CMS Issues Highly Controversial Final Medicare Advantage Audit Rule

RADV Program Overview

The Social Security Act (Act) requires CMS to risk-adjust payments that it makes to MAOs for medical services provided to their MA beneficiaries in a manner that ensures actuarial equivalence with the original Medicare program. Risk payments are intended to reflect the expected costs associated with the health status and demographic characteristics of their MA beneficiaries. CMS assigns each MA enrollee a risk score based on the individual’s health conditions and uses the risk score to adjust the base payment rate to the insurer for each beneficiary. MAOs receive lower payments for enrollees who are healthier and higher payments for less healthy enrollees who are expected to incur higher health care costs.³

MAOs and providers provide diagnosis codes that the government uses to calculate risk scores and make payments. CMS reviews samples of patient medical records during post-payment RADV audits to assess whether MAOs and providers accurately reported the diagnoses. MAOs have been sharply critical of the audits and the standards used in those audits.

In the RADV Final Rule, CMS alleged that the practice of paying MAOs more for less healthy enrollees creates “an incentive for MAOs to potentially over-code diagnoses to increase their payments, that is, to code diagnoses not properly substantiated by medical record documentation.”⁴  The assertion echoes reports previously issued by CMS and the Department of Health and Human Services Office of Inspector General (HHS-OIG) that failed to contend with the design of the MA program, lack of clear guidance to providers, and substantial work by providers and MAOs to ensure appropriate coding and eliminate overpayments.

Extrapolation Across Contracts

Time period: CMS finalized its proposal to extrapolate RADV audit findings to calculate contract-level recoveries but narrowed the time period in which the agency will extrapolate. CMS had proposed extrapolating RADV audit findings beginning in payment year 2011.

Comments submitted in connection with the proposed rule raised a series of legal concerns. In addition to challenging the proposal to apply a final rule retroactively, some commenters questioned whether CMS has statutory authority to use extrapolation in RADV audits. Commenters also expressed concerns that extrapolating audit findings for past years would deter participation in the MA program, would disrupt the care provided by physicians under risk-sharing contracts with MAOs, and would be inequitable.

In its Final Rule, as noted, CMS decided to begin contract-level extrapolation of RADV audits beginning in payment year 2018. CMS provided two reasons for its decision not to extrapolate starting with payment year 2011. First, the agency contended that extrapolating audit results starting with payment year 2018 will allow CMS to “focus on conducting future RADV audits as soon as practicable after an MAO payment year concludes.”⁵  Although CMS dismissed commenters’ concerns that extrapolating beginning with payment year 2011 would be an impermissible retroactive rulemaking, the agency’s action suggests CMS may have been concerned regarding the potential for litigation challenges over extrapolation in the earlier years. Second, CMS stated that the finalized approach will “better control the total number of active appeals that are submitted in the first few years following finalization of this rule.”⁶

Following publication of the rule, CMS plans to issue enrollee-level audit findings from the RADV audits that have already been completed for payment years 2011 through 2013 and will follow with the audits for payment years 2014 and 2015. CMS also plans to seek recovery only for what it asserts are enrollee-level “improper payments” identified in HHS-OIG audits for payment years 2011 through 2017. However, HHS-OIG will take the position that the RADV Final Rule has no impact on its independent audit authority to calculate extrapolated overpayment amounts.

Methodology: CMS did not adopt a particular extrapolation methodology in the RADV Final Rule. In the 2018 proposed rule, CMS had sought comments on a proposed sub-cohort sampling method, such as auditing only enrollees with certain high-risk conditions and extrapolating across the contract’s population of patients associated with those diagnosis codes. Comments challenged the agency’s legal authority to adopt such a methodology. In the Final Rule, CMS decided that it will “rely on any statistically valid method for sampling and extrapolation that is determined to be well-suited to a particular audit.”⁷  CMS will disclose the extrapolation methodology to MAOs through Health Plan Management System memoranda or other means.

It is particularly notable that CMS will not publicly commit to a particular sampling or extrapolation methodology given that CMS’s regulations prohibit MAOs from contesting the agency’s “RADV payment error calculation methodology.”⁸  This plan may be subject to challenge under Allina⁹ to the extent it involves a subregulatory process to change MA payment policy.

CMS also intends to focus its audits on MAO contracts and enrollees that, “through statistical modeling and/or data analytics, are identified as being at the highest risk for improper payments.”¹⁰  Since the RADV audits for payment year 2014, CMS has used statistical modeling to “incorporat[e] the potential risk of improper payments to MAOs, based on past audit findings and other factors, into selecting enrollee samples for audits.”¹¹  Finally, CMS reinforced the importance of compliance safeguards, including internal auditing, in reducing audit risk.¹²

Exceptions to Extrapolation: Another change from the proposed rule is that CMS may decide not to use extrapolation in particular instances, though extrapolation will be the standard practice. This could occur if, for example, CMS needs to exclude a large number of cases from a sample due to the loss of medical records in a natural disaster.¹³

CMS Will Not Apply a FFS Adjuster

As noted, the statute requires CMS to risk adjust its payments to MAOs “so as to ensure actuarial equivalence.”¹⁴  Actuarial standards of practice (ASOP) have long provided that the “input data that is used in the application of risk adjustment should be reasonably consistent with the data used to develop the model.”¹⁵  Consistent with that standard, when CMS first issued an extrapolation methodology in 2012, CMS adopted the so-called “FFS adjuster” to account “for the fact that the documentation standard used in RADV audits to determine a contract’s payment error (medical records) is different from the documentation standard used to develop the Part C risk-adjustment model (FFS claims).”¹⁶  Although the 2012 announcement did not specify the size of the adjustment to be made, other CMS documents indicated that the agency had calculated that the FFS Adjuster should be in the range of 4% to 8%.

However, in the 2018 proposed rule, CMS proposed to alter its policy and not use any FFS Adjuster in RADV audits. At the time, CMS stated that a study it conducted “found that errors in Medicare FFS claims data did not lead to systemic payment error in the MA program.” It also asserted that it “would be inequitable to only correct payment errors made to audited contracts.”¹⁷  Comments sharply criticized CMS’s analysis and its conclusion. In the Final Rule, CMS attempted to avoid the criticisms, stating that it is “not relying on the empirical findings of our study as the basis for our decision not to apply an FFS Adjuster.”¹⁸

CMS finalized that proposal in the RADV Final Rule, concluding that a FFS Adjuster is “not appropriate.” In so doing, CMS relied heavily on the D.C. Circuit’s decision in UnitedHealthcare Insurance Co. v. Becerra, 16 F.4th 867 (D.C. Cir. 2021). In Becerra, an MAO challenged the MA overpayment rule’s requirement that every overpayment associated with the MA program must be returned to CMS under penalty of potential False Claims Act liability. The MAO argued that before CMS could enforce the overpayment rule, CMS needed to “either audit traditional Medicare data before it goes into the risk-adjustment model or, alternatively, adopt a systemic corrective similar to the FFS Adjuster” contemplated for RADV audits.¹⁹  But the court disagreed, upholding the overpayment rule. Significantly, however, the decision did not directly address RADV audits. Notwithstanding that, in the RADV Final Rule, CMS concluded that by extension, the court’s reasoning also forecloses application of a FFS Adjuster. According to CMS, the RADV audit program similarly “applies after the fact to require MAOs to refund any payment to which they are not entitled, based on diagnoses that lack support in the medical record.”²⁰

The RADV Final Rule is almost certain to face litigation challenges. Whatever the impact of such litigation, MAOs and providers serving MA beneficiaries should consider reassessing their compliance and internal auditing programs in light of CMS’s audit plans.

¹ 88 Fed. Reg. 6643, 6644 (Feb. 1, 2023).
² Id. at 6653.
³ Id. at 6644.
⁴ Id. at 6645.
⁵ Id. at 6655.
⁶ Id.
⁷ Id. at 6651.
⁸ 42 C.F.R. § 422.311(c)(3)(ii).
⁹ Azar v. Allina Health Services, 139 S. Ct. 1804 (2019).
¹⁰ 88 Fed. Reg. at 6652.
¹¹ Id.
¹² Id. at 6658.
¹³ Id. at 6650.
¹⁴ 42 U.S.C. § 1395w-23(a)(1)(C)(i).
¹⁵ ASOP 45, § 3.2 (2011).
¹⁶ CMS, Notice of Final Payment Error Calculation Methodology for Part C Medicare Advantage Risk Adjustment Data Validation Contract-Level Audits (Feb. 24, 2012).
¹⁷ 88 Fed. Reg. at 6656 (summarizing the 2018 proposed rule).
¹⁸ Id. at 6659.
¹⁹ Id. at 883.
²⁰ 88 Fed. Reg. at 6656.