Pulling Back the Curtain: Lessons from a OIG Risk Adjustment Audit

EDITOR’S NOTE: The author of this article used artificial intelligence (AI)-assisted tools in its composition, but all content, analysis, and conclusions were based on the author’s professional judgment and expertise. The article was then edited by a human being.

The U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) recently released findings of an audit examining diagnosis codes submitted by a Medicare Advantage (MA) organization for use in the Centers for Medicare & Medicaid Services (CMS) risk adjustment program. Although the review focused on a single MA contract, the findings highlight documentation and compliance issues that may have implications across the healthcare industry.

The report, “Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Priority Health Submitted to CMS,” evaluated whether selected diagnosis codes used to calculate risk-adjusted payments were supported by the medical record. The findings provide insight into how regulators evaluate documentation supporting diagnoses that influence MA payments and reinforce the importance of strong documentation oversight within healthcare organizations.

This audit also arrives as federal oversight of MA risk adjustment continues to expand, particularly following CMS’s decision to allow extrapolation in Risk Adjustment Data Validation (RADV) audits: an enforcement change that significantly increases the financial exposure associated with unsupported diagnoses.

Audit Findings

The OIG reviewed 300 sampled enrollee-years associated with diagnoses identified through data mining and clinical consultation as having a higher risk of miscoding in risk-adjustment submissions.

According to the report, 252 of the 300 sampled enrollee-years lacked sufficient medical record documentation to support the diagnosis codes submitted to CMS, resulting in $828,010 in net overpayments identified in the sample.¹

Using statistical extrapolation, the OIG estimated that the MA organization received approximately $4.4 million in net overpayments for the payment years examined.¹ The audit also concluded that the organization’s internal compliance processes designed to prevent, detect, and correct inaccurate risk adjustment data could be strengthened.

The findings provide important insight into how regulators evaluate the documentation supporting diagnoses used in risk adjustment.

High-Risk Diagnoses Identified in the Audit

The OIG focused on 10 diagnostic categories identified as having an elevated risk of inaccurate reporting in risk-adjustment submissions:

• Acute stroke;
• Acute myocardial infarction (MI);
• Embolism;
• Lung cancer;
• Breast cancer;
• Colon cancer;
• Prostate cancer;
• Ovarian cancer;
• Sepsis; and
• Pressure ulcers (stage 3, stage 4, or unstageable).

Across these categories, auditors frequently observed diagnoses appearing on a single physician or outpatient claim, without corroborating clinical documentation, treatment patterns, or additional encounters typically associated with those conditions.

For example, some diagnoses, such as acute stroke or MI, appeared on a single physician or outpatient claim without corresponding hospital claims or follow-up documentation that would normally accompany those conditions. In other instances, cancer diagnoses were present without evidence of surgery, chemotherapy, or radiation therapy within the timeframe typically associated with active treatment.¹

These patterns were used by auditors to assess whether the diagnosis codes submitted to CMS were adequately supported by the medical record.

Documentation Expectations in Risk Adjustment

Under federal regulations governing the MA program, diagnosis codes submitted to CMS for risk adjustment must be supported by documentation in the medical record, and must be based on a face-to-face encounter with the patient.²

MA organizations are also responsible for ensuring the accuracy, completeness, and truthfulness of the data submitted to CMS, including diagnoses obtained from provider documentation.²

In practice, this means diagnoses used to determine risk scores must clearly reflect the conditions evaluated, assessed, or managed during the encounter. When documentation does not demonstrate that a condition was active and clinically relevant during the reporting year, the diagnosis may be vulnerable to audit challenge.

The Documentation Signal Behind the Audit

Beyond the financial findings, the audit provides an important signal about how regulators evaluate diagnoses used for risk adjustment.

In many of the cases reviewed, the issue was not necessarily that the diagnosis itself was clinically implausible. Rather, the documentation did not clearly demonstrate that the condition was active during the encounter (or being actively managed by the provider).

In several cases, the documentation more closely reflected:

• Historical conditions, rather than active disease;
• Evaluation of prior diagnoses; and
• Diagnoses lacking evidence of treatment, monitoring, or ongoing management.

These distinctions between active conditions and historical diagnoses have become increasingly important in risk-adjustment validation and payment-integrity oversight.

The Role of Interdisciplinary Documentation Oversight

The audit also underscores the importance of collaboration between the teams responsible for documentation oversight within healthcare organizations.

Physician advisors, clinical documentation integrity (CDI) specialists, coding professionals, and compliance leaders each play a role in ensuring that diagnoses reflected in the medical record meet regulatory documentation expectations.

Physician advisors help clinicians understand the degree of clinical documentation necessary to support diagnoses that influence risk scores. CDI programs serve as the operational bridge in this process, identifying documentation gaps and supporting providers in accurately communicating the patient’s clinical condition.

Coding professionals remain responsible for applying ICD-10-CM coding guidelines and ensuring that diagnosis codes accurately reflect provider documentation. Compliance teams provide the governance framework that ensures organizations maintain policies and procedures designed to produce the accuracy and integrity of data submitted for payment purposes.

When these disciplines work collaboratively, organizations are better positioned to ensure that diagnoses used for risk adjustment are clinically supported, appropriately documented, and accurately coded.

Why Hospital Leaders Should Pay Attention

Although the audit focused on a MA organization, the findings have broader implications for hospital leadership and health system governance.

The diagnosis codes reviewed in the audit ultimately originate from provider documentation that MA plans collect and submit to CMS, meaning hospitals and health systems play a central role in ensuring the accuracy and defensibility of those diagnoses.

When documentation does not clearly support a condition reported for risk adjustment, the downstream impact can extend beyond a single claim.

Hospitals that contract with MA plans may face:

• Payment recoupments;
• Contract disputes with health plans; and
• Increased audit scrutiny related to documentation supporting high-impact diagnoses.

For hospital executives, this reinforces the need to view documentation integrity not simply as a coding function, but as a clinical governance priority. Strong documentation oversight structures that integrate physician advisors, CDI programs, coding leadership, and compliance teams can help ensure that diagnoses recorded in the medical record accurately reflect the patient’s clinical condition and withstand payer and regulatory review.

What Hospital Leaders Should Do Now

The findings from this audit highlight several practical steps hospital leaders should consider:

• Strengthen documentation governance. Oversight should extend beyond coding departments and include physician advisors, CDI leadership, and compliance teams.
• Prioritize clinical validation for high-risk diagnoses. Conditions such as sepsis, stroke, MI, advanced pressure ulcers, and active malignancy frequently drive risk-adjustment payments and require clear clinical documentation.
• Expand physician advisor engagement. Physician-to-physician communication can help ensure that documentation accurately reflects clinical reasoning and supports the diagnoses reported on claims.
• Align CDI and coding workflows. Structured collaboration between these teams helps ensure that diagnoses reflected in the medical record are both clinically supported and appropriately coded.

Looking Ahead

The OIG noted that this audit is part of a broader series examining high-risk diagnoses submitted by MA organizations.¹

MA spending continues to expand, reaching $494 billion in payments in 2024 and representing nearly half of all Medicare expenditures.¹ As enrollment and spending grow, regulatory scrutiny of risk-adjusted payments is expected to increase.

For healthcare organizations, the message from this audit is clear. Ensuring that diagnosis codes are supported by clear, clinically grounded documentation is essential not only for accurate reimbursement, but also for maintaining compliance in an environment of growing oversight.

Programs that emphasize strong collaboration among physicians, CDI specialists, coding professionals, and compliance teams will be better positioned to ensure that the medical record accurately reflects the patient’s clinical story – and that the diagnoses derived from that record can withstand the scrutiny of future audits.

References

1. Office of Inspector General. Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Priority Health (Contract H2320) Submitted to CMS. U.S. Department of Health and Human Services. March 31, 2026. https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-priority-health-contract-h2320-submitted-to-cms/
2. Centers for Medicare & Medicaid Services. Medicare Managed Care Manual, Chapter 7 – Risk Adjustment. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/mc86c07.pdf
3. Social Security Act §1853; 42 CFR §§422.308 and 422.310 – Medicare Advantage Risk Adjustment Data Requirements.