# Oz Promised Audits of Every Medicare Advantage Plan. GAO Found $23.7bn in Improper Payments—and No Complete Fraud-Risk Map.

Published: 2026-11-01

None of those links establishes that an individual insurer committed fraud.

# Oz Promised Audits of Every Medicare Advantage Plan. GAO Found $23.7bn in Improper Payments—and No Complete Fraud-Risk Map.

*An accountability investigation | United States | Research cutoff: 1 November 2026*

**Dek:** The Trump administration promised to expand audits of private Medicare plans. A 2026 federal audit found that the payment-error rate had not fallen, while inspectors identified disputed overpayments at named insurers. The missing public test is whether new audits produce documented recoveries without sacrificing patient care.

## The verdict: a tougher announcement is not yet a recovered dollar

The Trump administration's Centers for Medicare & Medicaid Services announced a dramatic expansion of Medicare Advantage payment audits in May 2025. Administrator [Mehmet Oz](/people/mehmet-oz) said the agency would move from auditing roughly 60 plans annually to approximately 550 eligible contracts in newly initiated audits. By July 2026, however, the [Government Accountability Office's examination](https://files.gao.gov/reports/GAO-26-107946/index.html) found a different, narrower fact: CMS had not furnished a sufficiently detailed plan showing how its expansion would be completed, what it would cost, or how its effectiveness would be measured. GAO reported a **$23.7 billion fiscal-2025 Medicare Advantage improper-payment estimate**, equal to 6.1% of relevant program outlays. That estimate is not a finding that insurers committed $23.7 billion of fraud, nor an amount already adjudicated for collection.

The financial incentive is real and structural. Private insurers receive monthly risk-adjusted payments; more supported diagnoses can justify higher payments for patients with greater expected needs. Unsupported diagnoses can also inflate payments. New 2026 inspector-general audits estimated at least $130.9 million in overpayments for a HumanaChoice contract and separate estimates of $24.5 million and $46.9 million for two UnitedHealthcare contracts. The companies disputed findings and recommendations. These are **auditors' estimates for selected older payment years**, not court judgments, proof of intent or evidence that the three sums have been recovered.

The accountability question is therefore not whether every Medicare Advantage insurer cheats. It is whether Congress and the administration can distinguish valid payment for sicker patients from unsupported coding, recover established overpayments, and disclose what the new audit program actually accomplishes. The public record supports a documented oversight gap, not a charge of political collusion or a quantified private windfall.

## Three numbers that must never be added together

The first number, **$23.7 billion**, is CMS's fiscal-2025 estimate of Medicare Advantage improper payments reported by [GAO](https://files.gao.gov/reports/GAO-26-107946/index.html). The audit says the estimated rate has stayed near 6% since the fiscal-2023 baseline even as the program grew. It measures a defined payment-integrity problem under the government's sampling and documentation rules. It is not equivalent to proved intentional fraud. A payment can be improper because supporting records are missing or inconsistent, even if a beneficiary received appropriate care.

The second number, **$76 billion**, is [MedPAC's projected 2026 difference](https://www.medpac.gov/wp-content/uploads/2026/03/Mar26_MedPAC_Report_To_Congress_SEC.pdf) between payments to Medicare Advantage and what Medicare would have spent for the same beneficiaries in traditional fee-for-service Medicare after adjusting for coding intensity and favorable selection. MedPAC describes an estimated 14% excess relative to that counterfactual. It expressly cautions that this difference is not an estimate of insurer profit or administrative costs. Much of the extra payment can finance supplemental benefits and protection from medical bills. It is a different metric, for a different year, derived from a different methodology.

The third number is [KFF's estimate of more than $13 billion](https://www.kff.org/medicare/medicare-will-spend-more-than-13-billion-on-the-medicare-advantage-quality-bonus-program-in-2026/) in 2026 Medicare Advantage quality bonuses. These bonuses follow star-rating rules, not a finding of erroneous diagnosis coding. The program can reward improved quality, but its design also changes revenue available to plans. KFF cautions that this estimate is a lower bound under its assumptions. None of these three figures should be summed to manufacture a total fraud bill.

A useful reader test is to ask whether a dollar represents a payment error, an economic comparison with a hypothetical alternative, an incentive payment, an audit extrapolation, or a settlement. Confusing those categories would misidentify both the reported conduct and the people who might benefit.

## The documentary timeline: what Washington actually decided

The oversight weakness predates the current [White House](/organizations/white-house). GAO says it warned in 2016 that Medicare Advantage risk-adjustment audits were taking too long. In 2017 it recommended more systematic fraud-risk assessments. CMS later created a risk-assessment framework, and in 2024 assessed utilization-management controls, but the [July 2026 GAO review](https://files.gao.gov/reports/GAO-26-107946/index.html) found that exercise did not contain the elements of a comprehensive fraud assessment: inherent risks, likelihood and impact, risk tolerance, suitability of controls, and a documented fraud-risk profile.

In November 2024 CMS began audits for payment year 2018. Its officials later told GAO that automated record intake shortened an expected review period from roughly 18 to 12 months. In May 2025, [CMS under Oz announced](https://www.cms.gov/newsroom/press-releases/cms-rolls-out-aggressive-strategy-enhance-accelerate-medicare-advantage-audits) a much larger programme. It proposed technology-assisted screening, expansion of medical coders from about 40 to approximately 2,000, and more medical records reviewed per contract. It also committed to work with HHS's inspector general on old uncollected amounts.

The distinction between an announcement and execution appeared quickly. GAO reported that CMS missed its expected autumn 2025 initiation timetable for several payment years. Officials cited multiple factors, including a government shutdown and the absence of a sufficiently detailed completion plan. CMS revised its timetable in December 2025. A [January 2026 industry briefing](https://www.ahcancal.org/News-and-Communications/Blog/Pages/CMS-Releases-Update-on-Medicare-Advantage-RADV-Audit-Plans.aspx) described changes to record-submission periods after industry concerns about administrative burden.

By 2026 the published [CMS schedule](https://www.cms.gov/files/document/radv-audit-schedule.pdf) showed actual initiations for payment years 2020 on March 20, 2021 on May 29, and 2024 on August 28. Payment year 2023 was scheduled for November 2026, 2022 for January–February 2027, and 2025 for April–May 2027. The order is not chronological; the document says dates may change. The [CMS announcements register](https://www.cms.gov/data-research/monitoring-programs/medicare-advantage-risk-adjustment-data-validation-radv-program/radv-announcements) corroborates the 2020, 2021 and 2024 starts. A start date establishes that the agency initiated an audit cycle. It does **not** establish a final audit finding, a collectible debt, a paid recovery or a net saving.

On July 21, 2026, GAO issued two recommendations directed to the CMS administrator: document a detailed plan with costs, completion dates and performance measures, and conduct a comprehensive Medicare Advantage fraud-risk assessment. HHS neither agreed nor disagreed with those recommendations. It pointed to its schedule, expanded contracted resources and technology. GAO responded that the evidence supplied did not yet include the required detailed operating plan. That disagreement is a concrete public test for Oz's promise, rather than a speculation about his private intentions.

## A power map with real veto points

Congress creates and finances the Medicare Advantage system, establishes statutory payment and integrity obligations, conducts hearings and can change the law. The July 2026 report was addressed to House oversight subcommittee leaders Pete Sessions and Kweisi Mfume. Their committee's oversight power is meaningful, but a congressional report alone cannot recover a disputed insurer payment. Lawmakers can request the missing performance record, question CMS and HHS leaders, legislate audit authority and resources, or leave the existing system in place.

[President Donald Trump](/people/mig-donald-trump) appoints and politically directs the executive leadership within the law. HHS leadership supervises CMS; Administrator Mehmet Oz controls the operational audit strategy and the agency's response to GAO recommendations. Those are distinct roles. No evidence in the reviewed documents shows that Trump personally selected the disputed diagnosis codes, approved any particular insurer claim, or instructed auditors to favor a company. Assigning such actions to him would be invention.

CMS has the immediate administrative leverage: it specifies risk-adjustment submissions, commissions reviews, makes payment determinations, provides dispute procedures and pursues recovery under applicable rules. The independent HHS inspector general can examine specific contracts and recommend refunds, but an inspector-general recommendation is not automatically a completed collection. The Justice Department has a separate enforcement path for cases it alleges violate the False Claims Act. Courts, settlements and procedural appeals can determine the legal outcome. A company may contest an extrapolated audit result even when sampled medical records show deficiencies.

The insurers and their clinical partners hold another kind of power: they generate and gather diagnosis documentation, contract with providers, design home-assessment programmes and submit data that feed CMS payments. Their influence over the records does not give them authority to decide whether an audit is valid. Conversely, CMS's power to demand records does not eliminate providers' time costs or patients' interest in receiving care.

## How a diagnosis becomes money

Medicare Advantage substitutes a contracted private-plan model for traditional Medicare coverage. CMS pays an insurer a monthly amount for each enrolled person, adjusted for factors including documented health conditions. This is intended to avoid paying the same amount for a comparatively healthy person and someone with expensive chronic illness. The system would be unfair without some way to reflect genuine differences in expected medical need.

But the method creates an incentive to find and report more diagnoses. [KFF's July 2026 analysis](https://www.kff.org/medicare/decoding-medicare-advantage-coding-intensity/) explains why additional coding can increase risk scores even when care use does not increase proportionally. That is not, by itself, evidence that an individual diagnosis is false. A diagnosis documented during a home visit can identify previously overlooked disease. A diagnosis lacking clinical support, or left in a payment file after it should be removed, raises a different question.

GAO's account of CMS's process identifies two checkpoints. Reviewers first determine whether records are valid, including signatures, dates and clinician credentials. They then test whether the records substantiate the diagnosis. Problems can include contradictory documentation, a condition no longer present, incorrect coding or an unsupported patient-reported condition. CMS generally tests after payments, rather than validating every diagnosis before monthly amounts are calculated. The agency says universal prepayment medical review would be costly and difficult given the programme's scale.

This sequencing matters financially. A questionable diagnosis can affect a payment before the agency finishes its review. Years may then pass between the payment year, audit initiation, findings, dispute and recovery. A plan may face costs to retrieve older records from clinicians who have moved or merged. GAO reported that national plan associations warned overlapping audits could divert staff time from patient care. CMS said it had clarified rules and allowed more time to submit records. A good recovery programme must show both accuracy and proportionality.

## Named corporate cases: estimates, disagreements and settlements

A [2026 HHS inspector-general audit of HumanaChoice contract H5216](https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-humanachoice-contract-h5216-submitted-to-cms/) examined selected high-risk diagnosis groups for 2020 and 2021. Inspectors said 178 of 220 sampled enrollee-years had unsupported diagnosis codes, producing $669,237 in overpayments within the sample. They extrapolated at least **$130,922,653** and recommended a refund and additional compliance work. Humana disagreed with some findings and all recommendations. The public recommendation page listed the main refund recommendation as open and unimplemented, with an expected update in March 2027. The extrapolation is not an assertion that all Humana payments were improper.

For [UnitedHealthcare Benefits of Texas, contract H0609](https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-unitedhealthcare-benefits-of-texas-inc-contract-h0609-submitted-to-cms/), inspectors reported unsupported codes for 172 of 230 sampled enrollee-years, $622,927 in sampled overpayments and an estimate of at least **$24,465,369** for 2020–21. The company disputed some findings and sought withdrawal of all recommendations. A [separate UnitedHealthcare of Wisconsin audit, H5253](https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-unitedhealthcare-of-wisconsin-inc-contract-h5253-submitted-to-cms/), found 183 of 250 sampled enrollee-years unsupported, $722,280 in sampled overpayments and an extrapolated estimate of at least **$46,913,121**. United disputed findings there too. The estimates concern distinct contracts; none proves a corporate-wide fraud rate or a final debt.

Civil enforcement records show a different legal stage. On March 11, the [Justice Department announced a $117.7 million Aetna settlement](https://www.justice.gov/opa/pr/aetna-agrees-pay-1177-million-resolve-false-claims-act-allegations) resolving allegations of inaccurate diagnosis submissions and failure to withdraw them. On June 3, [Matrix Medical Network, HealthFair and a founder agreed to $56.5 million combined](https://www.justice.gov/opa/pr/matrix-healthfair-and-healthfair-founder-agree-pay-565m-resolve-false-claims-act-allegations) to resolve separate allegations involving diagnoses from in-home assessments. On September 30, [Independence Blue Cross agreed to $22.5 million](https://www.justice.gov/index.php/opa/pr/independence-blue-cross-pay-225m-resolve-false-claims-act-allegations) in a diagnosis-coding settlement. An October 6 [AIDS Healthcare Foundation settlement of $1.44 million](https://www.justice.gov/opa/pr/aids-healthcare-foundation-agrees-pay-144m-settle-false-claims-act-allegations) concerned reported failures to investigate and delete unsupported codes. These are announced civil resolutions of allegations, not findings that every named organization was criminally convicted.

The corporate names matter because they identify actual programme participants, not because their market share proves culpability. A separate [Reuters report on July 7](https://www.reuters.com/legal/litigation/unitedhealth-says-most-home-health-diagnoses-were-supported-2025-2026-07-07/) recorded UnitedHealth's contrary evidence: an external review of 200 home visits found nearly 97% of 494 diagnoses supported in its 2025 HouseCalls sample. That sample concerns a different programme, period and review method from the OIG's 2020–21 high-risk-code samples. Neither can erase the other. Both belong in an account that is serious about testing competing evidence.

## The financial beneficiaries are not necessarily wrongdoers

A private plan can benefit legitimately from risk-adjusted payments that reflect the cost of sicker members. Insurers also have financial incentives to improve star ratings because higher ratings can generate additional government payments. In October, [Reuters reported](https://www.reuters.com/legal/litigation/humana-surges-after-emerging-top-beneficiary-2027-medicare-star-ratings-2026-10-09/) that Humana expected 95% of its Medicare Advantage members to be in plans rated at least four stars for 2027, compared with 20% for 2026. Its share price rose sharply. Analysts discussed potentially substantial future bonuses, but projections for 2028 are not booked revenue and a stock-price response is not proof of wrongdoing.

The [KFF bonus analysis](https://www.kff.org/medicare/medicare-will-spend-more-than-13-billion-on-the-medicare-advantage-quality-bonus-program-in-2026/) also describes the countervailing public benefit: plans may use additional funds to improve benefits, reduce premiums or cost sharing, or support providers. The strongest argument for preserving risk adjustment is that without it, insurers would have an incentive to avoid expensive patients. The strongest argument for tougher audits is that public money should not rise merely because a code was added without valid support. Both arguments can be true.

The available records do not establish personal financial ties between Oz, Trump or members of Congress and any specific disputed contract. Nor do they establish that political donations determined an audit outcome, settlement or reimbursement. This investigation identifies the payment mechanism and named corporate participants; it does not substitute generalized industry influence for a documented personal conflict of interest.

## Who pays when the audit system falls behind?

Taxpayers finance Medicare's federal obligations. Beneficiaries have a stake in the solvency of the programme and in whether plans use their resources for real care. If unsupported diagnoses increase federal payments, the public may pay more than required. If an audit wrongly rejects a valid diagnosis, an insurer may spend heavily to defend an appropriate payment. If aggressive record demands disrupt clinicians, patients may bear indirect costs. These are competing risks, not interchangeable outcomes.

The programme's scale also makes crude shortcuts dangerous. GAO noted approximately 35 million Medicare Advantage enrollees as of March 2025. Checking every medical record before payment would be a different undertaking from postpayment sample audits. The policy choice is not simply whether to investigate more. It is how to set a defensible audit sample, document extrapolation rules, allow appeals, collect money after valid determinations, and publish the cost of doing so.

The most useful performance measures would include audit cycles started and completed, the age of the oldest unresolved payment years, gross overpayments identified, amounts finally sustained after dispute, actual cash recovered, administrative costs, net savings, error reversals, and effects on provider workload. These are proposed accountability indicators, not claims that the administration currently reports all of them. Without them, a large audit count could become another impressive announcement whose financial results remain opaque.

## The strongest counter-case

CMS did not sit idle. It publicly announced an ambitious expansion, initiated multiple 2026 payment-year audits, described additional coders and technology, and cooperated with the inspector general. HHS told GAO that its approach addresses the recommendations. GAO itself recognized CMS had a functioning root-cause identification process and had partially implemented corrective measures. The dispute is over completeness, timing and measurement, not the existence of any oversight.

Insurers likewise have defensible objections. Old records can be difficult to obtain; overlapping audits can demand substantial staff time; clinical diagnoses may be valid even if an audit sample initially lacks documentation; and extrapolation magnifies the importance of fair methodology and appeals. The UnitedHealth home-visit review is evidence that a separate, recent sample found substantial documentation support. It does not conclusively validate all past submissions, but excluding it would distort the case.

MedPAC's $76 billion comparison also needs its own counterargument. Its methodology compares different populations after complex adjustments and does not imply that beneficiaries would receive identical services under traditional Medicare. Private plans may offer extra dental, vision and other coverage. A credible reform debate must weigh both the fiscal opportunity and the service consequences.

## What the evidence cannot yet answer

The examined public documents do not supply a reconciled record linking each newly initiated RADV cycle to final recoveries, litigation outcomes, programme costs and net taxpayer savings. The OIG recommendation pages list disputed estimates, not proof of collection. A Justice Department settlement is a different legal instrument from a CMS extrapolated audit. A MedPAC counterfactual is not a cash transfer to a particular insurer. The political record shows authority and announced policy, not a demonstrated personal motive or improper enrichment.

Three tests could falsify the concern raised here. CMS could release a complete, independently verifiable audit programme plan and recovery record; subsequent audits could show a sustained fall in the properly measured improper-payment rate; and a comprehensive fraud-risk assessment could document that identified risks are addressed. Conversely, repeated missed deadlines, uncollected sustained debts, or missing performance measures would strengthen the concern. This investigation has not obtained nonpublic claims, contracts or donor-level transaction records, and no insurer was contacted for a new right-of-reply response; the published objections and statements are represented as such.

The actionable finding is narrower than a political slogan: **Oz's administration has begun expanding audits, while the July 2026 GAO record shows it had not yet demonstrated a complete, measurable route from audits to recoveries.** Congress can demand that route. Patients, taxpayers and honest plans all have an interest in knowing whether it works.

## Source trail and method

This reconstruction compares [GAO's July 2026 audit](https://files.gao.gov/reports/GAO-26-107946/index.html), the [CMS audit expansion announcement](https://www.cms.gov/newsroom/press-releases/cms-rolls-out-aggressive-strategy-enhance-accelerate-medicare-advantage-audits), [CMS's published audit calendar](https://www.cms.gov/files/document/radv-audit-schedule.pdf), three named [HHS-OIG audit](https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-humanachoice-contract-h5216-submitted-to-cms/) records, [DOJ civil resolutions](https://www.justice.gov/opa/pr/aetna-agrees-pay-1177-million-resolve-false-claims-act-allegations), [MedPAC's congressional analysis](https://www.medpac.gov/wp-content/uploads/2026/03/Mar26_MedPAC_Report_To_Congress_SEC.pdf), [KFF's independent analysis](https://www.kff.org/medicare/decoding-medicare-advantage-coding-intensity/) and [Reuters reporting](https://www.reuters.com/legal/litigation/unitedhealth-says-most-home-health-diagnoses-were-supported-2025-2026-07-07/). Each numerical statement is attributed to its own methodology and period. The source record records more documents than this compact trail. All dates and audit states are bounded by the research cutoff of 1 November 2026.

*Editorial state: draft for independent fact, legal, source and right-of-reply review. Not approved, imported or published.*

## Methodology

https://factrail.ai/methodology

Canonical: https://factrail.ai/articles/medicare-advantage-2026-radv-audits-improper-payments-oz-gao