Medicare Advantage Risk Adjustment Validation: The Plan Supplies the Number That Sets Its Pay

The Centers for Medicare & Medicaid Services relies on Medicare Advantage diagnosis data to pay plans before validating those diagnoses against the medical records. The party being paid supplies the figure that decides what it is paid. If you work in coding, risk adjustment or compliance, you may see the contradiction before the government does: a review finds that a diagnosis has no support, but the code stays in the payment submission.

The monthly payment rises with the health care needs the plan reports. A risk score built from diagnoses and patient characteristics adjusts the amount Medicare pays for each member. Diagnosis codes map to disease groups called Hierarchical Condition Categories, which contribute to that score. An unsupported code can raise the payment at taxpayers’ expense.

The incentive reaches beyond the insurer. A group of healthcare providers can share in the increased payment, and a vendor can earn a percentage of the additional revenue its review produces.

Does CMS Validate Medicare Advantage Risk Adjustment Data Before Payment?

No. In its February 2023 audit rule, the Centers for Medicare & Medicaid Services said it relies on diagnosis data from Medicare Advantage organizations before validating it:

The agency names the incentive in the same paragraph: plans can increase their payments by reporting diagnoses the medical record does not substantiate. Its response is post-payment risk adjustment data validation audits, which check medical records for a sample of enrollees. The Department of Health and Human Services’ inspector general also audits plans. The money leaves on the plan’s own number. The check comes later.

Risk adjustment data validation audits identify improper payments. The agency says they are not specifically designed to detect fraud or identify every improper diagnosis submission. An audit tests whether the record supports the payment. The company’s review instructions and response to a known error tell a different part of the story.

The agency’s audit questions and answers describe the practical handoff: the agency sends the plan an audit notice and record-submission instructions, and certified medical record coders review the documentation.

When the Regulator Counted, the Corrections Ran One Way

The inspector general found that more than 99 percent of the chart reviews it examined added diagnoses. Its December 2019 report, looking at reviews from 2016, estimated that diagnoses appearing only on chart reviews generated $6.7 billion in risk-adjusted payments for 2017. The reviews overwhelmingly ran toward additions.

A chart review can find a diagnosis a provider missed. It can also find that a diagnosis already submitted has no support. When a review finds an unsupported code, does the plan submit a delete, or leave the code in place? Calling the exercise a review says nothing about what the company does with the answer.

The government’s complaint against Anthem alleges that the company told providers its chart reviews would help ensure accurate coding, then used the results to add diagnoses while ignoring unsupported codes already submitted. The complaint describes what happened when changing that arrangement came up inside the company: in March 2016, an executive told two colleagues she would not change chart review in any respect, since its high return on investment made it a steady source of money for Anthem.

The same complaint alleges that Anthem’s programmers could have compared previously submitted codes with the review results for the same visits and patients, but the company did not run that comparison. The allegation goes beyond finding an unsupported diagnosis. It concerns a decision about which answers the review would produce.

The HealthCare Partners and DaVita settlement covers the same alleged pattern. The Department of Justice announced a $270 million settlement in October 2018 covering improper diagnosis coding and a whistleblower’s allegations of one-way reviews. According to those allegations, HealthCare Partners sent missed diagnoses to plans for increased payments while ignoring inaccurate codes that should have reduced payment or prompted repayment. In that account, the review had found information in both directions. The alleged failure was what happened next.

The Coding Adjustment Still Leaves a Gap

The Centers for Medicare & Medicaid Services already reduces risk scores to account for differences between Medicare Advantage coding and traditional Medicare coding. The Medicare Payment Advisory Commission’s March 2026 report to Congress says the agency has authority to make a larger reduction than the statutory minimum and has never done so. For 2026, the reduction is 5.9 percent.

The commission projects Medicare Advantage risk scores about 10 percent above those for comparable traditional Medicare beneficiaries that year. After the adjustment, it estimates coding intensity will still add $22 billion to payments. The gap between the problem and the correction is a choice the agency makes every year.

Reducing risk scores across the program leaves the support for an individual diagnosis to a separate check.

The distinction between sickness and coding also appears in Upcoding or Selection? Evidence from Medicare on Squishy Risk Adjustment, a 2015 working paper hosted by Duke University. It estimated that enrollees in private Medicare plans generated diagnosis-based risk scores 6% to 16% higher than they would have generated in traditional Medicare. It also found more intense coding with greater integration between insurers and providers.

The paper makes the incentive concrete: insurers can link physicians’ pay to coded diagnoses instead of to visits and procedures.

That is why the provider contract and the coding instructions belong in the same conversation as the risk score. The payment formula gives a diagnosis a price. The business arrangement can give someone a reason to find it.

More Audits Promised, Money Still Waiting to Come Back

The Centers for Medicare & Medicaid Services announced a much larger audit program on May 21, 2025. Its audit expansion announcement promised audits of all eligible contracts in newly initiated audits, moving from roughly 60 plans a year to approximately 550. It also announced larger record samples and a major increase in medical coders. Auditing every eligible contract would still mean checking samples within those contracts.

The 2023 rule was supposed to increase what an audit could recover. It provided for extrapolation from payment year 2018 onward: using a statistically valid sample to estimate the wider payment error.

On September 25, 2025, the federal district court in Northern Texas set aside the rule. The agency’s 2026 audit guidance still describes requesting records and reviewing diagnoses.

Then came the Government Accountability Office’s July 2026 findings. It said the agency lacked a detailed plan to expedite RADV audits and that the backlog significantly delayed recovery. The estimated improper-payment rate had stayed steady. The agency also had not conducted a comprehensive fraud-risk assessment for Medicare Advantage.

GAO reported CMS’s improper-payment estimate at $23.7 billion for fiscal 2025. The operational failure GAO identified is more specific: the agency’s main means of finding and recovering improper payments was backlogged, and its corrective plans did not adequately track progress. Announcing more audits and getting money back are different achievements.

One Payment Route Closes in 2027

The Centers for Medicare & Medicaid Services’ 2027 rate announcement excludes diagnoses from unlinked chart-review records, with an exception for beneficiaries switching Medicare Advantage organizations. An unlinked chart-review record adds diagnosis information without linking it to the underlying encounter record. The change narrows which diagnosis sources can feed payment.

The agency can change the input rules. It can reduce risk scores. It can request medical records after payment. Each operates at a different point, and none replaces the decision inside the company when a reviewer finds that a submitted diagnosis lacks support.

The agency’s own rule states the obligation plainly: an unsupported diagnosis is not a valid basis for risk-adjustment payment, and an insurer that learns the diagnosis lacks medical-record support must refund the payment. An internal finding, the original submission and the company’s correction decision can therefore connect what a coder saw to what Medicare paid.

That is where an insider can have something the payment system does not: the reason the code stayed. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Know Why the Code Stayed

If you saw a review find unsupported diagnoses and watched the company leave them in the payment submission, speak with our whistleblower experts. We work with you to build the case around who knew, what the review found and where the money went, bringing in Medicare Advantage whistleblower lawyers who understand risk adjustment and standing with you throughout the case.