CMS Expands Audits on Medicare Advantage Overpayments: What Providers Need to Know

The Centers for Medicare & Medicaid Services (CMS) recently announced significant changes to its Medicare Advantage (MA) auditing strategy. The changes, designed to curb MA overpayments and clear a significant audit backlog, signal a new era of accountability and audit management for Medicare Advantage Organizations (MAOs) and contracted providers.

Here’s what’s changing, what’s important and what healthcare providers need to know to stay ahead of the curve.

Background on Medicare Advantage Oversight

The Medicare Advantage program was first introduced in 1997 as a private-plan alternative to traditional Medicare. Since its introduction, it has increased in both size and cost. More than half of seniors are now enrolled in MA. Recent estimates place the total cost of the program around $455 billion, excluding Medicare Part D drug plan payments.

Concerns about fraud and overpayments in the MA program are longstanding. In 2013, CMS estimated $14.1 billion in improper payments to the program. MedPAC estimates Medicare Advantage enrollees will cost $84 billion more in 2025 than if enrollees opted for a traditional Medicare plan.

To combat overpayments, CMS uses Risk Adjustment Data Validation (RADV) audits that cross-reference coding with medical records. However, CMS is years behind these audits, facing a backlog that dates back to 2018. The last time funds were actually recovered from RADV audits was 2007. 

CMS completed audits after 2007 without significant effort to recoup overpayments. The completed audits from 2011 to 2013 found 5-8% of funds were classified as overpayments that were never recovered. Assuming this trajectory has remained stable, CMS estimates over $17 billion in overpayments are lost each year.

CMS’ Plan to Address MA Overpayments

To address the problem, CMS is rolling out what it calls an “aggressive strategy” to enhance RADV audits with the goal of completing all PY 2018-PY 2024 audits by early 2026. The expansion includes the following provisions.

1. Auditing all MA Contracts Annually

Previously, CMS audited approximately 60 MA plans per year. Rather than auditing a select sample, CMS will begin auditing every MA contract (around 550 total) on a rotating basis. 

2. Using Advanced Technologies

CMS is investing in AI-driven coding tools and enhanced data analytics to more efficiently identify patterns of potential overpayment. At this time, it’s not clear what these systems will look like.

3. Scaling Up Audit Resources

The agency is doubling down on coder staffing and technological infrastructure to dramatically increase audit capacity. Namely, CMS plans to grow from 40 medical coding staffers to 2,000 by September 1. These coders will be assigned records to review and audit manually. Additionally, while CMS used to audit 35 records per health plan per year, the agency will now review 35-200 records in all audits. The actual amount reviewed will be based on the size of the health plan. 

4. Targeting High-Risk Plans

While all contracts will be reviewed, CMS plans to prioritize contracts with indicators of non-compliance or elevated risk scores. In the past, these may have been the only audited accounts. Now, they will certainly be audited—and on a faster timeline.

In addition to the current changes, it’s important to note the January 2023 rule change, which allowed CMS to extrapolate RADV audit findings across entire contracts. This move, intended to boost program integrity and accuracy, has not yet been implemented, but will go into effect in the current expansion of the program. 

What This Means for Providers

While much about the new program remains uncertain (what AI tools will be in use, how CMS will scale up to 2,000 workers by September, etc.), one thing is true: organizations that work with MA plans will now need to prepare for new audits every year while protecting reimbursement from the backlog. Any discrepancies dating back to 2018 could result in significant financial penalties or clawbacks.

CMS is primarily focused on MAOs, but downstream healthcare providers will feel the pressure from these changes as well. Right now, providers can take steps to mitigate risks from 2018 onward while preparing to protect themselves against inevitable future MA audits. 

Mitigating Historical Risks

The best way to protect past reimbursement is to review the backlog. It’s a major undertaking, but it minimizes audit exposure. As resources and staff are available, review past documentation to:

• Correct or delete unsupported diagnoses 
• Add missing signatures
• Fill in documentation gaps

Use official correction and attestation processes. Do not alter or backdate original records.

Additionally, take time to review clawback provisions in existing and past contracts and seek clarity on any contract language. That way, staff can better understand potential risks ahead of time. 

Mitigating Present and Future Risks

There are several actions providers can take now to prepare for future MA audits, including:

• Conducting self-audits of existing tools and systems.
• Updating MA audit compliance processes and policies with clear timelines and expectations.
• Tightening documentation standards.
• Educating staff on RADV audits, especially the timeline and appeals process.
• Understanding the role of RADV audits and clawback provisions to better negotiate future contracts to minimize audit exposure. 
• Implementing a better system to manage interactions with MAOs, track documentation submitted for risk adjustment and monitor the status of audit-related communications.

The Role of Technology in Meeting CMS Audit Demands

Managing Medicare Advantage documentation has never been easy. But these new changes require more than manual effort and individual spreadsheets. To respond effectively, healthcare providers must strengthen their internal compliance capabilities without overburdening staff or incurring administrative costs. That’s where solutions like Office Ally’s Audit and Denial Tracker come in.‍

Audit and Denial Tracker is a purpose-built technology solution designed to help providers and health systems manage the challenges associated with third-party audits and data requests, including those stemming from RADV. Key capabilities include:

• Centralized tracking and workflow management in a single platform.
• Real-time status monitoring for audits and response timelines.
• Comprehensive reporting tools.
• Secure, HIPAA-compliant document management and transfer.
• Configurable alerts and workflows to suit your audit response strategy.

For healthcare providers now facing the reality of more frequent CMS audits, tools like Audit and Denial Tracker offer a streamlined way to respond with confidence and protect much-needed revenue. Learn more about Audit and Denial Tracker here.

A Proactive Approach to a Changing Landscape

CMS’s expanded audit strategy is not a short-term initiative—it marks a long-term shift toward tighter oversight of Medicare Advantage. Providers that invest now in the right systems and processes will be in a stronger position to adapt to ongoing changes.

Office Ally’s Audit and Denial Tracker empowers providers to take control of the audit process. Whether responding to RADV audits, coordinating with MAOs, or simply organizing internal documentation workflows, it offers a scalable and future-proof solution for teams of all sizes.

As CMS continues to refine and expand its audit protocols, providers who act now will have the edge in compliance, efficiency, and financial stability. Stay audit-ready: Reach out to our team today to see how Office Ally’s Audit and Denial Tracker fits into your compliance strategy.