OIG audits of Humana and UnitedHealthcare MA plans find most high-risk diagnoses unsupported by records; $177.8 million sought

“There is documentation of a past medical history of breast cancer [diagnosis] which does not result in an HCC.” The HHS Office of Inspector General (OIG) quotes that line from its medical review contractor in an audit of a Humana Medicare Advantage (MA) plan, and the same reasoning recurs, condition by condition, across two reports dated September 10 [1, 2].

What changed

OIG found that medical records did not support most of the high-risk diagnosis codes that two MA plans submitted to the Centers for Medicare & Medicaid Services (CMS) for payment years 2020 and 2021. At HumanaChoice (contract H5216), records failed to support 178 of 220 sampled enrollee-years, and OIG estimated the plan was overpaid at least $130.9 million [1]. At UnitedHealthcare of Wisconsin (contract H5253), 183 of 250 sampled enrollee-years were unsupported, and the estimate was at least $46.9 million [2]. Together the two recommended refunds come to about $177.8 million.

Both plans disputed parts of the findings. OIG revised each report after reading the plans’ comments: Humana’s errors fell from 187 in the draft to 178, cutting the recommended refund from $134,651,888 to $130,922,653, and United’s fell from 191 to 183 [1, 2].

The estimates are conservative by design. OIG uses the lower limit of a two-sided 90% confidence interval, which it says should fall below the actual overpayment 95% of the time [1].

Who it affects

The refund recommendations run to the plans, but the diagnoses came from practices. CMS sets each MA enrollee’s risk score from diagnoses collected from acceptable sources, including physicians and hospitals; the plan gathers those codes from providers and passes them to CMS, which maps them to Hierarchical Condition Categories (HCCs) [1]. Each HCC carries a factor that raises the enrollee’s risk score, and the plan’s monthly payment rises with it [1]. A diagnosis made in one year sets payment for the next [1].

The audited conditions point to specific specialties and settings: acute stroke, acute myocardial infarction, embolism, five cancers (lung, breast, colon, prostate and ovarian), sepsis and stage 3, 4 or unstageable pressure ulcers, plus a group of codes that looked like data-entry slips [1, 2]. Several groups are defined by a code on physician or outpatient claims with no matching hospital claim [1].

The plans are large. HumanaChoice, a preferred provider organization run by Humana, Inc., covered 1,730,650 enrollees in December 2021, and CMS paid it about $37.8 billion over the two audit years [1]. United’s contract covered 676,374 enrollees, with about $16.6 billion in payments [2]. For 2024, CMS paid MA organizations $494 billion, 44% of all Medicare payments [1].

Why don’t “history of” diagnoses count for Medicare Advantage payment?

OIG built its high-risk groups around claims patterns that suggest a past condition coded as a current one. An acute stroke code on one to five physician claims in a year, with no matching hospital claim, is flagged; OIG says a history-of-stroke diagnosis, which does not map to an HCC, “typically should have been used” in those cases [1]. A breast cancer code on a single date of service, with no surgery, radiation or chemotherapy within six months either way, is flagged the same way [1].

The pattern held in the records. At HumanaChoice, 15 of the 20 sampled acute stroke cases showed a prior stroke but nothing justifying an acute diagnosis at the visit, and all 19 breast cancer errors were history-only [1]. At United, every one of the 20 breast cancer samples and all 20 colon cancer samples were in error [2]. Sepsis was the exception at United, with 6 errors in 20 [2].

Some errors cut the other way. In one United case, the reviewer found no acute stroke but did find left-sided hemiparesis from an old stroke, a condition that maps to its own HCC; OIG credited the plan for that diagnosis instead [2]. Where a less severe diagnosis in the same disease group was supported, OIG counted the smaller payment rather than zero [1].

The data-entry group shows how small slips become payment errors. OIG’s tool found 3,973 ways a transposed or mistyped code could produce an unsupported HCC, such as E43 (protein-calorie malnutrition) keyed as I43, which maps to congestive heart failure [1]. In one Humana sample, a patient had five prostate cancer codes (C61) and a single code for asbestos-related lung disease (J61) [1]. In a United sample, four codes for mixed hyperlipidemia (E78.2) sat beside one code for cancer spread to the pleura (C78.2), which the reviewer could not support [2].

What it means for your practice

The note has to show current management. In one Humana sample, asbestosis appeared on the problem list, but the reviewer found “no documentation in the progress note to support that the condition was monitored, evaluated, assessed, or treated” [1]. Your problem list alone did not carry the HCC.

Only face-to-face encounters count. United supplied a stress echocardiogram to support one HCC. OIG treated that record as a diagnostic radiology service, not a face-to-face encounter, so it could not validate the code [2]. CMS requires every submitted diagnosis to be documented in a record from a face-to-face encounter and coded under the ICD official coding guidelines [1].

Plans will come back to you for records. Since the MA program began, plans “and their providers and practitioners” have been required to submit a sample of medical records for risk adjustment validation when CMS asks [3]. United could not locate records for 3 of its 250 sampled enrollee-years, and those HCCs went unvalidated [2]. During the audit period, United gave providers 30 days to send more documentation when an internal review found an unsupported code, then asked CMS to delete codes that still fell short [2].

Plan filters do not catch everything you send. United had a filter to block acute stroke codes, but its officials told OIG it applied only to in-home health and wellness visits and chart review submissions, not to diagnoses on claims submitted directly by providers [2].

Risk-sharing contracts carry recovery risk. When CMS wrote its 2023 audit rule, several commenters warned that providers in risk-sharing contracts with plans that had not reached final settlement “may be at risk for losses” [3]. CMS said the rule imposed no new documentation requirements on providers [3].

What to do now

1. Audit your own stroke, heart attack and cancer codes that appear once in a year with no related hospital claim or treatment, the pattern OIG flagged, and use history codes where the note describes only a past condition [1, 2].
2. Tie each risk-adjusting diagnosis to the assessment and plan in that visit’s progress note [1].
3. Run a keying check on high-value codes that differ by one character from common ones, using the E43/I43, C61/J61 and E78.2/C78.2 pairs as starting examples [1, 2].
4. Set a process for plan record requests so face-to-face notes can be produced within the plan’s deadline [2, 3].
5. Read the recovery terms in any risk-sharing MA contract. Talk to counsel if the contract is silent on audit-driven recoupments [3].

The policy fight

The plans’ main objection is the fee-for-service (FFS) adjuster. CMS built its risk model on diagnoses from traditional Medicare claims, which are not audited against charts; Humana argued that measuring MA payments against audited records, after setting rates from unaudited ones, is inconsistent, and that high-risk codes “are likely to be equally unsubstantiated in the FFS context” [1]. United made the same case, saying the codes OIG reviewed “were made and typically certified as accurate by providers” [2].

CMS rejected an adjuster in its February 1, 2023 rule, which allowed extrapolation of audit findings starting with payment year 2018 and dropped the adjuster for those audits [3]. On September 25, 2025, the federal district court in Fort Worth vacated that rule and sent it back to CMS, finding the final rule was not a “logical outgrowth” of the 2018 proposal [4]. United told OIG the ruling is on appeal and that CMS’s 2012 audit method, applies in the meantime [2]. That 2012 method included an adjuster, which operated from 2012 to 2018, according to the court [4].

OIG held its ground. It acknowledged the ruling but said it “does not impact our findings,” adding that CMS “has not issued any requirements that compel us to reduce our overpayment calculations” and can apply an adjuster during audit resolution if it chooses [1, 2]. Humana also objected to OIG’s coder tie-breaking method and its 90% confidence level; OIG said its approach did not need to mirror CMS’s audits [1].

CMS, for its part, said in May 2025 that it would audit all eligible MA contracts each payment year, roughly 550 plans, and expand its coding staff from 40 to about 2,000 [5]. It said its completed audits for 2011 to 2013 had found overpayments of 5% to 8% [5]. United pointed to those same audits as evidence its diagnoses are “among the most accurate in the industry” [2].

Whether CMS collects the $177.8 million, applies an adjuster, or waits for the appeal is not settled in either report. OIG’s own footnote says only that CMS action officials “will determine whether an overpayment exists” [1].