Medicare Advantage Audit Findings and Plan Compliance Outcomes from CMS

CMS's 2024 Medicare Advantage audit findings confirm something practices have known for years without the paperwork to prove it: plans are systematically mishandling prior authorizations, misclassifying coverage requests, and failing to correct compliance problems even after internal monitoring catches them. Medicare Advantage now covers more than 31 million beneficiaries and drives $455 billion in federal spending, so when regulators document plan-level dysfunction at that scale, the consequences land squarely on the practices billing those plans every day. MedPAC's estimate that MA payments in 2024 ran roughly $83 billion above equivalent fee-for-service costs is the number driving CMS's audit escalation, and that escalation is now producing a paper trail practices can use.

What CMS actually audited in 2024 and what the findings covered

CMS ran 39 program audits in 2024, covering 36 parent organizations: 19 routine or full-scope audits and 20 focused audits. Combined, those audits touched 494 contracts, reaching 87.6% of the total Medicare Part C population and 68.8% of Medicare Parts C and D combined. Routine audits alone covered 14.9 million beneficiaries, and the focused audits added another 24.3 million Part C beneficiaries on top of that. This was not a sampling exercise on the margins of the program; it was a look at nearly the entire market.

What CMS found, repeatedly, was that compliance issues inside plans were not being tracked, addressed, or corrected once identified. Internal monitoring at several organizations failed to catch untimely enrollee notifications when delegated entities misread regulatory requirements, meaning the failure often sat one layer removed from the plan itself, in a vendor or subcontractor CMS still holds the plan accountable for. Auditors also documented coverage requests that were misclassified or dismissed outright, a finding that translates directly into delayed access to care for the beneficiary and delayed payment for the provider who rendered it.

The July 2025 report on these findings flagged recurring problems in prior authorization, appeals processing, care coordination, and oversight of delegated entities. Recurring is the operative word; these are not one-off errors from a handful of struggling plans; they are patterns that show up across audit cycles. Civil money penalties from 2025 enforcement came to roughly $1.54 million, a figure that is almost trivial against the revenue of the plans involved, and practices should not expect a penalty of that size to change payer behavior on its own. The audit findings describe failures at the plan level, but each category maps onto a specific point of friction that shows up in a billing office: a denied prior auth, a dismissed coverage request, a notification that arrived too late to matter.

How prior authorization non-compliance shows up as a billing problem at the practice level

Prior authorization volume in Medicare Advantage climbed to nearly 53 million requests in 2024, up from 49.8 million the year before. MA insurers denied 4.1 million of those requests, a 7.7% denial rate. Only 11.5% of denials were appealed, yet among the ones that were, 80.7% got overturned, a rate that deserves attention on its own terms.

An overturn rate above 80% does not describe a system that occasionally gets it wrong and corrects itself on appeal. It describes a system where the initial denial is, more often than not, unjustified from the start, and where the burden of proving that falls on the practice and the patient rather than the plan. That is precisely the pattern CMS's audit findings confirm at the organizational level: coverage requests misclassified, timelines missed, appeals mishandled.

CMS responded by imposing stricter prior authorization processing timeline requirements on plans, an area its own audits had already flagged as a recurring failure. Its own audits had already flagged untimely notifications as a recurring failure, so the timeline requirement is less a new standard than an attempt to enforce one that plans were already supposed to meet. A more recent analysis of the mandatory public disclosures plans now have to file found average standard prior authorization denial rates of 12% in Medicare Advantage in 2025, notably higher than the 7.7% figure covering all determination types. Standard requests, in other words, face tougher scrutiny than the aggregate number suggests.

The surface area for denial keeps expanding, too. MA plans apply prior authorization requirements across a wide and growing range of services, spanning diagnostic imaging, outpatient procedures, specialist referrals, and durable medical equipment. Every one of those service lines is a place where a misclassified or wrongly dismissed request can cost a practice weeks of revenue. CMS's finding that coverage requests are being "misclassified or inappropriately dismissed" is not a description of paperwork sloppiness. It is a tactic, whether by design or by neglect, that delays care and shifts the administrative cost of correcting the error onto the provider. Every MA prior auth denial deserves a second look at whether the plan actually followed its own timeline and its own classification rules, because CMS has now put in writing that many plans do not.

What the major insurers' denial rates reveal — and what regulators found when they looked closely

Federal investigators looked specifically at post-acute care denials among the largest MA insurers and found a gap too wide to be coincidence. Long-term care hospital denial rates ran 71% at UnitedHealth, 72% at Humana, and 80% at CVS Health, compared with 42% across sixteen other MA insurers combined. Inpatient rehabilitation facility denials followed the same shape: 66% at UnitedHealth, 54% at Humana, and elevated rates at CVS Health as well.

That is not a marginal difference. The gap is wide enough that plan-level financial incentives are a natural focus for anyone trying to explain it. Separate investigations have pointed to algorithmic tools at major insurers as a mechanism behind elevated post-acute denial rates, suggesting the technology was a driver rather than a bystander.

The use of such tools has moved past theoretical concern, with legal and regulatory scrutiny increasingly focused on whether algorithmic denial systems comply with MA coverage requirements. The findings here are specific to post-acute and institutional care, and it would overstate the evidence to claim the exact same tools drive every outpatient denial a practice sees. But the underlying mechanism, algorithmic denial calibration paired with delegated entities applying the wrong criteria, is structurally the same machinery producing friction across the rest of MA billing. For a billing team, the practical use of this information is straightforward: knowing which plans deny at disproportionate rates for particular service categories lets a practice build stronger documentation into the initial submission, rather than treating every denial as an isolated surprise requiring reactive cleanup.

How RADV audit expansion changes what MA plans will demand from providers

CMS currently audits between 50 and 60 MA plans a year. The announced expansion pushes that to all 550 active MA plans annually, more than a tenfold jump in coverage. Sample size per plan grows from 35 records to 200, and CMS is scaling its medical coding review staff from 40 people to roughly 2,000 to handle it. This is not a modest adjustment to an existing process; it is a wholesale rebuild of how the program polices itself.

The justification is the $17 billion CMS estimates MA plans overbill the federal government annually. Plans know that number, and they know CMS extrapolates RADV findings, starting with payment year 2018, across a plan's entire audited population. A small sample of documentation errors can therefore generate a very large recoupment demand, because the error rate found in 200 records gets applied to every claim the plan filed that year. CMS is also compressing the review timeline, moving to examine payment years 2018 through 2024 on an accelerated schedule, so plans that expected years to sort out old documentation issues are instead facing concentrated exposure in a much shorter window.

Plans facing that kind of financial risk do not absorb it quietly. The likely response, and one practices should watch for now rather than after the fact, is tighter documentation requirements and, in some cases, contract language that pushes recoupment liability for coding errors back onto providers. Any new MA contract clause touching documentation standards, coding accuracy, or repayment obligations warrants closer reading than it might have gotten a year ago. This is not routine contract housekeeping; it is a direct downstream consequence of RADV expansion, and it is coming.

The denial rate benchmarks that tell practices whether their MA billing is holding up

The headline trend for 2024: initial claim denial rates across payers continued rising year over year. Medicare Advantage specifically saw a notably steep increase in denials from 2023 to 2024, outpacing other payer categories. That is not background noise in the denial data; MA is the category pulling the average up.

Best-in-class practices maintain denial rates well below the industry average, and closing the gap with top performers is increasingly consequential. Getting there in the current environment is harder than it used to be, and more important than it used to be, at the same time. A substantial share of denials trace back to front-end errors, with eligibility issues accounting for a meaningful portion of what should be preventable before a claim ever leaves the building. That means a meaningful chunk of the MA denial problem is fixable upstream, before it turns into an appeal.

Clean claim rate tells a similar story, with a meaningful gap between where most practices operate and recognized performance targets. The gap between where most practices actually operate and where they should be operating is real money, sitting unclaimed in the space between those two numbers. A/R days grew year over year in 2024, while high performers maintained notably tighter collection cycles. MA denial volume is one of the primary forces pushing A/R the wrong direction for everyone else.

The composition of denials shifted too, and the shift matters more than the raw rate. The composition of denials shifted, with plans increasingly framing denials around medical necessity and documentation requests rather than prior authorization grounds alone. That is not plans getting better at prior auth; it is plans reclassifying and reframing how they justify a denial, which lines up exactly with what CMS's audits found at the organizational level. A practice tracking an MA denial rate above 5% in 2025 is not looking at bad luck; it is already absorbing the cost of the exact plan behavior regulators are now documenting.

What practices can do operationally to anticipate and counter the denial patterns CMS is documenting

The audit findings function as more than a compliance narrative about plans; they work as a tactical map for anyone billing those plans. CMS has now confirmed, in writing, that plans miss prior auth timelines, misclassify coverage requests, and fail to correct known problems inside delegated entities. That tells a billing team exactly where to look and exactly what to document.

On prior authorization, the priority is tracking plan-specific timelines and flagging any breach of the 72-hour expedited or seven-day standard windows CMS requires; a missed deadline is a defensible, documented basis for appeal, not a gray area. Every coverage request submission should have its classification recorded at the point of submission, so that if a plan later reclassifies or dismisses it, the practice has a paper trail showing the original request was legitimate. Because prior auth requirements span a wide and expanding range of services, generic workflows no longer cut it; payer-specific checklists, built around which plans are adding requirements and where, are worth the setup time.

Denial management needs the same urgency. With an 80.7% overturn rate on appealed MA prior auth denials, the appeal is worth filing almost every time; the real revenue loss happens when appeals sit in a queue past their filing deadline. Denial reason codes should be tracked by payer in real time rather than reviewed at month-end, because the 2024 shift from authorization denials toward medical necessity and documentation-request denials is exactly the kind of pattern that has to be caught early to be countered at all. Institutional memory matters here too: knowing which MA plans deny post-acute referrals at disproportionate rates, which lean on algorithmic tools, which delegated entities consistently apply the wrong criteria, is knowledge that compounds over time and evaporates the moment billing staff turns over.

Front-end prevention closes the loop. Given how much of the denial problem traces to eligibility errors, real-time eligibility verification before every MA visit is not optional; coverage and benefit details change more often in MA than in traditional Medicare. RADV expansion means plans will scrutinize diagnosis code documentation more aggressively going forward, so practices are better served auditing their own documentation now rather than waiting for a plan-driven record request to arrive first.

The pace of change here outstrips what manual tracking can reasonably keep up with. Payer rules shift, denial justifications shift, and the plans CMS is auditing have already built algorithmic tools to work the system on their end. Practices need pattern recognition and payer-specific memory that scales with that complexity, paired with human billing judgment for the exceptions that don't fit a pattern. CMS's audit program, the new mandatory disclosure requirements, and the RADV expansion are all pointing in the same direction: more accountability demanded of plans, and more documentation scrutiny demanded of providers. Practices that build their billing operations around that reality now will be in a far better position than those still waiting to see how it plays out.