F.W.A: Straight Outta’ D.C. Is CMS about to get even tougher on Fraud, Waste and Abuse?

By now you have probably seen Yulan Egan’s excellent breakdown of a huge slate of potential changes to healthcare, courtesy of the (One Big Beautiful) Bill passed by the US House of Representatives on May 22nd. Between the lines of those details there is a lot that should keep hospital finance and health plan leaders up at night. From uninsured rates re-approaching pre-ACA levels, to the likely flow on effect of worsening health outcomes due to diminished primary care utilization, ED volume growth, a higher burden of observation/inpatient admit decisions and UR along with a likely rise in charity care and bad debt requirements. And as always that burden won’t spread evenly. For example: smaller community and rural hospitals are likely to be squeezed harder than their larger, urban counterparts. (Boy did the paragraph above get dark, faster than I expected when I first sat down to write. I’ll try to keep it lighter from here on out, promise).

However, what appears to have slipped through to the catcher (or keeper if you’re more of a cricket enthusiast) were two announcements from the OIG and CMS that merely pile on the likely financial hits coming to payers and providers in the near future. The first – via CMS - was related to impending audits for Medicare Advantage plans; while the second – via the OIG - indicates the agency appears ready to fire up several rounds of audits targeting Medicare inpatient payments.  Given the recent statement by CMS administrator Mehmet Oz that “We are committed to crushing fraud, waste and abuse across all federal healthcare programs”, neither of these announcements should come as a huge surprise. 

However, the difficult news for hospitals and health plans is that both sets of changes have large financial implications tied to them, along with the potential for a significant operational burden and some associated ripple effects. Let’s jump in and review.

Fraud, Waste and Abuse item 1: CMS leaving no stones unturned on Medicare Advantage (MA) audits.

We lead off with easily the biggest recent update from CMS on May 21 as the agency announced a muscled-up shift in its philosophical approach to MA audits that echoes this administration’s refocus on Fraud, Waste and Abuse. If it were a movie, it’d be titled: “Faster and More Furious”.  The agency estimates it could be overpaying MA plans to the tune of $43 billion per year - with obvious implications for the Medicare HI Trust Fund – and is planning a sprint to the end of 2026 to get the backlog down to zero.  For those less familiar with how MA monitoring works: CMS routinely conducts what are known as risk adjustment data validation (RADV) audits, to ensure CMS is paying plans commensurate with the patient’s documented severity of illness.  It turns out, after several years of falling behind on RADVs, that CMS intends to make serious headway on that large backlog, with a level of aggressive investment not commonly seen in Federal Government.

However, the really interesting part of the announcement is not just the speed of action, it’s how the agency is planning to make up ground.  CMS is proposing a three-pronged approach: using AI to automate MA case reviews; going on a hiring binge that seeks to grow the government’s coder/auditor workforce from 40 to 2000 by September 2025 (Yes, you read that right, a near 5000% increase in staffing in 3 months) and intentions to audit ALL 550 MA plans nationally by examining up to 200 records per plan.  OIG will also partner with CMS to go after any overpayments found throughout the audit process. 

Plans and providers in regions with the highest ratios of Medicare Advantage patients likely to be disproportionately impacted.

While on the surface this seems like an initiative that could have MA plans quaking in their boots due to the potential financial liability associated with audits – yet another signal that Trump 2.0 isn’t offering quite as much MA relief as was originally anticipated - (see my colleague Jordan Petersen’s excellent recent round-up of health plan financial performance for a more detailed take) there is zero chance providers go unscathed, either operationally (more on that below) or financially, in this nook and cranny search to claw back dollars.  Further, if CMS does find evidence of substantial overpayment, one can only wonder how fast the ripple effect will impact providers when payers find themselves on the short end of the audit stick.  It’s important to remember that many of these payer organizations are for-profit entities. As we saw in plain-English as part of the case filed against United Healthcare by its own shareholders (withdrawn as of April 16, 2025) squeezing the profit balloon at one end often leads to a ratcheting up of denials on the other, as payers redistribute their financial challenges onto health systems and providers.  Thus, it wouldn’t be surprising if providers find themselves requiring a “golden dome” level defense system to offset a fresh wave of denials on the MA and commercial side payers look to balance the books. 

Operationally there are some big unknowns here. CMS followed up with an FAQ on May 30th that opens doors to further questions around how it'll conduct sampling and confidence intervals that could have some significant implications for impact and aggression of recovery rates.

As my buddy, and MA doyen, Jason Jobes asserts, the OIG’s plan to scale up audits really positions coders and CDI professionals as critical cogs in the reimbursement machine given their roles directly tie to meaningful dollars for a provider organization.  Here's the operational part I referred to earlier: Health systems are going to need to pay even closer attention to elements such as diagnosis accuracy via progress notes (important for contracting) and documentation around treatment rationale to ensure clarity in the case of a potential CMS audit, while simultaneously doubling down on loss-preventing educational efforts to ensure documentation and risk adjustment coding aligns with RADV audit approaches.  Given that, now may be a good time for providers to re-examine staffing needs and appropriate technology options to support an almost certain increase in workload. And if you've been following challenges with provider-side labor in recent years, you'll know that may be easier said than done.

Two closing thoughts on MA audits for now. First: Could the requests for provider’s medical records end up being a trojan horse? That may sound like an odd idea to pose but several people I've spoken with in the MA consulting space are watching this closely. Obviously, CMS’s audits will require access to medical record-level detail.  Records could be transmitted as a scanned file, or by “plugging-in” payers to the provider via EHR integration to facilitate faster and more comprehensive access.  Both options have downsides from a provider standpoint.  Should a provider choose to extract PDF files, we’re talking about a potentially substantial manual burden, depending on the volume of records being requested.  However, if a payer desires more streamlined access into the provider’s system via EHR integration, questions arise as to whether such visibility ultimately gives payers an upper hand with insight that ultimately leads to more denials in future.

Second: These audits, and the associated heightened scrutiny, have the potential to reshape relations between the plans and the providers where shared savings are concerned.  If CMS ultimately determines repayment is required by an MA plan based on a review of provider documentation, what is the payer response? Do they look to recoup payments (like shared savings) from the provider?  And (how) does that re-align the payer-provider partnership in the future?  Could this be another straw on the camel’s back, amping up the trend of providers taking a hard look at dropping more MA plans?

Watch this space…

Are hospital stays about to be put under the microscope?

The second major release on the compliance docket came from the OIG on May 25th announcing intentions to audit hospitals for “upcoding” inpatient stays and ensuring appropriate interpretation of the two-midnight policy.  CMS estimates a combined $7.8B in opportunity tied to compliance. However, unlike the MA announcement this is where things get a little bit…peculiar? What makes these OIG enforcement recommendations odd is that the agency seemingly exhumed analyses from several years ago, coupled with recommendations that CMS wasn’t fully onboard with at the time and declined to enforce.  So, what’s going on here? Are hospitals at risk for a fresh round of RAC-related audits as the federal government looks for additional savings to pursue? It seems like that could be the case. Let's dig into the potential enforcement actions, and the implications for providers.

OIG estimates over $9B cost-savings, based on its analysis of historical Medicare fee-for-service hospital payments

Potential Fraud, Waste and Abuse item 2: Could a fresh round of scrutiny on hospital inpatient CC/MCC status be in play?

CMS’s report specifically called out a $5B savings opportunity if the agency ensured that inpatient stays are appropriately billed at the right complication and comorbidity level.  What does that mean you ask?  Glad you did! First a quick primer on what an MS-DRG is and how it may be “inappropriately billed”.

A diagnosis related group (DRG or MS-DRG for Medicare Severity Adjusted DRGs) is a grouping mechanism that enables hospitals to explain the services received and severity of illness of an inpatient, so that payers can reimburse appropriately.  MS-DRGs typically consider elements such as the patient’s sex, age, main diagnosis plus any additional relevant diagnoses or complications, and services received, translated into ICD-10 codes which ultimately map to a specific (MS) DRG.  DRGs may also be organized into different levels (doublets or triplets) to account for case complexity.  The sicker or more complex the case, the higher the reimbursement from the payer to cover the cost of care.  (For a visual illustration of how this works at a high level, check the graphic below).

Example of differences in inpatient reimbursements for AMI patient under two distinct MS-DRG "triplets"

So, what'd the OIG find? The retrospective analysis looked at inpatient stays between 2014 and 2019, to understand if upcoding was evident before the pandemic.  The agency’s assessment was “YES”. Nearly half of the $109.8 billion that Medicare spent on inpatient hospital stays in FY 2019 was for stays at the highest severity level (again those are the highest paying MCC status patients) but there had been steady growth in patients coded as MCC over the prior 5 years with a commensurate decline in both the low and medium severity admissions. 

Here’s where the OIG intimated that things start to get “fishy” (not official terminology). Despite patients seemingly getting sicker, the average patient length of stay (ALOS) remained relatively unchanged during that same time. The OIG implied that such a finding wouldn’t be expected.  Further, around 30% of the highest severity stays were “short”, meaning those stays were at least 20% shorter than the ALOS for the same MS-DRG-severity tier. Analysis also revealed that these high severity, low LOS cases were often driven by a single diagnosis code – meaning the presence of one diagnosis code in the medical record - was responsible for driving the case into the highest severity tier.   Last, there was a significant concentration of these cases observed at a subset of hospitals with “5 percent of hospitals billing between 80 and 100 percent of their stays at the highest severity level with only one major complication.” 

Case types called out in OIG report as being high frequency, CC or MCC MS-DRGs

The OIG’s assertion is, effectively: Hey, some of y’all’s hospitals are telling us you’re treating the sickest patients out there, and you clearly know how to code them as severely ill, but there is evidence to indicate that at least some of these patients aren’t as severe as you’re suggesting, based on length-of-stay. (And, by the way, if you’re doing this, we know who you are.)

When the OIG initially delivered its report back in Q1 of 2021, it recommended CMS increase oversight and direct the Recovery Audit Contractors (RACs) to perform targeted reviews of providers to determine specific instances of upcoding. However, CMS did not concur with the findings, responding that there was not sufficient proof of upcoding.  And yet, we now find ourselves in 2025 with the OIG re-surfacing reports and spruiking significant savings opportunities tied to upcoding, with the report status listed as “Open and Unimplemented”. 

Again, watch this space…

Potential Fraud, Waste and Abuse item 3: Will CMS’ re-focus on 2 midnights be an additional opportunity for substantial reimbursement claw backs?

The OIG’s second recommendation to CMS for Spring 2025 was to strengthen oversight of the “2-midnight” rule. The agency may have employed the wayback machine, referencing a 2016 report that evaluated the rule’s effectiveness after its 2014 implementation, and highlighting that enhanced oversight of hospital billing under the 2-midnight policy could yield an estimated $2.9 billion in savings.

For those less familiar, the two midnights policy was introduced by CMS for FY 2014 as a mechanism to offset a rise in extended outpatient stays, along with various negative financial implications for patients finding themselves in observation, especially under rules around post-acute care coverage. The policy was an effort to assist physician decision making on Part A admissions, by clarifying that a physician’s expectation of a two midnight stay, would generally qualify a patient for inpatient status (and coverage). For patients not expected to stay “2-midnights” observation (outpatient status) was recommended, pending further patient evaluation or change in status.

The OIG’s study highlighted three points of exposure under the rule;  First, hospitals billed nearly $3B of short inpatient visits in FY 2014; Second, CMS found a significant amount of long observation stays, despite comparable diagnostic profiles to admitted patients. Third, the long-stay observation patients had to pay more out-of-pocket and experienced reduced access to skilled nursing, due to the CMS 3-day coverage rules.  Perhaps not surprisingly, the agency also observed marked variation in the use of observation status across hospitals.

As you might expect, the OIGs recommendations for CMS were to perform routine analytics to understand which hospitals were inappropriately applying the two-midnight policy, and then to go ahead and audit them. Further the agency directed CMS to figure out ways to insulate patients from financial and SNF coverage shortfalls, given the potential for such gaps if those patients were inappropriately held as a long stay observation case.

Wrap up thoughts (for now)

It's an interesting time in D.C. as discussions around budget continue to swirl while the administration's laser-like focus on F.W.A seeks out low-hanging fruit in healthcare spending. And while some newer efforts include hot-button issues like MA reimbursement, don't be surprised to see additional lifting-of -couch-cushion examples, as OIG/CMS seeks savings from past issues that went unresolved.  We'll be watching especially closely for any ripple effect(s) that such changes could have on interactions between payers and providers as the balloon is seemingly squeezed further at both ends for two players already facing a challenging financial outlook in 2025.

Until next time, I bid you adieu.

Curious about key challenges for revenue cycle leaders? Join our upcoming board briefing June 26 at 1pm Eastern where Yulan Egan and Eric Fontana will break down what you need to know from our in-progress research.

----------This webinar will be open for members and non-members-----------

If you'd like to learn more about access to Union Healthcare's expert insight schedule time with us to learn more about how to join, and what's included in membership: https://www.unionhealthcareinsight.com/overview.