Healthcare provider organizations, including Medicare Advantage organizations (MAOs), face a range of federal and state legal and regulatory constraints, which affect their formation, operation, procedural coding and billing, and transactions. This final installment of the three-part series on the valuation of Medicare Advantage (MA) plans will review the regulatory environment in which these plans operate.

The MA Program is regulated under Title 42, Part 422 of the Code of Federal Regulations (CFR), but because MA organizations (MAOs) that wish to operate MA plans must have an insurance license in every state in which they operate, their conduct is also governed by state law. Federal law requires MA plans to offer the same benefits as Original Medicare, but they are also permitted to cover additional benefits, subject to the approval of the Centers for Medicare & Medicaid Services (CMS).  Further, a plan is required to have an adequate network of providers who can offer all necessary services to the plan’s beneficiaries, known as network adequacy. In order to demonstrate network adequacy, MAOs are required to file annual Health Service Delivery (HSD) tables to show the plan has enough facilities, primary care and specialty physicians, and other provider types within a certain time and distance requirement set by CMS.¹ To have proper network adequacy, an MAO must have contracts with these providers.  CMS has several requirements that must be included in each provider contract between a MAO and a provider. It is then left to the two parties to negotiate a payment rate.

As MA utilization (by both MAOs and Medicare beneficiaries) has grown, so has regulatory enforcement of MA plans and organizations. In a September 2021 report, the U.S. Department of Health & Human Services (HHS) Office of Inspector General (OIG) found that MAOs were leveraging chart reviews and health risk assessments to maximize risk-adjustment payments – in other words, MA plans were fraudulently depicting their patients as sicker than they actually were in order to obtain higher payments from Medicare.² Subsequently, in April 2022, the OIG issued a report finding that 15 of the largest MAOs “have at times denied or delayed beneficiary access to care and provider payment requests for services that met Medicare coverage and MAO billing rules.”³ As a result, the OIG recommended that CMS:

1. “Issue new guidance on the appropriate use of MAO clinical criteria in medical necessity reviews”;
2. “Update its audit protocols to address the issues identified in this report, such as MAO use of clinical criteria, and/or examine particular service types”; and,
3. “Direct MAOs to take additional steps to identify and address vulnerabilities that can lead to manual review errors and system errors.”⁴

CMS concurred with all three of these OIG recommendations,⁵ indicating that additional MA regulation may be forthcoming.

In addition to additional regulations aimed at MAOs, the U.S. Department of Justice (DOJ) has been active over the past decade in regulatory enforcement, largely by pursuing fraud actions against MAOs. A recent New York Times review of “dozens of fraud lawsuits, inspector general audits and investigations by watchdogs” found that 9 of the top 10 MAOs have been accused of fraud, largely in the form of overbilling, which has resulted in overpayments from Medicare totaling billions of dollars.⁶ As recently as 2022, the DOJ has made clear in press releases that one of its priorities is “investigating and litigating a growing number of matters related to the Medicare Advantage program.”⁷

MAOs are expected to face increased enforcement and scrutiny going forward, as MA grows in terms of enrollment and federal spending.⁸ Enforcement actions against MAOs have largely focused on violations of the False Claims Act (FCA), and has primarily involved risk adjustment activities.⁹ Allegations, which vary among MAOs, include:

1. Adding unsupported diagnosis codes;
2. Conducting “one-sided” reviews of patient charts to identify codes (but not deleting them);
3. Developing data mining software to identify missed diagnosis codes, and using addenda to retroactively add them;
4. Using vendors to identify diagnosis codes through in-home assessments of patients; and
5. Failing to delete diagnosis codes that are not supported.¹⁰

In a 2022 report, the HHS OIG criticized MAOs for using prior authorization to deny their members access to services that were medically necessary, and to deny payments to providers for these services.¹¹ The OIG is also expected to increase enforcement actions against MAOs for denial of services that are deemed medically necessary.¹²

On April 5, 2023, CMS released a final rule that would increase the oversight of MA plans, and align them more with Original Medicare plans.¹³ This ruling would:

• Access gaps in behavioral health services;
• Further streamline the prior authorization process;
• Establish additional health plan utilization management oversight processes to include required annual reviews of MA plan policies;
• Establish reviews of coverage denial reviews by healthcare professionals with relevant expertise;
• Tighten MA marketing rules to protect beneficiaries from misleading advertisements and pressure tactics;
• Expand requirements for MA plans to provide culturally and linguistically appropriate services; and
• Make changes to MA star ratings to address social determinants of health.¹⁴

The various government actions described above, with the most recent final rule from CMS, indicate that the federal government may continue its relatively intense regulatory scrutiny of MA plans in the future. CMS, which regulates MAOs, has been urged by MedPAC, the OIG, and the U.S. House of Representatives, among others, to increase oversight and enforcement of MA plans.¹⁵ Whether it will heed these urgings, and further intensify MA scrutiny, remains to be seen.