Extrapolation Audits in Medicare and Commercial Payer Overpayment Demands
How contractors use tiny samples to calculate massive Medicare overpayment demands.
Extrapolation audits do not resemble ordinary claim reviews, because the number at the end of one has almost nothing to do with the number of claims an auditor actually looked at. A contractor pulls a sample of 30 charts, finds errors in roughly a quarter of them, and uses that error rate to calculate a repayment demand across every claim in the billing population, whether that population runs to hundreds of claims or thousands. The sample stays small. The demand does not.
From a Sample of 30 Charts to a Seven-Figure Repayment Demand
The sequence runs in four steps, as healthcare audit defense attorneys describe it: the auditor defines a "universe" of eligible claims, draws a sample from within it, reviews the sampled records against a coverage or documentation standard, and then projects the resulting error rate back across the full universe. The chart review itself is almost incidental. It is the input to a calculation, not the conclusion of one. A contractor that reviews 30 charts and finds errors in roughly a quarter of them is asserting that the quarter it found in the sample can stand in for every claim it did not review, and billing the practice accordingly.
That distinction changes what a practice is actually defending once extrapolation enters the picture. A provider contesting a single denied claim is arguing about the medical necessity or documentation of one service, for one patient, on one date. A provider contesting an extrapolated overpayment demand is arguing about a mathematical projection, one built on assumptions about randomness, representativeness, and statistical validity that may never have been disclosed, let alone justified. The dispute moves from a clinical question to a methodological one, and the dollar figure attached to it can span an entire billing period, a full service line, or an entire contract population covering years of claims. A seven-figure demand can rest on a documentation review that touched only a few dozen files. Understanding that gap is the starting point for anything that follows.
Where extrapolation audit authority comes from
Extrapolation is not a default tool that a contractor can reach for whenever it suspects a billing pattern is off. It depends on specific legal authority, and that authority varies by program. Extrapolation applies in Medicare fee-for-service reviews, RAC reviews, MAC overpayment determinations, UPIC investigations, Medicaid audits, Medicare Advantage RADV audits, and commercial payer post-payment reviews, and each of those settings rests on a different legal footing. A method that is valid in one program is not automatically valid in another, and a contractor's internal practice of "this is how we've always done it" carries no legal weight on its own.
The official rationale for extrapolation is administrative efficiency: reviewing every claim in a large population with a similar billing pattern would be too costly and too slow to be practical. That rationale has genuine legal support in certain programs and under certain conditions, but it is not a blanket license. For Medicare fee-for-service, the authority runs through Section 1893(f) of the Social Security Act and Chapter 3 of the Medicare Program Integrity Manual. If a contractor extrapolates without satisfying those requirements, it has no valid basis for the demand, no matter how carefully it drew the underlying sample.
That separation matters for how a practice builds a challenge. A valid program rule does not rescue a defective sample, and a well-constructed sample does not substitute for missing legal authority. Those are two distinct failure points, and an effective defense typically has to address both: whether the contractor had the authority to extrapolate at all in this setting, for this claim type, under these program rules, and separately, whether the sample and projection it used were sound. A practice that argues only one of these risks leaving the other unchallenged, even where it is the weaker link in the contractor's case.
The RADV Expansion as a Front-Line Issue for Medicare Advantage Participants
Extrapolation used to be a risk that a minority of Medicare Advantage plans worried about in any given year. CMS's 2025 to 2026 RADV expansion has made it a planning priority for every MA participant, and the exposure now reaches well past the plans themselves into the physician practices that serve their members. CMS announced in May 2025 that it would move from auditing a limited sample of MA plans each year to auditing all eligible MA plans annually, while also working through a backlog of audits covering Payment Years 2018 through 2024. The scale of that shift is difficult to overstate against the program's prior practice.
The audits now run on a defined, recurring schedule. Payment Year 2020 audits began in March 2026 on a roughly quarterly cadence, with CMS publishing a formal audit calendar that lays out the sequence in advance. The operative question for an MA plan is no longer whether a given contract will be audited. It is when that audit arrives.
One structural change inside the audits deserves particular attention, because it alters the math of every repayment demand that follows. CMS previously applied something called the FFS Adjuster, which accounted for the fact that traditional fee-for-service Medicare carries its own baseline rate of documentation variance, so not every unsupported HCC (hierarchical condition category) translated into a full, dollar-for-dollar recoupment. The 2023 RADV Final Rule eliminated that adjuster. Under the rule as written, every unsupported HCC would count as a complete overpayment, with no buffer for the documentation gaps that exist across the Medicare system generally. A federal court vacated that rule in September 2025, and it is currently unenforceable while CMS pursues an appeal, but the underlying design, treating every documentation gap as full loss rather than partial variance, is the model CMS intends to restore if the appeal succeeds.
Layered on top of the FFS Adjuster question is a timeline compression that carries its own financial risk. CMS's plan to complete RADV audits spanning Payment Years 2018 through 2024 in a concentrated window means that some MA plans could face repayment demands for multiple years of alleged overpayments landing nearly simultaneously. Financial officers at these plans are modeling worst-case scenarios around that compressed exposure right now. MA plans increasingly structure risk-sharing arrangements that push repayment obligations down to the physician practices in their networks, so a downstream provider with a substantial MA patient panel can end up liable for a clawback traced to documentation gaps in its own medical records, even though the audit and the headline demand belong to the plan.
The legal cloud over extrapolation that the September 2025 court ruling created
A federal court vacated the 2023 RADV Final Rule in September 2025, and that ruling has introduced genuine uncertainty into how extrapolated RADV recoveries will proceed. It has not stopped the audits, and the question of whether CMS can extrapolate remains unsettled. A practice that treats the ruling as a safe harbor is reading more into it than the court actually decided.
The court's holding was procedural. It found that CMS had not properly promulgated the rule, a notice-and-comment defect in how the agency adopted its new extrapolation methodology, and it did not rule that extrapolation is unlawful as a matter of principle. That distinction matters enormously for what comes next, because a procedural defect can be cured by redoing the rulemaking process correctly, while a substantive finding against extrapolation would have foreclosed the practice. The question the court left open is still open.
In practical terms, CMS is currently recovering overpayments identified through RADV audits only on the sampled enrollees actually reviewed, not on an extrapolated figure projected across the full contract. Extrapolated recovery is paused while the government's appeal proceeds, but the audits themselves continue on the quarterly schedule CMS has published. CMS appealed the ruling in November 2025 and has said that RADV audits will continue through the interim period, which tells MA plans that the agency expects the methodology to be reinstated once the appellate question is resolved.
Major participants in the market are acting on that expectation rather than on the hope that the ruling ends the matter. Alignment Healthcare's FY2025 10-K describes the court's ruling as having created uncertainty about the timing and methodology for issuing findings and recovery actions, while noting that the company continued preparing on the assumption that the government would appeal and that the methodology would eventually be applied. Humana's Q1 2026 Form 10-Q shows the same posture from a different angle: Humana preserved, in its actuarially certified bids through Payment Year 2026, its argument that CMS should apply an FFS Adjuster in any RADV audit it intends to extrapolate. Neither company is operating as though the dispute is settled. Both are preparing for the methodology's return.
How commercial payers adopted extrapolation
Commercial insurers have adopted extrapolation for their own post-payment audits, following the pattern CMS established in government programs, but they operate under fewer procedural constraints than Medicare contractors do. That difference changes both the character of the demands commercial payers issue and the strategy available to challenge them.
One of the fastest-growing categories of dispute involves post-payment "medical necessity" clawbacks aimed at services that were pre-authorized, performed on a physician's prescription, and reimbursed without any objection at the time of payment, only to be challenged months later once an extrapolated review is run. Cases involving MRI facilities in Florida and New York illustrate the pattern: insurers alleged that diagnostic scans were not medically necessary despite the presence of treating-physician orders and prior authorization secured before the service was ever performed. The documentation existed, and the payer approved the service in advance, but the clawback arrived anyway.
A related tactic has grown more common as well. Providers reported more frequently in 2025 that insurers were withholding future payments outright to recover alleged overpayments, without waiting for a completed appeal or any formal adjudication of the underlying dispute. That approach sidesteps the dispute process that would normally give a provider a chance to contest the finding before money changes hands.
The legal footing for a challenge in the commercial setting is different from the government setting in a way that works against providers. Medicare contractors must satisfy statutory authority and the requirements of the Medicare Program Integrity Manual before they can extrapolate. Commercial payers are generally governed by contract terms and state insurance law instead, and those vary widely from state to state and from one participation agreement to the next. A challenge to a commercial payer's extrapolation methodology has to start with the provider's own contract, because the procedural protections built into Medicare's statutory and manual-based framework often have no direct counterpart in a private payer agreement.
The specific grounds on which extrapolation methodology can be challenged
An extrapolated overpayment demand can be challenged at several distinct points in the sequence that produced it, and a provider that waits until the final dollar figure to object is usually arguing too late, at too high a level of generality, to be effective. The more defensible approach examines each step the auditor used to build the number, moving from the final figure back to its source.
The first point of attack is universe definition: whether the auditor correctly scoped the population of claims subject to review, limiting it to the right dates of service, the right providers, and the right claim types. An error here inflates the denominator against which the error rate gets projected, which can produce an overpayment demand larger than any sound methodology would actually support, even if every individual finding within the sample were accurate.
The second is sample validity: whether the sample was genuinely random and whether the randomization procedure was documented in a way that another reviewer could reproduce. This is not a theoretical concern. A federal oversight body found that CMS contractors' extrapolation methodologies and practices were inconsistent across the board, and it recommended that CMS adopt more uniform processes for applying them. That finding means the variation from one contractor to the next is itself a documented weakness, not a hypothetical one, and a provider facing a given contractor's methodology has reason to ask how that methodology compares to the standard the OIG found lacking.
The third is the review standard applied to the individual charts inside the sample: whether the auditor used the correct coverage and documentation standard for each claim, and whether it treated a partial documentation deficiency as grounds for a complete denial when a proportional reduction was the standard that applied. A sample can be drawn perfectly at random and still produce a corrupted error rate if the chart-level reviews inside it were conducted incorrectly, because the projection is only as sound as the individual findings feeding into it.
The fourth is the estimation method itself: whether the auditor used a statistically valid approach to project the sample's error rate across the full universe. A correctly drawn random sample can still be projected using a flawed statistical model, and that makes the projection math a distinct vulnerability, separate from any question about how the sample was selected or reviewed.
The fifth is legal authority, and it runs differently depending on the program involved. In Medicare fee-for-service, authority runs through Section 1893(f) of the Social Security Act and Chapter 3 of the Medicare Program Integrity Manual, and a contractor that proceeds without satisfying those requirements lacks a valid basis for the demand no matter how well-constructed its sample turns out to be. In RADV, the September 2025 court ruling has suspended extrapolated recovery, so whether the contractor retains authority to extrapolate remains unresolved while the appeal works its way through the courts. In the commercial payer setting, authority turns on the language of the provider's own participation agreement and the state insurance law that governs it, which makes the contract itself the starting point for any challenge a provider intends to raise.
