On December 16, 2025, the Office of Inspector General (“OIG”) for the U.S. Department of Health and Human Services (“HHS”) published the results of its audit of a Louisiana-based Medicare Advantage contract for Humana, the second-largest Medicare Advantage organization (“MAO”) in the country.¹  OIG’s audit continues a pattern of heightened regulatory scrutiny of certain “high-risk” diagnosis codes submitted by MAOs for payment from the Centers for Medicare & Medicaid Services (“CMS”).

The audit is HHS’s latest move in a long-running set of disputes over alleged overpayments to MAOs. As we described in a recent client alert, these issues remain the subject of litigation that will affect CMS’s authority to extrapolate adverse audit findings. The outcome of these disputes—and the evolving standards for audits conducted by both OIG and CMS—will have significant implications for MAO compliance, audit exposure, and payment integrity going forward.

Background 

Medicare Advantage is a public-private partnership established by Congress nearly three decades ago to offer beneficiaries an alternative to traditional Medicare. Under the program, private insurers contract with CMS to cover Medicare benefits for individuals who choose Medicare Advantage coverage. Today, more than half of all Medicare beneficiaries are enrolled in Medicare Advantage plans, which account for approximately 54% of all Medicare spending.²

A defining feature of Medicare Advantage is its distinct payment methodology. Unlike traditional Medicare, which reimburses providers on a fee-for-service basis, CMS pays MAOs a fixed, “capitated” monthly amount for each enrolled member. The base payment amount reflects an estimate of the average cost to cover a Medicare beneficiary. To account for differences among plans’ members, CMS then adjusts each plan’s payment up or down based on the plan members’ specific demographic characteristics and health status as reflected in diagnoses reported by providers in the prior year—a process known as “risk adjustment.” Congress required these risk-adjusted payments to MAOs “so as to ensure actuarial equivalence” with the costs CMS would expect to incur for the same population under traditional Medicare.³ As a result, MAOs receive higher payments for enrollees with more complex or severe health conditions that are correlated with higher anticipated healthcare costs.

CMS conducts retrospective risk adjustment data validation (“RADV”) audits to verify that its payments to MAOs are accurate. In addition, OIG has concurrent authority to audit MAO contracts. While CMS has the authority to make final determinations and initiate collection of any overpayments, OIG may identify and recommend recovery of payments it determines were improper.⁴

In December 2023, OIG released a “Toolkit” outlining “high-risk diagnosis codes” that often lead to improper payments to MAOs, including:

• acute stroke reported only on a physician claim without a corresponding hospital claim;
• acute heart attack reported only on a physician or outpatient claim without an inpatient hospital claim within 60 days;
• embolism without evidence of anticoagulant medication; and
• certain cancers (lung, breast, colon, and prostrate) without evidence of surgery, radiation, or chemotherapy within 6 months.⁵

Based on prior audits of MAOs, OIG has determined that the vast majority of these codes, including more than 90% of the stroke and heart attack codes, are not supported by the medical records and typically should have been reported using a “history of” code, which is not risk-adjusting.⁶

OIG Audit Shows Continued Focus on High-Risk Diagnosis Codes

In the audit of Humana, OIG continued its scrutiny of high-risk diagnosis codes. The audit targeted eight categories of diagnoses. Seven (stroke, heart attack, embolism, and lung, breast, colon, and prostate cancers) track codes OIG previously identified as “high-risk” in its December 2023 Toolkit.⁷ The other category—sepsis reported only on a physician or outpatient claim without a corresponding inpatient hospital claim—reflects the same focus on conditions that OIG believes are particularly susceptible to common coding errors and that the agency has included in similar audits of other MAOs.⁸ OIG audited 30 instances of each code for sample enrollees in payment years 2017 and 2018.⁹

Of the 240 codes, OIG determined that 218—more than 90%—lacked adequate support in the medical records.¹⁰ Humana could not retrieve medical records for 2 of the codes, and OIG found that the medical records Humana submitted supported only 22 codes altogether. OIG rejected some codes on the grounds that the records were for radiology reports or electrocardiograms that were not interpreted and signed by a provider type that CMS accepts for risk adjustment.¹¹ In other cases, while rejecting the reported condition, OIG credited Humana for a less severe manifestation of the related-disease group.¹² Consistent with its finding from earlier audits of other MAOs, OIG concluded that the unsupported diagnoses most often resulted from past medical conditions improperly being reported as current conditions.¹³

OIG estimated that the unsupported diagnoses caused Humana to be overpaid by more than $550,000 for the sampled codes and by more than $10 million for all such codes when extrapolated to the audited contract in Louisiana for payment years 2017 and 2018.¹⁴ The RADV rule issued by CMS in 2023, however, does not authorize extrapolation for RADV audits prior to payment year 2018. OIG therefore recommended that CMS recoup roughly half the estimated overpayment, or a little more than $5 million, primarily for payment year 2018.¹⁵

OIG Report Reflects Ongoing Disputes Over Audit Methodology

OIG’s audit of Humana brings renewed attention to longstanding disagreements between MAOs and CMS regarding a number of issues, including the use of extrapolation in RADV audits and credit for underpayments, among other concerns.

1. Extrapolation and Actuarial Equivalence

When CMS first introduced extrapolation in RADV audits in 2010, MAOs and the American Academy of Actuaries argued that a “Fee-for-Service Adjuster” (“FFS Adjuster”) would be necessary to preserve “actuarial equivalence”—the statutory requirement that risk-adjusted payments to MAOs match what CMS would expect to pay for the same population under traditional Medicare. That is because when CMS calibrates its risk-adjustment model by estimating the higher expected costs for members with particular conditions, it relies on traditional Medicare claims data, which is largely unaudited. Yet when CMS conducts a RADV audit, it ignores MAOs’ claims data and requires medical record support. Without an adjustment, MAOs explained, holding their data to a different, more stringent documentation standard would violate “actuarial equivalence” and could systematically underpay MAOs for the health status of their members.¹⁶

In its response to the OIG audit, Humana reiterated this longstanding objection that extrapolation without an FFS Adjuster would violate actuarial equivalence. Humana explained that audits of “high-risk” codes underscore the importance of an adjustment to address the inconsistent treatment of MAOs’ data because such codes are likely to be equally unsupported in traditional Medicare data.¹⁷ And Humana noted its pending legal challenge to CMS’s decision to eliminate the FFS Adjuster in the RADV rule.¹⁸

Although OIG acknowledged the subsequent district court decision vacating the RADV rule, it maintained that the litigation over the rule does not require the agency to alter its findings or recommendations. OIG reasoned that “CMS has not issued any requirements that compel [OIG] to reduce [its] overpayment calculations,” and that if CMS “deems it appropriate” to apply an FFS Adjuster, it will do so before finalizing any recovery.¹⁹  And OIG disagreed with Humana’s contention that it was arbitrary and misleading for OIG to estimate an extrapolated overpayment that ignores the potential need for an FFS Adjuster.²⁰

2. Credit for Underpayments

Humana also argued that OIG findings are “systematically skewed towards identifying overpayments rather than underpayments.”²¹ Humana explained that it was tasked with providing medical records to substantiate only codes actually submitted to CMS, not all codes that could have been submitted to CMS but were not (i.e., potential underpayments).²² And by excluding non-“high-risk” codes from the sample frame, CMS reduced the possibility of identifying underpayments.²³ For statistical validity and accuracy, Humana urged OIG to reconsider its audit methodology and expand the credit it provides for underpayments.²⁴

OIG responded that identifying underpayments in the manner Humana suggests would extend “beyond the scope of the audit.”²⁵  OIG asserted that a valid estimate of overpayments does not require consideration of all potential diagnosis codes and that its methodology was accurate.²⁶ OIG noted, however, that if it identified a code that Humana should have submitted instead of the audited code (e.g., a less severe manifestation of the related disease group), OIG credited that alternative code and based the overpayment on the difference.²⁷

3. Other Objections

Humana lodged several other objections, including that OIG’s review of the medical records imposes requirements beyond the relevant coding guidelines; that it may not adequately address data corrections that Humana submitted to CMS; and that OIG’s RADV audit methodology departs from CMS’s in various respects.²⁸ Humana also disagreed with OIG’s recommendations to identify and return overpayments for high-risk diagnosis codes after the audit period and enhance the company’s existing compliance programs, citing limitations in the scope of OIG’s review.²⁹

Key Takeaways

OIG’s audit of Humana raises broader, unresolved questions regarding audits of Medicare Advantage contracts. CMS has appealed Humana’s recent victory in challenging the 2023 RADV rule, which is the basis for extrapolation in RADV audits.³⁰ At issue in that litigation are similar disputes over the use of extrapolation, including the requirement of actuarial equivalence and the need for an FFS Adjuster. As these issues remain the subject of active court challenges and regulatory scrutiny, MAOs should closely monitor developments.

Beyond the litigation over the RADV rule, the potential for extrapolation might also warrant legal challenges to individual audit recoveries. It is thus important for MAOs to build the record for such litigation during the audit and diligently preserve all relevant arguments and objections—even in early stages, such as when responding to OIG draft audit reports. Although the litigation landscape continues to evolve, and OIG has largely deferred to CMS on major audit issues, a party could potentially be deemed to have forfeited an objection that it did not assert during the administrative proceeding. Establishing a thorough record of objections will help facilitate future litigation.

WilmerHale has experience representing MAOs in connection with CMS rulemakings and audits, as well as handling investigations and litigation relating to risk adjustment and other regulatory compliance issues. We are available to advise MAOs as they navigate the risks posed by the shifting landscape.