CMS releases final rule for the Medicare Advantage RADV program

On February 1, 2023, the Centers for Medicare and Medicaid Services (CMS) published its final rule outlining its audit methodology and policies for the contract-level Medicare Advantage (MA) Risk Adjustment Data Validation (RADV) program.

The final rule provides new tools for CMS to strengthen the risk adjustment audit process, reduce the amount of overpayments related to improperly reported diagnoses and recover potentially significant overpayments from MA plans.  Under the final rule, among other changes, CMS can now audit MA claims dating back to Payment Year (PY) 2018 using an extrapolation methodology to identify billing errors covering the entire universe of claims.

CMS delves into a detailed discussion about its methodology and policies in the commentary accompanying the publication of the new regulation. The rule reflects three specific policies adopted by CMS on (1) the extrapolation of RADV audit findings, (2) the so-called Fee-for-Service (FFS) Adjuster and (3) the remission of improper payments identified during RADV audits.

What is the MA RADV program?

The MA program was created by Congress in 2003 pursuant to the Medicare Modernization Act to help stabilize healthcare spending on Medicare-eligible individuals. Under this program, Medicare beneficiaries are provided the option of receiving their benefits through private health insurance plans rather than through the traditional Medicare FFS program (ie, Medicare Parts A and B). Private health insurance companies enter into contracts with the federal government to coordinate the care of eligible Medicare beneficiaries and are paid a fixed or capitated rate per enrollee, per month, as compared to the FFS model of traditional Medicare. Many seniors choose the MA program option because it provides for comparable coverage while also providing certain extra benefits, such as vision, hearing and dental benefits. 

The capitated rates CMS pays to MA organizations (MAOs) are based, in part, on the beneficiary diagnosis codes reported by MAOs’ contracted healthcare providers.  Those providers evaluate a patient and submit claims containing the patient's ICD-10 codes to the MAO.  The MAO, in turn, reports the ICD-10 information along with other information regarding the enrollee population to CMS.  Based on the information submitted to CMS from the MAO, CMS makes risk adjustment payments to the MAO to cover the cost of caring for the MAO’s enrollees. 

CMS risk-adjusts payments made to MAOs to account for the health status and demographic characteristics of the MAOs’ enrolled beneficiaries.  An MAO with less healthy enrollees would incur greater healthcare costs and so would receive higher payments from CMS through risk adjustment than an MAO with healthier enrollees and lower costs. In other words, to discourage cherry-picking of healthy patients by the MAOs, CMS pays the MAO a higher capitated payment for a sicker enrollee than a healthier one. 

This is accomplished via CMS’ risk adjustment model – the CMS Hierarchical Condition Category (HCC) model.  Under the CMS-HCC model, about 10,000 diagnosis codes are grouped together under about 90 HCCs.  HCCs are assigned based on the data submitted by MAOs with respect to the MAOs’ clinical services provided to its particular patient population.  Diagnosis codes documented in patient records contribute to the enrollee’s risk score.  Importantly, when CMS calculates a risk score and pays MAOs, it accepts the data as reported and does not validate the diagnosis data before determining the MAO’s rates.  This pay-first process creates a risk of overpayment where an MAO may have – in CMS’ words – “over-coded” diagnoses, meaning the code diagnoses are not substantiated by the medical record.  Post payment, CMS deploys its RADV program to audit a selection of MAOs each year to identify and recover overpayments.

The current MA RADV program represents years of internal review, requests for information and market testing by CMS. The audits conducted through the MA RADV program are the main corrective action tool used by CMS for overpayments made to an MAO when the medical record lacks sufficient documentation to support a particular diagnosis code reported for risk adjustment.  Both CMS and the US Department of Health and Human Services, Office of Inspector General (OIG) have conducted numerous audits of MAOs of risk adjustment coding and have expressed concerns about error rates identified in those audits with respect to reported ICD-10 codes which CMS and the OIG concluded were not supported by the providers’ medical record documentation. 

What policies does the final rule adopt for the RADV program?

CMS has adopted three specific policies for its RADV program addressing (1) the extrapolation of RADV audit findings, (2) the use of the FFS Adjuster in risk adjusting payments to MAOs and (3) the remission by MAOs of improper payments identified during RADV audits.  Each of these policies are discussed in more detail below.

Did CMS decide that it will extrapolate RADV audit findings?

Yes.  As discussed at length in the final rule, CMS has decided that it will extrapolate RADV audit findings to a universe of the MAO’s claims. However, CMS has not adopted a specific sampling or extrapolated audit methodology but will rely on any statistically valid method that it determines to be “well-suited” to a particular audit.  Medicare’s FFS audit process has long relied on an extrapolation methodology, which requires a randomized, statistically valid methodology based on RAT-STATs to calculate sample size. 

Extrapolation will allow CMS to move away from enrollee-level adjustments (whereby CMS merely adjusts payments for specific enrollees from an audit sample) to contract-level payment adjustments to account for the overall error of payments to an MAO.

CMS will only apply extrapolation beginning with PY 2018.  It will collect non-extrapolated overpayments for PYs 2011 to 2017.

Has CMS decided to accept the recommendation to incorporate an FFS Adjuster into its RADV program?

No.  CMS has firmly rejected the proposal from some MAOs to incorporate an FFS Adjuster into its RADV program.

Some MAOs had proposed that CMS include an FFS Adjuster in calculating payments owed to MAOs.  While the reasons for the FFS Adjuster are tied to complex policy and legal considerations, in practice, the FFS Adjuster would be an adjustment (via an increase) in the payment rates to MAOs to account for the presence of erroneous diagnoses in the Medicare FFS claims data used to calibrate the MA payment model. These MAOs argue that Medicare FFS data understates the cost of treating various conditions.  Alternatively, the MAOs suggest that, if the MAO payments will not be adjusted upwards, medical record documentation requirement should be lessened. Currently, an MAO cannot simply list ICD codes; the codes must be substantiated with findings in the patient’s medical record to be considered in the RADV audit process. Hence, the FFS Adjuster would be an adjustment to payments or documentation requirements.

After pointing to various studies conducted on this issue, CMS concluded that there is no evidence that Medicare FFS claims data is systematically biasing MA risk scores and asserted it has the legal authority to employ a RADV methodology without a FFS Adjuster.  Thus, as CMS rolls out its RADV audits beginning with PY 2018, MAOs will be expected to meet all currently applicable medical record documentation requirements.

Has CMS specified how MAOs will be required to remit extrapolated recovery amounts from RADV audits?

Yes and no.  Per the final rule, amended 42 C.F.R. § 422.310(e) now specifies that MAOs must remit improper payments based on RADV audits “in the manner specified by CMS.”  For PYs 2011 to 2017, this means MAOs should expect CMS to recover enrollee-level improper payments identified in any completed RADV audit.

Beginning with PY 2018, it is not yet clear how CMS will require the remission of overpaid amounts.  In its Proposed Rule from November 2018, CMS had suggested that it would require payment through the MA and Prescription Drug System (MARx), which is the system for making monthly payments and adjustments to MAOs and Medicare Part D sponsors.  Through this process, overpayment recoveries would be accomplished as offsets to an MAO’s monthly payments.  If an offset exceeds a monthly payment, it would be spread across adjustments for multiple months until the full amount is recovered.  It is not clear whether there would be any interest imposed on unpaid amounts. In the final rule, CMS did not choose to adopt any specific recovery mechanism.

In the final rule, CMS emphasizes multiple times that nothing in these new rules changes the obligation of an MAO to refund overpayments to CMS if the MAO learns “through any means” that a diagnosis lacks support in an enrollee’s medical record.

What are the implications of this rule for MAOs?

The availability of extrapolation as a tool for CMS’ RADV audits will likely serve to increase audit activity of MAOs and lead to higher overpayment recoveries. As the MA program continues to grow and allegations of risk score inflation remain under high scrutiny by regulatory agencies, increased audit activity and litigation are likely to result. It will be critical for MAOs subject to RADV audits to position themselves for appeal and aggressively challenge any extrapolation determinations.

What are the implications of this rule for healthcare providers?

With CMS’ decision to use extrapolation beginning with PY 2018 and its rejection of the FFS Adjuster, MAOs will be under significant financial and legal pressure to ensure that medical records support the data being submitted to CMS and used to determine risk scores for enrollees.  Given that healthcare providers are required by MAOs to meet MA documentation requirements, providers should expect MAOs to be more aggressive in their oversight and review of that documentation.  Some MAOs are already incorporating financial penalties into their managed care contracts with providers with respect to incomplete, inaccurate or other problematic risk adjustment data.  MAOs will also be likely to exercise their contractual rights to recoup overpayments owed to CMS from providers that submit inaccurate, incomplete or otherwise problematic risk adjustment data.  Providers should expect these trends to continue and should carefully assess their contractual liabilities and obligations to MAOs as they negotiate and perform under MA managed care agreements.

What are CMS’ next steps regarding the final rule?

The final rule will go into effect on April 3, 2023.  CMS will continue completing RADV audits for PYs 2011 to 2017, initiate audits in calendar year 2025 beginning with PY 2018 and seek repayment of any identified, improper payments pursuant to the policies adopted in the final rule.  For PYs 2011 through 2017, CMS expects to collect only about $41.1 million as a result of this final rule (as opposed to the $2 billion it estimates it would collect if it applied extrapolation to those PYs).  Overall, CMS is expecting estimated recoveries from 2023 through 2032 to amount to $4.7 billion.

Learn more about the final rule by contacting the authors or your usual DLA Piper relationship attorney.