Risk Adjustment Data Validation (RADV) bombshell should worry Medicare Advantage (MA) plans
In a bombshell announcement, beginning immediately the Centers for Medicare and Medicaid Services (CMS) will audit all eligible Medicare Advantage (MA) plans for each payment year in all newly initiated audits and invest additional resources to expedite the completion of audits for payment years (PYs) 2018 through 2024.
MA opponents and a bipartisan group of lawmakers have raised issues with what they view as immense overpayments, some of which are tied directly to risk adjustment scoring. CMS says risk adjustment overpayments are about $17 billion a year. CMS’ completed audits for PYs 2011–2013 found between 5% and 8% in overpayments. Richard Kronick and his colleagues at the University of San Diego find that risk scores are 18.5% greater in MA in 2021, amounting to $33 billion. The Medicare Payment Advisory Commission (MedPAC) estimates the risk scoring overpayment figure could be as high as $43 billion per year. MedPAC says total overpayments are $84 billion per year. Others have numbers over $100 billion annually.
I often dispute MedPAC’s and other researchers’ total overpayment numbers. They seem based on flawed or limited data and are tinged with bias. I have made the case that some risk scoring above the traditional program is fair given fee-for-service program providers lack an incentive to report all diagnoses. But I do find that a small group of MA plans have aggressive and aberrant behavior in terms of risk adjustment submissions. Further, there are a number of whistleblower and Department of Justice (joining whistleblower suits or bringing them independently) cases that allege far-reaching fraud in risk adjustment.
Poor record
CMS has had an extremely poor track record on carrying out risk adjustment audits and recouping revenue. CMS admits the agency is very behind in conducting such audits and recouping overpayments. The last significant recovery of MA overpayments occurred following the audit of PY 2007. CMS has a plan to complete all remaining RADV audits for PY 2018 to PY 2024 by early 2026.
Key elements of CMS reform
Key elements of the plan include enhanced technology for medical record review to flag unsupported diagnoses and a major workforce expansion to boost medical coders from 40 to 2,000 by September 1. CMS says it will be able to increase its audits from ~60 MA plans a year to all eligible MA plans each year in all newly initiated audits (approximately 550 MA plans). The CMS press release uses this rather inexact terminology of “plans.” A quick review suggests that the 550 number purported to cover 100% of plans represents a subset of H contracts relying on risk adjustment (e.g., not certain pilots) that were in effect as of 1/1/2024 or before. The coders will manually verify flagged diagnoses to ensure accuracy. It will increase reviews from auditing 35 records per MA plan per year to between 35 and 200 records per MA plan per year, based on size.
Why now?
The reform was driven by a few emerging trends. First, the Trump administration is looking for a huge sum of dollars to reduce the budget. The overpayment issue has been tagged by conservative think tanks and incoming administration officials as a major issue to tackle to reduce spending. Second, a growing number of lawmakers on both sides of the aisle have called out overpayments as “corporate welfare” to MA plans. Third, CMS Administrator Dr. Mehmet Oz promised to go after MA overpayments at his two confirmation hearings. Oz committed to 100% auditing of plans (known as risk adjustment data validation (RADV)) quickly.
What is a RADV audit?
CMS already adjusts rates downward by putting a coding intensity adjustment on MA rates each year. But, to further attack the perceived issue of overpayments, it added a new and controversial RADV rule and process that was finalized in 2023. The rule stemmed from earlier pilot audits done by CMS and the Department of Health and Human Services (HHS) Office of Inspector General (OIG) on a pilot or ad hoc basis.
In these new individual audits, the government will send a sample to a plan. Plans will need to provide documentation of diagnoses submitted via encounter data or supplemental submissions. CMS can now extrapolate penalties based on a sample audit’s errors. What does this mean? Based on the error rates in the sample, CMS and the HHS OIG (both can conduct audits under the rule) could calculate penalties across the entire membership and revenue (or a substantial portion of members depending on the sample scope) as if the errors occurred throughout the enterprise. So, poor risk adjustment policies at a plan could lead to huge recoveries – billions across the industry.
The rule also gives CMS significant flexibility on what plans and the encounters the agency audits, although the CMS press release says they will audit every plan every year. Audits could be focused on contracts at the highest risk for improper payments. Diagnoses and types of beneficiaries (subpopulations) may be singled out if they are at the highest risk for improper penalties (extrapolation would be narrowed to these groups as well if undertaken). This is how payment year (PY) 2018 is being done.
Who are the culprits in risk adjustment overpayments?
The University of San Diego researchers found that the suspect coding revenue varied widely by MA plan. It found that UnitedHealth Group’s MA market share was 27% in 2021, but United received 42% ($13.9 billion) of that $33 billion sum. United’s estimated per-member revenue increase of $1,863 was the biggest, with the MA industry average at $1,220 per member. They also found that chart reviews and home-based health risk assessments (HRAs) accounted for about half of the difference in MA risk scores.
The San Diego researchers’ conclusion is backed up by other studies.
A study published in Health Affairs found that MA plans that conduct in-home and other HRAs are adding considerably to revenue through coding diagnoses from these encounters. The study, based on 2019 data, found that when an HRA is present, risk scores increase by about 12.8 percent on average. Restricting their use for such purposes could save between $4.5 billion to $12.3 billion.
The HHS OIG, which studied HRAs for the 2017 calendar year, determined that diagnoses reported only on HRAs (and on no other service records) that year led to an estimated $2.6 billion in additional risk-adjusted payments.
The HHS OIG came back in late 2021 with an additional study using the same data from 2016 and combining the HRA issue with manual chart reviews. It found that 20 of the 162 MA plans drove a disproportionate share of payments related to diagnoses that were reported only on chart reviews and HRAs and no other service events. HHS OIG pegged the overall universe of potential overpayments across all the plans at $9.2 billion.
HHS OIG said that the higher share of payments to the 20 plans could not be explained by their enrollment size. The companies generated payments that were more than 25 percent higher than their share of enrolled MA beneficiaries. The 20 companies drove 54% of the $9.2 billion. One company drove 40% of the total amount. That was United.
Is what Oz is proposing fair and will it work?
I certainly support the proposal to invest at CMS in 100% RADV audits. Audits should be comprehensive and timely. Recouping true risk-score overpayments is certainly fair. There are bad actors on risk adjustment that disproportionately benefit from revenue and give the entire industry a bad name.
But the RADV rule finalized in early 2023 is very controversial. The rule is being challenged by several MA plans, including most notably Humana, due in part because of some legally questionable provisions put in by the Biden administration. More lawsuits are inevitable with the recent CMS announcement. CMS would have to use the 2023 rule to conduct the audits.
Based on what has happened over the past few years, MA plans’ concerns regarding benefit stability and the impact on bids are not unreasonable. Numerous due process, adequate notice, selective enforcement, regulatory scope, and other legal issues are ripe here for court challenge. The plans argue that the rule is inconsistent with previous policies and may lead to underpayments to Medicare Advantage organizations.
Plan complaints and legal challenges center on the following:
- Does the RADV rule’s scope exceed CMS’ authority? In the post-Chevron legal world, it very well could.
- Concerns have been raised about the consistency of the audit methodology, including the selection of high-risk diagnoses for review, and whether the audit methodology is aligned with the risk adjustment model and actuarial equivalence requirements.
- Does CMS have the legal ability to extrapolate penalties across the entire membership (it says it does this in other areas) and will the methodology be fair and sound (it did not publish the exact methodology)?
- Plans are also concerned about the significant flexibility given CMS on what plans and the encounters the agency audits. As with PY 2018, audits can now be focused on contracts at the highest risk for improper payments. Diagnoses and types of beneficiaries (subpopulations) may be singled out if they are at the highest risk for improper penalties (but admittedly extrapolation would be narrowed to these groups as well if undertaken). Is this appropriate, though? Could targeted audits and extrapolating penalties across high-risk subpopulations actually cost plans more money than more comprehensive RADV approaches?
- The FFS adjuster in the RADV formula was eliminated. It was in CMS’ 2012 RADV methodology and deemed critical. The adjuster accounts for potential errors in FFS data as well as the difference in how coding is validated between FFS and Medicare Advantage. CMS claims FFS providers submit fewer diagnoses; therefore, no adjuster is needed. But in MA, there is the risk score coding intensity adjustment applied to the MA rates. Are MA plans then being penalized twice, once with coding intensity and then on RADV?
- The rule has a retroactive application and seeks to recoup revenues in payment years that were before the actual adoption of the RADV rule in 2023. The recoupment would go back to 2018. CMS says this is not ruly retoractive as audits of claims significantly lag the year anyway. Plans argue they had no notice of the change in policy.
- CMS argues that RADV’s requirement to have MA plans submit documentation will be a payment integrity tool. But FFS claims are accepted without this type of documentation. Save for some fiscal intermediary oversight, there is little scrutiny of claims in the FFS system. Why shouldn’t there be a similar process in FFS claims submission given all the talk of rampant fraud, waste, and abuse?
CMS’ latest proposal could add to the regulatory muddle and will compound concerns:
- CMS now says it will seek to recover uncollected overpayments identified in past audits. It also says the increased audit volume will help ensure CMS’s audit findings are more reliable and can be appropriately extrapolated as allowed under the rule. So, will Trump’s CMS be aggressive on extrapolation and recoupment retroactively (whether across all members or high-revenue subgroups)?
- CMS says it will deploy advanced systems to efficiently review medical records and flag unsupported diagnoses. Although it says medical coders will review during the audit, will AI-driven algorithms be used that focus primarily on suspect or high-risk areas or plans, which is a major concern MA plans have with the rule? Do truly random samples disappear? Will he samples be valid and fair? If not, extrapolation and retroactivity is an even bigger concern for plans.
I also question whether CMS can compete with the private sector to attract all the medical coders it would need to hit the targets. Private sector salaries are higher and who in his or her right mind would jump to CMS given all the layoff news lately. I have some doubts there would even be enough coders if this becomes a combination of full-time staff and contractors.
I also wonder how a legacy-technology agency like CMS will procure and implement advanced technology efficiently and effectively.
Existing and potential reforms beyond RADV
What has been implemented and could be done beyond aggressive RADV audits to address overpayments?
v28 Risk model — The new model was created and implemented by CMS to rein in overcoding by health plans and target recognition of risk among individuals better. v28 will take more than 7% out of rates when the phase-in is complete for rate year 2026. Models could be refined on an ongoing basis to curtail overcoding. Risk models could also be refined to include both prospective and retrospective components.
Elimination of manual chart reviews and HRAs – Based on the evidence in several studies, many argue that risk score diagnoses that tie exclusively to HRAs or manual chart reviews should be eliminated. The argument here is that providers should be able to submit diagnoses via encounters to the plan if the diagnosis on a member is truly there.
Changes in the coding intensity factor – The coding intensity factor seeks to adjust for differences between patterns in MA vs. the traditional program. It is currently set at a negative 5.91%. Some want to increase that adjustment factor globally, while others seek to apply the coding intensity factor on a plan-by-plan basis to take into account each plan’s relative coding intensity (with a credible adjustment for real differences in risk based on population demographics).
Blend two years’ worth of diagnostic data – This would be applied before setting risk scores. This could curb aggressive coding.
Enact penalties for plans that do not provide complete, accurate, or timely encounter submissions.
Conclusion
I do think MA plans need to clean up their act on risk adjustment practices. In most cases, what occurs likely is sheer sloppiness and lack of adequate controls; in others, based on whistleblower complaints, it may be willful and fraudulent as well as overly aggressive risk scoring. Each plan needs a comprehensive and accountable submission and validation process. The American taxpayer deserves this.
But at the same time, MA plans should not apologize for having a business incentive to accurately document diagnoses for revenue when a diagnosis exists. FFS providers simply do not have the incentive in a transaction payment system. This alone requires that any RADV rule and CMS program is fair and equitable.
#riskadjustment #overpayments #radv #medicareadvantage #cms #fwa
— Marc S. Ryan
