Medicare Advantage in the Crosshairs: Risk Adjustment, the False Claims Act, and AI
Subscribe: Apple Podcasts | Spotify | Amazon Music | Android | Email | RSS | More
Kevin Chmura
Welcome to 1st Talk Compliance. I’m your host, Kevin Chmura, CEO of Panacea Healthcare Solutions. Today we’re digging into an area the Department of Justice and CMS have flagged as a top enforcement priority. Fraud in Medicare Advantage, which now covers more than half of all Medicare beneficiaries. We’ll walk through how risk adjustment creates an incentive to make patients appear even sicker than they are. Why the False Claims Act remains the government’s number one fraud fighting tool, and how AI is adding an entirely new layer of compliance risk.
To help us make sense of it all. I’m glad to welcome back Rachel Rose. Rachel is principal at Rachel V. Rose, Attorney at Law PLLC and holds a JD and MBA. She’s a published author whose practice sits at the intersection of healthcare compliance and cybersecurity with deep expertise and experience in False Claims Act litigation and whistleblower representation. The last point matters today. Rachel had a front row seat to one of the cases we’ll be discussing. She represented the whistleblower in a fraud case that resulted in a significant settlement. She brings firsthand insight into how these cases actually unfold and what providers can do to protect themselves and their practices.
Rachel, welcome back to the podcast.
Rachel Rose
Thank you, Kevin. Always great to be back.
Kevin Chmura
Great. So maybe we just start at the very top and lay down some background information for everybody, and then we’ll dive deeper into the topic. So basic question, how does Medicare Part C, otherwise known as Medicare Advantage, differ from Medicare Part A and B, you know, sort of traditional Medicare?
Rachel Rose
Great question and a foundational question at that. So for those who are in healthcare, Medicare Parts A&B are known as traditional Medicare and they came into being in 1965. Having said that, Part A deals with inpatient and facility care, where Part B deals with outpatient and outpatient services. And the way that the Government [a collaboration of sorts between CMS and Congress] sets the physician fee schedule every fall that typically becomes effective on January 1 of the impending year, has traditionally been a fee for service program. And if you recall, with the Affordable Care Act passage in 2010, we began to see some value-based programs as well, whether it was MIPS, whether it was value-based care, whether it was the reduction of infections. All of those types of programs are your typical methods for reimbursing. Again, Congress sets the physician fee schedule and Medicare then reimburses off of that typically. Now, if we look at Medicare Advantage, it’s also known as Medicare Part C, and it was quite a while before we saw Medicare Part C come into play. In fact, it was in the early 2000s. So if you think about the time span between 1965 and the early 2000s, we’re dealing with over 35 years. So that’s a pretty significant shift in terms of how Medicare was administered as well as options. Around the same time, as a side note, we also saw Medicare Part D, which is specific to prescription drugs come into play as well. So what is Medicare Advantage and how does it differ from the traditional Medicare Part A and Part B? Well, first, Medicare Advantage is private sector based. And basically, what it does is Medicare gives plans an agreed upon amount per plan enrollee in exchange for assuming financial risk and complying with program rules. So under traditional Medicare, one would elect to work directly with CMS. Under Medicare Advantage, it’s your third party plan such as Aetna, Cigna, Blue Cross, Blue Shield, Humana, et cetera, which are the conduits or the intermediaries for administering these Medicare Advantage plans. So unlike the fee for service, how in the physician fee schedule, which is how our traditional Medicare is reimbursed, under Part C, we’re looking at MA premiums, which are calculated on a geographic basis through a benchmark bid rebate formula. Additionally, there is a risk adjustment and a coding intensity for the Medicare Advantage plans. And risk adjustment, stated another way, is a method to calculate what to pay a health provider based on a patient’s health, their likely use of healthcare services and the cost of those services. And the risk score, which is generated, represents the predicated cost of treating a specific patient or group of patients compared to the average Medicare patient based on certain criteria.
Just to wrap that up, Kevin, before we go into the next question, basically, Medicare beneficiaries may opt out of our traditional Medicare. However, these Medicare Part C plans are required to offer the same coverage for goods. And when I say goods, I mean durable medical equipment and other types of items that are billed for as well as services. So how this all comes together is that in order to make the risk adjustment, CMX collects medical diagnosis codes from the Medicare Advantage organizations. And these diagnoses must be supported in the medical record, which any time a claim is submitted, whether it’s to a government payer or to a private insurer, you have to meet what’s known, and I know Panacea and First Healthcare Compliance deal with this all the time as medical necessity, as well as some other predicate items, including that initial face-to-face visit between a patient and a provider and having the required or affected patient care treatment or management at a particular visit for outpatient visits. So all of this to say this is another area that is ripe for potential fraud.
Kevin Chmura
Totally, totally. You know, my many, many years in revenue cycle, you know, there’s just mantras that you pick up and, you know, one of them is, you know, if it’s not in the medical record, it never happened, even if it did, and you better not bill for it, right? That’s just, just, just, just that simple. So, so, so,
Rachel Rose
Yeah, yeah.
Kevin Chmura
So, and now, based on latest statistics, I’ve seen more Medicare beneficiaries are in Medicare Advantage than in traditional Medicare. It’s 50-50 or even better at this point. It just speaks to the proliferation that started in the early 2000s. So, it is something, and yeah, and becomes an area of focus. So let’s dive into that a little bit because you touched on something that I think is where this starts to potentially hit people’s pocketbooks, if you will, right? So the US Department of Justice and CMS, they’re prioritizing Medicare Advantage fraud as a top priority.
Because it is ripe for the potential for fraud. So based on your experience, can you give me some insights into what specific areas of fraud that the government is looking at and seems to be interested in?
Rachel Rose
Sure, as a general matter, as you just articulated, Medicare Advantage is 1 area. Cybersecurity continues to be another hot area for the government in terms of Department of Justice and CMS priorities. Another area is basically your vanilla health care fraud, such as fraud, waste, and abuse violations, including those five areas that HHS OIG has espoused for years. And those five areas are the Federal False Claims Act, the Stark Law, the anti-kickback statute, civil monetary penalties, and exclusionary. Authorities, those are still in play in a very significant way. And as it relates to the aggressive risk adjustment enforcement and litigation, DOJ has expressly stated that it will continue to target risk adjustment practices coding intensity. So there is there upcoding? Is there a code that’s being rendered where there is no medical necessity that is documented? And then prior authorization abuses in MA plans. And prior authorization abuses really begin to weave in artificial intelligence and some of that area of software. So here you’re seeing the convergence potentially between the cybersecurity focus of the DOJ and CMS coupled with how that can play out with Medicare Advantage plans.
Kevin Chmura
Wow, yeah, that I don’t think it’s possible to do a healthcare podcast or a thought leadership article without at least touching on AI these days. It’s near impossible because the acceleration of the technology is brisk. And, you know, the thing we teach our auditors at Panacea relative to coding audits and what you really auditor coders are supposed to take the kind of revenue neutral, revenue agnostic way of looking at things, just code what you see. But the demands and the margin squeeze at providers is such that there’s a opportunity and the motivation to be aggressive. I don’t want to accuse anybody of fraud, but the motivation to be aggressive is there sometimes just for the survival of the practice. So it’s a tough one and so tough, tough stuff. So you touched on something that we’ve covered in the past. And so I think it’s good to dive into, and that’s the False Claims Act. Still the government’s number one fraud fighting tool, I’m sure. And, you know, moving into the real world now, there’s two notable False Claims Act.
Settlements involving Medicare Advantage, and those include a settlement with Kaiser and a group called Matrix, which I’ll let you tell us more about. Now, in the interest of disclosure, Rachel, you represented a whistleblower in the Matrix case. So this is great. We have firsthand front row visibility into this. So wondering if you could just tell us as much as you can, knowing that you participated in this. Can you provide some highlights of both the Kaiser and Matrix cases and settlements?
Rachel Rose
Absolutely. And before I delve into that, I just wanted to highlight something that you said, Kevin, about AI and how it’s utilized. There is a very significant trend among states to incorporate the requirements of a physician to review what is in the medical record before it’s signed off on. And as you know, when after a medical record is signed off and quote un quote closed, that’s when the claims process can begin. And in Texas, for example, in June of 2025, Governor Abbott signed into law a Texas Senate Bill, 1188. And what’s material about that and how that really plays a gatekeeping role in terms of False Claims Act and the use of AI is that the onus is on the physician or other medical provider who has the authority to sign off on a chart to review what’s in that chart for accuracy and make sure that everything is correct before it is submitted for a claim. If you think about AI and how it works, it basically is this huge data scraper. And by scraping data, it may in fact come up with wrong diagnoses, wrong codes, wrong notes. For example, what if someone took opioids 10 years ago and now through AI’s creativity, they now say this patient has substance use disorder. Well, just because you had opioid use as a result of a total hip replacement is a far leap to saying that the person has substance use disorder or opioid use disorder. Another item that’s very relevant is mental health care. And this lays the foundation into some of the items in the matrix case. AI, you can see how by having inaccurate. AI prompts that end up in the record. If someone had depression, say they note depression because a family member died or they were in a major car accident, or if you think about the number of people post-9-11, a lot of people had depression. It doesn’t mean that they’re manic depressive, it doesn’t mean that they have a history of psychotic disorders or anything like that. And so really for the provider, making sure that what AI is generating is in fact accurate for that particular patient is going to be very material, not only in terms of their own licensure, but also in terms of the claims that were submitted. So before I go into these cases, is there any question you have about that?
Kevin Chmura
No, but 100% a comment. I think that what we’re seeing now in our practices at Panacea and across revenue cycles especially, and it’s where it’s intersecting with compliance, is something you said, which is kind of AI never forgets and it tries to build on all knowledge it ever had. And I gave a story to some of the folks here that are working on some AI initiatives for us on the exact same thing. I had stitches on my knee in like the 3rd grade. And now at age 54, it really doesn’t factor into my any future medical diagnosis, AI would factor it in, right? And it’s not relevant anymore. And so it really speaks to the limitations of the technology and the need for governance when you start to adopt it. And it’s challenging because the ability to take cost out of the equation.
Rachel Rose
Correct. Correct.
Kevin Chmura
And an increased volume, and volume is important in a medical practice to maintain margins. It’s a, you know, there’s a tug and pull there, there’s a tug of war that is, that’s hard to ignore, really. So, and I have a feeling you and I will be talking over the next several years about specific both use cases and also problems relative to AI. I think that’s fair to say. We’ve got future content coming.
Rachel Rose
I would say that that is an apt prediction as to what is to come. So let me cycle back into these two cases because they are very material. First, I’ll lead with the Kaiser Permanente case. And in January of 2026, the DOJ announced that Kaiser and its affiliates would pay approximately $556 million to resolve allegations related to the submission of invalid diagnosis codes for their Medicare Advantage Plan enrollees in order to receive higher payments from the government. So if you think about Medicare Advantage fraud, that’s where that nexus really does come into play. And so here, as we mentioned at the outset, CMS pays MAOs more for sicker beneficiaries expected to incur higher health care costs and less for healthier beneficiaries expected to incur lower costs. So when I think of this, I remember my health law class at Vanderbilt with Professor Blumstein, and he analogized health care to car insurance. And it’s that same risk basket, right? What are the factors that are going into your pool? And some people are reckless drivers, some people are average drivers, and some people don’t go one mile an hour over the speed limit. That’s kind of the way I think of the… beneficiaries and how the Medicare Advantage model works. So how does this come into play with the risk adjustments? Well, CMS collects medical diagnoses codes, as we mentioned, and those diagnoses, again, must be supported by the medical record across a lot of fronts.
So in Kaiser, Kaiser owns and operates MAOs that offer Medicare Advantage plans to beneficiaries across the country. And to your point earlier, more than 50% of Medicare beneficiaries are in fact enrolled in the Medicare Advantage Plan. So by submitting claims and submitting data that is inflated or factually false, Medicare relies on the accuracy of that data and information submitted by the plans in order to ascertain what the reimbursement will be for the next year. So really the incentive is to have quote sicker patients and that’s why that AI factor is a very significant item to keep in the back of one’s mind too.
Since I did have the courtside seats to the Matrix case. The DOJ announced the settlement regarding Matrix Health Fair and Health Fair founder James Ekbatani in June of this year. And essentially, I represented Dr. Oristaglio. There was more than one case that was filed, and that raises a whole host of fund procedural issues within the False Claims Act space and area of litigation. But in essence, these defendants agreed to pay $56.5 million to resolve allegations that they violated the FCA by causing the submission of false or invalid diagnosis codes to the Medicare Advantage program. And what we’re seeing generally in this space, Kevin, is that sometimes there’s a concerted effort between a company and a particular insurer to do that. A particular MAO to make that happen. And in that instance, you’d have more of a co-conspiracy because both the… in this case, Matrix and whatever the MAO would have been, would have benefited from higher reimbursement rates from the United States government. And so the government’s position is that, and rightly so, it’s a breach of trust when providers look to make more money by making their patients appear sicker than they actually are.
So if I would say the one take away for this type of fraud, it’s absolutely that. Making patients appear sicker than what is substantiated in order to skew the risk adjustment score and obtain higher reimbursement rates. So just as we heard about with the Kaiser case, some of the issues at play in the matrix cases had to do with utilizing, for example, potentially tests that weren’t, I will call it best in class, and knowing that potentially not getting accurate outcomes and then using those inaccurate outcomes as the basis of a documentation in the medical record.
Another area that did come up, and this is public, is the depression code that a lot of people received. And so when you stop and think about depression, like I said, I actually worked for Eli Lilly and sold Prozac. So, this area I happen to know pretty well. And basically someone could have depression in an episodic manner, like we suggested with someone being in a bad car accident or losing a close loved one or a spouse or whatever the case may be. And it doesn’t mean that they’re chronic. It doesn’t mean that they’re manic depressive or bipolar or borderline personality or any of those, but or major depressive mood disorder.
Kevin Chmura
And a lot of the jumps that are often seen in this area is that jump from a depression, which is may be accurate or to your point earlier with the stitches when you were in the 3rd grade, it may have been accurate at one point in time, but is it necessarily accurate now? And how does one make the leap from depression to major depressive mood disorder?
Rachel Rose
That’s a whole different kettle of fish, especially when there is not documentation that’s consistent with the DSM-5 criteria, nor are there referrals to psychologists or other licensed professionals who would be more appropriate to deal with someone with that level of depression. It’s not going in saying, you know, I’m a little depressed, blah, blah, blah. My kid went off to college and you asked for an SSRI, a selective serotonin reuptake inhibitor, or an SNRI selective norepinephrine reuptake inhibitor that a primary care or another basic physician can write. You start getting into major depressive mood disorder that requires a very, I’ll use the word intimate relationship between the patient and a mental health professional because of the importance of talk therapy. And if you read the literature that’s out, whether it’s for PTSD or talk therapy or things of that nature, there is a huge correlation about the positive impact on not only treating but maintaining the diagnoses with PTSD or major depressive mood disorder. So those are a lot of areas that are coming into play along those lines.
There were also [allegations] in the Ekbatani case that Health Fair providers had made certain diagnoses, including but not limited to AIDS, HIV, metastatic cancer, and mesothenia gravis without documentation establishing or confirming the existence of the condition. And as we know, HIV is a precursor to AIDS. So that’s a very different animal. And with all the drugs that are out there now, just because you have HIV, it does not necessarily mean that a person may in fact end up with an AIDS diagnosis. Also, the other types of diagnoses included were rheumatoid arthritis, coagulation defect, drug dependence, which we talked about, morbid obesity, the major depressive mood disorder, which is what I just went into, and then chronic obstructive pulmonary disease. And so diagnosing congestive heart failure and heart arrhythmia despite contradiction by electrocardiogram and electrocardiogram results and also some thrombophilia solely based on separate diagnosis of atrial fibrillation. So just because you have one diagnosis – to our earlier discussion – doesn’t mean you can make that leap that you’re automatically going to have the separate diagnosis which has separate criteria associated with it.
Kevin Chmura
Right, and the risk involved in in the you know in a provider sort of up coding those is so high because much of what you just described is is proven by diagnostics, right? We can we we’ve got tests that will tell us, or there’s a measurable that says whether or not you’re morbidly obese.
And so very easy to disprove. And just sort of speaks to, I think, the, I guess the attractiveness of potentially seeing what you can get away with, but it’s not worth it because what I heard you say there was [an approximate total of $611 million] in settlements on these 2 cases alone. And that’s a real-world pocketbook impactor. So be careful. So in that light, maybe what we can end on, given those massive settlements out there, is it, you know, give some people some practical knowledge about what they can do and how maybe they can evolve their compliance program to help guard against some of these.
Rachel Rose
I think that’s a great question to end with, Kevin. And I always start with the seven core requirements of a compliance program. And those, as we know, include training policies and procedures, a compliance officer, adequate avenues for whistleblowers to be coming to fruition and reporting their concerns within a company. That is another area to focus on.
And so if you look at the factors and translate that to the Medicare Advantage, the 42 CFR for 83.85, which does set forth the compliance and ethics programs, it means it needs to be set up across a continuum. So it should not be siloed. And the most effective approach is to have an enterprise risk management approach, which gets all of the players involved. As we know, whenever a person goes into a doctor’s office or a hospital, their first touch point, their logging in, if you may, or sitting down and verifying their appointment time, and then their medical information and medical history and things of that part. That is where the first step is.
From there, we have the providers, and if nurses are taking notes, are the nurses taking notes accurately, or are they relying on AI solely without reviewing it? If the doctor relies on that and takes it at face value, there can be downstream liability in terms of, as I mentioned, the Texas Senate Bill 1188. And really physicians are fiduciaries just as lawyers are fiduciaries. So, what we’ve seen lately play out in the federal and state courts with lawyers not reviewing their pleadings and just submitting it and getting sanctioned for using hallucinated cases, hallucinated facts, expert witnesses, submitting expert reports without fact checking and coming up with hallucinations in those, those can be very costly. And I think a key take away on that point is that it can affect a physician’s license just as it can affect a lawyer’s license. But instead of going to a State Bar to file a complaint or a court referring a lawyer to a State Bar with a complaint, the same thing can happen with physicians.
I would say that there’s even more of a gravitas there because if the physician blindly relies on AI and it’s inaccurate, or as we know, one word can change an entire course of treatment, you could actually end up with an adverse patient event or a patient death. And so the stakes in healthcare are much higher than just coding and a related note to compliance is, you should always put the patient first. That patient-centered home, which evolved as a term in the Affordable Care Act, is something that is still very prevalent today, and especially in AI. So, when I advise my clients, we always make the patient and the clinical side first.
In my experience with the DOJ, one of the first questions they ask me, and the whistleblowers that I represent is right out of the gate, was there harm to patients? So as you’re moving through all of the stakeholders in this enterprise risk management system, from intake to clinical, to fact checking the medical record, to billing, to clearing house, to final submission, you really need to think how the organization is looking at this, not only from a coding compliance perspective and that side of fraud, waste, and abuse, but also the patient harm. And is there substandard care involved. And I think that’s an area that we’d likely see a lot of interest in, especially if there are a large number of adverse patient events.
Kevin Chmura
Rachel, this has been a valuable and sobering conversation. We came in thinking about financial risk and fraud, but where you left us is exactly where everybody’s mind should be. The real-world impact on patients. When AI puts a wrong diagnosis in the record, the risk isn’t just financial. It could be substandard care or an adverse outcome. The patient has to come first. A quick recap for our listeners. Medicare Advantage now covers more than half of all Medicare beneficiaries. The DOJ and CMS have made fraud a top enforcement priority. Risk adjustment is where the incentive to game the system lives. The False Claims Act remains government’s number one tool as the Kaiser and Matrix cases make clear. And AI needs real governance because the onus stays on the provider to review the medical record before it’s signed and submitted. These topics are not going away, so I’m sure Rachel and I will revisit them again soon.
Rachel, thanks again for your time and your insights. And to our listeners, thanks for joining us on 1st Talk Compliance. We’ll see you next time.
