On August 13, 2021, the U.S. Court of Appeals for the District of Columbia Circuit (“D.C. Circuit”), in a much-anticipated decision, unanimously reversed[1] rulings by the U.S. District Court for the District of Columbia (“District Court”) that were appealed by the Centers for Medicare & Medicaid Services (“CMS”) related to Medicare Advantage overpayments (“Overpayment Rule”). The Overpayment Rule requires Medicare Advantage Organizations (“MAOs”) to take appropriate steps to report and return excess payments within 60 days after they are “identified.”[2] Importantly, this decision did not affect the lower court’s ruling that the Overpayment Rule violated the Administrative Procedures Act (“APA”), due to CMS’s adoption of a scienter definition that conflicted with the “knowing” standard of the False Claims Act (“FCA”), as CMS elected to not appeal that holding.


“Traditional” Medicare was established under Parts A and B of Title XVIII of the Social Security Act (as amended, the “Medicare statute”). Unlike traditional Medicare, CMS pays MAOs fixed, monthly payments to assume the financial risk of covering the cost of Parts A and B Medicare beneficiaries’ health care expenses. The Part C payments are determined by a base rate adjusted for certain demographic data and the health status of each MAO member. The health status is communicated through the diagnostic codes MAOs provide to CMS. Some of these codes may risk adjust, which can increase payment to health plans commensurate with expected costs to manage and treat a given enrollee.[3]

CMS and other federal government agencies employ various mechanisms to ensure Medicare Advantage program integrity is maintained. Since 2008, CMS has conducted risk adjustment data validation (“RADV”) audits to make sure the documentation in the medical record supports the diagnosis codes submitted. Following the passage of the Affordable Care Act’s overpayment law and modification of the term “obligation” under the FCA, CMS promulgated the Overpayment Rule in 2014, which requires that entities make appropriate disclosers and steps to effectuate repayment to CMS within 60 days after overpayments are identified by the MAO.[4] CMS’s regulation defined identified as “when the [MAO] has determined, or should have determined through the exercise of reasonable diligence, that the [MAO] has received an overpayment.”[5] Assuming all other requirements are met, failing to take appropriate steps to return overpayments can give rise to FCA liability.

UnitedHealthcare Insurance Co. (“United”) successfully challenged the Overpayment Rule in the UnitedHealthcare Ins. Co. v. Azar case. The District Court struck down the Overpayment Rule, holding that the Overpayment Rule violated the Medicare statute’s “actuarial equivalence” and “same methodology” requirements.[6] Additionally, the lower court found that CMS’s failure to adopt a Fee-for-Service payment Adjuster (“FFS Adjuster”) was arbitrary and capricious, in violation of the APA. Finally, the court held that CMS’s adoption of a pure negligence intent standard, which required proactive auditing and an exercise of reasonable diligence, was a departure from the FCA, also in violation of the APA. CMS appealed all of the lower court’s rulings except for the District Court’s ruling on the intent standard required under the FCA.

The Decision

On appeal, the D.C. Circuit agreed with CMS and vacated the portions of the lower court’s decision that were on appeal. The D.C. Circuit held that Congress’s directives to CMS to account for “actuarial equivalence” and “same methodology” in computing payments to MAOs did not apply to the Overpayment Rule. The D.C. Circuit further found that the Overpayment Rule was not “arbitrary and capricious” in violation of the APA for CMS’s failure to adopt a FFS Adjuster to account for errors in the FFS model, which is used as the basis for payment under Medicare Part C.

  1. The D.C. Circuit Rejected United’s “Actuarial Equivalence” Challenge to the Overpayment Rule

The Medicare statute requires CMS to adjust payment amounts to MAOs based on risk factors “so as to ensure actuarial equivalence” between that insurer’s beneficiary population and the costs incurred by traditional FFS Medicare, Parts A and B.[7] United claimed that CMS failed to ensure actuarial equivalence by relying on essentially unaudited traditional Medicare data (which has errors) to calibrate the monthly payment rates for Medicare Advantage insurers, while at the same time obligating MAOs to refund all errors. United argued that the Overpayment Rule’s more stringent standard was inconsistent with the mandated actuarial equivalence standard. Of note, United did not challenge the actuarial equivalence of the risk adjustment model or, more specifically, the mechanism the model uses to assign value to certain risk conditions. The District Court agreed with United, finding that the Overpayment Rule would “inevitabl[y] lead to the loss of actuarial equivalence . . .” because the Overpayment Rule “systematically devalues payments to Medicare Advantage insurers by measuring ‘overpayments’ based on audited patient records” while the initial payments are based on unaudited records.[8]

Reversing the lower court’s decision, the D.C. Circuit ruled that “actuarial equivalence does not apply to the Overpayment Rule or the statutory overpayment-refund obligation under which it was promulgated,” reasoning that actuarial equivalence and the refunding of overpayments appear in “different statutory subchapter[s],” that neither provision cross-references the other, and that both “serve different ends.”[9] Additionally, the D.C. Circuit referenced the Affordable Care Act’s 60-day overpayment obligation for all health care providers[10] and restated that actuarial equivalence is neither referenced nor permitted as a defense to or to be considered in the refund of overpayments.[11] The D.C. Circuit also agreed with CMS’s interpretation of the actuarial equivalence requirement, stating that “[it] is not an ‘entitlement . . . to a precise payment amount’ . . . but only ‘an instruction to the Secretary [of HHS] regarding the design of the risk adjustment model as a whole.”[12]The D.C. Circuit essentially viewed the workings of these core Medicare Advantage payment authorities as operating in distinct universes, wholly separate and apart from the Overpayment Rule, which ensures the integrity of those payments. 

  1. The D.C. Circuit Rejected United’s “Same Methodology” Argument

United also contended that the Overpayment Rule failed to abide by the “same methodology” directive of the Medicare statute, which requires CMS to establish risk factors for Medicate Advantage beneficiaries “using the same methodology as is expected to be applied in making payments under” traditional Medicare.[13] While the District Court found that CMS failed to use the “same methodology,” not accounting for the “crucial data mismatch” between audited and unaudited data,[14] the D.C. Circuit rejected this argument as well, finding that this requirement, as with the actuarial equivalence requirement, “does not bear on the overpayment-refund obligation.”[15]

  1. The D.C. Circuit Ruled That CMS Was Not Arbitrary and Capricious in Its Implementation of the Overpayment Rule

United contended that CMS was arbitrary and capricious in violation of the APA in implementing the Overpayment Rule, departing from its intent, at least historically, to apply a FFS adjustment to the results of a RADV audit to account for error rates made under traditional Medicare, to the results of a RADV audit. In the wake of high-profile FCA litigation, including United’s challenge, CMS modified its position and made clear in the November 2018 proposed RADV rule that it no longer would apply a FFS Adjuster, citing a then-recent (and criticized) study that showed that errors in the FFS data had no real impact on the payment rates to Medicare Advantage plans.[16] The D.C. Circuit agreed with CMS, determining that CMS’s “one-time intention to apply the [Medicare] adjustment in one context but not the other was reasonable” given that CMS’s RADV audits and the Overpayment Rule’s obligations are “plainly distinguishable” error-correction mechanisms.[17] This decision suggests that CMS can operate RADV—an audit specifically designed to ferret out and recoup Medicare Part C overpayments—in a manner inconsistent with the Overpayment Rule.

Impact of Decision

Undoubtedly, government enforcement agencies are pleased with the outcome of this decision. In turn, this will generate further national emphasis on risk adjustment investigations, which show no signs of slowing down. This decision should be put in context, though.

Saving successful certiorari (assuming that path is even being considered), United merely unsuccessfully attacked the interplay of the Part C payment model with the Overpayment Rule. It bears mentioning again that the decision did not touch on the failed negligence standard CMS attempted to impose on MAOs via the Overpayment Rule. The District Court found that this negligence standard was inconsistent with the “knowing” standard under the FCA. The FCA defines “knowingly” as having “actual knowledge” or acting “in deliberate ignorance” or in “reckless disregard of the truth and falsity of the information.”[18] Though CMS did not appeal this particular piece, when disagreeing with United’s arguments regarding mandated risk adjustment audits, the D.C. Circuit expressly stated that “[n]othing in the Overpayment Rule obligates insurers to audit their reported data . . . the Rule only requires insurers to refund amounts they know were overpayments, i.e., payments they are aware lack support in a beneficiary’s medical records. That limited scope does not impose a self-auditing mandate.”[19]

This litigation, while significant, is one set piece in a much larger risk adjustment enforcement and regulatory landscape. Additional CMS rulemaking and sub-regulatory guidance should be expected related to RADV audits and Medicare Part C payment overall. Moreover, key risk adjustment cases, such as United v. Poehling,[20] and scores of investigations are yet to be resolved. Accordingly, developments such as this will incrementally shed more light into the murky halls that MAOs and their downstream entities unwillingly find themselves operating in relative to the fraud and abuse laws.  

* * *

This Insight was authored by Jason E. Christ; Edward J. Loya, Jr.; Teresa A. Mason; and Matthew Sprankle. For additional information, please contact one of the authors or the Epstein Becker Green attorney who regularly handles your legal matters.


[1] UnitedHealthcare Insurance Co. et al. v. Becerra et al. (“UnitedHealthcare”), case number 18-5326 (D.C. Circuit 2021).

[2] See 79 Fed. Reg. 29844 (May 23, 2014). See also 42 C.F.R. § 422.326.

[3] These beneficiaries’ diagnosis codes for risk adjustment purposes are derived from ICD-10 diagnoses that providers determine from a patient encounter, which may map to certain Hierarchical Condition Categories (“HCCs”) that justify a risk adjusted payment (i.e., those diagnoses attributed to higher-risk beneficiaries).

[4] See 42 U.S.C. § 1320a-7K(d); see also 31 U.S.C. § 1349(b)(3).

[5] See 42 C.F.R. § 422.326(c).

[6] See UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 192 (D.D.C. 2018).

[7] See 42 U.S.C. § 1395w-23(a)(1)(C)(i).

[8] See UnitedHealthcare, 330 F. Supp. 3d 173.

[9] See UnitedHealthcare, at 3-4. In stating they serve different ends, the D.C. Circuit noted the following regarding the actuarial equivalence and overpayment rule provisions: “The role of the actuarial-equivalence provision is to require CMS to model a demographically and medically analogous beneficiary population in traditional Medicare to determine the prospective lump-sum payments to Medicare Advantage insurers. The Overpayment Rule, in contrast, applies after the fact to require Medicare Advantage insurers to refund any payment increment they obtained based on a diagnosis they know lacks support in their beneficiaries’ medical records.” See id. at 4.

[10] See Section 6402(a) of the Affordable Care Act (2010).

[11] See UnitedHealthcare, at 32.

[12] See id. at 34.

[13] See 42 U.S.C. § 1395w-23(b)(4)(D).

[14] See UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 187.

[15] See UnitedHealthcare, at 5.

[16] See 83 Fed. Reg. 54982. See also CMS’s study, Fee for Service and Payment Recovery for Contract Level Risk Adjustment Data Validation Audits, available at https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-Risk-Adjustment-Data-Validation-Program/Other-Content-Types/RADV-Docs/FFS-Adjuster-Excecutive-Summary.pdf and https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-Risk-Adjustment-Data-Validation-Program/Other-Content-Types/RADV-Docs/FFS-Adjuster-Technical-Appendix.pdf.

[17] See id. at 6.

[18] See 31 U.S.C. § 3729(b)(1)(A).

[19] See UnitedHealthcare, at 31 (emphasis in original).

[20] United States ex rel. Poehling v. UnitedHealth Grp., Inc., No. 16-cv-8697 (C.D. Cal.).

Jump to Page

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.