Where Supported Risk Leaks Out — And Why 2027 Changes Everything
OIG flags $462 million in MA overpayments. CMS finalizes the unlinked chart review rule. RADV scales to 500+ contracts. Four operational gaps that let legitimate risk disappear before it reaches a score.
Most Medicare Advantage risk adjustment programs are not broken. They are siloed.
Retrospective review runs. Prospective coding runs. Rejection management runs. Each program, measured on its own terms, looks healthy. Yet payment year scores stay flat, and the default explanation — provider documentation — absorbs blame that belongs elsewhere.
What the May 2026 OIG audit makes visible is that the leak is not in any one program. It is in the seams between them. $462 million in estimated net overpayments from a single diagnosis pattern across a single payment year is not a documentation failure at the provider level. It is a systems failure: supported risk that existed in the data, processed through programs that each saw only a slice of it, and never reached a score.
This post maps where that happens — across the full risk adjustment lifecycle — and what the current regulatory environment means for each gap.
The Four Gaps Where Risk Disappears
Gap 1: Siloed data
A suspect identified in prospective review never gets reconciled against what was actually submitted and accepted downstream. Claims, charts, and response files live in separate systems, so when an HCC falls through, it looks like a missed provider visit — not a missed handoff between programs.
The result: supported, documentable risk that existed in the data simply never reaches a score.
Gap 2: Rejection management prioritized by volume, not value
Worked at the claim level, every rejected encounter looks equal. But a rejection carrying the only instance of a high-value HCC is worth pursuing; one whose HCC is already accepted on another encounter is not.
Without visibility into which rejections carry unique, unduplicated HCC opportunity, teams spend effort on recoveries that move no risk.
Gap 3: RA-ineligible data never mined for suspects
Lab claims and other RA-ineligible data cannot be submitted for risk adjustment — but an A1c over 9 signals diabetes with complication; a low eGFR points to staged CKD. These are signals that a documentable, supportable diagnosis exists and is not yet captured.
Plans that mine only submittable claims never see them.
Gap 4: The provider documentation stage treated as a dead end
"It's the providers" is a conclusion, not a measurement. Provider documentation is one stage in a funnel — routing the suspect, addressing it at the visit, documenting to support the HCC, submitting, getting accepted are all distinct stages, and each one leaks.
Without closed-loop tracking, there is no way to distinguish between a suspect that was never routed, a visit where it wasn't addressed, and a diagnosis that wasn't documented. All three look identical from the outside.
What the May 2026 OIG Audit Found
HHS-OIG's May 2026 nationwide audit (A-02-23-01020) examined one specific high-risk pattern: acute-stroke diagnosis codes submitted on physician data records without a corresponding inpatient or outpatient hospital record in the same service year.
The findings were unambiguous:
For all 97 sampled enrollees, the medical records did not support the acute-stroke code submitted to CMS
In most cases, the records documented a history of stroke — a condition that correctly maps to no HCC — rather than an active acute event
554 MA organizations received increased risk-adjusted payments tied to these codes in payment year 2021
Estimated net overpayments: $461,958,186
The pattern is not confined to a legacy payment model. Of the 95 high-risk stroke codes reviewed in the audit, 91 also appear in CMS's updated payment model, currently in use. The miscoding recurs unless the underlying process is corrected.
OIG's recommended fix is a prepayment control — a CMS filter that prevents unsupported codes from being used in risk adjustment at submission rather than recovering overpayments after the fact. CMS has noted it will consider the report as it reviews diagnosis submission practices.
The 2025 Reconciliation Is Already in Your June 2026 Payment
While plans are preparing for 2027, the 2025 risk adjustment lifecycle has already closed — and the financial result landed in June 2026.
Per the February 26, 2026 HPMS memo, the final 2025 risk adjustment reconciliation is included in the June 2026 payment. Updated risk scores are based on diagnoses with dates of service from January 1, 2024 through December 31, 2024, submitted to CMS through March 6, 2026. The adjustments appear on the June 2026 Monthly Membership Report under two Adjustment Reason Codes:
ARC 25 — Part C Risk Adjustment Factor Change / Reconciliation
ARC 37 — Part D Risk Adjustment Factor Change
What that means in practice: every gap described above — the siloed suspect that never got reconciled, the rejection that wasn't prioritized, the ineligible-data signal that was never mined, the provider documentation stage that wasn't tracked — had until March 6, 2026 to be corrected. Anything that fell through those seams during service year 2024 is now reflected in June's numbers. There is no further submission window for that year.
The reconciliation payment is not just an accounting event. It is the final score for a closed lifecycle. Plans that review their ARC 25 and ARC 37 adjustments against their expected risk — and find the gap larger than anticipated — are seeing the cost of those operational seams in a single line item.
That gap is exactly what closes with a connected, end-to-end program. And for service year 2025, the equivalent window is still open — but not indefinitely.
The PY2027 Unlinked Chart Review Rule
The acute-stroke finding illustrates a coding accuracy problem. The 2027 rule change addresses a structural one.
Finalized in the CY2027 Rate Announcement: beginning with payment year 2027, diagnoses submitted from unlinked chart review records — chart reviews that are not tied back to a specific encounter by ICN — no longer count toward MA risk scores. The narrow exception covers members who switch between MA organizations during the plan year.
The implication is direct. Plans that rely heavily on unlinked chart review coding will see that accepted risk removed from their scores in 2027 unless it is re-anchored to an encounter before the deadline.
How a diagnosis is captured now carries direct payment consequences. A supported diagnosis submitted through an unlinked chart review and the same diagnosis anchored to an encounter produce different outcomes in 2027.
RADV Is Scaling Simultaneously
The unlinked chart review rule does not exist in isolation. Per CMS's own comments in the OIG audit report, RADV is expanding substantially:
From roughly 60 to over 500 MA contracts audited per payment year
Audit samples rising to up to 200 enrollees for the largest contracts
Advanced analytics being used to flag potentially unsupported diagnoses before record review
The stroke audit is an illustration of what RADV reviewers look for. Documentation must support the specific diagnosis submitted — not a related condition, not a historical one, not a diagnosis carried forward without a current-year face-to-face encounter. Full ICD-10-CM specificity and MEAT criteria apply.
At the scale CMS is now operating, the question for MA organizations is not whether an audit will occur, but whether the diagnoses that drive payment will hold up when it does. Every suspect HDM surfaces ties to its source chart and the encounter behind it — so what you recover holds up when an auditor asks.
What Operational Readiness Looks Like Now
Given the convergence of these changes, several questions deserve attention before 2027:
On unlinked chart reviews:
What share of currently accepted diagnoses came from unlinked CRRs?
Which can be re-anchored to an encounter, and within what timeframe?
Is there a workflow to route those diagnoses to linked submissions before the PY2027 cutoff?
On coding accuracy:
Are acute-stroke codes being reviewed against inpatient and outpatient hospital records before submission?
Do coding validation processes catch the distinction between acute-stroke diagnoses and history-of-stroke diagnoses?
On rejection management:
Is rejection prioritization based on unique HCC opportunity or claim count?
Are high-value unduplicated HCCs identified and routed before the risk adjustment submission deadline?
On suspect tracking:
Can your organization measure where suspects are lost between identification and CMS acceptance?
Is the provider documentation stage a visible, measured step or a narrative explanation?
The Common Thread
Each of these gaps is solvable in isolation. The challenge is that solving them in isolation is precisely what created them. Rejection management that doesn't see prospective suspects. Chart review that doesn't talk to encounter data. Provider outreach that doesn't feed back into submission tracking.
The four gaps, the OIG audit, the unlinked chart review rule, the RADV expansion, and the June 2026 reconciliation are different expressions of the same underlying problem: supported risk exists in the data, but the systems watching it each see only part of the picture.
The plans that close the gap between supported risk and accepted risk are the ones that treat risk adjustment as a connected lifecycle — not a collection of programs that happen to share a member population. A suspect identified in prospective review should be visible to the team managing rejections. A diagnosis accepted on an unlinked chart review should be automatically flagged when the rules change. A coding error that looks isolated in a sample of 97 is estimated to represent $462 million across a population of 240,401.
The plans that recover what they are legitimately owed — and keep it through an audit — are the ones that close those seams before regulators do it for them.
Health Data Max | June 2026 Category: Compliance, Oversight & OIG / CMS Actions
To learn more about how Health Data Max connects your risk adjustment programs into a single lifecycle view, contact us at sales@healthdatamax.com or visit healthdatamax.com/contact-us.