Two things happened in close succession, and they need to be read together. In May 2026, the HHS Office of Inspector General published a nationwide audit finding that CMS potentially overpaid Medicare Advantage organizations $462 million for payment year 2021, based entirely on acute stroke diagnosis codes that were not supported by medical records. Shortly after, CMS posted PY2021 RADV audit methods and instructions, meaning that audit cycle is now live.
Neither development is a surprise in isolation. But together, they complete a picture that MA plans should have been acting on already: the evidentiary standard for diagnoses submitted for risk adjustment is being enforced, at scale, and through multiple channels simultaneously. The OIG tells CMS where the problems are. RADV is how CMS collects.
In May 2026, the HHS Office of Inspector General estimated that CMS made $462 million in potential net overpayments to Medicare Advantage organizations for payment year 2021. The overpayments were tied to acute stroke diagnosis codes submitted on physician data records with no corresponding inpatient or outpatient hospital record during the same service year. Every single one of the 97 sampled enrollees had diagnosis codes that failed to meet federal documentation requirements. The sampling frame covered 240,401 MA enrollees nationwide who were at high risk for having an incorrectly submitted acute stroke code.
This was not an audit of one plan. OIG examined the pattern across MA organizations nationally, having already issued 34 individual plan audits on the same issue. Across those prior audits, 1,146 of 1,185 sampled acute stroke diagnoses were not supported by medical records. The nationwide audit confirmed that the problem is systemic, not isolated.
The most common error, present in 68 of the 97 sampled cases, was a specificity failure. The patient had a prior history of stroke, documented in the medical record. But the provider coded it as an acute stroke rather than history of stroke. That distinction matters enormously for risk adjustment: acute stroke maps to an HCC; history of stroke does not. In 22 additional cases, the records did not support an acute stroke diagnosis at all. In both scenarios, the plan received an inflated risk-adjusted payment that was not defensible under federal requirements.
OIG explicitly chose not to recommend CMS pursue recovery of the $462 million, because the audit spanned multiple organizations and used statistical sampling rather than individual plan-level review. That is a methodology decision, not an exoneration. The finding tells CMS exactly where to look, and the RADV expansion is the mechanism CMS will use to find it plan by plan.
CMS’s written response to the OIG report, signed by Administrator Dr. Mehmet Oz in March 2026, did not concur or non-concur with OIG’s recommendation. Instead, CMS pointed to its ongoing RADV expansion as evidence of its commitment to payment accuracy. In that response, CMS confirmed it is scaling audits from 60 to more than 500 MA contracts per payment year and increasing the number of records reviewed per plan to up to 200 for the largest contracts. CMS also confirmed it will use advanced analytics to flag unsupported diagnoses.
What OIG found at the national level, CMS will now pursue at the plan level. The [RADV expansion that is changing the rules for every Medicare Advantage plan] is no longer a future threat; the PY2021 RADV posting confirms it is operational.
OIG defines a high-risk acute stroke code as one submitted on a physician data record where the enrollee does not also have an acute stroke diagnosis on an inpatient or outpatient hospital record during the same service year. Acute stroke is a life-threatening medical emergency that requires prompt hospital treatment, so the absence of a corresponding hospital record is a reliable indicator that the submitted code is incorrect.
The American Academy of Professional Coders is clear on this: acute stroke diagnoses are appropriate only during the acute encounter and should be confirmed by diagnostic studies in a hospital setting, such as an emergency room or inpatient admission. A patient with a prior stroke history who presents to a physician office is not experiencing an acute stroke. The correct code is history of stroke, which does not generate an HCC. When providers or coders apply the acute stroke code instead, the plan receives payment for a condition it has not documented at the required evidentiary standard.
Ninety-one of the 95 high-risk acute stroke codes OIG identified in this audit are also present in CMS’s updated 2024 risk adjustment model. The same documentation failure that generated $462 million in estimated overpayments for 2021 will generate the same exposure going forward, unless plans build controls specifically targeting this pattern.
CMS posting PY2021 RADV audit methods and instructions means those audits are now underway. PY2020 audits began in February 2026; new payment year audit cycles are initiating approximately every three months. Plans selected for PY2021 review will be evaluated on documentation from service year 2020, the same window OIG’s nationwide audit just covered.
CMS selects HCCs for RADV review using a risk-based approach focused on codes more likely to be in error. The physician-record-only acute stroke pattern is exactly the kind of signal CMS’s analytics are designed to surface. Plans carrying this pattern in their submission history for service years 2020 and 2021 should assume it is visible to CMS and should already be [building a defensible documentation strategy] around what auditors are trained to find.
There is also a self-correction obligation worth understanding. Federal regulations require MA organizations to submit deletions for incorrect diagnosis codes to CMS, regardless of whether the error is identified before or after the final risk adjustment data submission deadline. That obligation does not expire because time has passed. Plans that identify unsupported acute stroke codes in their submission history should treat deletion as a compliance requirement, not an optional cleanup exercise.
Plans should start by auditing their own submission history for the specific pattern OIG identified: acute stroke codes on physician data records without a corresponding hospital record in the same service year. That self-audit is the starting point for every other action that follows.
Step 1: Pull diagnosis data for service years 2020 through the present and isolate acute stroke codes submitted on physician data records. Cross-reference against inpatient and outpatient hospital records for the same service year. Flag every enrollee where the physician record is the only source.
Step 2: Pull the medical records for flagged enrollees and conduct an internal coding review. The question is not whether the patient has a stroke history. It is whether the record supports an acute stroke diagnosis at the specific date of the physician’s service. If the record shows history of prior stroke but no clinical evidence of an acute event, the code is wrong.
Step 3: For incorrectly submitted codes, submit deletions to CMS. This is a compliance obligation, not a discretionary choice. Plans that identify errors and correct them proactively are in a materially different position under RADV than those that wait to be found.
Step 4: Audit current coding practices for the acute stroke / history of stroke distinction at the provider and coder level. The most common error in OIG’s sample was a provider coding a prior stroke history as an active acute event. Provider education and pre-submission coder review are the most direct controls.
Step 5: Implement second-level coding review specifically targeting this HCC pattern going forward. OIG’s publicly available toolkit identifies high-risk diagnosis codes and describes how to build internal controls around them. Twelve of the 63 plans in this audit were already using it. Plans that are not should start immediately, and should be thinking about how to [build an audit-ready documentation culture] that sustains that discipline over time.
Step 6: Extend the same scrutiny to other high-risk HCC codes. Acute stroke is one OIG has been tracking explicitly, but the toolkit covers a broader set. A plan that has acute stroke exposure almost certainly has exposure in other high-risk areas it has not yet examined, and needs the kind of [systematic compliance infrastructure] that can scale across all of them.
HCC Validator is built specifically for this moment. It flags OIG-identified high-risk diagnosis codes, including the acute stroke pattern, before submission. It validates that diagnoses are encounter-supported and builds the structured evidence trail that RADV preparation requires. The goal is to find what an auditor would find before an auditor does.
HCC Assistant supports diagnostic specificity at the point of care, where the coding decision is made. Surfacing the clinical distinction between active conditions and history of conditions in real time, while the provider is still in the encounter, is where the documentation failure OIG identified is most effectively prevented.
Together, these tools address both ends of the problem: preventing unsupported codes from entering the submission pipeline in the first place, and validating what is already there before it becomes an audit finding.
CMS is scaling RADV audits to cover all eligible MA plans annually. OIG is conducting both individual plan and nationwide audits of high-risk HCC codes. The acute stroke pattern, now documented at $462 million in estimated overpayments, is visible to CMS through both its own analytics and the published OIG report. Plans that have not self-audited, corrected what they find, and built controls to prevent recurrence are carrying known exposure in an environment that will not tolerate it much longer.
The organizations that act now are buying themselves time, credibility, and a defensible record. The ones that wait will face the same scrutiny with less to show for it. What a [defensible risk adjustment program in a post-V28 environment] actually looks like, and [what every plan should know about risk adjustment heading into 2027], both point to the same conclusion: the window for proactive correction is closing.
What did the OIG find in its 2026 Medicare Advantage acute stroke audit? In May 2026, OIG estimated that CMS made $462 million in potential net overpayments to MA organizations for payment year 2021 based on acute stroke diagnosis codes that were not supported by medical records. For all 97 sampled enrollees, the submitted codes failed to meet federal requirements, a 100% sample error rate. The audit focused on cases where acute stroke codes appeared on physician data records without a corresponding inpatient or outpatient hospital record in the same service year.
Why is the OIG’s $462 million finding significant even though CMS isn’t pursuing recovery? OIG chose not to recommend recovery because the audit spanned multiple organizations and used statistical sampling. But that is a methodology decision, not a finding that plans are clear. The report identifies exactly where CMS should look, and the RADV expansion is how CMS will pursue recovery at the individual plan level. Plans with this coding pattern in their submission history should assume it is visible to CMS’s analytics.
What is a high-risk acute stroke diagnosis code? A high-risk acute stroke diagnosis code is an acute stroke diagnosis submitted on a physician data record where the enrollee does not have a corresponding acute stroke diagnosis on a hospital record in the same service year. Acute stroke is a medical emergency requiring hospitalization, so a physician-only submission without a hospital record is a strong indicator that the code is incorrect. Most often, the patient had a prior history of stroke that was miscoded as an active acute event.
How does the RADV audit expansion affect plans with acute stroke coding exposure? CMS is scaling RADV audits to cover all approximately 550 eligible MA plans annually, with record reviews increasing from 35 to up to 200 per plan. PY2020 audits began in February 2026; PY2021 audit methods have now been posted. CMS selects HCCs for RADV review using a risk-based approach focused on codes more likely to be in error, which aligns directly with the methodology OIG used to identify the acute stroke pattern. Plans with this exposure should treat RADV selection as a question of when, not if.
What should MA plans do if they have acute stroke diagnosis codes on physician records without hospital records? Plans should immediately pull submission data for service years 2020 forward, identify acute stroke codes on physician records without corresponding hospital records, conduct an internal coding review of those records, submit deletions for any codes that were not supported, and implement second-level coding review to prevent recurrence. Federal regulations require MA organizations to submit deletions for incorrect codes regardless of when the error is identified. That obligation does not expire.
The OIG report and the PY2021 RADV posting are not separate events. They are the same enforcement direction arriving through two different channels. OIG identifies the pattern at scale; RADV pursues it plan by plan. A 100% sample error rate, $462 million in estimated overpayments, and a pattern tracked across 34 individual plan audits before this nationwide report: this is not a one-off that slipped through the system. It is a systemic documentation and coding failure that CMS now has both the visibility and the audit infrastructure to act on.
Plans that self-audit now, correct what they find, and build the internal controls to prevent recurrence are building audit resilience in an environment that will not reward waiting.
Contact Inferscience to audit your high-risk HCC exposure and build a defensible documentation program before RADV auditors identify what internal review has not. Request a walkthrough to see how real-time validation and pre-submission compliance support reduce the risks this environment is making unavoidable.
