OIG MA Compliance Guidance 2026: What Coders Must Know

A Compliance Wake-Up Call for Every Risk Adjustment Coder

On February 3, 2026, the United States Department of Health and Human Services (HHS) Office of Inspector General (OIG) released its new Industry Compliance Program Guidance (ICPG) for the Medicare Advantage (MA) program. This is the first major update since 1999 -- a 27-year gap -- and it sends a clear signal to every organization and coder involved in Hierarchical Condition Category (HCC) coding: the era of loose risk adjustment practices is over. You can see how the OIG is lining up its enforcement priorities in the agency's own work plan project on CMS-HCC V24 vs. V28 model trends, which feeds directly into the ICPG's risk-adjustment section.

Coming on the heels of the Kaiser Permanente $556 million False Claims Act settlement in January 2026 and an Aetna settlement in March 2026, this guidance is not theoretical. It reflects real enforcement patterns, real investigations, and real penalties. Whether you work for a Medicare Advantage Organization (MAO), a coding vendor, or a provider group submitting diagnosis data, this guidance directly affects how you do your job.

What the OIG Guidance Covers

The ICPG is a voluntary but heavily influential compliance framework organized around seven key risk areas:

1. Access to Care -- ensuring enrollees can reach providers within network adequacy standards

2. Marketing and Enrollment -- honest communication about plan benefits

3. Risk Adjustment -- the section that matters most to HCC coders

4. Quality of Care -- clinical outcomes and care coordination

5. Oversight of Third Parties -- vendor management for coding, chart review, and Health Risk Assessment (HRA) companies

6. Vertically Integrated Organizations -- conflicts of interest when plans own provider networks

7. Accurate Claims Submission -- ensuring every code on every claim is supported

For coders, sections three, five, and seven are where the action is. The OIG has essentially drawn a map of the practices it considers high-risk, and many of them touch day-to-day coding workflows.

Risk Adjustment Practices the OIG Flagged

The guidance identifies specific practices that federal investigations have linked to fraudulent or abusive conduct. Here are the ones every HCC coder should internalize:

Relying solely on chart review to add risk-score-increasing diagnoses. Do not turn historical data or a software flag into a submitted diagnosis. Verify the full eligible record, provider documentation, official code-assignment guidance, and applicable CMS and payer rules. MEAT is not the legal test.

Conducting in-home Health Risk Assessments primarily to generate diagnosis codes. HRAs serve a legitimate purpose in care coordination and identifying unmet health needs. But the OIG has flagged scenarios where HRA vendors are deployed specifically to capture diagnosis codes that drive up Risk Adjustment Factor (RAF) scores without those diagnoses being incorporated into the patient's ongoing care or treatment plan.

Failing to delete unsupported diagnosis codes. When a chart review reveals that a previously submitted diagnosis code lacks clinical support, the organization has an obligation to remove that code from the data submitted to CMS. The OIG found patterns where organizations identified unsupported codes but did not follow through with deletions.

Using artificial intelligence-generated prompts to encourage unsupported coding. This is a new addition that reflects the growing use of technology in coding workflows. The OIG is watching how organizations deploy automated coding tools and whether those tools push coders toward adding diagnoses that are not fully supported by the clinical documentation.

The Kaiser Settlement: A $556 Million Warning

On January 14, 2026, Kaiser Permanente affiliates agreed to pay $556 million to resolve False Claims Act allegations involving Medicare Advantage diagnosis submissions. The Department of Justice announcement says the United States alleged that, from 2009 to 2018, Kaiser pressured physicians to add diagnoses after patient visits through medical-record addenda, sometimes months or over a year after the encounter. The claims were allegations only, with no determination of liability.

The United States alleged that Kaiser used data-mining mechanisms to identify diagnoses that had not been submitted to CMS and sent post-visit queries to providers. DOJ says the resolved qui tam cases were brought by two former employees, Ronda Osinek and James M. Taylor, M.D.

The settlement is a significant enforcement example, but it did not determine liability. The operational lesson is to verify that diagnosis submissions are supported under the applicable CMS and medical-record rules. MedPAC's February 2026 CY2027 Advance Notice comment letter separately urged CMS to tighten risk-score validation around chart-review-driven captures.

What This Means for Your Daily Coding Work

If you are an HCC coder, a coding manager, or a risk adjustment specialist, here are the practical takeaways:

Verify every HCC-relevant diagnosis. The mapping does not establish reportability. Review the medical record and applicable coding, encounter, program, and payer requirements; use MEAT only as an optional checklist.

Question retrospective addenda. If your workflow involves processing provider queries or addenda that add diagnoses weeks or months after an encounter, treat those with heightened scrutiny. Ask whether the condition was actually addressed during the visit. If the addendum is simply adding a code that was "missed" without any clinical narrative to support it, that is exactly the pattern the OIG is targeting.

Audit your HRA-sourced diagnoses. If your organization uses in-home HRAs, verify that diagnoses captured during those assessments are being incorporated into the patient's care plan and addressed by treating providers. A standalone HRA diagnosis that never appears in subsequent office visit documentation is a red flag.

Understand your AI tools. If your organization uses automated coding software that suggests diagnosis codes, make sure you understand how those suggestions are generated. Blindly accepting AI-generated code recommendations without verifying clinical documentation support puts both you and your organization at risk.

Delete what is not supported. If an internal audit or chart review reveals that a submitted diagnosis lacks documentation support, ensure your organization has a process to delete that code from CMS submissions. Knowing a code is unsupported and leaving it in place is not a gray area -- it is the exact behavior the OIG highlighted.

The V28 Connection

These compliance expectations overlap with the non-PACE full-weight use of CMS-HCC V28 in CY2026. The source-checked comparison has 2,267 codes found only in the historical PY2025 V24 mapping and 359 found only in current V28, while the model category count increased from 86 to 115. Those are code-level comparison facts from the CMS 2026 risk-adjustment model software and ICD-10 mappings release and the historical 2025 source. Coders should verify the exact code and payment year instead of extending one family's result to another.

This convergence of stricter compliance guidance and a more specific risk model means that the path forward for HCC coders is clear: code what is documented, document what is treated, and do not chase codes that lack clinical substance.

Protecting Yourself and Your Organization

The OIG's guidance is voluntary, but the enforcement actions behind it are not. Organizations that align their coding practices with this ICPG will be better positioned in Risk Adjustment Data Validation (RADV) audits, DOJ investigations, and whistleblower lawsuits. Coders who understand these expectations protect not only their employers but also their own professional standing.

Review your current workflows against the risk areas identified in the guidance. If your organization has not yet conducted a gap analysis, now is the time to raise the issue with compliance leadership.

Stay Audit-Ready with the Right Tools

Keeping your coding accurate and compliant starts with having reliable reference tools at your fingertips. The HCC Buddy encoder lets you quickly verify ICD-10-CM to HCC mappings under the V28 model, while the CRC reference helps you confirm condition category hierarchies. For checking provider credentials during chart reviews, the NPI lookup tool provides instant access to the National Plan and Provider Enumeration System registry data.

Staying ahead of compliance changes is easier when you are not guessing. If you are not already using HCC Buddy's free coding tools, create an account and build compliance confidence into your daily workflow.