Megan Tinker, Chief of Staff at HHS OIG, delivered the closing keynote at RISE National 2026. The OIG has expanded its oversight of Medicare Advantage significantly, and the data she brought to the stage made clear that this shift in regulatory posture is permanent and the plans treating it as temporary are already behind.
She came with completed audit results, not projections. Specific diagnosis categories, specific dollar amounts, and specific practices the OIG is actively watching. The picture she put on the stage is worth understanding in full.
The Numbers First
In FY2025, the OIG delivered $19.04 billion in total monetary impact. It executed 1,577 criminal and civil actions and excluded 2,837 individuals and entities from federal healthcare programs.
The Medicare Advantage numbers are sharper. Improper risk adjustment payments reached $23.7 billion in 2025. Across 35 targeted RADV audit reports, the OIG identified $269 million in overpayments and found that 75% of the HCCs reviewed were not supported by documentation. Only 4% of those findings were disputed.
One figure is worth isolating: for acute stroke diagnoses submitted without an accompanying inpatient stay, the OIG’s error rate is 97%.
A 97% error rate on that code is not a statistical outlier. It is an audit signal. Acute stroke diagnoses submitted without a corresponding inpatient stay will appear in RADV results the same way they appeared in OIG reports: as unsupported and overpaid.
The HRA Problem: $7.5 Billion From One Source
This is the most specific and underreported finding from the keynote.
$7.5 billion. That is how much Medicare Advantage paid out in 2023 for diagnoses reported exclusively through Health Risk Assessments, with no corresponding clinical encounter, no treatment record, and no evidence of ongoing care.
$3.5 billion In-home HRAs
$2.7 billion Facility-based HRAs
$1.3 billion HRA linked chart reviews
$92 million Telehealth HRAs
The OIG’s position is clear and it is moving. A diagnosis that exists only on an HRA does not meet the standard for legitimate risk adjustment. The agency is explicitly backing CMS’s proposed ban on unlinked chart reviews. The financial exposure is real and the timeline is set. CMS actuaries project that eliminating unlinked chart review diagnoses would reduce MA payments by approximately 1.53%—roughly $7 billion in 2027 alone. Plans still using unlinked HRAs to capture diagnoses should treat this as an operational deadline, not a policy debate. Close the documentation gap before the rule does it for you.
The diagnosis categories with the highest rates of questionable payments from HRAs are listed in the table below. These are the specific HCC categories the OIG has publicly flagged as audit priorities.
| Condition | Questionable Rate | Total Reviewed |
| Myasthenia Gravis and Inflammatory Neuropathy | 91% | $363.8M |
| Disorders of Immunity | 88% | $476.8M |
| Other Endocrine and Metabolic Disorders | 87% | $189.5M |
| Coagulation Defects | 82% | $314.4M |
| Congestive Heart Failure | 81% | $247.6M |
| Diabetes with Chronic Complications | 81% | $283.8M |
| Substance Use Disorder, Moderate and Severe | 81% | $238.6M |
What this means for Health Plans: Pull your HRA data against these categories. If diagnoses in these buckets are not linked to a subsequent clinical encounter or ongoing care documentation, that is your audit exposure. The seven categories in the table above collectively account for over $2.1 billion in questionable HRA-driven payments—these are the OIG’s published audit targets for the current cycle. On vendors: the OIG was explicit. Plans are accountable for what their vendors do. If your HRA vendor is coding aggressively without linkage to care, your RAF score may look strong today. Your RADV result will reflect what the documentation actually supports. Review your vendor contracts and speak to a risk adjustment specialist if you are unsure where your exposure sits.
Three Areas Under Active Scrutiny
Risk Adjustment
Beyond the HRA data, enforcement has already recovered more than $1 billion through settlements, including a $565 million False Claims Act case against Kaiser. The mechanism in that case was physicians being pressured to add diagnoses not identified during patient visits, sometimes more than a year after the visit.
Start with a self-audit: use data analytics to flag coding patterns that do not make clinical sense, and treat vendor oversight as a compliance function rather than a contract management task.
What the OIG’s findings reveal more broadly is that most risk adjustment failures are not the result of intentional fraud. They are the result of process gaps that were never designed with audit defensibility in mind. Plans that built their risk adjustment programs around volume and RAF score capture, without equal investment in documentation integrity and diagnosis validation, are now the most exposed. A compliant program requires prospective coding strategies, clinical validation at the point of care, and a continuous review cycle, not a retrospective cleanup before audit season.
Access to Care
Ghost networks are under active investigation. In a nationwide OIG investigation of Medicare Advantage plan provider directories, 55% of listed behavioral health providers were found to be inactive or unavailable—nearly double the 28% rate found in Medicaid networks. Fewer than five active behavioral health providers exist per 1,000 enrollees across Medicare and Medicaid combined.
CMS will tighten network verification requirements for plan year 2027. The OIG already conducts secret shopping, posing as beneficiaries and calling providers to verify availability. Do your own verification before they do theirs.
Marketing and Enrollment
Tinker introduced a term worth keeping: lemon dropping. It refers to steering enrollment away from sicker, costlier members toward healthier ones. Alongside kickback type arrangements between plans and brokers, this is now an active enforcement area.
The Troy Health non-prosecution agreement is instructive. The company admitted to using AI and automation software to fraudulently enroll Medicare beneficiaries. Enforcement now extends to the technology used in enrollment strategies, not just the people executing them.
If your broker compensation structure could reasonably be read as an incentive to avoid high-cost members, it needs to be reviewed before a regulator reads it that way first.
The February 2026 Compliance Guidance
The OIG released its Medicare Advantage Industry Segment-Specific Compliance Program Guidance in February 2026, developed after two years of listening sessions with payers, providers, vendors, and trade associations. Tinker’s framing was direct: “We didn’t want to produce another wonky government document. We wanted practical, meaningful guidance.”
Seven risk areas are covered: access to care, marketing and enrollment, risk adjustment, quality of care, third party oversight, organizational type risks, and accurate claims submission.
Seven structural elements define what an adequate compliance program looks like: written policies and procedures, compliance leadership and oversight, training and education, effective communication channels, enforcing standards through consequences and incentives, ongoing risk assessment with auditing and monitoring, and a corrective action program.
Tinker emphasized that while this guidance is not mandatory, it represents the published standard by which MA compliance will be judged. For plans reviewing their programs now, the message is straightforward: there is no ambiguity about what the OIG expects. It’s documented, public, and available to any auditor benchmarking your program against it. Tinker closed by noting that aligning with OIG guidance is not only about regulatory protection—it’s about delivering better care to members.
One additional resource your compliance team should be using regularly: the OIG Work Plan, updated monthly, which tells you what audits and focus areas are currently active. There is no reason to be surprised by an OIG priority in 2026 when the agency publishes its agenda.
The Bottom Line
“Compliance is a critical tool to protect your organization and managed care as a whole.”
— Megan Tinker, Chief of Staff, HHS OIG, RISE National 2026
The plans that treat this keynote as an operational input will be in a better position than those that treat it as a warning to acknowledge and move past.
The OIG published exactly where they are looking. Plans that audit those same areas first are building defensible programs; plans that wait are building remediation budgets. If you want to assess where your program currently stands, Annova Solutions works with Medicare Advantage plans to build risk adjustment and compliance programs that are defensible before the audit arrives, not after.
Frequently Asked Questions
What are the biggest compliance risks the OIG identified in Medicare Advantage?
Improper risk adjustment payments reached $23.7 billion in 2025, with $7.5 billion tied specifically to HRA-only diagnoses in 2023. Targeted RADV audits found 75% of reviewed HCCs unsupported and error rates as high as 97% on certain codes.
What is the OIG’s position on unlinked chart reviews?
The OIG supports CMS’s proposed ban. Diagnoses captured through chart reviews not tied to a specific date of service or clinical encounter are not considered valid for risk adjustment purposes.
Which diagnosis codes face the highest OIG scrutiny in Medicare Advantage?
The highest error rates in HRA-driven audits involve Disorders of Immunity (88%), Myasthenia Gravis and related conditions (91%), Coagulation Defects (82%), Congestive Heart Failure (81%), and Diabetes with Chronic Complications (81%).
What is lemon dropping and why does it matter?
Lemon dropping means steering enrollment away from sicker members to improve your risk pool. The OIG named it an active enforcement area alongside broker kickback arrangements and misleading marketing practices.
