The HHS Office of Inspector General (OIG) panel at the 27th Risk Adjustment Forum in Orlando brought three perspectives to one stage. Jacqualine Reid, Senior Social Science Analyst, and Sadie Ellington, Team Leader and Social Science Analyst, walked through OIG’s evaluations of chart reviews and health risk assessments (HRAs), and Special Agent Christian Jurs explained how those findings connect to enforcement in managed care.
The message during the hour was consistent and constructive. Risk adjustment data holds up best when every diagnosis traces back to documented care, and the panel spent most of its time on what strong compliance programs do to keep the link between data and care intact.
What OIG’s HRA and chart review work found
OIG’s first series of reports, released between 2019 and 2021, looked at 2016 encounter data and asked a simple question: how much risk adjusted payment came from diagnoses reported only on a chart review or HRA, with no other record of care for the condition during the year. The answer was an estimated $9.2 billion, with unlinked chart reviews and in-home HRAs accounting for large shares and a small group of companies accounting for a disproportionate share of the total.
The analysts explained why the number matters either way. If those diagnoses are unsupported, the payments are too, and if the diagnoses are accurate, members with serious conditions went a full year without documented treatment for them.
OIG’s 2024 follow-up used 2022 encounter data and added a new category, HRA-linked chart reviews, where a plan runs a retrospective review on an HRA encounter. Diagnoses reported only on HRAs or HRA-linked chart reviews generated an estimated $7.5 billion, and 13 conditions accounted for three quarters of the total, led by vascular disease, COPD, disorders of immunity, behavioral health conditions and morbid obesity.
Where OIG’s recommendations stand with CMS
Ellington and Reid gave a status report on roughly a dozen recommendations OIG has made to CMS across the series. Four are closed, including oversight of unlinked chart reviews, an area where CMS reviewed its own 2023 encounter data and moved to exclude unlinked chart reviews as a source of risk adjustment diagnoses.
Five remain in progress, among them incorporating in-home HRAs and HRA-linked chart reviews into contract-level RADV audits, continued review of HCCs vulnerable to misuse alongside the move to the V28 model, and oversight of plans paid for enrollees whose only encounter in a year was a single in-home visit. CMS has not agreed to three others, including excluding diagnoses reported only on in-home HRAs unless the plan shows follow-up care, adding an encounter data flag for plan-sponsored HRAs, and making HRA best practices mandatory.
What is next on OIG’s list
The panel previewed active and upcoming work tied to Medicare Advantage:
- A financial evaluation of HRAs and HRA-linked chart reviews in Dual-Eligible Special Needs Plans, given rapid D-SNP enrollment growth.
- Targeted audits of diagnoses originating from unlinked chart reviews and HRAs.
- Medical record audits of high-risk diagnoses submitted by MA organizations.
- An analysis of the payment impact and program savings from the V28 risk adjustment model.
What OIG expects from compliance programs
The analysts pointed attendees to OIG’s Medicare Advantage Industry Compliance Program Guidance and to the in-home assessment best practices CMS described in its 2015 rate announcement. The common thread is connecting risk adjustment to care, which means aligning chart retrieval and retrospective review with care management teams, training staff, network providers, coding vendors and the software doing the work on coding integrity and the appropriate use of HRAs, and monitoring for outliers in coding, high-risk HCCs and vendor patterns, with prompt corrective action when something looks off.
Jurs added the legal frame. Plans certify the accuracy, completeness and truthfulness of their risk adjustment data, and the obligation runs in both directions, covering the codes a plan adds and the codes a plan should remove once the record no longer supports them. He also offered a simple test for where coding direction belongs.
“If the diagnosis codes are coming out of the CFO’s office and not the CMO’s office, [you’re] usually going to have a bit of a problem.”
Jurs referenced recent False Claims Act settlements in the Eastern District of Pennsylvania centered on the duty to delete unsupported codes, both resolving allegations without a determination of liability, and a Ninth Circuit decision treating diagnoses as time-bound, so a condition documented in the past does not support a code in a later year. He also noted OIG and the Department of Justice continue to expand their work in risk adjustment.
What the Q&A covered
Attendee questions pushed into the practical side of the research and the guidance. One asked whether the $9.2 billion finding rested on encounter data alone, and the analysts explained how national studies differ from the medical record reviews used in audits and investigations. Another asked how investigators separate individual provider coding habits from plan-level direction, and Jurs described the plan practices and incentives investigators look at first.
Other questions covered plans ingesting CCDA and other interoperability data for supplemental diagnoses without coder validation, how encounter data distinguishes in-home HRAs from facility-based and telehealth assessments, how plans route vendor HRA findings to the member’s primary care provider, and the coding burden on small independent practices. On the last point, the panel was direct: the responsibility for education, auditing and support of the network sits with the plan. The session closed on the same theme as the opening, with risk adjustment, compliance and care management leaders in the room hearing one expectation from the people who study the program and the people who enforce the rules.
Compliance and audit readiness have a dedicated track at RISE National 2027, March 16-18 at Caesars Forum in Las Vegas, where compliance, risk adjustment and care management leaders work through OIG and CMS expectations together.