CMS has spent the last two years narrowing how Medicare Advantage diagnoses can be counted — audio-only encounters, then unlinked chart reviews. If you want to know what’s next in the crosshairs, the government has already told you plainly: in-home health risk assessments.
If your risk scores lean on diagnoses that appear only on an HRA and nowhere else in the record, this is the exposure to fix before someone else fixes it for you.
1. What the watchdog actually found
$7.5 billion in 2023 risk-adjusted payments rested on diagnoses that appeared only on HRAs and HRA-linked chart reviews — and nowhere else.
In its most recent evaluation, the HHS Office of Inspector General estimated that diagnoses reported solely on health risk assessments and HRA-linked chart reviews — with no corresponding visit, procedure, or test — drove roughly $7.5 billion in MA risk-adjusted payments in 2023.
In-home HRAs were the sharpest edge of it: they generated about 46% of that $7.5 billion while accounting for only about 13% of the HRA records. An in-home visit produced, on average, roughly $1,869 in payments versus about $365 for a facility-based chart review. The concentration is telling.
2. Why a diagnosis with no follow-up is a red flag
OIG’s deeper concern was clinical, not just financial: for roughly 1.7 million enrollees, conditions were coded from these sources with no subsequent visit, procedure, or test. If a diagnosis is real and consequential, something usually happens next. When nothing does, it raises the question of whether the condition was managed — or merely captured.
That is the pattern regulators now read as a marker of risk-score inflation rather than of care.
3. CMS hasn’t closed this door yet — which is exactly why it’s the next one
OIG asked CMS to restrict and audit in-home HRA diagnoses. CMS agreed to only one of three recommendations.
OIG recommended that CMS impose additional restrictions on diagnoses reported only on in-home HRAs, audit them, and identify the conditions most susceptible to misuse. CMS concurred with the third recommendation but not the first two.
So unlike unlinked chart reviews — which CMS is excluding from risk scores starting in 2027 — HRA-only diagnoses remain permitted. That gap is precisely what makes them the probable next target, and it is why the smart move is to get ahead of a change that hasn’t been forced yet.
4. The pressure is coming from three directions at once
This is not one report. In February 2026, OIG issued its first Medicare Advantage-specific compliance program guidance since 1999, explicitly flagging HRAs that generate diagnoses never used in a patient’s care, and chart-review programs that only add codes and never delete them.
In Congress, the bipartisan No UPCODE Act would go further than CMS — excluding diagnoses from HRAs as well as linked and unlinked chart reviews, a change the Congressional Budget Office estimated could save well over $100 billion across a decade. When the watchdog, the compliance guidance, and pending legislation all point at the same practice, that practice has a shelf life.
5. What to do now
Run the analysis most organizations avoid: what share of your captured HCCs is supported only by an HRA, with no confirming encounter? Those are the codes most at risk. Then close the loop clinically — an HRA should surface a condition that a provider then evaluates, documents, and manages at a real visit, not a code that lives and dies on the assessment form.
The organizations that convert HRAs from a coding instrument back into a care instrument will keep their risk scores and their integrity. The ones treating in-home HRAs as a revenue channel are running a strategy on borrowed time.
Final Thoughts
The through-line of the last two years is unmistakable: CMS is systematically dismantling the diagnosis pathways that let risk scores rise without care to match. HRAs are the next logical stop, and every oversight body in the system is pointing there.
As someone trained as a physician who later spent years as a certified medical auditor, I read this as a straightforward call to action: make every diagnosis defensible at a real encounter. An HRA-only code is a liability whether or not CMS has closed the door yet — and the door is closing.
If a meaningful share of your risk capture is supported only by in-home HRAs, you’re carrying an exposure regulators have already named. At HealtheNomics I help MA plans and risk-bearing groups audit HRA-dependent capture and rebuild it on encounter-based, audit-defensible documentation.
Explore the services: https://healthenomics.com/services-2/
Request a strategy conversation: https://healthenomics.com/contact-us/
Connect on LinkedIn: https://www.linkedin.com/in/muhammad-ayoub-ashraf/
Website: https://www.drayoubashraf.com
Watch on YouTube: https://www.youtube.com/@HealtheNomics
