On September 25, 2025, the U.S. District Court for the Northern District of Texas issued a significant decision vacating a rule issued by the Centers for Medicare & Medicaid Services (“CMS”) that would have had far-reaching ramifications for Medicare Advantage organizations (“MAOs”) subject to risk adjustment data validation (“RADV”) audits by CMS.¹ The court’s decision that CMS’s rule violated the procedural requirements of the Administrative Procedure Act (“APA”) is the latest development in a 15-year saga over CMS’s authority to extrapolate sample audit results in a way that could result in substantial liability for MAOs. The decision has the potential to delay CMS’s ongoing efforts to conclude numerous RADV audits currently in progress.

Background

Medicare Advantage is a public-private partnership created by Congress nearly three decades ago as an alternative to traditional Medicare. Under the program, private insurers contract with CMS to cover Medicare benefits for individuals who opt into the program. Today, over half of all Medicare beneficiaries are enrolled in Medicare Advantage plans.

CMS’s payment methodology in Medicare Advantage differs significantly from its methodology in traditional Medicare. In traditional Medicare, CMS pays healthcare providers directly on a “fee-for-service” basis. In contrast, MAOs receive a “capitated” amount per enrolled member based on a prospective estimate of how much it is likely to cost the MAO to provide monthly coverage to the average Medicare beneficiary. CMS then adjusts this amount for the health status and demographic characteristics of each MAO’s membership—‌a process known as “risk adjustment.” Congress mandated risk-adjustment payments to MAOs “so as to ensure actuarial equivalence” with the costs that CMS would expect to incur for the same beneficiaries in traditional Medicare.² Thus, for enrollees with more severe health conditions based on the diagnosis codes reported by their providers, CMS pays the MAO more to cover the higher expected costs of treatment.

CMS conducts retrospective “RADV audits” to confirm the accuracy of its risk-adjustment payments to MAOs. In a RADV audit, CMS identifies a sample of members and asks the MAO to submit medical records validating diagnosis codes for those members that affect risk-adjustment payments. If the records do not support a diagnosis, CMS may conclude that it has overpaid the MAO for that member. For several years, CMS has also indicated that it may seek to extrapolate the net overpayment for the sampled members to an MAO’s entire membership under a given contract.

Extrapolation has the potential to lead to very significant repayment obligations. But so far, CMS has yet to use extrapolation to determine an overpayment amount in any RADV audit, in part due to disputes with MAOs about whether and how the agency can do so in an actuarially sound manner. In 2010, when CMS first proposed extrapolation, some MAOs and the American Academy of Actuaries commented that the proposal would require an offset to ensure “actuarial equivalence” with CMS’s expected payments in traditional Medicare. That is because when CMS calibrates its risk-adjustment model by estimating the higher expected costs for members with particular conditions, it relies on traditional Medicare claims data, which is largely unaudited. Yet when CMS conducts a RADV audit, it ignores MAOs’ claims data and requires medical record support. Without an adjustment, MAOs explained, holding MAOs to a different, more stringent documentation standard would violate “actuarial equivalence” and could systematically underpay MAOs for the health status of their members.

In 2012, CMS agreed and said it would calculate a “Fee-for-Service Adjuster (FFS Adjuster)” as an offset in extrapolated RADV audits.³ For years, the industry therefore expected that if and when CMS sought to extrapolate RADV audit findings, it would apply an FFS Adjuster. In 2018, however, CMS abruptly proposed eliminating the FFS Adjuster, claiming that it had conducted a study showing no payment effect from the use of unaudited fee-for-service data.⁴ After MAOs fought to obtain the data and submitted actuarial and statistical analyses demonstrating numerous flaws in CMS’s study, CMS abandoned the study in the final rule.

‌The final rule—which was issued in 2023, over four years after CMS’s initial proposal—‌‌still eliminated the FFS Adjuster, but it did so without any empirical finding that such an adjustment was no longer necessary. Instead, CMS cited new, purely legal rationales. Specifically, CMS claimed that the statute does not require “actuarial equivalence” in the audit context, instead requiring it only in the calibration of the risk-adjustment payment model.⁵ And despite its four-year delay, CMS decided to apply its new methodology with no FFS Adjuster to RADV audits going back to payment year 2018.

Humana, one of the largest MAOs, filed suit in Fort Worth challenging the rule on three grounds under the APA:

1. The rule’s elimination of the FFS Adjuster was arbitrary and capricious;
2. By applying to RADV audits for prior payment years, the rule was impermissibly retroactive; and
3. CMS’s shift in rationales violated the APA’s procedural requirements to provide adequate notice to the public and a meaningful opportunity to comment on the rule.⁶

District Court’s Decision

The district court granted summary judgment to Humana on the third ground, holding that CMS violated the APA’s procedural requirements.⁷ To provide fair notice, the court explained, the APA requires that the final rule be a “logical outgrowth” of the agency’s proposal.⁸ Here, however, CMS initially proposed to eliminate the FFS Adjuster based on a flawed empirical analysis the agency later abandoned and, alternatively, because it would be “inequitable” to apply the FFS Adjuster only to audited plans and not unaudited plans.⁹ In the final rule, CMS relied on neither rationale. Instead, CMS asserted for the first time a statutory exemption from “actuarial equivalence” for RADV audits and, alternatively, claimed that a different statutorily required adjustment (the “Coding-Intensity Adjustment”) obviated the need for the FFS Adjuster.¹⁰ The court concluded that by jettisoning its earlier rationales without adequately previewing the later ones, CMS had thus failed to give the public fair notice as required by the APA.

The government contended that any procedural defects were remedied by CMS’s later request, while the comment period was still open, for public input on whether the statutory provisions governing risk adjustment should be read to mandate or prohibit an FFS Adjuster or should otherwise inform the agency’s proposal. The court, however, concluded that this broad, generic request did not reasonably imply that CMS would abandon its empirical and equitable rationales for not applying an FFS Adjuster in favor of a new statutory interpretation repudiating the agency’s long-standing position that RADV Audits must comply with actuarial principles governing risk adjustment generally.¹¹

The court likewise rejected the government’s arguments that the rule was merely “interpretive” and thus exempt from the APA’s procedural requirements and that any procedural deficiency was harmless.¹² As the court explained, CMS’s decision in 2012 to apply an FFS Adjuster was a legislative rule that required notice-and-comment rulemaking; the agency’s repudiation of its prior position was therefore necessarily subject to the same procedural obligations, even if CMS’s rationale was a new statutory interpretation.¹³ The court concluded, moreover, that the procedural deficiency here was not harmless because MAOs relied on CMS’s earlier guidance regarding the application of an FFS Adjuster from 2018 through 2023 and “will potentially bear enormous unforeseen costs as a result.”¹⁴

Because the court determined that this procedural defect was a sufficient basis to vacate the rule, it declined to reach Humana’s other arguments that the rule’s elimination of an FFS Adjuster was arbitrary and capricious and that the rule’s application to RADV audits for earlier payment years was impermissibly retroactive.

Key Takeaways

As mentioned above, this decision is the latest development in a lengthy process of determining whether and how CMS may engage in extrapolation in RADV audits. MAOs and other stakeholders will want to monitor future developments closely. Considerations to keep in mind include:

• The court’s decision comes on the heels of an announcement in May 2025 by CMS that it planned to accelerate RADV audits significantly.¹⁵ In that announcement, CMS detailed a large commitment of resources to expand the use of RADV audits, including by auditing every contract, and to address the backlog of RADV audits, which have been stalled for years in light of the uncertainty over the extrapolation methodology that CMS would use.

• Even before the recent decision, it had been unclear whether CMS could continue at the pace it announced. But the decision will create a significant hurdle, as it vacates the rule that CMS would be relying on to apply extrapolation in the pending RADV audits.

• If the government chooses to appeal the decision, that could prolong the uncertainty that has already been hanging over these audits for years.

• Absent appellate relief, CMS will likely have to go through a new rulemaking to address the procedural defect identified by the district court. And a new rule—‌if it purports to apply retroactively and still eliminates the FFS Adjuster—‌would likely be challenged anew.

It is important for MAOs to follow the litigation and any new proposed rulemaking by CMS and to be prepared to preserve arguments they may later wish to make both in any CMS rulemaking and in pending RADV audits. In the earlier rulemaking, members of the industry submitted robust comments addressing the shortcomings of the proposed rule. Any new proposed rulemaking here would present another opportunity for interested parties to submit comments. If CMS at some point does attempt to engage in extrapolation, the financial consequences could be substantial.

WilmerHale has experience representing MAOs in connection with CMS rulemakings and RADV audits, as well as handling investigations and litigation relating to risk adjustment and other regulatory compliance issues. We are available to advise MAOs as they navigate the risks posed by the shifting landscape.