporting the HCCs that drove their payments. Certified coders review the records. Where a record does not support a submitted diagnosis, the payment attached to that HCC is an overpayment. The question that has occupied the industry for more than a decade is what happens next. CMS can recover only the overpayments in the sample, or it can project the sample’s error rate across the whole contract.

That projection, called extrapolation, is what makes RADV financially significant. Recovering the overpayment for 35 sampled enrollees is a rounding error for a large plan. Applying the sample’s error rate to every enrollee in the contract is not.

How one code changes a payment

The mechanics are easiest to see with round numbers. Say Medicare’s monthly payment for an enrollee of average expected cost in a given county is $1,000, and a coded condition adds 0.3 to an enrollee’s risk score. The plan is paid about $300 more each month for that enrollee, or about $3,600 over a year. The figures are illustrative, not CMS rates or coefficients, but the structure is the real one.

The structure has 2 features that explain why coding attracts scrutiny. Diagnoses recorded in one year set payments for the next, which is why the inspector general’s reports pair a year of diagnoses with the following year’s payments. And a condition has to be documented and coded again each year to keep counting. A plan that adds a chronic condition through a records review in one year and again the next is paid for it twice. If the record never supported the condition, both payments were overpayments.

What CMS announced in May 2025

CMS laid out its new approach in a press release on May 21, 2025. The table shows the main commitments.

From the CMS press release of May 21, 2025.

CMS framed the change around money it says it has not been collecting. The release cites federal estimates that MA plans may overbill the government by about $17 billion a year, and a Medicare Payment Advisory Commission (MedPAC) estimate that the figure could be as high as $43 billion. It says completed audits for payment years 2011 through 2013 found overpayments of 5% to 8%, and that the last significant recovery of MA overpayments followed the audit of payment year 2007. CMS also said it would work with the HHS Office of Inspector General (OIG) to recover uncollected overpayments from past audits.

The larger samples are tied to extrapolation. CMS said bigger samples would make audit findings more reliable for projection under the RADV final rule. That is the rule the court vacated in September.

The extrapolation rule the court vacated

CMS finalized its RADV methodology in 2023 after years of debate. The rule made 2 choices that mattered most to plans. It allowed extrapolation of contract-level audit findings starting with payment year 2018. And it eliminated the fee-for-service (FFS) adjuster.

The FFS adjuster addressed a structural problem. The MA risk adjustment model is calibrated on Traditional Medicare claims, and those claims contain diagnoses that would not survive a medical record review either. Plans argued that holding MA coding to a documentation standard stricter than the data used to build the payment model would systematically understate what they are owed. The adjuster was meant to offset that difference. CMS concluded in 2023 that it was not needed.

On September 25, 2025, in Humana v. Becerra, the U.S. District Court for the Northern District of Texas granted summary judgment to the plaintiffs and vacated the rule. According to a client alert from Crowell & Moring, the court found the rule procedurally invalid under the Administrative Procedure Act. CMS’s reasons for dropping the adjuster were not a logical outgrowth of its 2018 proposed rule, and the final rule introduced justifications the proposal had not presented. The court rejected the government’s argument that the error was harmless, noting the absence of meaningful discussion of costs and benefits and plans’ reliance on the earlier approach. It did not reach Humana’s other arguments, including that applying the rule retroactively to 2018 was an abuse of discretion. It remanded the rule to CMS.

CMS filed a notice of appeal on November 21, 2025, according to a second Crowell alert. The notice did not state CMS’s arguments. Its brief is expected in early 2026.

What the vacatur does and does not stop

The decision removed the regulatory basis for extrapolating findings without the adjuster for payment years 2018 and later. It did not stop RADV audits as such. The first Crowell alert noted that audits CMS had planned to extrapolate could be suspended. It added that audits for payment years before 2018 were likely to continue, because the vacated rule did not govern them.

CMS can still audit samples and recover the overpayments it finds in them. It can also write a new rule through notice and comment. What it cannot do while the vacatur stands is rely on the 2023 rule to project sample error rates across contracts without the adjuster.

Universal audits change behavior even without extrapolation, because every coded diagnosis becomes one a coder outside the plan may read.

What is moving while the appeal is pending

The November Crowell alert gives the clearest picture of the state of play at the end of 2025. CMS had initiated audits for payment years 2018 and 2019, with the final submission deadline for the second 2019 batch in late November. Audits for payment year 2020 and later had not been formally initiated. The alert said it was not yet clear how CMS would approach RADV audits in 2026, and that it was unclear whether CMS had launched the recruitment needed to reach about 2,000 coders.

A separate inquiry is also underway. The same alert reports that an OIG audit announced in August 2025 is reviewing whether MA organizations complied with federal requirements for submitting certain diagnosis codes. Results are expected in 2027.

The early-2026 completion date CMS set for the backlog now looks difficult to meet as described. Even if the agency proceeds with audits, the open legal question governs how much those audits will recover, and the scale of review depends on staffing that has not been publicly confirmed.

Enforcement has pointed the same way

RADV is an audit program. The False Claims Act is the enforcement backstop, and recent cases describe the coding practices that audits are designed to catch.

In late September 2023, the Justice Department announced that Cigna would pay $172 million to resolve allegations that it submitted false diagnosis codes for MA enrollees, according to Healthcare Dive. The government’s allegations covered 3 practices.

• From 2014 to 2019, Cigna’s chart review program retrieved records from providers and assigned additional diagnosis codes that the government said were unsubstantiated.
• Vendors, typically nurse practitioners, visited members’ homes and flagged conditions, and Cigna billed Medicare for diagnoses not supported by diagnostic testing or imaging.
• From 2016 to 2021, Cigna allegedly submitted inaccurate diagnosis codes for morbid obesity.

Cigna did not admit liability. The settlement included a 5-year oversight arrangement with OIG, with an annual independent review of its risk adjustment data.

In December 2024, Independent Health agreed to pay up to $98 million to resolve allegations that it knowingly submitted or caused the submission of invalid diagnosis codes for MA enrollees, increasing its Medicare payments, according to OIG’s enforcement summary.

OIG’s audit work had flagged the underlying pattern years earlier. In a December 2019 evaluation, it estimated that diagnoses reported only on chart reviews, with no matching service record, generated $6.7 billion in risk-adjusted payments for 2017. More than 99% of the chart reviews it studied added diagnoses rather than removing them. OIG recommended that CMS audit chart-review diagnoses against medical records, and CMS agreed.

That last finding names the design question every coding program faces. A chart review that only looks for diagnoses to add, and never removes a submitted code the record does not support, moves payment in one direction. A program that reviews in both directions can still find missed conditions, but it also deletes the codes an auditor would reject. Under occasional audits, the difference mattered mostly in litigation. Under universal audits, it shows up in every sample.

In practice, a 2-way program treats every diagnosis it touches the same way. A coder reviewing a chart checks the codes already submitted as well as the ones that might be missing, and a code without support in the record is removed through the same chart review process that could have added one. The cost is real, since deletions lower payment. The benefit is that the plan’s own review, rather than an auditor’s sample, becomes the first place an unsupported diagnosis is caught, at a point when correcting it costs a code rather than a projected recovery.

Where the coding risk concentrates

CMS’s announcement did not single out a coding practice, but OIG’s more recent work points to one. In an evaluation issued in October 2024, OIG estimated that diagnoses reported only on health risk assessments (HRAs) and HRA-linked chart reviews, with no other service records for those diagnoses in 2022, generated $7.5 billion in MA risk-adjusted payments for 2023. About 1.7 million enrollees had such diagnoses.

The report has 2 details that matter for audit exposure. In-home HRAs and the chart reviews linked to them accounted for almost two-thirds of the $7.5 billion. These assessments are often administered by MA companies or their vendors rather than by enrollees’ own clinicians. And the payments were concentrated, with 20 companies driving 80% of them. OIG noted that the top companies generated a substantially greater share of HRA-related payments for conditions such as diabetes and congestive heart failure.

OIG recommended that CMS restrict and audit diagnoses reported only on in-home HRAs or linked chart reviews. It also recommended that CMS determine whether certain condition categories are more susceptible to misuse, which was the only recommendation CMS agreed with.

A diagnosis recorded once in a home visit, never treated or mentioned again by the enrollee’s clinicians, is the kind most likely to fail a medical record review. In an audit regime that samples a few dozen enrollees from a fraction of contracts, the chance that any particular diagnosis is reviewed is small. In a regime that samples up to 200 enrollees from every contract every year, it is not.

What universal audits would change

Even if CMS loses on extrapolation, auditing every contract each year would change the economics of risk adjustment coding in 4 ways.

Record retrieval becomes routine. At the announced sample sizes, a full year of audits would cover between about 19,000 and 110,000 enrollee samples across 550 contracts. Those figures are this analysis’s arithmetic from CMS’s stated range of 35 to 200 records per contract, not a CMS estimate. Each sampled enrollee can involve records from several providers. Practices that treat MA enrollees should expect more requests, and plans will need retrieval processes that do not depend on goodwill.

Unsupported diagnoses carry a known cost. Under occasional audits, an unsupported code was a low-probability liability. Under universal audits, the expected cost of a code that cannot be supported rises for every contract. That favors coding programs that validate diagnoses before submission, over programs designed to find more diagnoses.

Vendors and home assessments face scrutiny. Plans that rely on in-home HRAs and retrospective chart reviews to capture diagnoses will see those diagnoses sampled. The OIG findings suggest that is where support is weakest.

Reserving gets harder. As long as the extrapolation question is open, plans face a range of possible outcomes from audits of past years, from sample-only recoveries to contract-wide projections. Finance teams will need to account for both until the appeal is decided or CMS writes a new rule.

The same logic applies to providers outside the payment relationship. A diagnosis a clinician documents for clinical reasons is rarely a problem. A diagnosis added to meet a coding target, without the evaluation and plan of care that would support it, is the kind a reviewer will find.

What to watch in 2026

The appeal. CMS’s brief, expected early in the year, will show whether it defends the 2023 rule on the merits or focuses on remedy. A decision that reinstates the rule would make extrapolation for 2018 and later years possible again.

New rulemaking. CMS could address the court’s procedural objection by proposing the change again with a full explanation. Any proposal would show how the agency now views the FFS adjuster.

Audit notices for 2020 and later. The timing and sample sizes of the next audit cycles will show whether the universal approach is happening at the scale announced.

Coding staff and technology. Public confirmation of the coder workforce and of how technology is used to flag diagnoses would indicate whether CMS can review records at the volume it described.

Plans’ own validation programs. Plans that review in both directions, and that test home-assessment diagnoses against later clinical records before submitting them, will be the first to learn what a universal audit is likely to find in their data.

OIG’s diagnosis code audit. Its findings, expected in 2027, may give CMS additional grounds to restrict diagnoses from HRAs.

About this analysis

Basis. This analysis relies on CMS’s May 2025 press release on RADV audits and on 2 client alerts by Crowell & Moring describing the court decision and the appeal. OIG evaluations OEI-03-17-00470 and OEI-03-23-00380 supplied the chart review and HRA findings, and OIG and Healthcare Dive reports describe the 2 settlements. The court’s opinion and the 2023 final rule were not reviewed directly, nor were the settlement agreements. Their contents are described from the sources cited.

Data notes.

• The $17 billion and $43 billion figures are estimates cited by CMS. They are annual estimates of overpayment from unsupported diagnoses, not audit findings.
• The 5% to 8% overpayment range comes from completed audits of payment years 2011 through 2013, as reported by CMS.
• OIG’s $6.7 billion and $7.5 billion are estimates of payments attributable to diagnoses that appeared only on chart reviews or HRAs. They are not findings that those diagnoses were false.
• The payment example is illustrative. The $1,000 monthly payment and the 0.3 risk score increase are not CMS figures.
• The range of 19,000 to 110,000 sampled enrollees is this analysis’s calculation from CMS’s announced figures (550 contracts times 35 to 200 records). Actual samples depend on how many contracts are eligible and how CMS assigns sample sizes.
• Settlements resolve allegations. They are not findings of liability.

Sources

• CMS, CMS rolls out aggressive strategy to enhance and accelerate Medicare Advantage audits, May 21, 2025
• Crowell & Moring, Court vacates CMS’s 2023 final rule on RADV audits
• Crowell & Moring, CMS appeals Humana v. Becerra
• HHS OIG, Billions in estimated Medicare Advantage payments from chart reviews raise concerns, OEI-03-17-00470, December 2019
• HHS OIG, Questionable use of health risk assessments continues to drive up payments to plans by billions, OEI-03-23-00380, October 2024
• HHS OIG, Medicare Advantage provider Independent Health to pay up to $98M to settle False Claims Act suit, December 2024
• Healthcare Dive, Cigna to pay $172M to settle claims it overcharged Medicare Advantage program, October 2, 2023

Frequently asked questions

How many Medicare Advantage contracts will CMS audit each year?

CMS said in May 2025 that it would audit all eligible MA contracts each payment year, about 550, compared with about 60 previously, reviewing 35 to 200 records per contract.

Can CMS still extrapolate RADV audit findings?

A federal court vacated the 2023 RADV final rule in September 2025, which removed its basis for extrapolating findings from payment year 2018 without the fee-for-service adjuster. CMS has appealed.

What did OIG find about health risk assessments in Medicare Advantage?

OIG estimated that diagnoses reported only on health risk assessments and linked chart reviews generated $7.5 billion in MA payments for 2023, with 20 companies accounting for 80% of those payments.