Medicare Advantage Risk Adjustment Data Certification: Who Signed, and What Did They Know?

Medicare Advantage risk adjustment data certification requires a plan’s chief executive, chief financial officer or direct delegate to attest that, to the best of their knowledge, the data submitted to the Centers for Medicare & Medicaid Services are accurate, complete and truthful. The signature connects the payment data to the people responsible for it. Unsupported diagnoses that increase payments cost Medicare and taxpayers money. For an insider examining Medicare Advantage fraud, the revealing question is what happened before that signature: which diagnoses the review rejected, who received the findings and whether those diagnoses still reached Medicare.

Who Certifies Medicare Advantage Risk Adjustment Data?

The Medicare Advantage contract requirements assign the certification to the chief executive, chief financial officer or a delegated individual who reports directly to one of those officers. They also require certifications from data-generating contractors, subcontractors and entities related to the plan. The provider group or chart-review company certifies the data it generates. The plan certifies the data it submits to Medicare.

The CFO’s certification covers information assembled across the business. A physician documents the encounter. A coding team interprets it. A vendor may review the chart. Plan staff transmit the diagnosis. The officer signs a representation about the resulting data.

In its December 2022 Cigna audit, the HHS Office of Inspector General emphasized the plan’s obligation to respond promptly and thoroughly to compliance problems. So the question is what the company learned before the signature, who heard it and what they did.

The Diagnosis Reaches Medicare Through Several Hands

Provider records, coding decisions, vendor reviews and plan submissions each describe a different stage of the same diagnosis. Medicare uses the submitted diagnoses to calculate risk scores that help determine the plan’s payment. A health risk assessment or retrospective chart review can supply additional diagnoses beyond those reported through ordinary care.

That second look can uncover information pointing in either direction. A supported diagnosis missing from the submission can raise payment. An already-submitted diagnosis that the chart does not support can require money to come back. One-way chart review describes the alleged practice of using the first result while leaving the second unresolved.

We follow the same diagnosis through those handoffs. The clinical record shows its support. The vendor’s output shows what the reviewer found. The plan’s submission shows what Medicare received. The next question is whether a correction inside the worklist changed the information used for payment.

What Information Reached the Signer?

Audit findings, vendor instructions and internal warnings show what reached the people responsible for the certification. The response matters as much as the finding: who ordered a correction, who narrowed the review and what remained in the submission afterward.

The government’s complaint against Anthem alleged a striking disconnect between the executive signing attestations and the rules for correcting the data:

The complaint also alleged that Anthem could have compared its previously submitted codes with its vendor’s review results to identify unsupported diagnoses, but did not run that comparison. Its programmers could write the database query. The alleged failure concerned what the business chose to ask its own data.

That is why internal compliance findings and the response to them matter beside the signed form. An attestation names the person making the representation. The communications and review decisions explain the information behind it.

The Data, the Knowledge and the Payment

The source record answers whether the diagnosis has support. Dated findings and instructions answer what the organization knew. Submission and payment records show how the disputed diagnosis reached the government’s calculation.

CMS’s April 2022 reminder about accurate risk adjustment data joins those obligations in one document. It addresses accurate submissions, compliance programs, certification and correction. It also says that a diagnosis without proper medical-record documentation is not a valid basis for risk adjustment payment.

We examine the signature alongside that payment trail, including how the false information mattered to payment and what the company did after learning of the problem.

Cigna and Martin’s Point Show Different Gaps

Cigna’s September 2023 national settlement resolved allegations for $172,294,350 involving chart reviews, home assessments and morbid-obesity diagnoses. The government alleged that Cigna used chart reviews to add diagnoses while failing to withdraw previously submitted diagnoses those reviews did not support. It also alleged that Cigna falsely certified its submitted diagnosis data each year.

The home-visit component supplies a more concrete account of the vendor handoff. In the local settlement announcement, the government recorded Cigna’s admissions concerning diagnoses unsupported by the information on vendor forms. Those diagnoses also had not been reported by another health care provider who saw the patient that year.

The resolution also required annual certifications by top executives and board members about Cigna’s compliance measures under a five-year corporate integrity agreement.

Martin’s Point settled for $22,485,000 in July 2023 over allegations that its chart reviews produced additional diagnoses unsupported by patients’ medical records. Its whistleblower’s complaint identified the visibility problem: information about invalid diagnoses did not accompany the attestations, and the underlying patient records did not travel to Medicare with the diagnosis codes.

The allegation explains why the form alone could look unremarkable. Medicare received the representation while the records needed to challenge it remained elsewhere. The insider who saw the rejected diagnosis and the submission decision could connect the two.

Vendors and Providers Share the Incentive and the Information

The certification requirements reach data-generating contractors and entities related to the plan because the data can originate outside the plan. Their records can also explain how the work was commissioned, what the reviewer was paid to find and which results the plan received.

A chart-review vendor paid for adds rather than deletes has a financial reason to concentrate on additional diagnoses. A contract tied to additional Medicare revenue makes that incentive visible. The review instructions and outputs show how it affected the work.

The healthcare provider relationship matters too. Upcoding or Selection? Evidence from Medicare on Squishy Risk Adjustment, a 2015 working paper hosted by Duke University, estimated that private Medicare plans generated diagnosis-based risk scores 6% to 16% higher than the same enrollees would generate under fee-for-service Medicare. Coding intensity increased with closer insurer-provider integration.

The paper describes contracts that tie a physician group’s payment to the insurer’s risk-adjusted revenue. That gives the group a share in the financial effect of its coding. We connect that arrangement to the actual review decisions: which diagnoses were challenged, what the provider or vendor reported and what the plan submitted.

The whistleblower behind Cigna’s home-visit case was a former part-owner of a vendor retained to conduct the visits. Knowledge of the assessment business reached the government from outside the insurer. A plan employee, a vendor coder and a provider’s billing team may each see a different handoff in the same payment trail.

What Happens When a Plan Identifies Incorrect Diagnosis Data After Certification?

The plan is responsible for deleting incorrect diagnosis data it has identified, including after the final submission deadline. CMS’s April 2022 memo names the Risk Adjustment Processing System and Encounter Data Processing System as the submission systems used for those deletions. Medicare recalculates risk scores and adjusts payments to account for corrections, including corrections to closed periods.

The certification date belongs beside the review date, the submission history and the correction record. Those records show whether the company had already identified a problem when it represented that its data were accurate, and whether its response reached the payment system.

A risk adjustment coder can connect the original record, the review finding, the instruction and the resulting submission. We work through that sequence with you: what the queue marked as corrected, what the export still contained, what reached the certifying officer and what happened to the payment.

A later audit supplies another dated finding. In a September 2026 audit of UnitedHealthcare Benefits of Texas, OIG found unsupported diagnoses in its sample of high-risk diagnosis groups and estimated at least $24.4 million in overpayments beyond the sampled records.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

When the Sign-Off Passed Over the Finding

If you know a plan certified diagnosis data after your team had identified unsupported codes, talk with our whistleblower experts about what reached the signer. We work with you to build your strongest whistleblower case around the records, the decisions and the payments, and bring in Medicare Advantage fraud whistleblower lawyers who understand vendor-generated diagnoses and data certifications. We stay with you from the first call to the end of the case.