Day two at The 27th Risk Adjustment Forum in Orlando turned to enforcement, with speakers walking through which organizations federal regulators now hold accountable, which coding practices draw scrutiny, and what Congress is weighing for Medicare Advantage risk adjustment. The sessions also looked ahead to January 1, when new prior authorization technology requirements take effect.
Here are five takeaways for risk adjustment, compliance and operations leaders at Medicare Advantage plans and the organizations working with them. Each settlement discussed resolved allegations only, with no determination of liability.
1. False Claims Act cases now reach the full chain of partners
False Claims Act cases in Medicare Advantage once centered on health plans, and speakers walked through recent settlements showing how far the scope now extends, to provider groups, management services organizations, vendors, brokers, and in some cases individual executives and clinicians. The Seoul Medical Group settlement of about $62 million included individual owners as parties, and Matrix Medical Network and HealthFair resolved allegations about in-home assessments for $56.5 million, where the government alleged the assessments captured diagnoses treating physicians had not documented.
Panelists also pointed to the first Medicare Advantage kickback case DOJ has joined, in which the government alleges plans paid brokers marketing "co-op" fees to steer beneficiaries toward their plans. The case is still pending.
2. Chart reviews work best in both directions
Chart reviews are a standard part of risk adjustment, and the concern panelists raised is one-way review, where a plan adds codes found in the record and leaves unsupported codes in place. Aetna’s $117.7 million settlement in March 2026 resolved allegations about this practice, including morbid obesity codes the government said lacked support because the documented BMI was under 30. A pending case involving UnitedHealth Group is expected to test whether keeping codes a plan knows are unsupported creates False Claims Act liability on its own.
The practice panelists returned to most often was review in both directions, with unsupported codes removed as diligently as missing codes are added.
3. How organizations respond to internal concerns carries weight
The False Claims Act does not require intent to defraud, and reckless disregard meets the standard, so speakers spent time on how internal communications read when concerns go unaddressed. Kaiser Permanente’s $556 million settlement in January 2026, the largest Medicare Advantage False Claims Act resolution to date, covered coding from 2009 through 2018 and resolved allegations centered on concerns physicians raised internally. Speakers noted most whistleblowers are employees who first raised concerns inside their own organizations and felt unheard.
Self-disclosure came up as well. Speakers described how The Villages Health identified coding issues through its own audit, shared them with the government and its Medicare Advantage plan partners, and resolved the matter in August 2026 for $541.5 million, and they cited the case as an example of how cooperation factors into the outcome.
4. The Save MEDICARE Act signals where policy is heading
H.R. 9544, introduced by Rep. Lloyd Doggett in June 2026, has 52 cosponsors. The bill’s key provisions include:
- No diagnosis codes from chart reviews or health risk assessments for risk adjustment, starting in 2028
- No vendor contracts paid as a percentage of premium or tied to coding incentives
- Fixed RADV timelines, with no judicial review
- Recovery audit contractors paid up to 20% of what they recover
Panelists said the bill’s prospects depend on the makeup of the next Congress after next week’s midterm elections. Whether or not H.R. 9544 passes, many of the bill’s provisions would put into law positions CMS and DOJ already take.
5. Prior authorization APIs go live January 1
The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) already requires decisions within 72 hours on expedited requests and seven days on standard requests, along with a specific reason for each denial, and those rules took effect in January 2026. On January 1, 2027, the technology requirements follow, led by a Prior Authorization API letting provider EHRs check whether prior authorization is required, submit requests and receive decisions electronically, alongside Patient Access, Provider Access and Payer-to-Payer APIs. The rule applies to Medicare Advantage organizations, Medicaid and CHIP programs and managed care plans, and qualified health plan issuers on the federally facilitated exchanges.
With two months to go, speakers recommended end-to-end testing with top provider partners, a plan for API downtime, and a named person accountable for every decision, even where AI handles individual steps.
Compliance and audit readiness, risk adjustment, and operations and strategy will be covered at RISE National 2027, March 16-18 at Caesars Forum in Las Vegas.