Could You Defend Every Diagnosis You Submit?

This August, a Florida physician group agreed to pay more than half a billion dollars to resolve False Claims Act allegations that it submitted Medicare Advantage diagnosis codes the medical record didn’t support. 

Weeks earlier, a physician practice management company resolved similar allegations. In both cases, the matters involved allegations only, with no admission or finding of liability. 

For most of the last decade, documentation gaps in physician group notes were a story about missed revenue. A condition the patient was treated for never made it into the note, so the risk score came in lower than it should have. Close the gap, recover the revenue. 

That story is still true. Unfortunately, it’s no longer the whole story.

What The Government is Saying

The allegations touch provider practices that are common in risk adjustment programs, which is why they’re worth reading closely. In the larger case, DOJ stated some codes reported rested on record amendments that weren’t timely, or that the treating provider didn’t initiate. In the other, DOJ says the management company pushed doctors to add unsupported codes, and that compensation was tied to the payments Medicare Advantage plans received. 

OIG’s guidance points the same way. In February, OIG issued new Medicare Advantage compliance guidance. 

It underscores ongoing scrutiny of chart review and health risk assessment practices aimed at optimizing reimbursement, as well as EHR and AI-generated prompts that may lead to the documentation of diagnoses not supported by the patient's clinical presentation and assessment. 

The guidance recommends plans should make risk adjustment a top priority when overseeing third parties and should have increased focus where providers or vendors are paid on risk adjustment data. The guidance is voluntary. It is also a preview of what audits will focus on.

What CMS and payers are doing

CMS is tightening what counts. Diagnoses from unlinked encounters are excluded from risk scores for 2026 dates of service. 

The risk with telehealth isn’t that a diagnosis was documented during an audio-only visit. The risk is whether the clinician could reliably establish and support the diagnosis without the physical findings or observations typically available in an in-person or audio-video visit. CMS still recognizes certain audio-only services, but a diagnosis must be clinically supportable whatever the format of the visit. 

CMS also announced in 2025 that it would audit all eligible Medicare Advantage contracts each payment year, and that it can extrapolate findings across a contract. The rules for extrapolating have been challenged in federal court. Expect this to be an evolving matter, but one that could have significant impact. Plan contracts often include audit rights and repayment terms. Be knowledgeable about yours. 

Payers, meanwhile, are putting numbers on it. In September, the Blue Cross Blue Shield Association estimated that hospitals’ growing use of AI-assisted billing tools added close to a billion dollars in excess costs to its system over two years, an estimate that drew national coverage. 

The analysis was limited to inpatient stays, not physician practices, and represents the viewpoint of a payer, not a neutral third-party evaluation.

But the association says it plans further research, including outpatient care, and the question being asked, whether coding went up without a change in care, is one every auditor should ask regarding additional diagnoses

The Trap

When a gap turns into exposure, the instinct is to do more to remedy what got you there: more prompts, more reviews, more AI to find what’s missing. Some of that helps. 

While identifying additional diagnoses can improve accuracy and the clinical picture, a program built primarily for diagnosis capture or not validity, increases its risk whenever the documentation fails to support the conditions identified. 

In 2024, a Colorado health system paid more than $20 million to resolve allegations that a billing rule automatically assigned the highest emergency department level to qualifying visits, even though coders had raised concerns regarding accuracy. The government didn’t label this as AI, but it is a reflection of automation. Although this involved hospital claims, not risk adjustment, comparisons can be drawn. The lesson learned is this: any rule, prompt or tool that sets a code assignment must be checked against the standard it’s supposed to follow. 

None of this is about capturing less. It’s about capturing what’s real and being able to validate it

The Question for Leadership

The real test is simple: if a payer or CMS auditor selected any risk-adjusting diagnosis, could you immediately demonstrate the visit, the provider responsible, and the clinical documentation supporting it? 

Defensible documentation isn’t a slogan. It’s a necessity. Can you be tested and pass without scrutiny?

Six questions will tell you most of what you need to know…

1. Can every risk-adjusting diagnosis be traced to a visit that counts?

A qualifying encounter, a provider who can diagnose, and documentation that supports the condition, not just mentions it. OIG’s guidance says submitted diagnoses should be documented in the medical record as the result of a face-to-face visit. A diagnosis that exists only on a problem list won’t hold up the way it used to. 

2. Who has the authority to modify the documentation, what safeguards are in place for review and validation of the diagnoses or conditions flagged by the technology?

A prompt, a scribe, an algorithm or a back-office reviewer can suggest a diagnosis. The treating provider has to evaluate it and document appropriately, and the record should show the care provided. The allegations this summer show what it looks like when that step is missing: changes that weren’t timely or that the provider who saw the patient didn’t make. A click-through isn’t a validation check.

3. Are your queries clear and compliant?

A query should ask for clinical clarity, not for a particular answer. It should reach the provider while the visit is still open and be specific enough to answer in a minute. 

Every query requires time and attention from a provider, so simply generating more queries is not a sustainable strategy.

4. How are vendors and internal teams compensated?

The OIG tells plans to look harder where providers and vendors are paid on risk adjustment data, and one of this summer’s settlements involved a company whose pay was tied to plan payments.

Compensation models can introduce risk if they create perceived or actual incentives to maximize reimbursement. Organizations should routinely review contractual arrangements, performance metrics, and oversight mechanisms to ensure incentives support compliant documentation, coding, and risk adjustment practices while minimizing audit and regulatory exposure. 

5. Do you know where you’re exposed?

Risk can be assessed by clinic, specialty, or individual provider. Review whether diagnoses were added after the visit, and by whom. What do your Medicare Advantage contracts say about audit rights, repayment and certification? Most groups can tell you whether the risk score changed. Fewer can tell you which diagnoses would survive an audit.

6. Who owns the answer?

Coding owns the final code assignment. Compliance owns the rules. Quality owns the measures. Practice operations owns the schedule. Providers own the visit note. A committee can coordinate the program. It can’t be accountable for whether the answer to the first five questions is yes. Someone has to understand the whole path, from the schedule to the claim, and own the outcome. Who is that at your organization?

What This Means for Those Assuming the Risk

For health systems and provider groups participating in Medicare Advantage risk, the stakes are higher. Cleveland Clinic’s CFO has described the gamble this way: with the system taking on delegated premium, thorough documentation of patient acuity is what lines premiums up with the cost of care. He also acknowledged “a lot of ifs in that equation.” 

Documentation is the revenue line. If it can't be defended, neither can the dollars behind it.

Where to start

If you paused before responding to any of these questions, now is the time to align resources and understanding. UASI’s mid-revenue cycle experts help physician groups and health systems find where gaps in documentation exist and where documentation wouldn’t hold up against audit, fix the process and ownership behind it, and, when it makes sense, run the function. Talk to us about what a review would look like or start with Assess my program.

About the Author

Autumn Reiter, MBA, BSN, RN, CCDS, CCDS-O, CDIP, CCS

Chief Strategy and Solutions Officer at UASI

A registered nurse with 20 years of experience and a BSN from Virginia Commonwealth University, Autumn began her career as a CDI specialist and has spent more than a decade building and leading CDI programs at scale. At CorroHealth, she advanced from Director of Clinical Documentation Improvement to Vice President of CDI Services and Tech Enablement and, most recently, Senior Vice President of Payment Integrity and Provider Risk Strategies. Now Chief Strategy and Solutions Officer at UASI, she pairs frontline CDI insight with the business perspective of an MBA from Western Governors University, helping healthcare organizations strengthen documentation accuracy, protect revenue integrity, and connect clinical care to financial performance.