HHS OIG and CMS up ante on compliance
There have been a number of important developments on the Medicare Advantage (MA) compliance front over the past few months. These include the release of a guidance document from the Department of Health and Human Services (HHS) Office of Inspector General (OIG) on compliance as well as the Centers for Medicare and Medicaid Services’ (CMS) 2026 program audit protocol updates.
Overview of the MA-ICPG
The Medicare Advantage Industry Segment-Specific Compliance Program Guidance (MA-ICPG) is a voluntary, non-binding guidance document from the HHS OIG. The document can be found here: https://oig.hhs.gov/compliance/ma-icpg/ .
The guidance is meant to help MA plans and other entities to identify and mitigate compliance risks. The February 2026 guidance updates prior guidance from 1999. It is not meant to overrule or replace OIG’s separate General Compliance Program Guidance (GCPG) or CMS’s compliance program regulations for MA that can be found in various manuals. The OIG document just released is focused on reducing fraud, waste, and abuse (FWA), improving quality, and strengthening compliance programs.
Here are the compliance risk areas spelled out by the OIG:
HHS OIG outlines the following risks:
- Access to care, including inadequate provider networks, inaccurate provider directories, and improper utilization management or prior authorization barriers.
- Marketing and enrollment, including deceptive marketing practices and incentives that improperly influence enrollment.
- Risk adjustment, including improper diagnosis coding, and misuse of in-home health risk assessments (HRAs).
- Quality of care, including ensuring that MA enrollees receive appropriate, high-quality medical services.
- Inadequate vetting and oversight of third parties.
- Vertically integrated structures, including ensuring compliant contracting and financial arrangements.
- Submission of accurate claims and encounters.
The document also discusses recommendations surrounding elements of an effective compliance program (linked with OIG’s General Guidance), suggested compliance activities (monitoring, auditing, training, investigations, reporting, and corrective actions), and practical considerations for implementing, updating, and evaluating compliance structures.
We know a few things in these areas:
- CMS is hyper-focused on networks, access, and provider directories.
- Prior authorization is under fire, with major restrictions on its use as well as robust audit protocols.
- Risk adjustment is being closely scrutinized, especially with proposals to eliminate chart review scoring unless tied to an encounter as well as risk adjustment data validation (RADV) audits.
- Marketing is controversial and CMS has been unable so far to rein in controversial incentives made to third-party marketing organizations and brokers.
- Plans tend to have lax oversight of various important subcontractors, including pharmacy benefits managers (PBMs), behavioral health managed care entities, and marketing organizations.
- Vertical integration investigations are active at the Federal Trade Commission (FTC), Department of Justice (DOJ), and on Capitol Hill.
2026 program audit protocols
On November 20, the Centers for Medicare and Medicaid Services (CMS) issued its annual program audit memo to describe changes. While in the past few years little changed, there were some major developments this year. I did a blog on the changes here: https://www.healthcarelabyrinth.com/medicare-advantage-developments-for-2026/ .
Here is a brief summary:
- CMS will continue using the existing 2025 Final Audit Protocols for the Medicare Part C and Part D Program Audits and Industry-Wide Part C Timeliness Monitoring Project (CMS-10717) to conduct 2026 program audits.
- CMS has concluded that scoring on audits does not fully reflect a plan’s audit performance or how the plan is performing overall. CMS will remove scoring from audits, and conditions will no longer have a point value associated with them regardless of classification.
- CMS also is removing the classifications of Immediate Corrective Action Required (ICAR) and Observation Requiring Corrective Action (ORCA). CMS will determine if correction is needed to either prevent a recurrence or remediate impacted enrollees. If correction is needed, the condition will be classified as a Corrective Action Required (CAR). If CMS determines that correction is not needed, the condition will be classified as an Observation.
#cms #hhsoig #medicareadvantage #compliance
— Marc S. Ryan
