Anchor:

For years, a Medicare Advantage chart review program had one job: find diagnoses that supported a higher risk score. Whether every one of those diagnoses actually held up under scrutiny was, in practice, a secondary concern for a lot of programs. 

That era is closing fast. Federal regulators have made clear that a chart review process which only adds codes, and never removes the ones it cannot support, is no longer just an inefficient program. It is a compliance failure.

What Changed: OIG’s First Medicare Advantage Guidance Update in 27 Years

In early February 2026, the HHS Office of Inspector General released updated Medicare Advantage compliance guidance, the first update to its MA-specific guidance since 1999. On chart reviews specifically, the guidance is direct: failing to remove unsupported codes is treated as a compliance failure, not merely an operational gap. 

Deletion of unsupported diagnoses is now described as an obligation a compliance program is expected to meet, not a step a plan can skip without consequence.

The guidance is technically non-binding, using advisory language like “should” rather than “must.” In practice, that distinction offers less protection than it sounds like, since OIG guidance of this kind routinely gets referenced in audits and enforcement actions.

What an Add-Only Program Actually Costs

The clearest illustration of what this looks like in practice came in March 2026, when Aetna agreed to pay $117.7 million to resolve False Claims Act allegations tied to its Medicare Advantage risk adjustment practices. 

According to the Department of Justice, Aetna ran a chart review program that identified diagnosis codes its own records could not fully support, then kept those codes in place rather than withdrawing them and repaying CMS.

That pattern, identifying unsupported diagnoses through a chart review and then failing to act on that finding, is exactly the practice the new OIG guidance now treats as a compliance failure rather than a gray area.

What Two-Way Coding Actually Means

The industry term for the alternative to an add-only program is two-way coding, meaning a chart review process that both adds diagnoses supported by clinical documentation and removes diagnoses the documentation does not actually support. This sounds like a small distinction, but it changes the fundamental purpose of the review from revenue capture to data accuracy.

A genuinely two-way process treats an unsupported diagnosis the same way it treats a supported one: as a finding that needs to be acted on. That means a chart review vendor or internal team needs a defined workflow for surfacing codes that should come off a member’s record, not just codes that should go on, and needs to be able to show that workflow actually runs, not just that it theoretically exists.

What Health Plans Should Do Now

Auditing an existing chart review program against this new framing is a reasonable first step. Ask directly what percentage of chart reviews conducted over the past year resulted in a code being removed rather than added, since a program that never removes anything is exactly the pattern regulators are now scrutinizing.

It is also worth reviewing how any third-party vendor handling chart reviews or coding is contractually required to handle unsupported diagnoses, since the compliance exposure does not disappear just because the work is outsourced. Every diagnosis, whether added or removed, should be traceable back to specific clinical evidence in the record, not a general note that a chart was reviewed.

Evaluating Vendors on Compliance, Not Capture

This shift changes what actually matters when evaluating a risk adjustment technology partner. A platform that markets itself primarily on how many additional diagnoses it can surface is optimizing for exactly the metric regulators have started treating as a liability rather than an asset. 

Risk adjustment vendors increasingly need to be judged on whether they support genuine two-way coding and whether every suggested code carries a visible link back to the clinical documentation that supports it, since that evidence trail is precisely what an auditor or investigator will ask to see first.

The principle is not unique to Medicare Advantage. At the individual encounter level, the same rule decides whether a claim survives, and something as routine as PSA screening codes turns on whether the clinical note justifies the code selected, not on whether the code was available to select.

Conclusion

The regulatory ground under Medicare Advantage risk adjustment has genuinely shifted, not just tightened. An add-only chart review program that would have been considered simply aggressive a few years ago now carries real exposure under a specific, recently published federal guidance document, reinforced by a settlement that shows exactly what that exposure can cost.

Health plans that treat this as a documentation and process problem, building a genuine two-way review with a traceable evidence trail behind every diagnosis, are in a fundamentally stronger position than those that continue optimizing purely for capture and hope an audit never asks the harder question.

Frequently Asked Questions

1. Is an add-only chart review program automatically illegal? 

Not automatically, but it now carries meaningfully higher compliance risk. Federal guidance and recent enforcement actions treat the failure to remove unsupported diagnoses as a compliance failure, which increases exposure under the False Claims Act if those unsupported codes are submitted for payment.

2. What is the difference between OIG guidance and an actual legal requirement? 

OIG guidance like the MA ICPG is technically advisory rather than legally binding, using language like “should” instead of “must.” In practice, this guidance is frequently referenced in audits, investigations, and enforcement actions, which gives it real practical weight even without the force of law.

3. How does two-way coding actually reduce compliance risk? 

It creates a documented process for removing unsupported diagnoses rather than only adding new ones, which directly addresses the specific pattern federal regulators have identified as high-risk. It also produces an audit trail showing the health plan actively reviewed and corrected its own data rather than passively accumulating diagnoses.

4. Does this level of scrutiny apply to smaller health plans, or just large national insurers? 

The recent enforcement action targeted a large national insurer, but the underlying OIG guidance applies broadly to all Medicare Advantage Organizations and the vendors and entities that support them. Plan size affects enforcement visibility, not whether the compliance expectations technically apply.