CMS Found a $462 Million Hole. It Chose Not to Close It.
A new OIG audit found that every sampled acute stroke diagnosis code submitted by Medicare Advantage organizations failed validation. CMS’s non-answer on fixing its own payment system turns a federal design gap into a standing compliance obligation for every MA plan.
An Audit That Tested a Pattern, Not a Plan, and Found It Fails Completely
The HHS Office of Inspector General audited acute stroke diagnosis codes submitted by Medicare Advantage organizations across the industry, drawn from enrollees whose plans submitted acute stroke codes to CMS on physician data records. Of 97 sampled enrollees, every single one had a diagnosis code unsupported by the medical records tied to it. Not most. Not a concerning majority. All of them.
The specific pattern OIG tested is precise: an acute stroke diagnosis appearing on a physician encounter record, used to calculate risk-adjusted payment, with no corresponding inpatient or outpatient hospital record confirming that diagnosis in the same service year. Stroke care essentially never happens exclusively in a physician’s office. When that combination shows up without a hospital claim attached, the code should not have generated a payment in the first place.
Prior OIG audits had already flagged this exact pattern as high-risk within specific plans. This audit is the first to test it as an industry-wide condition rather than a single-organization failure, and the industry-wide result was unanimous failure. OIG estimated $462 million in potential net overpayments to MA organizations for 2021 alone, based on this pattern.
All 97 of 97 sampled enrollees’ acute stroke diagnosis codes were unsupported by the medical records associated with them.
Source: HHS-OIG, Report A-02-23-01020
CMS’s refusal to concur or nonconcur is a meaningful choice, not a procedural footnote. Concurrence would commit CMS to building the system edit. Nonconcurrence would at least tell plans where CMS stands and why. Silence does neither.
It leaves the payment architecture exactly as it is today: a system that will keep paying MA organizations for acute stroke codes with no facility confirmation, indefinitely, until CMS decides otherwise or catches the pattern later through a Risk Adjustment Data Validation audit.
Health plans should not read that silence as a pass. They should read it as CMS declining to own a fix it has now been told, on the record, that it needs. The absence of a federal edit check is, functionally, a decision that pushes the full responsibility for catching this pattern onto the organizations submitting the codes.
That reframing matters more than the dollar figure. It changes this report from a piece of news into a standing instruction: build the check yourself, because the government has told you, in writing, that it will not commit to building it centrally.
For a risk adjustment or coding integrity team, this report is a self-audit trigger, independent of whether the plan’s own contracts were in OIG’s sample. The fact pattern is precise and testable: any enrollee with an acute stroke HCC-mapped diagnosis code submitted on a physician data record, with no matching inpatient or outpatient stroke diagnosis in the same service year. That is a query a coding integrity team can run against its own RAPS and EDPS submission history this month, not a hypothetical to monitor for later.
The workflow gap this exposes usually sits between two systems that were never designed to reconcile automatically: the physician encounter data feeding risk adjustment, and the facility claims data that would confirm or contradict it. Plans that reconcile those two data sets only during annual data validation, or only when a delegated coding vendor happens to flag something, are running the exact configuration OIG just tested at scale and found fails completely.
The same logic extends to any coding or risk-adjustment vendor a plan delegates this work to. Delegation does not transfer the obligation to look. It only adds a step: confirming the delegate is running the same reconciliation the plan itself now has every reason to run, and documenting that confirmation as part of ongoing FDR oversight rather than assuming the delegation agreement covers it.
Acute stroke HCC-mapped code on a physician data record, no matching inpatient or outpatient hospital record, same service year. Runnable against RAPS/EDPS history this month.
If a vendor submits these codes on the plan’s behalf, ask for evidence of the same reconciliation, not just a contractual assurance. FDR oversight requires monitoring, not just agreements.
This diagnosis pattern now sits inside the most aggressive RADV audit environment on record. A documented, 100% failure pattern is close to a published audit target.
Physician-to-facility data reconciliation often has no single owner. Until it does, this exposure will keep resurfacing regardless of who runs the one-time query.
Under the Medicare overpayment reporting and return rule, an overpayment that is identified must be reported and returned within 60 days, and failure to do so converts an ordinary billing error into False Claims Act exposure. Coding integrity teams that read this report and do not run the corresponding query against their own submission history are building a defensibility gap that did not exist before the report was posted.
This report lands inside the most aggressive Risk Adjustment Data Validation audit environment in the program’s history, where CMS is already sampling across nearly every MA contract on a rolling basis and treating unsupported HCCs as full recoupments rather than partial adjustments. Plans that wait for their own RADV sample to surface this pattern, instead of finding it first, are choosing the more expensive way to learn the same lesson.
The Fix CMS Declined to Build Is Now Every Plan’s Job
CMS was handed a specific, quantified, fixable gap in its own payment system and chose not to say whether it will fix it. That decision does not make the gap disappear. It just moves the responsibility for closing it from the federal government’s systems to each health plan’s own data governance, whether or not that transfer was ever formally acknowledged.
This is not the first time OIG has asked CMS to build a payment-time or intake-time control rather than clean up after the fact. CMS’s pattern of declining to commit either way tells plans something durable about how to read federal oversight going forward: the expectation that CMS’s own systems will catch errors before payment is not a safe compliance assumption.
Three things follow directly. First, coding integrity functions should run the specific query this report makes possible, this month, not during the next scheduled audit cycle. Second, any coding or risk-adjustment vendor should be asked to demonstrate the same reconciliation, not simply assumed to be performing it under a standing contract. Third, whoever owns physician-to-facility data reconciliation should be named explicitly, because this exposure will keep resurfacing until someone owns closing it end to end.
None of this requires waiting on CMS. All of it is available to a coding integrity or compliance function today, using data the plan already has.
The plans that treat this report as a compliance assignment, and not a news item, are the ones that will not be explaining an aggravated finding to CMS next year.
Why It Matters — By Function
Where the OIG stroke-code finding lands across the health plan organization
Questions Leaders Should Ask Now
Seven questions to pressure-test risk adjustment data governance against the OIG stroke-code finding
What did the OIG find about acute stroke diagnosis codes in Medicare Advantage?
An OIG audit found that all 97 of 97 sampled acute stroke diagnosis codes submitted by Medicare Advantage organizations had no supporting inpatient or outpatient hospital record in the same service year, a 100 percent failure rate that OIG estimates cost CMS $462 million in potential net overpayments for 2021 alone.
Did CMS agree to fix the payment system gap OIG identified?
No. CMS’s recorded response specified neither concurrence nor nonconcurrence with OIG’s recommendation to build a pre-payment system edit that would flag unsupported acute stroke codes before risk scores calculate.
What is the 60-day overpayment rule and why does it matter here?
Under 42 C.F.R. § 422.326, an identified overpayment must be reported and returned within 60 days, and failure to do so can convert an ordinary billing error into False Claims Act exposure. A published, government-sourced audit describing this exact fact pattern makes it difficult for a plan to argue it could not have known about the risk going forward.
How does this audit relate to Risk Adjustment Data Validation (RADV)?
This report lands inside the most aggressive Risk Adjustment Data Validation audit environment in the program’s history, where CMS is sampling across nearly every Medicare Advantage contract and treating unsupported diagnosis codes as full recoupments rather than partial adjustments.