I Tried to Break OIG’s $462 Million Stroke Finding. Here’s Why I Couldn’t.

Whenever OIG releases one of these Medicare Advantage risk-adjustment audits, the industry response is reflexive: attack the sample. Sampling bias. The methodology misrepresents the degree of improper payments. Ninety-seven enrollees projected across 240,000 — please. It’s the defense plans reach for on their own RADV audits, and it’s the first instinct of most compliance teams.

So when the HHS Office of Inspector General concluded that CMS “potentially overpaid Medicare Advantage organizations $462 million” on unsupported acute stroke diagnosis codes, I didn’t react to the headline — I went after the methodology myself. I ignored the press release, sat down with the appendices, and tried to break the number the way a plan’s lawyers would. I couldn’t, and the reasons it holds up are exactly the reasons the “sampling bias” rebuttal fails. Here’s what the audit was looking for, what it found, the objections I worked through, and what it means for a plan.

What they were looking for

OIG didn’t sample Medicare Advantage at large. It built a deliberately high-risk pool: enrollees whose physician records carried one of 95 flagged acute stroke codes during the 2020 service year, but who had no corresponding hospital claim for an acute stroke that year (and who weren’t already capturing the more severe cerebral-hemorrhage code). Clinically, that pattern is suspect on its face — a genuine acute stroke almost always involves a hospitalization. After screening, the pool came to 240,401 enrollees, carrying roughly $477 million in acute-stroke-related payments.

From that pool they drew a stratified random sample of 100 — stratified by payment size — and had credentialed coders review the medical records to decide whether each acute stroke code was actually supported. The scope matters and the audit is careful about it: the finding only ever claims to describe this high-risk pool, not the whole program.

What they found

Of the 100 sampled, 97 were in scope; plans produced records for 93 and couldn’t locate records for 4. Of the 93 charts actually reviewed, zero supported the acute stroke code. Not most — all of them.

The pattern was consistent and mundane. In 68 of the 93, the acute code had been documented at an in-office follow-up visit, after the condition had plainly resolved — a prior stroke sitting in the patient’s history with nothing acute happening that day. One physician had told the patient to follow up in twelve months; as the reviewer noted, a genuine acute stroke gets an ambulance, not a twelve-month recheck. The correct code in those cases is “history of stroke,” which carries no risk-adjustment payment at all.

And the dollars were real, not nominal. The audit recalculated each enrollee’s risk score with the unsupported code removed and measured the net change — it even netted down for one plan that had actually underpaid itself by submitting an acute code in place of a better-supported, higher-paying one. Projected across the pool, the point estimate is about $462 million, and even the conservative low end of the range is $442 million — roughly 93% of every dollar at risk.

Lessons for plans

Strip away the statistics and the entire $462 million reduces to one habit: coding the status of the condition at the encounter you’re billing. An active stroke under treatment is one code. A prior stroke with no lasting deficits is “history of” — which doesn’t raise the risk score at all. A prior stroke that left deficits is a third code entirely. The audit is, at bottom, a measurement of how often the non-paying history code got submitted as the paying acute one.

That distinction isn’t a judgment call to make under pressure on coding day. It’s a process you build before the auditor calls: documentation standards, a second set of eyes on high-risk categories like acute stroke, and a record defensible enough to survive exactly the review OIG ran. Plans that operate that way don’t show up in a sample like this. Plans that don’t are reading their own number off a report like this one.

A concrete place to start: pull your own acute stroke codes submitted from physician encounters that have no corresponding hospital record. That’s the precise signature OIG mined — and you can run it on yourself before they do.

FAQ

Does $462 million mean Medicare Advantage coding is fraudulent across the board?

No — and this is the most common misread. The number describes a pool engineered to be high-risk: acute stroke codes with no matching hospital claim. It says nothing about coding that wasn’t pre-screened for that pattern. The finding is real, but it’s a finding about a targeted subset, not a verdict on the program.

Is a 97-person sample really enough to project onto 240,000?

Counterintuitively, yes. A sample’s reliability depends on the absolute sample size and how variable the result is — not on the ratio of sample to population. Here the result was nearly uniform: 0 of 93 reviewed charts supported the code. When a finding is that lopsided, a small sample pins it down tightly, which is why the projected range is so narrow.

Wasn’t the sample hand-picked, and therefore biased?

The pool was targeted on purpose — that’s a selection decision, not a flaw. But the 97 were drawn from that pool at random, with every enrollee having a known chance of being chosen. Random selection from a defined list is exactly what licenses projecting back to that list, and the audit only projects back to the high-risk pool.

Isn’t the logic circular — they picked cases with no hospital record, then failed them for having no hospital record?

No. The pool was built from claims data (no matching hospital record). The codes were judged from medical records — coders reading the physician’s own chart against coding rules. Different question, different evidence. A case could enter the pool and still pass review if the chart documented a real acute event. None did. If it were truly circular, they wouldn’t have needed coders at all.

Inpatient coding is notoriously incomplete. Couldn’t missing hospital codes explain this?

This was my best objection, and it doesn’t survive the data. Validation was keyed to the physician’s chart, not the hospital claim — so a real stroke the hospital fumbled but the physician documented would have passed review. The sample counts exactly those cases and found essentially none; the math caps the “actually fine” share of the pool under 4%. It also misreads the clinical picture: these codes sat on routine follow-up visits for resolved strokes, where the correct code is “history of” no matter what any hospital recorded.

Were the codes even material — did removing them actually save money?

Yes. The audit measured net dollar impact, not face value, and the pool was built so nothing more severe in the hierarchy would absorb the loss. In two of the three payment tiers, the savings equaled the full value of the code. The $462 million is net of offsetting corrections — recoverable money, not a code count.

What about 2020 being a pandemic year?

A fair caveat. Disrupted 2020 care patterns could put some legitimate encounters into unusual shapes, and the standard here is documentation, not clinical truth. Those considerations define the edges of the estimate; they don’t dent the core projection.

I went looking for the hole in this audit because that’s the discipline I bring to every finding before I let a client react to it. This one holds. The right response isn’t to argue with it — it’s to make sure your own codes could survive the same review.

Mark Bigelow is the founder of Bigelow Healthcare Consulting, where he helps Medicare Advantage organizations build risk-adjustment coding that holds up under audit. The OIG report discussed here is A-02-23-01020 (May 2026).