High-Risk Diagnosis Codes: What OIG’s Audits Actually Found

Introduction

When someone pulls a chart for one of your submitted diagnoses, will the documentation support the code you submitted?

Most risk adjustment programs cannot answer that with complete certainty. You cannot manually review every chart because the volume is simply too large, and some diagnoses have been carried forward for years without anyone going back to the source record to verify that the patient’s clinical status still supports the diagnosis.

OIG has already documented which diagnoses fail, why they fail, and the methodology it uses to identify them. The patterns are not hidden. They appear across multiple audits, are summarized in a publicly available toolkit, and were reinforced by a May 2026 nationwide study that reviewed 97 acute stroke codes and found that none were supported.

Acute stroke, acute MI, and active cancer are three of the highest-risk conditions OIG has audited. In the sections below, you will see what the documentation needs to show, what the charts typically show instead, and what you can do to identify these issues before an auditor does.

All error rates cited in this article come directly from OIG audit reports. Condition-specific figures are labeled with the relevant report number and health plan; they should not be interpreted as industry-wide averages.

OIG Has Already Told Us What Fails

The OIG high-risk diagnosis toolkit (Report A-07-23-01213, December 2023) provides Medicare Advantage organizations with the same data analytics methodology that OIG auditors use to identify diagnosis codes at high risk of being unsupported.

HHS Office of Inspector General did not build this toolkit from general principles. It was built from findings accumulated across a decade of plan-level audits, spanning payment years 2013 through 2019. As of November 2023, across the eight high-risk diagnosis groups the toolkit documents in detail, OIG had reviewed 4,543 flagged codes and found 4,081 of them unsupported in the associated medical records, an overall rate of 90%. Individual condition groups ranged from 79% (embolism) to 96% (acute stroke and breast cancer). Separately, in its broader summary spanning its full multi-year audit record, OIG describes the overall unsupported rate “as of November 2023” as “approximately 70 percent,” a figure that reflects a wider set of audits beyond the eight groups tabulated in this toolkit.²

What made the December 2023 toolkit significant was not just the error rates. OIG published the actual SQL queries it used to identify suspect cases, including the table names, joins, filters, and date ranges. Plans now have access to the same selection logic OIG uses before it opens a chart.

Wynda Clayton, Director of Risk Adjustment Coding and Compliance at RAAPID, put it plainly in the V28 Beyond the 2026 Transition webinar: “The OIG’s recent audits are the roadmap for what will fail under V28.”

What the plan-level audits show

The table below shows condition-level error rates from a March 2026 OIG audit of Health Plan A (service years 2017-2018 / payment years 2018-2019). These are the results for one plan, not industry averages, and they are labeled accordingly. They are included here because they show what condition-specific failure looks like at the individual plan level, not just in aggregate.

*Source: OIG A-07-22-01208, Health Plan A, service years 2017-2018 (payment years 2018-2019).*³

Voluntary guidance, mandatory obligation

Using the toolkit is voluntary. Identifying and returning overpayments from unsupported diagnoses is not. Federal law requires Medicare Advantage organizations to report and return identified overpayments (42 U.S.C. 1320a-7k; 42 CFR 422.326). The OIG’s February 2026 Medicare Advantage Compliance Program Guidance recommends that plans “scrutinize reporting of particularly high-risk diagnosis codes”⁴ and implement processes to “prevent the submission of unsupported diagnosis codes.”⁴

For a mid-size plan, that error rate has a dollar figure attached before extrapolation even comes into play. The Health Plan A audit’s 252 unsupported codes, drawn from a sample of just 300, resulted in $828,010 in net overpayments in the sample alone. OIG’s standard practice is to extrapolate a sample finding like that across the full population of the diagnosis codes it represents, which is how a 300-chart sample becomes a seven-figure recovery demand. The numbers become useful when you understand what is actually happening at the chart level for each condition.

How OIG Picks the Charts and How to Run It Yourself

OIG’s selection logic is a data comparison, not a clinical review. It identifies cases where the administrative data contains an internal inconsistency and then opens charts to investigate that inconsistency.

For acute stroke, the selection criterion is specific: an acute stroke diagnosis code mapping to the Acute Stroke HCC (HCC 249 under CMS-HCC V28) appears on physician data records on between one and five dates of service in the service year, with no corresponding acute stroke diagnosis on an inpatient or outpatient hospital data record during that same service year.²

That logic is productive for a clinical reason. A genuine acute stroke almost always leaves a hospital footprint: an emergency department visit, an inpatient admission, and imaging records. A physician-only acute stroke code, appearing once or twice in an office setting with no facility record, is a documentation anomaly that warrants chart review before anyone reaches a conclusion.

OIG applied the same cross-record comparison logic to acute MI (looking for physician or outpatient claims without a corresponding inpatient claim within 60 days before or 60 days after the encounter) and to the cancer groups (looking for active malignancy codes without corresponding chemotherapy, radiation, or surgical procedure codes within six months before or after).

Running this comparison yourself requires four components:

• Physician encounter data for the service year
• Facility encounter data (inpatient and outpatient) for the same service year
• HCC mapping for the relevant payment year to confirm which codes map to which HCCs
• Continuous-enrollment flags to identify and exclude enrollees who were not enrolled for the full year

OIG published the SQL it used in the December 2023 toolkit. The queries are available for download at the condition-specific links in the Sources section of this article.

Running the query is the easy part. It returns a list of candidates, not a verdict. Every enrollee that surfaces still needs someone or something to open the chart and confirm whether the documentation actually supports the code, which is where the real work of a compliance program lies: not in finding the list, but in validating it one chart at a time.

Wynda Clayton noted in the 2026 Risk Adjustment Outlook webinar: “If it’s not in the encounter data, it doesn’t exist for risk adjustment.”

One nuance worth noting: the one-to-five dates-of-service detail in OIG’s stroke selection matters. A single stray acute stroke code is a different problem than a code repeated at every visit across the year. One is more likely an entry error. The other is more likely to be copy-forward from a problem list or a prior-year template. OIG’s SQL accounts for this by capping the selection at five instances, isolating cases that are anomalous rather than pervasive.

Acute Stroke: What the Chart Actually Said

In the HHS Office of Inspector General’s May 2026 nationwide audit of acute stroke codes (A-02-23-01020), 97 of 97 sampled records were unsupported. OIG projected an estimated $461,958,186 in potential net overpayments for payment year 2021.

The finding is significant not because 97 charts failed. It is significant because of what those 97 charts actually showed. The breakdown tells a more precise story than the headline number:

*Source: OIG A-02-23-01020, May 2026.*¹

Sixty-eight of 97 charts documented a real prior stroke. These were not healthy patients. The record did not support an acute stroke for the service year under review.

The coding standard for acute stroke

An acute stroke diagnosis code (ICD-10-CM category I63) applies to an acute cerebrovascular event under active clinical management. For that code to survive documentation review, the medical record must show that the acute event was addressed during the encounter or that the patient was seen in an acute care setting for the stroke event during the service year.

What a physician’s office note that says “history of stroke, doing well, follow-up in three months” supports is a sequelae code, not an active acute stroke diagnosis.

Wynda Clayton, in the V28 Beyond the 2026 Transition webinar: “Keep in mind history means it no longer exists. So if it still exists, don’t call it a history of.”

What the documentation needs to show versus what it typically shows

Replacement diagnosis: When the chart shows only a resolved prior stroke with no persistent deficit, the correct code is Z86.73, an unspecified sequela of cerebrovascular disease; neither maps to an HCC. When the chart documents a specific persisting deficit, such as hemiplegia or hemiparesis, the correct code is the deficit-specific sequela code, which maps to its own HCC under V28, separate from the acute stroke HCC. The distinction that matters for the audit is the same either way: whether the current documentation supports what was submitted.

The transition from this section to the next is the same clinical question in a different setting: not whether the condition is real, but whether the documentation supports the submitted code.

Acute MI and Active Cancer: Same Problem, Different Clock

Acute MI and active cancer look nothing alike clinically. The audit question is the same: does the documentation support the diagnosis submitted for this service year?

Acute MI

In the Health Plan A audit, 27 of 30 sampled acute MI enrollee-years were unsupported.³

The governing standard is the ICD-10-CM calendar. I21 (acute myocardial infarction) applies to an MI specified as acute or with a stated duration of 4 weeks, 28 days, or less from onset. I22 covers a subsequent acute MI within that same window. Once the clock passes 28 days, the correct code is I25.2 (old myocardial infarction).

The most common failure mode: a real infarct from a prior year still being coded annually as acute, carried forward on a problem list or through a template that has not been updated since the original event.

This is worth stating directly because the 60-day figure circulates frequently in risk adjustment discussions. The 60-day window appears in OIG’s toolkit selection criteria as the range OIG uses to look for a corresponding inpatient claim. It is not the coding rule. The coding rule is 28 days from onset, per the ICD-10-CM Official Guidelines for Coding and Reporting.

Replacement diagnosis: Old myocardial infarction (I25.2). This code does not map to an HCC under CMS-HCC V28, but it is the accurate code when the infarct occurred outside the 28-day acute window.

Active Cancer

In the Health Plan A audit, breast cancer failed at 100% (30 of 30) and colon cancer at 97% (29 of 30).³

The standard for active malignancy coding is whether treatment is currently directed at the primary site. The ICD-10-CM guidelines specify that the primary malignancy code remains in effect while a patient is receiving treatment. Once the malignancy is excised or eradicated, no further treatment is directed at the site, and there is no evidence of an existing primary malignancy, the correct code is Z85 (personal history of malignant neoplasm).

The practical test question is not “did this patient have cancer” but “is treatment currently directed at the malignancy for this service year?”

Surveillance imaging, routine follow-up appointments, and laboratory monitoring are not treatment directed at the malignancy. They are monitoring a condition that may have resolved. Coding active malignancy for a patient in surveillance is a documentation mismatch, not a clinical one.

Wynda Clayton, in the Understanding CMS’s AI Strategy webinar: “It knows that the history of cancer is not the same as an active cancer. It knows that a family history of a stroke is not an HCC. It knows that a problem list entry without supporting documentation is actually not defensible.”

Replacement diagnoses: Z85.xxx, coded by the original site. This does not map to the cancer HCCs, but it is accurate when there is no evidence of active treatment for the service year.

Across all three conditions, the mechanism is consistent. The diagnosis is real. The clinical status indicated by the submitted code does not match the chart’s record for the service year under review. Correcting that mismatch is the work.

Unsupported Does Not Automatically Mean Fraud

An unsupported diagnosis code means the medical record does not support the submitted diagnosis. It does not mean the patient never had the condition or that someone acted with fraudulent intent.

The breakdown from OIG’s May 2026 stroke audit makes this concrete. Sixty-eight of the 97 unsupported cases documented a real prior stroke. The patients had strokes. The records simply described those strokes as historical rather than acute, which means the submitted code described the wrong clinical status for the service year.

The replacement codes OIG identified across all three conditions confirm the same pattern: sequelae of cerebrovascular disease, old myocardial infarction, and Z85 for cancer. These are not codes for fictional diagnoses. They are accurate codes for real conditions, but they are documented at the wrong acuity or time period.

The HHS Office of Inspector General’s February 2026 Medicare Advantage Compliance Program Guidance is useful here. It notes that its discussion of a practice “is not intended to imply that the practice or activity is necessarily illegal.” It frames the concern in terms of accuracy and documentation: the obligation is to prevent and correct unsupported code submissions, not to presume intent from a documentation error.⁴

How unsupported codes typically enter the submission

Three mechanisms account for most of what OIG finds:

• Copy-forward from a problem list: a diagnosis coded accurately at some point in the past is carried into the current year’s encounter note without verification of current clinical status
• Problem list interpretation: a condition appears on the problem list and is coded without the encounter note documenting that the condition was addressed and clinically relevant during that visit
• Timing errors: a code that was accurate at the time of the original event is submitted in subsequent years without recognition that the clinical category has changed

In the V28 Beyond the 2026 Transition webinar, Wynda Clayton put it this way: “A problem list is just what it says. It’s a list of problems. It’s not evidence.”

The review question is not “who is at fault.” The first question is “Does the chart support the code?” A plan that builds its review process around that question is doing accuracy work, not fraud investigation.

Where to Start When You Cannot Review Everything

No plan can review every chart equally. The question is not whether to prioritize, but which starting point gives you the most signal per chart reviewed.

Many programs default to prioritizing by HCC weight: which diagnoses carry the highest RAF impact if they fail. That is a reasonable lens, but it is not the same as prioritizing by risk of failure.

OIG’s published audit patterns provide plans with a different starting point: which conditions have the highest documented error rates, regardless of their individual RAF values. Starting there means the first charts reviewed are the ones most likely to contain a documentation problem, not just the ones most expensive to lose.

In a RAAPID webinar poll from the V28 Beyond the 2026 Transition session, attendees were asked how confident they were that their organization’s documentation was fully aligned with V28 standards. Eight percent said they were very confident. Fifty-four percent said they were somewhat confident. Twelve percent said they were not confident, and twenty-seven percent were unsure. Combined, more than 90% of a self-selected audience of risk adjustment professionals could not say with confidence that their documentation would hold up. That is not an outlier position. It reflects the genuine uncertainty that comes from auditing by revenue priority rather than by published failure pattern.

Four starting points, ordered by return

• Run the cross-record comparison first. Acute stroke, acute MI, and the cancer groups on physician records with no corresponding facility record for the same service year. This is OIG’s own selection method; it is the highest-yield filter available and requires only encounter data that the plan already has.
• Apply the calendar codes. Any I21 code with an onset date outside the 28-day acute window. Any primary malignancy code where documentation of active treatment has not appeared within the past two service years.
• Look for repeat high-risk codes across multiple dates of service. The same high-risk code appearing in three or more physician encounters within a service year, with no facility record, is a copy-forward signal until verified otherwise.
• Apply MEAT criteria (Monitoring, Evaluation, Assessment, Treatment) to what survives. For the codes that cleared the first three filters, verify that the encounter documentation shows the condition was actively addressed: monitored, evaluated, assessed, or treated during the visit. A mention is not evidence. An address is.

As Wynda Clayton framed it in the V28 Beyond the 2026 Transition webinar: “You need to shift from capture everything to validate everything.”

This is not a year-end process. It is a targeted quarterly pass, driven by known OIG patterns and run against submitted encounter data, designed to surface the same anomalies OIG will surface if and when it reviews the same charts.

The Goal Is a Defensible Code, Not Just a Found One

Finding a diagnosis in a chart is not the same as being able to defend it.

When an auditor reviews a chart, the question is simple: show me the evidence that this diagnosis was current, clinically relevant, and documented at the encounter for which the code was submitted. If the chart cannot answer that question, the code does not survive.

A review process built on that standard asks the same question the auditor will ask, against the same documentation the auditor will see. The output is specific, not probabilistic: this diagnosis is supported by the encounter documentation, or it is not.

Consider a note that reads “history of breast cancer,” routine follow-up visit, mastectomy site well healed, with breast cancer listed in the assessment and plan. A pattern-matching system that identifies the entity “breast cancer” and surfaces an active malignancy code is answering the wrong question. The right question is whether treatment is currently directed at the site. The answer in that note is no. The code the note supports is Z85, not an active malignancy code.

That distinction is the difference between a code that was found and a code that can be defended. A system that explicitly holds the documentation requirement can test the chart against the requirement rather than score it for likelihood.

Wynda Clayton said it plainly in the V28 Beyond the 2026 Transition webinar: “AI is suggestions. It’s not evidence.”

Raxit Goswami, VP of Research at RAAPID, in the Understanding CMS’s AI Strategy webinar: “We move from a black box guessing system to a glass box reasoning system where every decision can be explained and validated.”

And: “It’s not enough to say the AI suggested this code. The real question is, can you prove why this code is valid based on clinical documentation and guidelines?”

The plans best positioned in the current audit environment are not the ones that find the most codes. They are the ones who can provide evidence for every code they submit.

This is the half of coding accuracy that gets less attention than it should. Most of the conversation in this industry centers on missed codes. This article has been about the other half: the codes that were submitted but should not have been, the ones a defensible program has to be willing to correct or remove. A coding approach that only adds and never subtracts is not more accurate; it is just less examined. Neuro-symbolic AI, the approach RAAPID uses to test each code against its documentation requirements rather than scoring it for likelihood, is designed to handle both halves of that work.