Author: James Kennedy, MD | October 21, 2026
Medicare Advantage (MA), Medicaid (e.g., Tennessee’s TennCare program), and Patient Protection and Affordable Care Act (also known as Obamacare) plans’ monthly capitated per-member payments are heavily influenced by the quantity and quality of certain ICD-10-CM codes that are often simply passed through from provider (e.g., physician, hospital) claims to their funding sources (e.g., the Centers for Medicare & Medicaid Services/CMS, state Medicaid plans).
On Sept. 23, the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) released a critical analysis of a UnitedHealthcare (UHC) of Texas’s MA ICD-10-CM code submission affecting their CMS Hierarchical Condition Category (CMS-HCC)-based capitated funding, estimating and extrapolating that UHC was overpaid by at least $24.4 million from 2020 through 2021.
While focusing on only this one MA plan, the OIG’s analysis impacts all payer and provider entities, including hospitals (and their own MA plans) and physicians (and their Independent Physician Associations/IPAs or Accountable Care Organizations/ACOs), whose quality and cost efficiency metrics (e.g., CMS’s Medicare Spending Per Beneficiary/MSPB or Merit-based Incentive Payment System/MIPS) rely on ICD-10-CM-applicable clinical documentation integrity (CDI) for their success.
Like UHC, physicians and hospitals are subject to the U.S. Department of Justice (DOJ) and OIG’s definition of fraud, as anyone who knowingly a) has actual knowledge of the information; b) acts in deliberate ignorance of the truth or falsity of the information; or c) acts in reckless disregard of the truth or falsity of the information, whereby no proof of specific intent to defraud is required.
Please consult the OIG’s report for details of their findings, available at https://oig.hhs.gov/documents/audit/11917/A-07-24-01215.pdf as to process how the OIG reached its conclusions and how UHC responded to their findings.
United Healthcare’s Rebuttal is Instructive
UHC’s response to the OIG report, signed by Mr. Robert Hunter, UHC’s Chief Executive Officer of Government Program, instructs us on how their government relations executives and legal counsel view the OIG’s methodology and rationale in denying government payments to their health plans, which can be mirrored when hospitals and physicians fight UHC denials over the same issues. Elements asserted by UHC include the following:
- UHC asserted that many of the diagnoses that the OIG found invalid were in fact supported by the submitted medical records, given that the ICD-10-CM Official Guidelines for Coding and Reporting state that “The assignment of a diagnosis code is based on the provider’s diagnostic statement that the condition exists. The provider’s statement that the patient has a particular condition is sufficient. Code assignment is not based on clinical criteria used by the provider to establish the diagnosis.” This is a concept reinforced by the Coding Clinic editions published in the fourth quarter of 2016 (pages 147-149) and the fourth quarter of 2017 (page 110). (Why, then, does UHC not embrace physician-defined and CMS-sanctioned Sepsis-2 criteria when sepsis is documented in the medical record, only to be denied because UHC claims it did not meet Sepsis-3 criteria?)
- UHC asserted that the audit’s results were biased because the OIG largely ignores member underpayments. Does not UHC do the same when it audits physicians and hospitals for documentation, coding, and revenue integrity? When was the last time UHC (or any other payer) performed an underpayment audit of what should, could, or would have been documented and coded, reflecting the patient’s true illness severity and resource consumption? Is what is good for the goose not good for the gander?
- Finally, UHC claims the OIG did not identify the specific coding and documentation standards used to guide the medical record review and audit. Does not UHC do the same in its denials policies and programs, such as their denials based on the ICD-10-CM Excludes1 note? This policy ignores the Guidelines (page 10) instruction that “An exception to the Excludes1 definition is the circumstance when the two conditions are unrelated to each other.” Should UHC’s policy not be amended to reflect the totality of the Guidelines?
- Is it not true that MA plans accept the CMS HCC capitated payments based on provider-supplied ICD-10-CM diagnosis codes, even when the plan denied payment to the provider for that same diagnosis (e.g., sepsis not meeting Sepsis-3 criteria)? Why should the MA plan be paid for that diagnosis when the provider is not?
When addressing UHC’s denials of hospital and physician payments, Mr. Hunter’s response can serve as a template for writing a rebuttal, and even leveraged in testimony during a peer-to-peer session or in front of an administrative law judge (ALJ).
CDI Still Matters
Even though UHC rebutted the OIG’s findings, their audit remains instructive in how physicians, facilities, and their compliance officers must address their own internal documentation and coding policies, technologies, and personnel in advocating for CDI.
Interesting elements of this review include:
- Acute Cerebrovascular Disease – The OIG noted that acute stroke codes were reported without a corresponding hospital assessment for the condition. According to the Guidelines, page 53, and the Coding Clinic for ICD-9-CM/ICD-10-CM for the third quarter of 2006 (pages 3-4), ICD-10-CM codes for acute stroke (such as cerebral infarction or hemorrhage, subarachnoid hemorrhage, or any code classifiable to I60-I67) should only be reported during or immediately prior to an episode of acute hospital care. All follow-up visits, including those at physician offices, skilled nursing or rehabilitation facilities immediately following acute care, should use I69 codes when reporting any late effect (e.g., hemiparesis, aphasia) of these events. Z86.73, Personal history of transient ischemic attack (TIA), and cerebral infarction without residual deficits, is reported for patients with previous strokes without sequela.
- Acute Myocardial Infarction – The OIG noted that ICD-10-CM codes for acute myocardial infarction (e.g., category I21 codes) were assigned for patients with a “past history of myocardial infarction.” The Guidelines state on page 54, “For encounters occurring while the myocardial infarction is equal to, or less than four weeks old, including transfers to another acute setting or a postacute setting, and the myocardial infarction meets the definition for ‘other diagnoses,’ codes from category I21 may continue to be reported. For encounters after the four-week time frame and the patient is still receiving care related to the myocardial infarction, the appropriate aftercare code should be assigned, rather than a code from category I21. For old or healed myocardial infarctions not requiring further care, code I25.2, Old myocardial infarction, may be assigned.” The Coding Clinic for the fourth quarter of 2016 (page 140) emphasizes documentation of treatment of the recent myocardial infarction with “cardiac medications” within 28 days of its onset supports category I21 codes; however, the linkage between the myocardial infarction and medication use must be explicit (reference the Coding Clinic for the third quarter of 2021 (pages 32-33) for more details ). Of course, any short-term (e.g., those less than 28 days involving I23 codes) or long-term (those over 28 days) consequences from the myocardial infarction, such as heart failure (I50.-) or a specified arrhythmia, may be reported if directly addressed or linked to its medication treatment during the visit.
- Embolism (Deep Venous Thrombosis) – The OIG noted that several embolism-related HCCs were assigned based on provider documentation of a “history of” or “suspected” deep venous thrombosis (DVT), not the actual confirmed presence of the DVT. The Guidelines (page 97) describe personal history codes as an explanation of a patient’s “past medical condition that no longer exists and is not receiving any treatment, but that has the potential for recurrence and therefore may require continued monitoring.” Furthermore, the Guidelines emphasize on page 114 that no physician or any non-acute facility (including skilled nursing or rehabilitation center) claim may “code diagnoses documented as ‘probable’, ‘suspected,’ ‘questionable,’ ‘rule out,’ ‘compatible with,’ ‘consistent with,’ or ‘working diagnosis’ or other similar terms indicating uncertainty. Rather, code the condition(s) to the highest degree of certainty for that encounter/visit, such as symptoms, signs, abnormal test results, or other reason for the visit.” In addition, the provider must explicitly document that any anticoagulation treatment is for active treatment of a previously diagnosed DVT, as opposed to prophylaxis to prevent a new clot. According to the American Society of Hematology 2020 Guidelines for Management of Venous Thromboembolism: Treatment of Deep Vein Thrombosis and Pulmonary Embolism, patients with acute venous thromboembolism should receive three to six months of anticoagulation, so the intent and reasoning for any extended duration of full- or reduced-dose anticoagulation should be well-documented in those with persistent thrombotic risk factors.
- Lung, Breast, Colon, and Prostate Cancer – The OIG found many cases whereby an active primary cancer code was assigned without any documented supporting evidence that the patient currently manifested or was receiving active or adjuvant treatment for the malignancy. The newer CMS-HCC version 28 creates new compliance risks and opportunities for oncology-related ICD-10-CM coding, which includes:
- Primary Malignancies – The Guidelines (page 38) emphasize that “when a primary malignancy has been excised but further treatment, such as an additional surgery for the malignancy, radiation therapy or chemotherapy is directed to that site, the primary malignancy code should be used until treatment is completed. When a primary malignancy has been previously excised or eradicated from its site, there is no further treatment (of the malignancy) directed to that site, and there is no evidence of any existing primary malignancy at that site, a code from category Z85, Personal history of malignant neoplasm, should be used to indicate the former site of the malignancy.” Active treatment includes long-term adjuvant therapy (described as “decreasing the risk of the cancer recurring, stopping cell growth and prevent cancer cells from continuing to grow”) directed to the tumor, such as tamoxifen for breast cancer whereby a primary malignancy can be assigned, as explained in Coding Clinic for the third quarter of 2009 (pages 3-4). To assure compliance, explicit descriptions of such treatments as adjuvant therapy for malignancies is warranted.
- Secondary Malignancies – Defined by the Guidelines (page 35) as “any mention of extension, invasion, or metastasis to another site,” codes for a secondary malignant neoplasm to that site are very high-weighted with CMS-HCCs, and must be explicitly documented as being present or receiving treatment to be compliantly coded. Caveats and opportunities include:
- Secondary Malignancies of Lymph Nodes – Secondary malignancies of intrathoracic or multiple lymph nodes trigger v28 CMS-HCC 17 (RW 4.045), whereas those involving the axilla trigger v28 CMS-HCC 20 (RW 1.084) and other specified locations trigger v28 CMS-HCC 18 (RW 2.476). Note that the ICD-10-CM code C77.8, Secondary and unspecified malignant neoplasm of lymph nodes of multiple regions, triggering v28 CMS-HCC 17, should not be assigned when the physician documents secondary lymph node malignancies in separately identified multiple locations (e.g., inguinal and abdominal lymph node metastases) based the Guidelines (page 19) that currently state, “the classification defines ‘multiple’ as involving two or more sites. Follow chapter specific guidelines for assigning codes for ‘multiple sites.’ In the absence of chapter specific guidelines, assign codes describing specified sites individually when documented. When the specified site(s) are not documented, assign the appropriate code for ‘multiple sites.’” Consequently, a compliance risk occurs if a facility or provider fails to query for the locations of the multiple lymph node metastasis sites before assigning C77.8, Secondary and unspecified malignant neoplasm of lymph nodes of multiple regions, given the relative weight differences between the CMS-HCC 17 (4.045), 18 (2.476), and 20 (1.084).
- Lymphoma Spread Beyond Lymph Nodes into Solid Tissue – The Guidelines (page 39) state that “When a malignant neoplasm of lymphoid tissue metastasizes beyond the lymph nodes, a code from categories C81-C85 with a final character identifying ‘extranodal and solid organ sites’ should be assigned (v28 CMS-HCC 20, Lymphoma and other cancers), rather than a code for the secondary neoplasm of the affected solid organ,” inhibiting other v28 CMS-HCC risk adjustment. This Guideline, however, does not apply to leukemia, demonstrated by Coding Clinic for the first quarter of 2020 (pages 13-14) which allows the reporting of C79.32, Secondary malignant neoplasm of cerebral meninges, for leukemic meningitis (V28 CMS-HCC 17, Cancer Metastatic to Lung, Liver, Brain, and Other Organs; Acute Myeloid Leukemia Except Promyelocytic, RW 4.045).
- Biochemical Recurrence of Cancer – Coding Clinic for the second quarter of 2023 (pages 5-6) allowed for assigning C79.9, Secondary malignant neoplasm of unspecified site, (CMS-HCC 18, RW 2.476) when biochemical recurrence of prostate cancer was documented as the result of a rising PSA level after radical prostatectomy (ICD-10-CM code R97.21). While Coding Clinic has not published advice regarding if this would apply to biochemical recurrence of other malignancies diagnosed with abnormal biomarkers, such as epithelial ovarian cancer (defined by rising CA-125 levels without clinical or radiologic evidence of disease), one can likely extrapolate this advice to clinically analogous scenarios.
- Sepsis – The OIG believes that any sepsis code requires hospital evaluation. Caveats include the following:
- Coding Clinic for the first quarter of 2016 (page 32) advises not to code a sepsis code for documented “resolving sepsis” unless a provide query answers otherwise.
- Even though UHC uses Sepsis-3 criteria to deny inpatient sepsis DRG payments, CMS continues to define sepsis using Sepsis-2 criteria, since they stated in their FY2027 Inpatient Prospective Payment System/IPPS Final Rule (page 49959) that “sepsis is a life-threatening condition that results from the body’s dysregulated response to infection and is a leading cause of mortality, hospitalization, and readmission in the United States without requiring the presence of an associated organ dysfunction.” Furthermore, CMS stated on page 49891 that “While there is no one consensus definition of sepsis, Sepsis-2 (based on Systemic Inflammatory Response Syndrome/SIRS criteria) is highly sensitive, often identifying patients before severe deterioration. Sepsis-3 (based primarily on Sequential Organ Failure Assessment/SOFA) is highly specific, meaning it risks missing patients. Based on detailed expert clinical and TEP input, we elected to align the measure with Sepsis-2 definition in order to ensure cases were not missed, but also ensured no overlap with existing condition- and procedure-specific 30-day readmission measures,” suggesting that they would accept Sepsis-2 criteria for clinically validating sepsis.
- These references should be handy when confronting MA denials for inpatient reimbursement for sepsis admissions not meeting Sepsis-3 criteria; while they defend their CMS-HCC 2 capitation rates using Sepsis-2, especially since UHC explicitly stated in their rebuttal (page 51) that “The OIG’s recommended repayment amount is incorrect because many of the diagnoses that the OIG found invalid are supported by documentation in the relevant medical records,” and “ICD-10-CM Official Guidelines for Coding and Reporting FY 2019; Section I(A)(19), ICD-10-CM Official Guidelines for Coding and Reporting FY 2020 (“The assignment of a diagnosis code is based on the provider’s diagnostic statement that the condition exists. The provider’s statement that the patient has a particular condition is sufficient. Code assignment is not based on clinical criteria used by the provider to establish the diagnosis.” If UHC can use these references when addressing the OIG, should the hospital not do the same?
- Pressure Ulcers – The OIG investigated pressure ulcer diagnosis (that mapped to a Pressure Ulcer HCC) on only one date of service during the service year, but did not have a pressure ulcer diagnosis on another inpatient, outpatient, or physician claim for either the calendar year before or the calendar year after that service year. The Guidelines (pages 58-60) outline how documented pressure sore codes should be assigned. The National Pressure Injury Advisory Panel offers a synopsis of pressure injury staging on their website. The Guidelines (pages 15-16) allow for pressure injury staging to be based on nursing documentation when a provider with face-to-face patient contact confirms that a pressure injury is present.
- Potentially Mis-Keyed Diagnosis Codes – The OIG identified several clerical errors whereby CMS-HCC-applicable ICD-10-CM codes not supported by provider documentation were likely mis-keyed during bill submission. These include:
- E78.00 vs. C78.00 – there were 17 diagnosis codes for pure hypercholesterolemia, unspecified (E78.00), and only one diagnosis code for secondary malignant neoplasm of an unspecified lung (C78.00);
- G62.9 (Polyneuropathy, unspecified) versus I62.9 (Nontraumatic cerebral hemorrhage, unspecified);
- Z93.6 (Other artificial openings of urinary tract status) versus G93.6 (Cerebral edema);
- G83.11 (Monoplegia of lower limb affecting right dominant side) versus C83.11 (Mantle cell lymphoma, lymph nodes of head, face, and neck); and
- Others.
UHC requested that the OIG supply a list of what CMS-HCC-applicable ICD-10-CM codes subject to frequent mis-keying. Providers and their compliance officers can do the same through a Freedom of Information Act/FOIA request, which can facilitate their own internal audits.
Note again that UHC blamed their facilities and physicians for these inaccurate codes, as they claim that “CMS regulations do not require UHC to conduct the type of self-audits that the OIG recommends. In fact, the U.S. Department of Justice, on behalf of CMS, has stated that ‘MAOs are not required to audit every single diagnosis code they submit.’”
Consequently, since UHC absolves itself of any responsibility for what the OIG identified on this report, each facility or practice must ensure that they can defend these identified issues when accounted for, as to avoid legal liability.
Strong compliance programs mitigate potential penalties and embarrassment. Refer to the OIG’s General Compliance Program Guidance or your legal counsel for additional details.
This article was originally published on RACmonitor.