When the Audit Finds the Pattern
Three OIG findings. One major sanctions action. Four compliance obligations that were always there — and now have a precedent attached.
The harder version requires reading the series as a whole.
There is a version of the OIG’s recent audit work that can be read as routine enforcement activity: a few plans, some unsupported diagnosis codes, modest overpayment amounts. That reading is available if you look at each finding in isolation.
The harder version requires looking at the series as a whole. The OIG has now published findings from the same targeted audit program across at least three Medicare Advantage organizations. The findings are structurally identical. And last month, CMS sanctioned one of the country’s largest MA operators for seven years of knowing noncompliance with risk adjustment submission requirements — not because CMS discovered it, but because Elevance Health could not produce required electronic submissions when asked.
This edition connects those two threads. The question at the center is not whether your plan has unsupported diagnosis codes. Some number of them almost certainly exist in every large risk adjustment portfolio. The question is what your plan does when the internal review finds them — and whether your current protocols are legally compliant with what CMS requires next.
The OIG’s targeted Medicare Advantage diagnosis code audit series has been working through a defined set of high-risk diagnosis code categories across multiple MA organizations. In the past several months, it has published findings from three:
OIG Targeted Audit Series — Published Findings
The structural consistency is the signal. These are not three separate OIG reviews with independently developed methodologies. They are from the same series, targeting the same categories of diagnosis codes, applying the same sampling approach. The finding — that between 81% and 91% of sampled enrollee-years contained at least one unsupported code — is consistent enough across three separate organizations that treating it as an isolated organizational problem requires deliberate effort.
The OIG does not typically publish findings in the same series without a larger enforcement purpose. The RADV audit scaling that CMS announced — expanding from approximately 40 to 2,000 coders and moving toward near-universal plan coverage — creates the infrastructure for these findings to translate into financial consequences at scale. The OIG diagnosis code series and the RADV expansion are parallel tracks. For compliance leadership, the relevant question is not whether your plan will encounter this kind of scrutiny. It is whether your internal medical record review program identifies unsupported codes with the same clinical rigor the OIG applies when it arrives.
Four violations. Forty-six contracts. Seven years of known noncompliance.
Seven years of internal knowledge. Four regulatory violations. One sanctions action.
On February 27, 2026, CMS issued a sanctions notice to Elevance Health covering 46 of its Medicare Advantage and Part D contracts. The sanctions — suspension of enrollment and marketing communications — became effective March 31, 2026.
The timeline is the most significant disclosure in the CMS notice. CMS sent Elevance seven formal directives between 2018 and 2025 requiring correction. Elevance acknowledged the problem internally across that same period. It identified unsupported diagnosis codes. It simply did not submit corrections through the required electronic channels, and it continued certifying its data as accurate.
This is not an audit that caught a plan unaware. This is a seven-year gap between internal identification and regulatory action. The action came only when CMS determined that the standard correction process had failed completely. For compliance officers reviewing their own risk adjustment workflows, the Elevance notice provides a precise map of where the regulatory exposure sits: not in the existence of unsupported codes, but in what the plan does — and does not do — in the 60 days after internal review identifies them.
The 60-day overpayment reporting obligation under 42 CFR 422.326 does not require that CMS first audit the plan and find the overpayment. It requires the plan to act once it knows. Elevance’s internal reviews apparently identified, at minimum, some unsupported codes across years of service. The failure was not discovery. It was the response that followed discovery.
“The failure was not discovery. It was the response that followed discovery.”
PCOOB Weekly — May 1, 2026 — Risk Adjustment Compliance AnalysisFour operational implications that were always true. Now they have a precedent attached.
Five things compliance and quality leaders should act on from this edition
The OIG series and the Elevance sanctions define the same four compliance areas from two different directions — one through audit findings, one through enforcement action. Both point to the same operational gaps.
The OIG audit series is now confirmed systemic. Three plans, the same series, 81–91% unsupported code rates. Plans not auditing their own portfolios with equivalent clinical rigor are likely to encounter this question through a mandatory review process.
The 60-day clock starts at internal identification — not at CMS audit. Plans need a documented identification-to-reporting workflow with defined triggers and responsible owners. A written policy referencing the obligation is not sufficient.
Electronic submission channels are not interchangeable. RAPS, EDPS, and RAOR are required. Workarounds — including encrypted physical media — are a violation independent of data accuracy.
The Elevance timeline is the editorial anchor: seven years, seven directives. CMS does not always move fast. But when it does, the sanctions notice reflects the accumulated record of what the plan knew and when it knew it.
The OIG series and RADV expansion are parallel enforcement tracks. Plans should treat the OIG diagnosis code findings as an audit hypothetical for their own portfolios — not as a case study in someone else’s compliance failure.
What to watch next
Elevance cure attestation status
Elevance had until March 30, 2026 to submit an attestation of completion to avoid sanctions taking effect. Whether that attestation was submitted — and whether CMS accepted it — has not been publicly confirmed. Any CMS response or continued sanctions would be significant.
OIG series expansion
Priority Health, Gateway Health Plan, and BCBS Alabama are three findings. A fourth or fifth publication from the same series would constitute a confirmed national pattern across plan types and regions. Monitor OIG audit report publications.
RADV Payment Year 2020 first determinations
The RADV audit program — now with near-universal plan coverage and approximately 2,000 coders — will produce its first PY2020 overpayment determinations. These will be the first test of the new methodology at scale and of plans’ formal appeal options.
IRE transition: MAXIMUS to C2C
As of May 1, 2026, C2C replaces MAXIMUS as the Part C Independent Review Entity. Plans should confirm their IRE submission workflows, contact information, and operational handoff procedures are updated for the new contractor.