OIG Flags $462 Million in Medicare Advantage Overpayments - What the Acute Stroke Audit Means for HCC Risk Adjustment Coding Compliance

On June 1, 2026, the HHS Office of Inspector General published one of the most significant Medicare HCC risk adjustment coding findings in recent memory.

The report – audit number A-02-23-01020 – found that CMS potentially overpaid Medicare Advantage organizations $462 million for payment year 2021 based on certain unsupported acute stroke diagnosis codes. What makes this finding particularly concerning is not just the dollar amount. It is the sample result: across 97 enrollees reviewed from multiple MA organizations, every single submitted acute stroke code was unsupported by the medical record.

One hundred percent.

For MA plan leaders, this is not a report about someone else's compliance problem. It is a precise, current signal about where OIG scrutiny is concentrated – and what the documentation and coding standards are that your risk adjustment program will be measured against.

The OIG's audit reviewed a specific, well-defined risk pattern: acute stroke diagnosis codes submitted by MA organizations on physician data records where the enrollee had no corresponding acute stroke diagnosis on an inpatient or outpatient hospital data record during the same service year [1].

This is not a new concern. Previous OIG audits of specific MA organizations had already flagged this pattern in individual plan audits. What this report does differently is examine the pattern across multiple MA organizations simultaneously – creating a program-wide estimate rather than a plan-specific finding.

The methodology and the result:

• 97 enrollees sampled from across multiple coordinated care and private fee-for-service MA plans
• 100% of sampled acute stroke codes were not supported by the associated medical records
• $462 million estimated in potential net overpayments to MA organizations for 2021 – extrapolated from the sample

The OIG recommended that CMS implement a procedure to prevent these overpayments going forward, specifically targeting situations where an acute stroke diagnosis appears on a physician data record without a supporting inpatient or outpatient hospital record in the same service year. CMS did not specify concurrence or nonconcurrence with the recommendation.

That non-response matters. It means the policy gap the OIG identified has not been formally addressed – and MA organizations cannot assume CMS has closed it.

Understanding the mechanism behind this finding is essential for any MA plan conducting a risk adjustment audit of their own coding practices.

Acute stroke is a high-acuity, high-cost diagnosis. Under CMS-HCC risk adjustment methodology, it maps to an HCC category associated with significantly elevated predicted healthcare costs – meaning a submitted acute stroke diagnosis materially increases the risk score and the monthly capitation payment CMS makes to the MA plan on behalf of that enrollee.

The vulnerability identified by OIG is structural: MA organizations rely on diagnosis codes submitted by their network providers. When a physician submits an acute stroke diagnosis code on a professional claim – without the corresponding inpatient or outpatient hospital record that would validate a genuine acute stroke event – that code can flow into the MA risk adjustment data without a clinical checkpoint to identify the discrepancy.

The result is a diagnosis that inflates the RAF score without the clinical documentation to support it. In aggregate, across a plan's membership, these unsupported codes compound into what the OIG now estimates at $462 million in potential overpayments for a single payment year.

This does not necessarily indicate intentional miscoding in every case. Physicians may submit codes based on historical diagnoses, carry-forward documentation, or ambiguous clinical presentations that don't fully satisfy the acute event criteria required for HCC validation. But intent is not the standard OIG or CMS applies in a RADV audit. Documentation support is.

This report lands in a specific regulatory context that makes it more consequential than a standalone audit finding.

RADV audits are active. CMS's Risk Adjustment Data Validation program is conducting audits across MA contracts. The RADV final rule, published in 2023, established the framework for extrapolating audit findings – meaning an unsupported diagnosis found in a sample can result in a recovery demand calculated against the full population of similar diagnoses. The acute stroke pattern OIG identified is precisely the kind of high-risk, high-value code category that RADV audit methodology is designed to examine.

The OIG's January 2026 work plan specifically targets MA coding patterns. The OIG launched a work plan element in January 2026 to analyze whether MA organizations' coding patterns under CMS-HCC Version 28 reflect the model's intended financial outcomes. This $462 million acute stroke finding is consistent with that broader scrutiny trajectory – not a one-off.

100% unsupported across a multi-plan sample is a systemic signal. When an audit of 97 enrollees across multiple organizations returns a 100% finding, it is not pointing to isolated errors at individual plans. It is pointing to a systemic gap in how acute stroke diagnosis codes are validated before submission to CMS. Every MA organization should treat this as a directive to review their own coding data for this specific pattern.

For HCC risk adjustment programs that have not conducted a targeted review of acute stroke code submissions against corresponding inpatient and outpatient hospital records, that review should be prioritized immediately – before an external audit does it for you.

The OIG finding is specific enough to generate an immediate action list for MA plan compliance and risk adjustment coding services teams:

Conduct an internal audit of acute stroke HCC submissions for recent payment years.

Pull all acute stroke diagnosis codes submitted on physician data records and cross-reference against inpatient and outpatient hospital records for the same service year. Any acute stroke code appearing on a professional claim without a supporting facility record is a potential overpayment exposure consistent with the OIG's identified pattern.

Review your validation workflow for physician-submitted diagnoses.

The vulnerability identified by this audit is between what providers submit on professional claims and what the clinical record actually supports. MA organizations need a validation checkpoint – ideally concurrent with submission, not retrospective – that flags physician-submitted high-risk acute diagnoses for medical record review before they enter the risk adjustment data pipeline.

Assess your HCC risk adjustment coding governance against RADV standards.

RADV audits require chart-level documentation support for every submitted diagnosis. An acute stroke HCC that was accepted by CMS for payment will not survive RADV review if the medical record does not support an acute event with appropriate clinical documentation. The same documentation standard that prevents the OIG finding prevents the RADV recoupment.

Don't wait for CMS to implement a procedure.

The OIG recommended that CMS implement a preventive policy. CMS did not confirm it would do so. That means MA organizations cannot rely on a CMS-side control to catch this pattern. The responsibility for accurate, defensible HCC risk adjustment coding sits with the MA organization – and with the risk adjustment companies they partner with.

The $462 million OIG finding is the kind of result that emerges when coding accuracy is treated as a production-oriented process rather than a compliance discipline.

The MA plans that navigate this environment without material RADV exposure share a common characteristic: their HCC risk adjustment coding programs are built around documentation defensibility – not code volume. They have concurrent review workflows that validate high-risk diagnoses against clinical records before submission, not after an audit surfaces the gap. They have governance structures that connect coding findings to provider education, so the same documentation pattern doesn't generate the same compliance exposure in the next payment year.

That approach requires more than a coding team. It requires a risk adjustment infrastructure – people, technology, and process – built specifically for the regulatory environment MA plans operate in today.

At 3Gen Consulting, our Medicare risk adjustment coding programs are designed around exactly that standard: certified risk adjustment coders, concurrent and retrospective review workflows, RADV-ready documentation governance, and RiskGen-i – our AI-powered platform that identifies high-risk code patterns and documentation gaps before they become compliance findings.

The OIG just published a 100% unsupported finding across a multi-plan sample. The question for your organization is whether your current risk adjustment coding program would produce a different result under that same scrutiny.

If the answer is uncertain, that uncertainty is the appropriate starting point for review. Let's assess your risk adjustment compliance posture together.