Medicare pays private insurers more when their members are sicker. So insurers got very good at finding diseases, to the tune of $84 billion in 2025 alone.
Eighty-four billion dollars. That is what private Medicare Advantage plans will collect from CMS in 2025 above what it would have cost to cover the same beneficiaries directly through traditional fee-for-service Medicare. The estimate is not from a partisan think tank or a plaintiff's expert. It comes from MedPAC, the independent commission whose statutory job is telling Congress how much Medicare is overpaying for things.
The number is roughly what NASA spent in 2025 on all of its science. It is more than the federal government spent that year on housing assistance for low-income households. The cumulative ten-year overpayment, on MedPAC's trajectory, is about $1.2 trillion through 2034, of which roughly $520 billion comes out of the Medicare Hospital Insurance Trust Fund and another $220 billion shows up as higher Part B premiums for everyone, including the 46% of Medicare beneficiaries still in traditional Medicare.
If $84 billion were attributable to one identifiable bad actor, it would lead the evening news. It is, instead, a steady-state feature of how the program works.
The mechanics are simple enough to explain at a dinner party and outrageous enough that no one would believe you.
Medicare Advantage pays plans a fixed monthly amount per enrollee. That amount depends on three things: a county-level benchmark (set by CMS based on local fee-for-service costs), the insurer's bid (what it says it can do Part A and Part B for), and a multiplier called the Risk Adjustment Factor.
The Risk Adjustment Factor is where it gets interesting. The whole point of risk adjustment is to make sure plans don't only enroll the healthy. Without it, an insurer's most profitable strategy would be to advertise heavily at the gym and never at the dialysis clinic. So CMS pays plans more for sicker enrollees. A 75-year-old woman with no chronic conditions might generate roughly $9,000 a year in base payment. The same woman with diabetic complications, congestive heart failure, and major depression might generate twice that. The diagnoses are the difference.
Each diagnosis maps, via ICD-10 codes, into one of approximately 115 Hierarchical Condition Categories — HCCs. Each HCC carries a coefficient. Each coefficient gets multiplied through to additional payment. The approximate annual dollar values per condition look something like this:
For a CMS payment to be valid, the underlying diagnosis must come from a face-to-face encounter with an "acceptable provider type" and the documentation must satisfy what the industry calls the MEAT criteria — Monitor, Evaluate, Assess, Treat. Plans annually attest in writing to CMS that their submitted data is "accurate, complete, and truthful." That attestation is the predicate for nearly every False Claims Act case in this space.
Plans have two industrial-scale ways of finding more diagnoses. The first is the chart review. The second is the in-home Health Risk Assessment. Both are things CMS technically permits. Both are things HHS-OIG, MedPAC, and DOJ have spent the better part of a decade describing as the principal source of overpayment.
A chart review is exactly what it sounds like: the plan hires a vendor (or runs an internal team) to comb through medical records after the visit, looking for diagnosis codes the treating physician didn't bill. If the chart says the patient has diabetic retinopathy but the doctor only billed "diabetes without complications," the plan can submit the richer code and collect the larger HCC payment. CMS allows this. What the government's enforcement record alleges, again and again, is that plans run these reviews one-way: they keep the codes that pay more, ignore the codes that should be deleted, and don't tell CMS when the records didn't actually support the original codes.
The in-home Health Risk Assessment is the more theatrical version. Plans contract with companies that send nurses or NPs to enrollees' homes for a 30–60 minute visit. The clinician runs through a long checklist. The patient (often paid in gift cards for participating) gets a thank-you and a follow-up referral that frequently never happens. The plan, meanwhile, ends up with a long list of newly captured diagnoses to submit to CMS.
HHS-OIG has spent two reports counting the bill. In its October 2024 update report, OIG found that in 2023 alone, $7.5 billion in MA risk-adjusted payments came from diagnoses reported only on HRAs or HRA-linked chart reviews, meaning no other clinical encounter in the patient's record supported them. Twenty insurance companies generated 80% of that. UnitedHealth Group and Humana alone accounted for roughly $5.4 billion. CMS itself estimates the MA program's "improper payment rate" runs around 9.5%; HHS Inspector General Christi Grimm has said that of 17 OIG audits since 2019, nearly 69% of risk-adjustment diagnoses sampled were unsupported by the medical record.
In July 2024 the Wall Street Journal began publishing what it called the "Medicare Inc." series. Reporters Christopher Weaver, Tom McGinty, Anna Wilde Mathews, and Mark Maremont obtained a CMS data agreement covering 1.6 billion Medicare diagnoses from 2015 through 2022, and started running the numbers. The series was a 2025 Pulitzer finalist for Investigative Reporting.
The headline finding: between 2018 and 2021, Medicare Advantage plans collected an estimated $50 billion in payments tied to diagnoses added by insurers (never by the patient's actual treating doctor) for which patients received no follow-up treatment.
The examples were striking on their own. WSJ identified about 18,000 MA enrollees who received an HIV diagnosis only from their insurer. Among them, only 17% received any HIV-related treatment in the following year: antiviral drugs, specialist visits, or even repeat testing. Among MA enrollees diagnosed with HIV by their physician, 92% did. Each insurer-added HIV diagnosis was worth roughly $3,000 a year in additional federal payments.
Diabetic cataracts followed a similar pattern. WSJ found that members of one large insurer were 15 times more likely to have the diagnosis than traditional Medicare patients in the same demographic. Each diabetic-cataract diagnosis added an estimated $2,700 a year in MA payment. The Congressional Budget Office has estimated that ending Medicare Advantage payments tied to home-visit-only diagnoses would save roughly $124 billion over a decade.
None of this, on its face, is fraud. CMS allows chart reviews. CMS allows in-home HRAs. The illegal version is not the practice. It's the false attestation. When a plan certifies that the underlying records support its submitted diagnoses and they don't, the False Claims Act gets involved.
The following companies and individuals are referenced because they are the subjects of specific, publicly filed U.S. government enforcement actions. None of the civil settlements include admissions of liability.
Kaiser Permanente affiliates ($556 million, January 14, 2026). The largest Medicare Advantage risk-adjustment FCA settlement on record. Five Kaiser entities — Kaiser Foundation Health Plan, Kaiser FHP Colorado, the Permanente Medical Group, the Southern California Permanente Medical Group, and the Colorado Permanente Medical Group — agreed to pay $556 million to resolve allegations that, between 2009 and 2018, the organization pressured physicians to add diagnoses to medical records months after the patient encounters, in what relators alleged were known internally as "addenda," "dash for cash," and "coding parties." Approximately 500,000 added diagnoses generated about $1 billion in MA payments, the government alleged. Kaiser made no admission.
The Cigna Group ($172.3 million, September 2023). The Cigna Group agreed to pay $172.3 million to resolve allegations spanning three federal districts. About $37 million covered Cigna's "360 Program," in which (the government alleged) nurse practitioners diagnosed conditions without ordering tests or initiating treatment. About $115.8 million covered one-way chart reviews. About $19.5 million covered morbid-obesity diagnoses without supporting BMI documentation. Cigna entered a five-year Corporate Integrity Agreement with HHS-OIG. No admission of liability.
Aetna Inc. / CVS Health ($117.7 million, March 2026). Aetna agreed to pay $117.7 million: $106.2 million for chart-review-driven diagnoses generally and $11.5 million specifically for unsupported morbid obesity codes between 2018 and 2023. Among the alleged conduct: a chart-review program that flagged unsupported codes and submitted only the codes that increased risk scores. No admission.
Independent Health Association ($98 million, December 2024). The Buffalo-based plan and a former executive, Betsy Gaffney, agreed to pay up to $98 million after a twelve-year qui tam case. Independent Health's coding subsidiary, DxID, was alleged to have submitted unsupported diagnoses. Gaffney personally paid $2 million; the plan paid the rest contingent on financial milestones. No admission.
DaVita Medical Holdings / HealthCare Partners ($270 million, October 2018). DaVita agreed to pay $270 million following self-disclosure of certain coding-guidance practices and a parallel relator suit alleging one-way chart reviews. The largest MA FCA settlement against a provider organization at the time. No admission.
Sutter Health ($90 million, August 2021). The Northern California system paid $90 million to resolve allegations of submitting unsupported risk-adjustment diagnoses and failing to take corrective action when alerted. Five-year Corporate Integrity Agreement. No admission.
Freedom Health / Optimum Healthcare ($32.5 million, May 2017). The Florida-based plans and former COO Siddhartha Pagidipati paid $32.5 million ($31.7M from the entities, $750K from Pagidipati personally). Allegations: inflated risk scores via unsupported codes plus network-adequacy misrepresentations. Five-year CIA. No admission.
The next tier of cases is the active named litigation, meaning DOJ has filed publicly but no settlement has been reached. Two are worth flagging precisely.
U.S. ex rel. Poehling v. UnitedHealth Group, No. 16-cv-08697 (C.D. Cal.), is the longest-running MA upcoding case. DOJ intervened in 2017 alleging approximately $2.1 billion in overpayments tied to provider-submitted codes that conflicted with codes UnitedHealth's chart-review program had assigned. In March 2025, Special Master Suzanne Segal recommended summary judgment for UnitedHealth, finding (among other things) that DOJ had not actually reviewed the underlying medical records and that UnitedHealth had disclosed its chart-review practices to CMS at an April 2014 meeting, the "opposite of concealment." The government filed objections. As of April 2026, District Judge Fernando Olguin's ruling on the objection is pending. UnitedHealth has denied wrongdoing throughout.
U.S. v. Anthem, Inc. (now Elevance Health), filed March 2020 in the Southern District of New York, alleges that Elevance's chart-review program generated more than $100 million annually in additional MA revenue through one-sided code submission. Fact discovery is set to close June 30, 2026; expert discovery March 8, 2027. A settlement conference in October 2025 did not produce a resolution.
Separately, in July 2025, UnitedHealth Group's 8-K filing disclosed that the company had voluntarily reached out to DOJ following media reports and was complying with formal criminal and civil document requests regarding its MA practices. As of April 2026, the investigation is reportedly active. A criminal prosecution of an MA insurer would be the first in the program's history.
One criminal case has produced a conviction: Dr. Isaac Thompson, a South Florida primary-care physician, pled guilty in 2016 and was sentenced to 46 months in prison plus approximately $2.1 million in restitution after diagnosing 387 of his MA patients with ankylosing spondylitis (a rare spinal condition) to inflate his capitation. A second criminal case, against Kenia Valle Boza, the former director of risk-adjustment analytics at HealthSun Health Plans, ended differently: a federal jury acquitted her in June 2025 after roughly four hours of deliberation. HealthSun's parent (Elevance) had self-disclosed and repaid $53 million; DOJ declined to prosecute the corporate entity.
The settlements above are reported because the underlying allegations and resolutions are public. None of them includes an admission of wrongdoing. Several of the named plans operate large, generally compliant Medicare Advantage businesses, and the conduct alleged is bounded to specific business units, time periods, and practices. High Medicare Advantage enrollment, high risk scores, or aggressive but lawful coding practices are not, by themselves, evidence of fraud, and the plans not named in active enforcement actions are not implicated here.
Then there is the RADV fight. RADV stands for Risk Adjustment Data Validation, and it is CMS's mechanism for going back and auditing whether plans' submitted diagnoses are actually supported by medical records. RADV audits have existed for years; what they have not done, historically, is recover much money, because they sample a few hundred records per audit and apply findings only to those records.
In February 2023, CMS finalized a long-pending rule that did two things. It eliminated a "fee-for-service adjuster" that had previously discounted audit findings (on the theory that traditional Medicare claims data also contains documentation errors). And it authorized CMS to extrapolate audit findings across an entire MA contract, retroactive to payment year 2018. A 10% error rate found in a 200-record sample could be applied to the entire population to compute recoveries. CMS estimated up to $4.7 billion in recoveries from the 2018 audit alone.
Humana sued in the Northern District of Texas. In September 2025, Chief Judge Reed O'Connor vacated the rule on Administrative Procedure Act grounds, finding that the final version was not a "logical outgrowth" of CMS's 2018 proposed version. CMS had swapped its empirical justification for a new actuarial-equivalence statutory argument without re-opening the comment period. CMS appealed in November 2025 to the Fifth Circuit. As of April 2026, the appeal is briefed but not argued. The cumulative audit liability for major plans hangs on the outcome.
The new CMS administrator, Dr. Mehmet Oz, has publicly described himself as "the new sheriff in town" on Medicare Advantage and has announced plans to audit every MA plan annually (up from roughly 60 plans prior) and to increase records reviewed per plan. That schedule is now contingent on whether the Fifth Circuit reinstates the extrapolation rule.
The companies in this story are some of the largest publicly traded healthcare companies in the United States. UnitedHealth Group, Humana, CVS Health (Aetna), Elevance Health, and Cigna together accounted for about 65% of all MA enrollment in 2025. Risk-adjustment growth shows up in their 10-K filings, in their MD&A discussions, and in their earnings calls. Elevance disclosed a $935 million reserve in Q1 2026 against a CMS regulatory dispute over risk-adjustment data submission. UnitedHealth's July 2025 8-K disclosure of the DOJ investigation moved the stock by single-digit billions.
The same companies appear in adjacent federal datasets. AHIP, the trade association, spent a record $13.3 million on federal lobbying in 2024 per OpenSecrets. Better Medicare Alliance, the MA-specific advocacy group, more than doubled its lobbying spend the year the RADV rule was finalized. Marilyn Tavenner, who ran CMS during the Obama administration, became AHIP's CEO in 2015. Andy Slavitt, a former Optum/UnitedHealth EVP, returned to government as CMS Acting Administrator the same year. None of that is illegal; all of it is in the public record.
How K3 did this: The analysis draws on MedPAC's March 2025 Report to Congress, HHS-OIG reports OEI-03-23-00380 (October 2024) and prior installments, DOJ Office of Public Affairs press releases for each named settlement, federal court dockets in C.D. Cal., S.D.N.Y., N.D. Cal., N.D. Tex., E.D. Pa., and W.D.N.Y., the Wall Street Journal's "Medicare Inc." investigative series, and SEC 10-K disclosures from publicly traded MA insurers. K3 Analytics runs FraudGraph, a cross-reference platform spanning 300+ federal datasets including NPPES provider records, Medicare Part B and Part D claims, federal court dockets via CourtListener, SEC filings, lobbying disclosures (LDA), FEC contributions, and DOJ press releases. The cross-reference, not the single datapoint, is what turns a CMS payment record into a provable enforcement pattern.
The Poehling ruling. District Judge Olguin's decision on the government's objection to the Special Master's recommendation will determine whether the longest-running MA FCA case proceeds to trial or is dismissed. The case has been pending in some form since 2011. A dismissal would significantly raise the bar for future government MA upcoding cases, particularly the burden of proof on materiality and the requirement to actually examine the underlying medical records.
The RADV appeal. The Fifth Circuit's decision in Humana v. Becerra will determine whether CMS can extrapolate audit recoveries, which is the difference between collecting $30 million per audit and collecting $3 billion per audit cycle. Roughly 550 MA contracts are theoretically auditable; CMS Administrator Oz has said he wants to audit all of them. The math is bounded above by what the appellate court permits.
The DOJ criminal investigation of UnitedHealth. Disclosed in the company's July 2025 8-K, the investigation is reportedly active. A criminal indictment of a major MA insurer would be the first in the program's history and would substantially recalibrate the cost of one-sided chart review across the industry.
The V28 phase-in. The CMS-HCC V28 risk-adjustment model is fully operational as of January 1, 2026. Compared to V24, it reduces coding-intensity-driven payment differentials by an estimated 8.8 percentage points (per MedPAC), saves the trust fund roughly $11 billion a year, and reduces the dollar value of about ten of the most-flagged HCCs. Plans have been warning investors of 5–17% revenue impact; the actual impact will be visible in 2026 financial filings.
Bottom line. $84 billion in 2025 overpayments, per MedPAC. $7.5 billion in 2023 from HRA-driven diagnoses with no follow-up care, per OIG. A $556 million Kaiser settlement in January 2026, the largest in the program's history. A $117.7 million Aetna settlement two months later. A vacated audit rule on appeal. An active DOJ criminal investigation of the country's largest insurer. The structural feature is twofold: Medicare pays plans more when members are sicker, and there is no cheap way to verify that the diagnoses match actual care. Until that changes (through V28's coefficient cuts, through extrapolation-based audits, or through enforcement that prices the cost of one-sided chart review high enough to deter it), the math will keep doing what it does.