In early May 2016, the Government Accountability Office (GAO) released a critical report on the inability of the Centers for Medicare and Medicaid Services (CMS) to recover overcharges from errant and aggressive payment coding in the Medicare Advantage (MA) Risk Adjustment Program. The GAO’s report noted numerous shortcomings in CMS’s oversight of MA risk adjustment practices, resulting in the likely overpayment of Medicare funds to the private plans that participate in Medicare Advantage.

Risk adjustment was built into the MA program more than a decade ago to fund private MA plans for the care of particularly sick, frail or otherwise expensive people covered by Medicare. The Risk Adjustment Program incentivizes MA plans to document the conditions of their members by assigning them diagnosis codes based on medical records, from which MA plans receive increased funding. Many MA plans have hired specialized vendors to increase their ability to assign diagnoses, but critics, including several whistleblower lawsuits, charge that some of these vendors have miscoded or up-coded diagnosis codes of members in order to boost funding.

To address potential abuse, CMS conducts Risk Adjustment Data Validation (RADV) to detect and correct coding errors. But the GAO was sharply critical of CMS’s current RADV audit program, noting that the agency only audits 5 percent of MA plans per year, and when discrepancies are found, the resulting demand notices are limited in scope. The GAO suggests that CMS has spent about $117 million on RADV audits, yet has recouped only $14 million for the Medicare program.

The Affordable Care Act mandates that CMS strengthen its oversight of the MA Risk Adjustment Program by establishing Recovery Audit Contractors (RAC) for the MA program. These more aggressive auditors have recouped an estimated $2 billion in Medicare fee for service payments from hospitals since the start of the program. Unlike RADV and most other government auditors, RAC auditors are paid based on what they recover for the government (generally around 10 percent). They also take the errors they observe in their sample and “extrapolate” their findings across the entire population—resulting in much larger repayment demands.

CMS has not implemented RACs for the MA program, though recent agency statements and procurement documents suggest CMS is moving toward doing so. A brief experiment with RADV extrapolation in 2008 resulted in demand letters in the tens of millions of dollars that were contested by MA plans on several procedural and policy grounds. CMS has not collected money from these demand notices.

The GAO report makes five recommendations to CMS:

• Improve accuracy of CMS’s calculation of coding intensity (a calculation that ratchets down MA payments based on coding differences between the MA program and traditional Medicare);
• Focus audits on MA contractors most likely to have high rates of improper coding;
• Enhance the timeliness of CMS’s contract-level RADV audits;
• Improve timeliness of the RADV audit appeal process; and
• Develop a specific plan and timetable for incorporating RACs into the MA program.

There is a long history of GAO reports, often in concert with increased Congressional attention, spurring CMS to implement difficult program changes. While CMS, in its official response, pushed back on the GAO on some technical issue, it concurred with the GAO’s high level findings. For MA plans and their vendors, this GAO report should be considered less for its content than for the action it foreshadows, potentially as early as next year.