Medicare Advantage Risk Adjustment Payment Authority Failure Through Diagnosis Codes Added to Patient Records Without Clinical Basis

Medicare Advantage is the privatized alternative to traditional Medicare, covering more than half of all Medicare-eligible beneficiaries in 2025. The government pays private health plans a fixed monthly capitation amount per enrollee, adjusted for the enrollee's health risk score. Risk scores are calculated from diagnosis codes submitted by the plan — codes that represent conditions the enrollee has been documented as having. A higher risk score produces a higher monthly payment. The financial incentive is structural: plans that document more conditions for their enrollees receive more money, regardless of whether those enrollees actually use more medical care.

To receive a diagnosis code for risk adjustment purposes, a condition must be documented by a treating clinician as having been addressed, evaluated, or monitored during a clinical encounter. CMS requires that codes reflect conditions that are present and relevant to the patient's care. The diagnosis code, submitted to the risk adjustment system, is the credential that authorizes the additional payment. CMS does not independently verify the clinical encounter that produced the code at the point of payment. The payment follows the submitted code.

The Department of Justice alleged that Kaiser Permanente affiliates engaged in a widespread, coordinated scheme from 2009 through 2018 in which physicians in California and Colorado were pressured to add diagnosis codes to patient records after clinical encounters had concluded. The alleged methods included retrospective chart reviews in which coders and physicians were organized to work through lists of past patient records and add diagnostic codes; public rankings of physicians and facilities that identified those not generating sufficient coding additions as underperforming; and financial incentives — including executive bonuses — tied to meeting risk-adjustment coding targets.

Whistleblower Ronda Osinek, who trained physicians on medical coding guidelines, filed her case in August 2013. She alleged that Kaiser inflated claims by having doctors amend patient files, often months after visits, to add diagnoses that were not treated at the time or did not exist. She reported to Kaiser executives that more than half of physicians had told her they felt pressured to upcode. The DOJ alleged that Kaiser officials knew the practices were widespread and unlawful but ignored internal warnings and red flags. Approximately half a million diagnosis codes were alleged to be invalid. The DOJ estimated Kaiser earned approximately $1 billion from the conduct over the nine-year period. The $556 million settlement, announced January 14, 2026, is the largest FCA resolution in history involving Medicare Advantage risk-adjustment fraud.

The diagnosis code functions as a transfer credential in the Medicare Advantage payment system. It asserts that a condition was identified, documented, and addressed by a treating clinician at a clinical encounter. CMS accepts the submission and adjusts the capitation payment accordingly. The payment transfer follows the credential. CMS does not verify, at the point of payment, whether the clinical encounter that produced the code occurred as documented, whether the condition was actually addressed, or whether the code reflects the patient's condition as assessed by the treating physician rather than added retrospectively by a revenue-cycle process.

The evidentiary boundary that the diagnosis code is understood to represent — a clinically verified condition, documented at an encounter, by the treating physician — is not encoded in the credential itself. The code is a string of characters that maps to a condition description. It does not carry within it the record of when it was added, by whom, on what clinical basis, or whether it reflects what the physician observed and addressed or what a coder added afterward. The relying party — CMS — supplies that meaning at the point of payment. It is inferred. The payment follows the inference.

This case is not an isolated instance of coding error. It is the enforced surface of a structural condition that MedPAC has documented across the Medicare Advantage program at a scale of $40 billion annually. The same financial incentive — higher payment for higher risk scores, no independent verification of the clinical basis for the submitted codes at the point of payment — operates across every Medicare Advantage organization. Kaiser is the largest named enforcement action. The condition it illustrates is not unique to Kaiser.

The $556 million settlement resolved the FCA allegations without admission of liability. Kaiser stated it settled to avoid the delay, uncertainty, and cost of prolonged litigation, and noted that other health plans had faced similar government scrutiny. Whistleblowers Osinek and Taylor received $95 million combined under the FCA's qui tam provisions. DOJ and HHS-OIG have continued enforcement activity against other MA plans, with UnitedHealth Group under Senate investigation for risk-adjustment gaming as of January 2026. CMS has expanded its Risk Adjustment Data Validation audit program and is implementing a new risk adjustment model (V28) that reduced estimated excess MA payments from $84 billion in 2025 to a projected $76 billion in 2026. The coding intensity adjustment applied to all plans remains at 5.9 percent — well below the estimated 16 percent excess coding intensity in 2025 — and has not been increased despite MedPAC's repeated recommendations to do so.