UnitedHealthcare’s $24.4M RADV Audit: A Coding Lesson

The HHS Office of Inspector General issued a report on September 23, 2026 (posted September 28) finding that UnitedHealthcare Benefits of Texas, Inc. submitted diagnosis codes for its Medicare Advantage Contract H0609 that medical records did not support in the large majority of sampled cases. Of 230 sampled enrollee-years, OIG found that 172 — nearly 75% — lacked documentation backing the diagnosis codes submitted to CMS for risk-adjustment payment. The sample alone represented $622,927 in overpayments; projected across the full contract population for 2020 and 2021, OIG estimates UnitedHealthcare received at least $24.4 million it wasn’t entitled to.

For coding and compliance teams, the OIG report (number A-07-24-01215) is less a one-off headline than a data point in a pattern that has been building through 2026 — and a reminder of how thin the margin for documentation gaps has become under a Medicare Advantage risk-adjustment program CMS is auditing more aggressively than ever.

What OIG Found

The Sample Results

OIG’s audit focused on high-risk diagnosis codes — the kind most likely to inflate a plan’s risk score and, with it, its CMS payment — and asked a simple question: does the medical record actually support the code? For 172 of 230 sampled enrollee-years, the answer was no. OIG attributed the gap to diagnosis codes that appeared in claims or encounter data without corresponding clinical documentation in the medical record, a failure mode that shows up repeatedly across these audits regardless of which health plan is being reviewed.

UnitedHealthcare’s Response

UnitedHealthcare disagreed with OIG’s findings and requested that all four recommendations be withdrawn, including the central one: that the company refund the federal government the estimated $24.4 million. OIG’s other recommendations call for UnitedHealthcare to strengthen its policies and procedures for preventing, detecting, and correcting this kind of noncompliance going forward — a signal that OIG views this as a systemic process issue, not an isolated coding error.

Why These Gaps Keep Showing Up

Across this year’s wave of OIG diagnosis-code audits, a handful of root causes recur. None of them are exotic — which is exactly why they’re hard to catch without a dedicated review process:

• Codes carried forward without current-year support. A diagnosis documented in a prior encounter gets resubmitted in a later payment year without a corresponding visit note confirming it’s still active.
• Risk-adjustment codes sourced from claims rather than chart review. Codes pulled from billing or encounter data can miss the clinical specificity CMS requires for a risk-adjustment diagnosis to count.
• Thin coder bandwidth for high-risk code validation. High-risk HCC categories need closer scrutiny than routine codes, but audit teams are often stretched too thin to flag them before submission.
• Documentation and submission systems that don’t talk to each other. When the EHR note and the code sent to CMS live in separate workflows, nothing forces them to match before the claim goes out.

Part of a Broader OIG Pattern

The Texas finding lands alongside two other Medicare Advantage diagnosis-code audits OIG completed earlier this year under its recurring review of MA organizations’ risk-adjustment documentation, a series that began in October 2023: an audit of HumanaChoice found 178 of 220 sampled cases unsupported, projecting $130.9 million in overpayments for 2020-2021, and a separate audit of UnitedHealthcare of Wisconsin found 183 of 250 cases unsupported, projecting $46.9 million. Three more audits in that line are still in progress. Taken together, the pattern is consistent: large MA organizations, high sampled failure rates in the 75-80% range, and overpayment estimates running from tens to well over a hundred million dollars per contract.

That consistency is the real takeaway. These aren’t isolated coding mistakes at one plan — they’re a structural vulnerability in how risk-adjustment diagnosis codes move from the medical record to the CMS submission, and OIG’s audit cadence suggests more contract-level findings are coming before this review series wraps up.

What This Means for Coding and Compliance Teams

The practical lesson isn’t specific to UnitedHealthcare. Any coding or RCM operation submitting risk-adjustment diagnoses should treat this report as a prompt to check whether every high-risk HCC code it submits can be traced back to a specific, current-year documentation source — before CMS or OIG asks the question. That means concurrent validation at the point of coding rather than retrospective cleanup after a payment year closes, and consistent linkage between what’s in the chart and what’s on the claim.

This is precisely the kind of pattern-matching and documentation-linkage work that agentic AI tools are increasingly applied to in risk-adjustment coding: flagging a submitted diagnosis that lacks a matching current-year clinical note, or surfacing a high-risk HCC category for human review before it ever reaches a claim. As OIG’s audit series continues through the rest of its planned scope, the plans that can show that link — every code, matched to documentation, at the time of submission — are the ones least likely to see their name in the next report.

Medikode’s automated medical coding platform is built around exactly that kind of documentation-to-code traceability, helping coding and compliance teams catch unsupported risk-adjustment diagnoses before they ever leave the building. Learn more about Medikode’s automated medical coding platform.