MEDICARE 

ADVANTAGE

Fundamental 

Improvements 

Needed in CMS’s 

Effort to Recover 

Substantial Amounts 

of Improper Payments

Report to the Chairman, 

Committee on Ways and Means, 

House of Representatives

April 2016

GAO-16-76

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-76, a report to the 

Chairman, Committee on Ways and Means, 

House of Representatives

April 2016

MEDICARE ADVANTAGE

Fundamental Improvements Needed in CMS's Effort 

to Recover Substantial Amounts of Improper 

Payments

Why GAO Did This Study

In 2014, Medicare paid about $160

billion to MA organizations to provide 

health care services for approximately 

16 million beneficiaries. CMS, which 

administers Medicare, estimates that 

about 9.5 percent of its payments to

MA organizations were improper,

according to the most recent data—

primarily stemming from unsupported

diagnoses submitted by MA

organizations. CMS currently uses 

RADV audits to recover improper 

payments in the MA program.

GAO was asked to review the extent to 

which CMS is addressing improper 

payments in the MA program. This 

report examines the extent to which (1)

CMS’s contract selection methodology 

for RADV audits facilitates the recovery 

of improper payments, (2) CMS has 

completed RADV audits and appeals in 

a timely manner, and (3) CMS has 

made progress toward incorporating 

RACs into the MA program to identify 

and assist with improper payment 

recovery. In addition to reviewing 

research literature and agency 

documents, GAO analyzed data from 

ongoing RADV audits of 2007 and 

2011 payments—CMS’s two initial 

contract-level RADV audits. GAO also 

interviewed CMS officials.

What GAO Recommends

GAO is making five recommendations 

to CMS to improve its processes for 

selecting contracts to include in the 

RADV audits, enhance the timeliness 

of the audits, and incorporate RACs

into the RADV audits. HHS concurred 

with the recommendations.

What GAO Found

Medicare Advantage (MA) organizations contract with the Centers for Medicare &

Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the 

original program and are paid a predetermined monthly amount by Medicare for 

each enrolled beneficiary. These payments are risk adjusted to reflect each 

enrolled beneficiary’s health status and projected spending for Medicare-covered 

services. CMS conducts risk adjustment data validation (RADV) audits of MA 

contracts which facilitate the recovery of improper payments from MA 

organizations that submitted beneficiary diagnoses for payment adjustment 

purposes that were unsupported by medical records. With a separate national 

audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA 

organizations, primarily because of these unsupported diagnoses. 

GAO found that CMS’s methodology does not result in the selection of contracts 

for audit that have the greatest potential for recovery of improper payments. First, 

CMS’s estimate of improper payment risk for each contract, which is based on 

the diagnoses reported for the beneficiaries in that contract, is not strongly 

correlated with unsupported diagnoses. Second, CMS does not use other 

available information to select the contracts at the highest risk of improper 

payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 

2011 payments were among the 10 percent of contracts estimated by CMS to be 

at the highest risk for improper payments. These limitations are impediments to 

CMS’s goal of recovering improper payments and do not align with federal 

internal control standards, which require that agencies use quality information to 

achieve their program goals.

CMS’s goal of eventually conducting annual RADV audits is in jeopardy because 

its two RADV audits to date have experienced substantial delays in identifying 

and recovering improper payments. RADV audits of 2007 and 2011 payments 

have taken multiple years and are still ongoing for several reasons. First, CMS’s 

RADV audits rely on a system for transferring medical records from MA

organizations that has often been inoperable. Second, CMS audit procedures 

have lacked specified time requirements for completing medical record reviews 

and for other steps in the RADV audit process. In addition, CMS has not 

established timeframes for appeal decisions at the first-level of the MA appeal 

process, as it has done in other contexts.

CMS has not expanded the recovery audit program to MA by the end of 2010, as 

it was required to do by the Patient Protection and Affordable Care Act. RACs 

have been used in other Medicare programs to recover improper payments for a 

contingency fee. In December 2015, CMS issued a request for information 

seeking industry comment on how an MA RAC could be incorporated into the 

RADV audit framework. CMS noted in its request that incorporating a RAC into 

the RADV framework would increase the number of MA contracts audited each 

year. CMS currently includes 30 MA contracts in each RADV audit, about 5 

percent of all MA contracts. Despite the importance of increasing the number of 

contracts audited, CMS does not have specific plans or a timetable for 

incorporating RACs into the RADV audit framework, contrary to established

project management principles, which stress the importance of developing an 

overall plan to meet strategic goals.

View GAO-16-76. For more information, 

contact James Cosgrove at (202) 512-7114 or 

cosgrovej@gao.gov.
Page i GAO-16-76 Medicare Advantage Improper Payments

Letter 1

Background 7

CMS Does Not Focus MA RADV Audits on Contracts with the 

Highest Potential for Improper Payments 10

CMS’s RADV Process Has Experienced Substantial Delays in 

Completing Contract-Level RADV Audits and Appeals 17

CMS Has Made Little Progress toward Incorporating a Recovery 

Audit Contractor in MA 23

Conclusions 25

Recommendations for Executive Action 26

Agency Comments 27

Appendix I Comments from the Department of Health and Human Services 29

Appendix II GAO Contact and Staff Acknowledgments 33

Figures

Figure 1: Percentage of Unsupported Diagnoses within Medicare 

Advantage (MA) Contracts by the Centers for Medicare & 

Medicaid Services (CMS) Coding Intensity, 2007 Risk 

Adjustment Data Validation (RADV) Audits 12

Figure 2: Distribution of Medicare Advantage (MA) Contracts 

Selected for 2011 Risk Adjustment Data Validation 

(RADV) Audits, by Coding Intensity Group and Percentile 15

Figure 3: Timeline of Contract-Level Medicare Advantage (MA) 

Risk Adjustment Data Validation (RADV) Audits and 

Related Appeals 18

Contents
Page ii GAO-16-76 Medicare Advantage Improper Payments

Abbreviations

AHA American Hospital Association

AHIP America’s Health Insurance Plans

AMA American Medical Association

CDAT Central Data Abstraction Tool

CMS Centers for Medicare & Medicaid Services

ESMD Electronic Submission of Medical Documentation

FFS fee-for-service

HCC hierarchical condition category

HHS Department of Health and Human Services

IPIA Improper Payments Information Act of 2002

MA Medicare Advantage

MAC Medicare Administrative Contractor

RAC Recovery Audit Contractor

RADV risk adjustment data validation

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-16-76 Medicare Advantage Improper Payments

441 G St. N.W.

Washington, DC 20548

April 8, 2016

The Honorable Kevin Brady

Chairman

Committee on Ways and Means

House of Representatives

Dear Mr. Chairman,

In 2014, the federal government paid approximately $160 billion to 

Medicare Advantage (MA) organizations—entities that offer a private plan 

alternative to the Medicare fee-for-service (FFS) program.1 The Centers 

for Medicare & Medicaid Services (CMS), an agency within the 

Department of Health and Human Services (HHS), administers Medicare, 

contracts with MA organizations, and pays them a monthly amount to 

provide health care benefits to beneficiaries enrolled in these plans. In 

2014, CMS had 570 contracts with MA organizations that served 15.8 

million beneficiaries, constituting about 30 percent of all Medicare 

beneficiaries.2

Improper payments to MA organizations can result from unsupported 

information those organizations provide to CMS for the calculation of 

payment amounts. The Social Security Act requires that payments to MA 

organizations be adjusted for variation in the cost of providing health care 

to beneficiaries on the basis of various risk factors, including health 

status.3 Through the risk adjustment process, for example, CMS 

1

See The Boards of Trustees, 2015 Annual Report of the Boards of Trustees of the 

Federal Hospital Insurance and Federal Supplementary Medical Insurance Trust Funds

(Washington, D.C.: July 2015).

Medicare FFS consists of Medicare Parts A and B. Medicare Part A covers hospital and 

other inpatient stays. Medicare Part B is optional insurance and covers hospital outpatient,

physician, and other services. Medicare beneficiaries have the option of obtaining 

coverage for Medicare Part A and B services from private health plans that participate in 

the MA program—also known as Medicare Part C. MA organizations must cover all

Medicare Part A and B services, except for hospice care.

2

The 570 MA contracts in 2014 exclude Medicare-Medicaid 1876 Cost, 1833 Cost, 

Program of All-inclusive Care for the Elderly, and pilot contracts. 

3

42 U.S.C. § 1395w-23(a)(1)(C)(i). 

Letter
Page 2 GAO-16-76 Medicare Advantage Improper Payments

increases payments to MA organizations that enroll beneficiaries in 

poorer health to compensate the organizations for the expected higher 

spending on health care services for those beneficiaries. To risk adjust 

payments, CMS first calculates a risk score—a relative measure of 

projected Medicare spending based on diagnosis and demographic 

information—for every Medicare beneficiary, including those in MA plans 

and those in the FFS program. CMS requires MA organizations to submit 

diagnosis codes for each beneficiary in a contract in order to calculate 

risk scores.4 CMS has determined that improper payments in the MA 

program stem from beneficiary diagnoses submitted for risk adjustment 

purposes by MA organizations to CMS that are not supported by medical 

documentation.5 As the MA program continues to grow, safeguarding the 

program from loss is critical.

CMS conducts two types of risk adjustment data validation (RADV) audits 

to identify and correct MA improper payments: national RADV activities

and contract-level RADV audits. Both types of audits determine whether 

the diagnosis codes submitted by MA organizations are supported by a 

beneficiary’s medical record documentation. CMS conducts national 

RADV activities annually to estimate the national MA improper payment 

rate under the Improper Payments Information Act of 2002 (IPIA), as 

amended.6 Based on the most recent national audit, which reviewed 2013 

payments, CMS released an MA improper payment estimate of 9.5 

 4

A beneficiary’s health status is incorporated into payments using CMS hierarchical 

condition categories (HCC), which are groups of medical diagnoses in which related 

groups of diagnoses are ranked on the basis of disease severity and cost.

5

An improper payment is any payment that should not have been made or that was made 

in an incorrect amount (including overpayments and underpayments) under statutory, 

contractual, administrative, or other legally applicable requirements. It includes any 

payment to an ineligible recipient, any payment for an ineligible service, any duplicate 

payment, payment for services not received (except where authorized by law), and any 

payment that does not account for credit for applicable discounts. Improper Payments 

Elimination and Recovery Act of 2010, Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 

(codified at 31 U.S.C. § 3321 note).

6

IPIA, as amended by the Improper Payments Elimination and Recovery Act of 2010 and 

the Improper Payments Elimination and Recovery Improvement Act of 2012, requires 

executive branch agencies to annually identify programs and activities susceptible to 

significant improper payments, estimate the amount of improper payments, and report 

these estimates along with actions planned or taken to reduce them. Pub. L. No. 107-300, 

116 Stat. 2350 (2002), as amended by Pub. L. No. 111-204, 124 Stat. 2224 (2010) and 

Pub. L. No. 112-248, 126 Stat. 2390 (2013) (codified at 31 U.S.C. § 3321 note).
Page 3 GAO-16-76 Medicare Advantage Improper Payments

percent or $14.1 billion.7 CMS also estimated that 73 percent of the 

improper payments resulted from MA organizations submitting insufficient

medical record documentation to CMS that did not support the diagnoses 

those organizations had previously submitted to CMS to determine risk 

adjustment payments. The second type of RADV audit, referred to as 

contract-level audits, seeks to identify and recover improper payments 

from MA organizations and thus to deter MA organizations from 

submitting inaccurate beneficiary diagnoses. In 2008, CMS began 

contract-level audits of 2007 payments to identify and recover payments 

made in error for a sample of enrollees in 32 MA contracts.8 CMS stated it 

had recovered about $14 million in improper payments from these RADV 

audits of 2007 payments and may recover additional amounts depending 

on the adjudication of appeals filed by MA organizations challenging 

some of the audit findings.9 Since 2010, CMS has spent about $117 

million on both types of audits.

CMS’s goal is to annually conduct contract-level audits to recover 

improper payments efficiently, among other things. That is, CMS plans to 

recoup overpayments by calculating a payment error rate for a sample of 

enrollees in each audited contract and then extrapolating that error rate to 

 7

The most recent national RADV estimate was conducted in 2015 and is based on 2013 

data, as there is a 2-year lag in payment data availability. The national sample is used to 

estimate the overall improper payment estimate in the MA program. Previously, the 

estimate was based on a stratified random sample of approximately 600 beneficiaries for 

whom a risk adjustment payment was made. CMS also estimates a net improper payment 

rate that accounts for diagnoses that were omitted by MA organizations but would have

been permissible for payment purposes. However, CMS does not consider these 

payments to be improper because the agency considers the submission of these 

diagnoses to be the responsibility of the MA organization. The net improper payment rate 

in 2013 was 4.3 percent of total payments or $6.4 billion. See Department of Health and 

Human Services, FY 2015 Agency Financial Report (Washington, D.C.: November 2015).

8

Prior to selecting contracts for the targeted audits, CMS conducted pilot audits of 2007 

payments for five MA contracts. These pilot audits encompass about $3 million of the 

approximate $14 million in recovery.

9

For fiscal year 2015, CMS collected approximately $650 million in overpayments from 

MA organizations per the “report and repay” requirement, among other things. In the 

calendar year 2015 Hospital Outpatient Prospective Payment and Ambulatory Surgical 

Center final rule, CMS introduced the new “report and repay” requirement, by which MA 

organizations must report and return any overpayments they identify to CMS. This 

requirement complements the contract-level RADV audits as a vehicle for CMS to collect 

overpayments made to MA organizations. Medicare Advantage Organizations and Part D 

Sponsors: CMS-Identified Overpayments Associated with Submitted Payment Data, 79 

Fed. Reg. 66770-66999 (November 10, 2014).
Page 4 GAO-16-76 Medicare Advantage Improper Payments

estimate the total amount of improper payments made under the 

contract.10 As a first step, CMS officials stated that the agency has begun 

contract-level audits of 2011 payments using the same contract selection 

and beneficiary sampling methodology as its contract-level audits of 2007 

payments.11 Using this methodology, CMS selected a sample of 30 

contracts to audit in November 2013. According to CMS officials, the 

agency will offset any overpayments by the amount of any 

underpayments the agency discovers, but will not reimburse payments to 

MA organizations if estimated underpayments exceed overpayments. MA 

organizations have the right to appeal audit results within 60 days of 

receiving them. CMS estimates that the contract-level audits of 2011 

payments will recover about $370 million (about 3 percent of 2011 MA 

improper payments) after extrapolation. In addition, the Patient Protection 

and Affordable Care Act required CMS to expand the recovery audit 

program into the MA program to identify and assist CMS with improper 

payment recovery. Recovery audit contractors (RAC) are entities that 

conduct postpayment reviews to identify and correct potential improper 

payments.

You asked us to examine the extent to which CMS is addressing 

improper payments in MA. In this report, we examine

(1) the extent to which CMS’s contract selection methodology for 

contract-level RADV audits facilitates the recovery of improper 

payments;

(2) the extent to which CMS has completed contract-level RADV 

audits and appeals in a timely manner; and

(3) CMS’s progress toward incorporating RACs into the MA program 

to identify and assist with improper payment recovery.

To examine the extent to which CMS’s contract selection methodology for 

contract-level RADV audits facilitates the recovery of improper payments, 

we reviewed agency documents such as HHS’s Financial Report for fiscal 

years 2014 and 2015, which contain CMS’s objectives and goals for the 

 10CMS officials stated that the agency believes that these contract-level RADV audits also 

will deter MA organizations from submitting unsupported diagnoses, thereby reducing 

future improper payments.

11In fiscal year 2015, CMS selected contracts for audit to initiate contract-level RADV 

audits of 2012 payments. See FY 2015 Agency Financial Report.
Page 5 GAO-16-76 Medicare Advantage Improper Payments

contract-level audits; analyzed contract-level RADV audit data from CMS; 

reviewed research documents; and interviewed CMS officials about MA 

contracts. We examined the extent to which CMS’s contract selection 

methodology accounts for a contract’s total improper payment recovery 

potential in several ways. First, we examined whether the contracts 

selected for the contract-level RADV audits of 2007 payments were 

among those likely to have had high improper payment rates by 

comparing CMS’s estimate of risk for those contracts with the actual rates 

of unsupported diagnoses documented in the audit.12 Second, we 

examined the extent to which CMS’s contract selection methodology for 

the 2011 contract-level RADV audits successfully identified contracts with 

the greatest improper payment risk by comparing the agency’s estimate 

of risk of improper payment for its selected contracts with its estimate of 

risk for all other MA contracts. Third, because contract-level audits of 

2011 payments are ongoing, we analyzed the results of the 2007 

contract-level RADV audits of payments to inform our assessment of 

CMS’s current measurement of improper payment risk. We reviewed 

literature on MA contracts to determine whether CMS’s estimate of 

improper payment risk for each contract (referred to as coding intensity) 

properly accounted for changes in beneficiary health status. In addition, 

we evaluated CMS’s contract selection methodology against applicable 

internal control standards for federal agencies.13

To examine the extent to which CMS has completed contract-level RADV 

audits and appeals in a timely manner, we compared the total time 

required for the 2007 and 2011 contract-level RADV audits in light of 

CMS’s goal of conducting contract-level RADV audits annually. To do so, 

we reviewed agency documents and contract-level RADV audit results 

and interviewed CMS officials. We also compared RADV time frames to 

those from similar audit processes in Medicare’s FFS program. To 

determine the timeliness of one part of the audit process—CMS’s time 

frame for the MA organizations to submit medical records—we examined 

the percentage of audited diagnoses that were submitted by MA 

organizations by CMS’s deadline. We also assessed the prevalence of 

 12The percentages of unsupported diagnoses after medical record review do not include 

potential underpayments or RADV findings overturned after appeal.

13GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1, 1999). Internal control is a process effected by an 

entity’s oversight body, management, and other personnel that provides reasonable 

assurance that the objectives of an entity will be achieved.
Page 6 GAO-16-76 Medicare Advantage Improper Payments

RADV appeals for the 2007 contract-level RADV audits, the number of 

appeals adjudicated by CMS after MA organizations were notified of 

contract-level RADV audit decisions, and how long it has taken to 

complete the medical record dispute and appeal process. We evaluated 

CMS’s audit activities against established project management 

principles.14 For additional context, we interviewed officials from the 

American Medical Association (AMA), American Hospital Association 

(AHA), America’s Health Insurance Plans (AHIP), and two MA 

organizations with contracts that underwent both 2007 and 2011 contractlevel RADV audits. The views of these two MA organizations do not 

represent the views of all MA organizations.

To examine CMS’s progress toward incorporating RACs into the MA 

program to identify and recover improper payments, we reviewed CMS 

documents, including CMS’s 2014 Medicare Part C RAC Statement of 

Work and CMS’s proposed 2015 Medicare Part C RAC Statement of 

Work, and interviewed CMS officials. We evaluated CMS’s progress 

toward incorporating a RAC in the MA program against established 

project management principles, which call for developing an overall plan 

and monitoring framework to meet strategic goals.15 We also interviewed 

officials representing three of the four RACs that conduct claims review in 

Medicare’s FFS program to obtain their perspectives on CMS’s plans for 

incorporating RACs into the MA program.16 For additional context, we 

interviewed officials from the AMA, AHA, and AHIP.

We conducted this performance audit from October 2014 to April 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 14GAO, Cost Estimating and Assessment Guide: Best Practices for Developing and 

Managing Capital Program Costs, GAO-09-3SP (Washington, D.C.: March 2009). GAO 

developed this compilation of best practices that can be used across the federal 

government for developing, managing, and evaluating capital program cost estimates.

15GAO-09-3SP.

16One of the four RACs that conduct postpayment claims reviews in the FFS Medicare 

program declined GAO’s request for an interview.
Page 7 GAO-16-76 Medicare Advantage Improper Payments

There are four major steps in the contract-level RADV audit process as 

reported by CMS:

• MA contract selection. CMS selects 30 MA organization contracts for 

contract-level RADV audits, which agency officials stated provides a 

sufficient representation of contracts (about 5 percent) without 

imposing unreasonable costs on the agency.17 An MA organization 

may have more than one contract selected for a contract-level RADV 

audit. CMS selects contracts based on diagnosis coding intensity, 

which the agency defines for each contract as the average change in 

the risk score component specifically associated with the reported 

diagnoses for the beneficiaries covered by the contract.18 That is, 

increases in coding intensity measure the extent to which the 

estimated medical needs of the beneficiaries in a contract increase 

from year to year; thus, contracts whose beneficiaries appear to be 

getting “sicker” at a relatively rapid rate, based on the information 

submitted to CMS, will have relatively high coding intensity scores. 

Contracts with the highest increases in coding intensity are those with 

beneficiaries whose reported diagnoses increased in severity at the 

fastest rates. CMS officials stated that the agency adopted this 

selection methodology to (1) focus the contract-level RADV audits on 

MA organization contracts that might be more likely to have submitted 

diagnoses that are not supported by the medical records and (2) 

provide additional oversight of contracts with the most aggressive 

coding. To be eligible for a contract-level audit, MA contracts must 

have had at least three pair-years of data that can be used to 

distinguish a change in disease risk scores from one year to the next; 

that is, the contract must have been in place for at least 4 years of 

continuous payment activity plus the audit year. For each pair year, 

CMS’s coding intensity calculation excludes beneficiaries not enrolled 

in the same contract or not eligible for Medicare in consecutive years. 

CMS ranks contracts by coding intensity and divides them into three 

categories: high, medium, and low. CMS then randomly selects 

 17For the 2011 contract-level RADV audits, the 30 MA organization contracts that CMS 

selected accounted for 11 percent of MA enrollees.

18Information on a beneficiary’s age, sex, Medicaid enrollment status, and original reason 

for Medicare entitlement (age, disability) also are used to calculate risk scores.

Background

Contract-Level RADV 

Audit Process
Page 8 GAO-16-76 Medicare Advantage Improper Payments

contracts for audit: 20 from the high category, 5 from the medium 

category, and 5 from the low category.19 According to CMS officials, 

this strategy ensures contracts with the highest coding intensity—

considered high risk for improper payments by CMS—have a higher 

probability for audit while keeping all contracts at risk for review.

• MA beneficiary sampling. After CMS selects 30 MA contracts to audit, 

the agency selects the beneficiaries whose medical records will be the 

focus of review. Up to 201 beneficiaries are chosen from each 

contract based on the individuals’ risk scores using a stratified random 

sample: 67 beneficiaries from each of the three risk score groups 

(highest one-third of risk scores, the middle one-third, and the lowest 

third).20

• Medical record collection and review. After selecting beneficiaries for 

review, CMS requests supporting medical record documentation for 

all diagnoses submitted to adjust risk in the payment year.21 The MA 

organization may submit up to five medical records per audited 

diagnosis. CMS contractors review the submitted medical records to 

determine if the records support the diagnoses submitted by the MA 

organizations. If the initial reviewer determines that a diagnosis is not 

supported, a second reviewer reviews the case.

• Payment error calculation and extrapolation. When medical record 

review is completed, CMS extrapolates a payment error rate to the 

entire contract beginning with contract-level audits of 2011 payments. 

 19For the 2011 contract-level RADV audits, CMS selected 6 contracts for which the HHS 

Office of Inspector General conducted audits of 2007 payments. The remaining 24 of the 

30 contracts were randomly selected from each coding intensity group per CMS’s 

selection methodology described above. 

20CMS chooses beneficiaries to sample who meet the following criteria: (1) were enrolled 

in the MA contract in January of the payment year; (2) were continuously enrolled in the 

MA contract for all 12 months preceding the payment year; (3) did not have end-stage 

renal disease in or before the payment year; (4) did not receive hospice care between 

January of the collection year and January of the payment year, with less than 12 months 

of hospice during the payment year; (5) were enrolled in Medicare Part B for all 12 months 

during the data collection year; and (6) were diagnosed with at least one risk adjustment 

diagnosis submitted during the data collection year that resulted in a least one coded 

CMS-HCC.

21MA-submitted diagnoses must be based on clinical medical record documentation from 

a face-to-face encounter with a provider, coded in accordance with the ICD-9-CM 

Guidelines for Coding and Reporting, assigned based on dates of service within the data 

collection period, and submitted to the MA contracts by an acceptable provider type and 

data source. Beginning October 1, 2015, all Medicare claims with a date of service on or 

after October 1, 2015, will only be accepted if they contain a valid ICD-10 code, which is 

the next iteration of codes.
Page 9 GAO-16-76 Medicare Advantage Improper Payments

Each beneficiary’s payment error is multiplied by a sampling weight 

and the number of months the beneficiary was enrolled in the MA 

contract during the payment year.22 After these beneficiary-level 

payment errors are summed, the amount CMS will seek to recover will 

be reduced by (1) using the lower limit of a 99 percent confidence 

interval based on the sample and (2) reducing the recovery amount by 

a FFS adjuster amount that estimates payment errors that would have 

likely occurred in FFS claims data.23 Once the recovery amount is 

finalized, CMS releases contract-level RADV audit finding reports to 

each audited MA organization, which may dispute the results of 

medical record review or appeal the audit findings. Beginning with the 

contract-level RADV audits of 2011 payments, CMS will collect 

extrapolated overpayments from MA organizations once all appeals 

are final.

Recovery auditors have been used in various industries, including health 

care, to identify and collect overpayments. The Medicare Prescription 

Drug, Improvement, and Modernization Act of 2003 directed CMS to test 

the use of RACs to identify overpayments and underpayments through a 

postpayment review of FFS medical claims and recoup overpayments.24

The Tax Relief and Health Care Act of 2006 required CMS to implement a 

permanent national recovery audit contractor program by January 1, 2010

and to compensate RACs using a contingency fee structure under which 

the RACs are paid from recovered overpayments.

25 The Patient 

 22Sampling weights are constructed so each sample of eligible enrollees represents the 

group from which they were drawn. These weights are used to scale-up the sample 

payment error findings to the population it represents.

23The FFS adjuster accounts for the fact that contract-level RADV audits require 

diagnoses to be supported by medical record documentation reviews that include those 

coded by providers in claims, but the same standard is not used in FFS claims to develop 

the MA risk adjustment model. The actual amount of the adjuster will be calculated by 

CMS based on a RADV-like review of records submitted to support FFS claims data. CMS 

officials stated that the agency expects to solicit public comments from stakeholders 

regarding the FFS adjuster in 2016.

24Pub. L. No. 108-173, § 306, 117 Stat. 2066, 2256-57 (2003).

25Pub. L. No. 109-432, div B., title III, § 302, 120 Stat. 2922, 2991-92 (2006) (codified at 

42 U.S.C. § 1395ddd(h)).

Recovery Audit 

Contractors
Page 10 GAO-16-76 Medicare Advantage Improper Payments

Protection and Affordable Care Act expanded the recovery audit program 

initiated in Medicare FFS to MA plans under Part C, among other things.26

In future contract-level RADV audits, CMS also will review diagnoses 

submitted through MA encounter data. While CMS previously collected 

diagnoses from MA organizations, in 2012 the agency also began 

collecting encounter data from MA organizations similar to that submitted 

on FFS claims. CMS requires MA organizations to submit, via the 

Encounter Data System, encounter data weekly, biweekly, or monthly 

depending on their number of enrollees.27 Encounter data include 

diagnosis and treatment information recorded by providers for all medical 

services and may either originate from claims that providers submit to MA 

organizations for payment or from MA organizations’ medical record 

review. CMS started including the diagnosis information from MA 

encounter data from 2014 dates of service when calculating 2015 

enrollee risk scores.

While coding intensity scores can be helpful in assessing the likelihood of 

improper payments for MA contracts, results from the CMS contract-level 

RADV audits of 2007 payments indicate that the coding intensity scores 

CMS calculated were not strongly correlated with the percentage of 

unsupported diagnoses within a contract. The fact that this correlation is 

not strong reduces the likelihood that contracts selected for audit would 

be those most likely to yield large amounts of improper payments and 

 26Pub. L. No. 111-148, § 6411(b), 124 Stat. 119, 775 (2010) (codified at 42 U.S.C. § 

1395ddd(h)). 

27MA organizations with more than 100,000 enrollees must submit encounter data weekly, 

those with between 50,000 and 100,000 enrollees biweekly, and those with fewer than 

50,000 enrollees monthly.

CMS Encounter Data

CMS Does Not Focus 

MA RADV Audits on 

Contracts with the 

Highest Potential for 

Improper Payments

CMS’s Estimate of MA 

Improper Payment Risk 

Has Shortcomings
Page 11 GAO-16-76 Medicare Advantage Improper Payments

hampers CMS’s goal of using the audits to recover improper payments.28

In addition, internal control standards for federal agencies state that 

agencies should use and communicate quality information in achieving 

program goals.29 Figure 1 shows, for example, that CMS reported that the 

percentage of unsupported diagnoses (36.0 percent) among the high 

coding intensity contracts it audited was nearly identical to the percentage 

of unsupported diagnoses (35.7 percent) among the medium coding 

intensity contracts audited. In addition, 7 contracts in the high coding 

intensity group had unsupported diagnosis rates below 30 percent, 

including the contract with the highest coding intensity score.30

 28The coefficient of correlation between coding intensity and rate of unsupported 

diagnoses was slightly less than 0.3 for these 32 contracts, indicating a relatively low 

positive correlation given that CMS uses coding intensity as the basis for risk of MA 

improper payments. The coefficient of correlation between CMS’s coding intensity and the 

unsupported diagnosis rate was less than 0.3 when using either the Pearson or Spearman 

method. The coefficient of correlation was lower when the five 2007 pilot contract-level 

audits were included in our calculation. The rate of unsupported diagnoses was highly 

correlated (Pearson 0.9 coefficient of correlation) with improper payment recovery. The 

coefficient of correlation between coding intensity and improper payment recovery was 

about 0.3 and was not statistically significant. The coefficient of correlation between 

coding intensity and payment recovery was lower when the five 2007 pilot contract-level 

audits were included in our calculation. Improper payment recovery may increase when 

beneficiaries with high average risk scores are enrolled in an MA contract.

29GAO/AIMD-00-21.3.1.

30Twelve of the 32 contracts that were selected for contract-level audits of 2007 payments 

had rates of unsupported diagnoses at or below 30 percent, 10 of the 32 had rates 

between 30 and 40 percent, and 10 of the 32 contracts had rates at or above 40 percent.

Ten of the 32 contracts that were selected for contract-level audits of 2007 payments had 

recoveries above $400,000, 12 of the 32 had recoveries between $200,000 and $400,000, 

and 10 of the 32 had recoveries below $200,000 (including two contracts with recoveries 

of $0). The average contract payment recovery was $323,545, and the median was 

$325,413. Seven contracts in the high coding intensity group had recoveries below 

$200,000.
Page 12 GAO-16-76 Medicare Advantage Improper Payments

Figure 1: Percentage of Unsupported Diagnoses within Medicare Advantage (MA) 

Contracts by the Centers for Medicare & Medicaid Services (CMS) Coding Intensity, 

2007 Risk Adjustment Data Validation (RADV) Audits

Notes: Unsupported diagnoses represent CMS hierarchical condition categories that were not 

validated by medical records during contract-level RADV audits. CMS defines coding intensity as the 

average change in the disease component of the contract’s risk scores for all available years.

Several shortcomings in CMS’s methods for calculating coding intensity 

could have weakened the correlation between the degree of coding 

intensity and the percentage of improper payments. These shortcomings 

and their potential effects are as follows.

CMS’s coding intensity calculation may be based on noncomparable 

coding intensity scores across contracts because (1) the years of data 

used for each contract may not be the same and (2) coding intensity 

scores are not standardized to control for year-to-year differences. First, 

although CMS officials stated that the agency requires at least three pairyears of data for each contract, the agency includes data from all 

available years for each contract, which may vary between contracts. 

Because the growth in risk scores was lower in the MA program in earlier 

Comparability of Risk Scores 

across Years
Page 13 GAO-16-76 Medicare Advantage Improper Payments

years among beneficiaries that continuously enrolled in the program, 

CMS’s inconsistent standard of years measured for each contract would 

tend to calculate higher coding intensity scores for contracts that entered 

the MA market during periods of higher risk score growth.31 Among 

beneficiaries who enrolled in MA in consecutive years, the growth in 

average risk scores was 0.106 from 2004 through 2006, 0.119 from 2006 

through 2010, and 0.132 from 2010 through 2013.32 Second, CMS 

officials stated that the agency does not standardize its coding intensity 

data relative to a measure of central tendency. Because CMS’s coding 

intensity calculation does not account for the expected increase in risk 

scores during each period of growth, changes in risk scores may be more 

volatile from year to year than they would likely be if standardized or 

indexed to a measure of central tendency.

CMS’s coding intensity calculation does not distinguish between the 

diagnoses that were likely coded by providers and the diagnoses that 

were likely revised by MA organizations. MA organizations may receive 

diagnoses from providers that are related to services rendered to MA 

beneficiaries. Because these diagnoses are submitted by providers, the 

medical records they create may be more likely to support these 

diagnoses compared with diagnoses that are subsequently coded by the 

MA organization through medical record chart reviews. For future years, 

CMS has an available method to distinguish between diagnoses likely 

submitted by providers to MA organizations and diagnoses that were 

likely later added by MA organizations. CMS’s Encounter Data System 

provides a way for MA organizations to designate supplemental 

diagnoses that the organization added or revised after conducting 

medical record review.33 CMS has not outlined plans for incorporating 

encounter data into its contract selection methodology, even though the 

encounter data could help target the submitted diagnoses that may be 

most likely related to improper payments in the future.

 31CMS first incorporated diagnoses for risk adjustment payment in 2000, and the phase-in 

of these diagnoses was complete in 2007.

32Richard Kronick and W. Pete Welch, “Measuring Coding Intensity in the Medicare 

Advantage Program,” Medicare and Medicaid Research Review, 4, no. 2 (Baltimore, Md.: 

2014).

33CMS allows MA organizations to submit all encounter data up to 25 months after the 

original date of service.

Targeting Diagnoses Most 

Likely Related to Coding 

Intensity
Page 14 GAO-16-76 Medicare Advantage Improper Payments

CMS follows contracts that are renewed or consolidated under a different 

existing contract within the same MA organization; however, the agency’s 

coding intensity calculation does not include the prior risk scores of the 

prior contract in the MA organization’s renewed contract. This may result 

in overestimated improper payment risk if MA organizations move 

beneficiaries with higher risk scores—such as those with special needs—

into one consolidated contract.34

CMS’s contract selection methodology did not (1) always target contracts 

with the highest coding intensity scores, (2) use results from prior 

contract-level RADV audits, (3) account for contract consolidation, and (4) 

account for contracts with high enrollment. These shortcomings are 

impediments to CMS’s goal of recovering improper payments and are 

counter to federal internal control standards, which require that agencies 

use quality information to achieve their program goals.35

For the 2011 contract-level RADV audits, CMS used a contract selection 

methodology that did not focus on contracts with the highest coding 

intensity scores. While we found that coding intensity scores are not 

strongly correlated with diagnostic discrepancies, they are somewhat 

correlated. CMS failed to fully consider that correlation for the 2011 

contract-level RADV audit. For that audit, CMS officials stated that 20 of 

the 30 contracts were chosen because they were among the top third of 

all contracts in coding intensity, but we found that many of the 20 

contracts were not at the highest risk for improper payments according to 

 34To help beneficiaries select an MA plan, CMS rates MA organization contracts on a 5-

star scale, with 5 stars indicating the highest quality. An MA organization contract’s overall 

star rating indicates its performance relative to that of all other plans on about 50 

measures of clinical quality, patient experience, and contractor performance. CMS permits 

MA organizations to move enrollees from a contract with a low star rating to a contract 

with a higher star rating, and the Medicare Payment Advisory Commission has reported 

that contracts with low quality ratings tend to disproportionately serve beneficiaries with 

special needs—including those under the age of 65 who are disabled. Medicare Payment 

Advisory Commission, Report to the Congress: Medicare Payment Policy: Online 

Appendixes, Chapter 14 (Washington, D.C.: March 2013), 6. Medicare Payment Advisory 

Commission, Report to the Congress: Medicare Payment Policy (Washington, D.C.: 

March 2015), 337.

35GAO/AIMD-00-21.3.1.

Contract Consolidation

CMS Does Not Always 

Select Contracts Based on 

Evidence of the Potential 

for Improper Payments

Contracts with Highest Coding 

Intensity
Page 15 GAO-16-76 Medicare Advantage Improper Payments

CMS’s estimate of coding intensity.36 Only 4 of the 20 contracts ranked 

among the highest 10 percent in coding intensity, while 8 of the 20 

contracts ranked below the 75th percentile in the coding intensity 

distribution (see fig. 2). In addition, CMS chose 5 of the 30 contracts 

because they were among the bottom third of all contracts in coding 

intensity, even though CMS’s contract-level RADV audits of 2007 

payments found that all contracts in the lowest third of the agency’s 

coding intensity calculation had a below-average percentage of 

unsupported diagnoses. CMS officials stated that the RADV contract 

selection methodology includes these contracts to show that all contracts 

are at risk of being audited. However, officials also stated that MA 

organizations are not informed of their contracts’ coding intensity relative 

to all other MA contracts; thus, MA organizations cannot be certain their 

contracts will not be audited even if CMS announced it will no longer audit 

low coding intensity contracts.

Figure 2: Distribution of Medicare Advantage (MA) Contracts Selected for 2011 Risk Adjustment Data Validation (RADV) 

Audits, by Coding Intensity Group and Percentile

 36CMS’s reported range of coding intensity for the high-risk group of contracts was far 

greater than the range of the low- and medium-risk groups, resulting in a large 

discrepancy of coding intensity within the high-risk group. The range in coding intensity for 

the low-risk group was -.39 to -.04; for the medium-risk group, .04 to .07; and for the highrisk group, .07 to .91. 
Page 16 GAO-16-76 Medicare Advantage Improper Payments

Note: A total of 30 MA contracts were selected for the 2011 contract-level RADV audits. Each MA 

contract was assigned to only one category of coding intensity, and percentiles were calculated 

based on all MA contracts eligible for the 2011 contract-level RADV audits (contracts with at least 

three pair-years of data). CMS defines coding intensity as the average change in the disease 

component of the contract’s risk scores for all available years.

According to agency officials, CMS’s 2011 contract-level RADV contract 

selection methodology also did not consider results from the agency’s 

prior RADV audits, potentially overlooking information indicating contracts 

with known improper payment risk. Thus, contracts with the highest rates 

of unsupported diagnoses in the 2007 contract-level RADV audits were 

not among those selected for 2011 contract-level RADV audits. While 

CMS selected 6 contracts for 2011 that also underwent 2007 contractlevel RADV audits, only 1 of these contracts was among the 10 with the 

highest rates of unsupported diagnoses in 2007.37 For the 2011 contractlevel RADV audits, CMS officials stated that the agency selected 6 MA 

contracts because the HHS Office of Inspector General had conducted 

audits of 2007 payments on those contracts, but CMS did not know the 

rates of unsupported diagnoses for those contracts and did not determine 

which of them were at high risk of improper payments.38

By not considering results from prior contract-level RADV audits, CMS’s 

contract selection methodology also did not account for contract 

consolidation. An MA organization may have more than one contract in a 

service area; further, it may no longer have a contract that underwent a 

prior RADV audit but continue to operate another contract within the 

same service area. For example, the contract with the highest rate of 

unsupported diagnoses in the 2007 contract-level RADV audit is no 

longer in place, but the MA organization continues to operate a different 

contract that includes the service area from its prior contract.39 Thus, 

 37CMS did not examine the relative changes in coding intensity for contracts that 

underwent 2007 contract-level RADV audits, and agency officials stated that they were 

unaware whether rates of unsupported diagnoses dropped for those contracts or for other 

contracts under the same MA organization.

38CMS officials stated that they chose these six contracts because the agency wanted to 

see what the improper payment rate would be using CMS’s contract-level RADV audit 

methodology, which differed substantially from the audit methodology used by the HHS

Office of Inspector General.

39The contract with the high rate of unsupported diagnoses decreased its enrollment in 

2010 and was no longer in place after that year. However, total enrollment under the MA 

organization’s two contracts was nearly unchanged, and the contract that was not audited 

included the same service area.

Results from Prior Audits

Contract Consolidation
Page 17 GAO-16-76 Medicare Advantage Improper Payments

without considering all of an MA organization’s contracts in that service 

area, CMS cannot audit the beneficiaries affiliated with the highest 

percentage of unsupported diagnoses in 2007.

Although the potential dollar amount of improper payments to MA 

organizations with high rates of unsupported diagnoses is likely greater 

when contract enrollment is large, CMS officials stated that the 2011 

contract-level RADV contract selection methodology did not account for 

contracts with high enrollment. In 2011, the median enrollment among MA 

contracts was about 5,000, while enrollment at the 90th percentile was 

nearly 45,000. Some MA contracts with large enrollment had high rates of 

unsupported diagnoses under prior contract-level RADV audits. For 

example, 5 of the 10 MA contracts with the highest rates of unsupported 

diagnoses for the 2007 contract-level RADV audits had 2011 enrollment 

above the 90th percentile.

CMS officials reported that current contract-level RADV audits have been 

ongoing for several years, including the appeals associated with the 2007 

contract-level RADV audits. (See fig. 3.) For audits of 2007 payments, 

CMS notified MA organizations in November 2008 that their contracts 

would be audited but did not complete medical record review until 

approximately 4-1/2 years later in March 2013. Similarly, 2011 contractlevel RADV audits had not been completed as of August 2015. CMS 

notified MA organizations of contract audit selection in November 2013 

but did not begin medical record review for these contracts until May 

2015. CMS officials said the agency will start collecting payments from 

the 2011 contract-level RADV audits in fiscal year 2016. As the agency is 

in the medical record review phase, appeals have not yet started. This 

slow progress in completing audits is contrary to CMS’s goal to conduct 

contract-level RADV audits on an annual basis and slows its recovery of 

improper payments.

Contracts with High Enrollment

CMS’s RADV 

Process Has 

Experienced 

Substantial Delays in 

Completing ContractLevel RADV Audits 

and Appeals

Prior Contract-Level 

RADV Audits Have Been 

Ongoing for Years, and 

CMS Lacks a Timetable to 

Annually Conduct and 

Complete Audits
Page 18 GAO-16-76 Medicare Advantage Improper Payments

Figure 3: Timeline of Contract-Level Medicare Advantage (MA) Risk Adjustment Data Validation (RADV) Audits and Related 

Appeals

a

CMS began reviewing appeals in May 2013. Because MA organizations had 30 days to appeal 

CMS’s contract-level RADV audit findings in 2013, there may be a 30-day gap between the end of 

medical record review and the start of appeals.

In addition, CMS lacks a timetable that would help the agency to 

complete these contract-level audits on an annual cycle. In contrast, the 

national RADV audit that calculates the national improper payment 

estimate uses a timetable, but this is not applied to the contract-level 
Page 19 GAO-16-76 Medicare Advantage Improper Payments

audits.40 The national RADV audits that CMS annually conducts to 

estimate the national MA improper payment rate under IPIA provide the 

agency with a possible timetable for completing annual contract-level 

RADV audits.41 CMS has not followed established project management 

principles in this regard, which call for developing an overall plan to meet 

strategic goals and to complete projects in a timely manner.42

In addition to the lack of a timetable, other factors have lengthened the 

time frame of the contract-level audit process. First, CMS’s sequential 

notification to MA organizations—first identifying which contracts had 

been selected for audit and then later identifying which beneficiaries 

under these contracts would be audited—hinders the agency’s goal of 

conducting annual contract-level audits because it creates a time gap.43

For example, for the 2011 contract-level audits, CMS officials stated that 

the agency notified MA organizations about the beneficiaries whose 

diagnoses would be audited 3 months after notifying these same MA 

organizations about which contracts had been selected for audit. Both the 

selection of contracts and beneficiaries currently require risk score and 

beneficiary enrollment data.

Second, ongoing performance issues with the web-based system CMS 

uses to receive medical records submitted by MA organizations for 

contract-level RADV audits caused CMS to substantially lengthen the 

time frame for MA organizations to submit these medical records for the 

2011 contract-level RADV audits. According to CMS officials, for the 2007 

contract-level RADV audits, MA organizations submitted medical records 

for 98 percent of all audited diagnoses within a 16-week time frame. 

However, system performance issues with the Central Data Abstraction 

Tool (CDAT)—CMS’s web-based system for transferring and receiving 

 40For the national improper payment estimate of 2008 MA payments, CMS conducted 

RADV audits from December 2009 through July 2010. This involved notifying MA 

organizations of contracts selected for audit, completing medical record submission, and 

completing medical record review. 

41AHIP officials stated that MA organizations’ most frequent concerns about the RADV 

process are CMS’s lack of an annual timetable for audits and the misalignment with the 

annual RADV audits the agency uses to estimate the national MA improper payment rate. 

42GAO-09-3SP.

43According to CMS officials, once MA organization contracts are notified of selection for 

RADV audit, the agency prevents the MA organization from submitting any additional 

payment data that could affect CMS’s selection of beneficiaries for audit.
Page 20 GAO-16-76 Medicare Advantage Improper Payments

contract-level RADV audit data—led CMS to more than triple the medical 

record submission time frame for the 2011 contract-level RADV audits to 

over 1 year.44 Officials from AHIP and the two MA organizations we 

interviewed indicated that CDAT often proved inoperable, with significant 

delays and errors in uploading files. CMS officials stated that the agency 

suspended the use of CDAT for 8 months and implemented steps to 

monitor and test CDAT’s performance. CMS officials stated that they 

have implemented steps to continue monitoring and testing CDAT’s 

performance. However, officials from MA organizations stated that CDAT 

continued to experience significant delays in uploading files after CMS 

reopened CDAT for use. Officials of one MA organization suspected that 

the system may have been overwhelmed because CMS increased the 

number of medical records allowed per audited diagnosis from one to five 

between the 2007 and 2011 contract-level audits. For future medical 

record submissions, CMS officials subsequently told us that they plan to 

use a 20-week submission period and did not indicate to us any plans for 

an additional medical record submission method if CDAT’s problems 

persisted.

CMS’s Medicare FFS program has increasingly used the Electronic 

Submission of Medical Documentation System (ESMD) to transfer 

medical records reliably from providers to Medicare contractors since 

2011. Both ESMD and CDAT allow for the electronic submission of 

medical records by securely uploading and submitting medical record 

documentation in a portable document format file.45 CMS officials stated 

that the agency did not use ESMD to transfer medical records primarily 

because it could not also be used for medical record review like CDAT. 

However, medical records could be reviewed without being transferred 

through CDAT. The transfer of medical records has been the main source 

of delay in completing CMS’s contract-level audits of 2011 payments, and 

CMS has not assessed the feasibility of updating ESMD for transferring 

medical records in contract-level RADV audits. While ESMD was not 

 44MA organization officials stated that they had experienced problems with CDAT for 2007 

contract-level RADV audits, but these problems were substantially worse for 2011 

contract-level RADV audits. MA organization officials also stated that the problems with 

CDAT forced them to divert more staff resources to medical record submission.

45CMS authorizes Health Information Handlers—organizations that handle health 

information on behalf of a provider—to assist providers with submitting medical records 

through ESMD. In contrast, CMS only provides training directly to MA organizations for 

submitting medical records for contract-level RADV audits through CDAT.
Page 21 GAO-16-76 Medicare Advantage Improper Payments

available when CMS began its 2007 contract-level RADV audits, the 

system has demonstrated a greater capacity for transferring medical 

records than CDAT. In fiscal year 2014, providers used ESMD to transfer 

nearly 500,000 medical records—far beyond the capacity necessary for 

contract-level RADV audits.46 In interviews, officials of two FFS RACs 

stated that ESMD was very reliable and did not have technical issues that 

affected audits.

In addition, CMS has not applied time limits to contract-level RADV 

reviewers for completing medical record reviews. These reviews took 3 

years for the 2007 contract-level RADV audits. In contrast, CMS generally 

requires its Medicare Administrative Contractors (MAC)—a type of FFS 

contractor—to make postpayment audit determinations within 60 days of 

receiving medical record documentation.47 Because CMS has not 

required that contract-level RADV auditors complete medical record 

reviews within a specific time period, the agency is hindering its ability to 

reach its goal of conducting annual contract-level RADV audits.48

Disputes and appeals stemming from the 2007 contract-level RADV audit 

findings have been ongoing for years and the lack of time frames at the 

first level of the appeal process hinders CMS from achieving its goal of 

using contract-level audits to recoup improper payments. Nearly all MA 

organizations whose contracts were included in the 2007 contract-level 

RADV audit cycle disputed at least one diagnosis finding following 

medical record review, and five MA organizations disputed all the findings 

of unsupported diagnoses. CMS officials stated that MA organizations in 

total disputed 624 (4.3 percent) of the 14,388 audited diagnoses, and that 

 46During the first 13 weeks of fiscal year 2014, providers transferred 173,234 medical 

records through ESMD. This volume of medical records would exceed the number of 

medical records necessary for contract-level RADV audits if each audited beneficiary had 

5 audited diagnoses and MA organizations submitted the maximum five medical records 

per diagnosis. For the 2007 contract-level RADV audits, the average beneficiary had 2.4 

audited diagnoses.

47MACs are a type of contractor used by CMS to process and pay claims in the FFS 

Medicare program. MACs also conduct postpayment claims reviews on a small 

percentage of paid claims to determine if the payments were proper based on underlying 

documentation in an effort to prevent future FFS Medicare payment errors.

48For 2011 contract-level RADV audits, the medical record review process began in May 

2015, and CMS expects to complete medical record review and send RADV results to MA 

organizations in 2016.

Disputes and Appeals of 

Contract-Level RADV 

Audits Have Been 

Ongoing for Years, and 

CMS Has Not 

Incorporated Measures to 

Expedite the Process
Page 22 GAO-16-76 Medicare Advantage Improper Payments

the determinations on these disputes, which were submitted starting 

March 2013 through May 2013, were not complete until July 2014. 

If an MA organization disagrees with the medical record dispute 

determination, the MA organization may appeal to a hearing officer. This

appeal level is called review by a CMS hearing officer. Because the 

medical record dispute process for the 2007 contract-level RADV audit 

cycle took nearly 1-1/2 years to complete, CMS officials stated that the 

agency did not receive all 2007 second-level appeal requests for hearing 

officer review until August 2014. CMS officials stated that the hearing 

officer adjudicated or received a withdrawal request from the MA 

organization for 377 of the 624 appeals (60 percent) from August 2014 

through September 2015. 49

Appeals for the 2011 contract-level RADV audit cycle have yet to begin, 

as CMS officials stated that the agency is currently in the process of 

reviewing medical records submitted by MA organizations for the 2011 

contract-level RADV audits. CMS officials stated that the medical record 

dispute process for the 2011 contract-level RADV audit cycle will differ 

from the process used during the 2007 cycle in certain respects. In 

particular, for the 2011 RADV audit cycle, the medical record dispute 

process will be incorporated into the appeal process instead of being part 

of the audit process, as it was during the 2007 cycle. The new first-level 

appeal process, in which an MA organization can submit a written request 

for an independent reevaluation of the RADV audit decision, will be called 

the reconsideration stage. This change will allow MA organizations to 

request reconsideration of medical record review determinations 

simultaneously with the appeal of payment error calculations, rather than 

sequentially, as was the case during the 2007 contract-level RADV audit 

cycle.

While such a change may be helpful, the new process does not establish 

time limits for when reconsideration decisions must be issued. In contrast, 

CMS generally imposes a 60-day time limit on MA organization decisions 

 49Due to the complexity of the contract-level RADV audit process, the agency stated that 

appeal decisions will be made on a case-by-case basis. CMS officials estimated that 

some cases could be settled in as little as 2 weeks, with more complex cases taking as 

long as 18 to 24 months. 
Page 23 GAO-16-76 Medicare Advantage Improper Payments

regarding beneficiary payment first-level appeals in MA.50 CMS measures 

the timeliness of decisions regarding MA beneficiary first-level appeals to 

assist the agency in assigning quality performance ratings and bonus 

payments to MA organizations.51 Similarly in Medicare FFS, officials 

generally must issue decisions within 60 days of receiving first-level

appeal requests.52 CMS officials stated that due to the agency’s limited 

experience with the contract-level RADV audit process, time limits were 

not imposed at the reconsideration appeal level and that this issue may 

be revisited once CMS completes a full contract-level RADV audit cycle. 

The lack of explicit time frames for appeal decisions at the 

reconsideration level hinders CMS’s collection of improper payments as 

the agency cannot recover extrapolated overpayments until the MA 

organization exhausts all levels of appeal and is inconsistent with 

established project management principles.53

CMS has not expanded the RAC program to MA, as it was required to do 

by the end of 2010 by the Patient Protection and Affordable Care Act. 

CMS issued a request for industry comment regarding implementation of 

the MA RAC on December 27, 2010, seeking stakeholder input regarding 

potential ways improper payments could be identified in MA using RACs. 

CMS reported that it had received all stakeholder comments from this 

request by late February 2011. CMS issued a request for proposals for 

the MA RAC in July 2014. As defined by the Statement of Work in that 

request, the MA RAC would audit improper payments in the audit areas of 

 50Beneficiary payment appeals are handled under an appeal process specifically for MA 

organizations. The first level of review is reconsideration by the health plan offered by an 

MA organization. If the health plan offered by an MA organization issues a decision 

against the beneficiary at the first level of appeal, the beneficiary’s appeal is automatically 

sent to the next level of review, reconsideration by an independent review entity. 

51Beginning in 2015, MA organizations must earn an overall rating of 4 or more stars to be 

eligible for quality bonus payments.

52We are currently examining recent trends in Medicare FFS appeals and any efforts by 

HHS to monitor and improve the appeal process and plan to issue a report in spring 2016.

53GAO-09-3SP.

CMS Has Made Little 

Progress toward 

Incorporating a 

Recovery Audit 

Contractor in MA
Page 24 GAO-16-76 Medicare Advantage Improper Payments

Medicare secondary payer, end-stage renal disease, and hospice.54 In 

October 2014, CMS officials told us that the agency did not receive any 

proposals to conduct the work in those three audit areas and that CMS’s 

goal was to reissue the MA RAC solicitation in 2015.

In November 2015, CMS officials told us that the agency is no longer 

considering Medicare secondary payer, end-stage renal disease, and 

hospice services as audit areas for the MA RAC. Instead, the officials told 

us that CMS was exploring whether and how an MA RAC could assist 

CMS with contract-level RADV audits. In December 2015, CMS issued a 

request for information seeking industry comment regarding how an MA 

RAC could be incorporated into CMS’s existing contract-level RADV audit 

framework.55 In the request document, CMS stated that it is seeking an 

MA RAC to help the agency expand the number of MA contracts subject 

to audit each year. In the request, CMS stated that its ultimate goal is to 

have all MA contracts subject to either a contract-level RADV audit or 

what it termed a condition-specific RADV audit for each payment year.56

Officials we interviewed from three of the current Medicare FFS RACs all 

acknowledged that their organizations had the capacity and willingness to 

conduct contract-level RADV audits.

Despite its recent request for information, CMS does not have specific 

plans or a timetable for including RACs in the contract-level RADV audit 

process. Established project management principles call for developing 

 54Based on our own analysis, we believe that targeting RAC audit work to Medicare 

secondary payer, end-stage renal disease, and hospice would have minimal impact on 

MA improper payments and that these are areas that could be addressed through 

administrative processes CMS already has in place. For example, CMS already has a 

contractor in place to ensure that Medicare is not incorrectly billed as a primary payer. 

CMS’s proposal would have applied to relatively few MA enrollees with end-stage renal 

disease, and MA organizations do not control when CMS reduces payments to them for a 

beneficiary who seeks hospice services since the election forms are submitted by the 

hospice provider. 

55Centers for Medicare & Medicaid Services, Medicare Advantage Part C Recovery 

Auditor Request for Information, December 22, 2015, RFI-CMS-2016-RADV-RAC, 

accessed January 4, 2016, 

https://www.fbo.gov/index?s=opportunity&mode=form&id=83f1ec085c52a81a6a6ce7cba3f

fbc5d&tab=core&_cview=0. 

56CMS described condition-specific RADV audits as audits that would be focused on 

specific diagnoses that had been determined to have a high probability of being 

erroneous. CMS envisions that these audits would be conducted for MA contracts that 

were not subject to contract-level RADV audits for a particular payment year. 
Page 25 GAO-16-76 Medicare Advantage Improper Payments

an overall plan and monitoring framework to meet strategic goals.57 A 

plan and timetable would help guide CMS’s efforts in incorporating a RAC 

in MA and help hold the agency accountable for implementing this 

requirement from the Patient Protection and Affordable Care Act. Once 

the requirement is implemented, CMS could leverage the MA RAC in 

order to increase the number of MA organization contracts audited. 

CMS’s recovery of improper payments has been restricted because it has 

not established an MA RAC. For example, CMS currently plans to include 

30 MA contracts in contract-level RADV audits for each payment year, 

about 5 percent of all contracts.

Limitations in CMS’s processes for selecting contracts for audit, in the 

timeliness of CMS’s audit and appeal processes, and in the agency’s

plans for using MA RACs to assist in identifying improper payments 

hinder the accomplishment of its contract-level RADV audit goals: to 

conduct annual contract-level audits and recover improper payments. 

These limitations are also inconsistent with federal internal control 

standards and established project management principles. Our analyses 

of these processes and plans suggest that CMS will likely recover a small 

portion of the billions of dollars in MA improper payments that occur every 

year. Shortcomings in CMS’s MA contract selection methodology may 

result in audits that are not focused on the contracts most likely to be 

disproportionately responsible for improper payments. Furthermore, 

CMS’s RADV time frames are so long that they may hamper the agency’s 

efforts to conduct audits annually, collect extrapolated payments 

efficiently, and use audit results to inform future RADV contract selection. 

By CMS’s own estimates, conducting annual contract-level audits would 

potentially allow CMS to recover hundreds of millions of dollars more in 

improper payments each year. Agency officials have expressed concerns 

about the intensive agency resources required to conduct contract-level 

RADV audits. To address the resource requirements of conducting 

contract-level audits, CMS intends to leverage the MA RACs for this 

purpose; however, the agency has not outlined how it plans to incorporate 

RACs into the contract-level RADV audits and is in the early stages of 

soliciting industry comment regarding how to do so.

 57GAO-09-3SP.

Conclusions
Page 26 GAO-16-76 Medicare Advantage Improper Payments

As CMS continues to implement and refine the contract-level RADV audit 

process, we recommend that the Administrator of CMS take actions in the 

following five key areas to improve the efficiency and effectiveness of 

reducing and recovering improper payments.

First, to improve the accuracy of CMS’s calculation of coding intensity, the 

Administrator should modify that calculation by taking actions such as the 

following:

• including only the three most recent pair-years of risk score data for 

all contracts;

• standardizing the changes in disease risk scores to account for the 

expected increase in risk scores for all MA contracts;

• developing a method of accounting for diagnostic errors not coded by 

providers, such as requiring that diagnoses added by MA 

organizations be flagged as supplemental diagnoses in the agency’s 

Encounter Data System to separately calculate coding intensity 

scores related only to diagnoses that were added through MA 

organizations’ supplemental record review (that is, were not coded by 

providers); and

• including MA beneficiaries enrolled in contracts that were renewed 

from a different contract under the same MA organization during the 

pair-year period.

Second, the Administrator should modify CMS’s selection of contracts for 

contract-level RADV audits to focus on those contracts most likely to have 

high rates of improper payments by taking actions such as the following:

• selecting more contracts with the highest coding intensity scores;

• excluding contracts with low coding intensity scores;

• selecting contracts with high rates of unsupported diagnoses in prior 

contract-level RADV audits;

• if a contract with a high rate of unsupported diagnoses is no longer in 

operation, selecting a contract under the same MA organization that 

includes the service area of the prior contract; and

• selecting some contracts with high enrollment that also have either 

high rates of unsupported diagnoses in prior contract-level RADV 

audits or high coding intensity scores.

Third, the Administrator should enhance the timeliness of CMS’s contractlevel RADV process by taking actions such as the following:

Recommendations for 

Executive Action
Page 27 GAO-16-76 Medicare Advantage Improper Payments

• closely aligning the time frames in CMS’s contract-level RADV audits 

with those of the national RADV audits the agency uses to estimate 

the MA improper payment rate;

• reducing the time between notifying MA organizations of contract 

audit selection and notifying them about the beneficiaries and 

diagnoses that will be audited;

• improving the reliability and performance of the agency’s process for 

transferring medical records from MA organizations, including 

assessing the feasibility of updating ESMD for use in transferring 

medical records in contract-level RADV audits; and

• requiring that CMS contract-level RADV auditors complete their 

medical record reviews within a specific number of days comparable 

to other medical record review time frames in the Medicare program.

Fourth, the Administrator should improve the timeliness of CMS’s 

contract-level RADV appeal process by requiring that reconsideration 

decisions be rendered within a specified number of days comparable to 

other medical record review and first-level appeal time frames in the 

Medicare program.

Fifth, the Administrator should ensure that CMS develops specific plans 

and a timetable for incorporating a RAC in the MA program as mandated 

by the Patient Protection and Affordable Care Act.

We provided a draft of this report to HHS for comment. HHS provided 

written comments, which are printed in appendix I. HHS concurred with 

our recommendations. In its comment letter, HHS also reaffirmed its 

commitment to identifying and correcting improper payments in the MA 

program. HHS also provided technical comments, which we incorporated 

as appropriate. Based on HHS’s technical comments, we revised our 

suggested actions for how HHS could meet GAO’s first recommendation.

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies of this report to the 

appropriate congressional committees and the Secretary of Health and 

Human Services. In addition, this report will be available at no charge on 

the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

Agency Comments
Page 28 GAO-16-76 Medicare Advantage Improper Payments

the last page of this report. GAO staff who made major contributions to 

this report are listed in appendix II.

Sincerely yours,

James Cosgrove

Director, Health Care
Appendix I: Comments from the Department of 

Health and Human Services

Page 29 GAO-16-76 Medicare Advantage Improper Payments

Appendix I: Comments from the Department 

of Health and Human Services
Appendix I: Comments from the Department of 

Health and Human Services

Page 30 GAO-16-76 Medicare Advantage Improper Payments
Appendix I: Comments from the Department of 

Health and Human Services

Page 31 GAO-16-76 Medicare Advantage Improper Payments
Appendix I: Comments from the Department of 

Health and Human Services

Page 32 GAO-16-76 Medicare Advantage Improper Payments
Appendix II: GAO Contact and Staff 

Acknowledgments

Page 33 GAO-16-76 Medicare Advantage Improper Payments

James Cosgrove, (202) 512-7114 or cosgrovej@gao.gov.

In addition to the contact named above, individuals making key 

contributions to this report include Martin T. Gahart, Assistant Director; 

Luis Serna III; and Marisa Beatley. Elizabeth T. Morrison and Jennifer 

Whitworth also provided valuable assistance.

Appendix II: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(291232)
Appendix II: GAO Contact and Staff 

Acknowledgments

Page 34 GAO-16-76 Medicare Advantage Improper Payments

The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.