The Prime Directive of HCC coding

The Department of Justice, Office of Public Affairs released a notice on Jan. 14, 2026 stating that the government had entered into a settlement with Kaiser Permanente, et al for false claims related to HCC coding. The government contended that Kaiser had overbilled CMS by a billion dollars over a nine-year period. Kaiser agreed to pay the government $558 million dollars for claims submitted during this time period related to its joint function as a Medicare Advantage Organization (MAO) and health care provider.  It should be noted that the notice from the DOJ states “The claims resolved by the settlement are allegations only and there has been no determination of liability.”

• The investigation was the result of whistleblowers
• When you read the quotes from the complaint, it’s clear that the government didn’t think these were simple diagnosis coding errors
• Taken with OIG reports of audits of MAO organizations, it’s a blueprint of mistakes and practices to avoid in order to compliantly report diagnoses in risk-based contracts

The complaint itself is a cautionary tale for MAO and health care entities with large risk contracts. This article includes quotes from the complaint itself (keep in mind the settlement noted these are allegations only without a determination of liability) and will illustrate things to do and not do.  These were services provided in physician offices and are subject to Section IV in ICD-10-CM guidelines; that is, outpatient claims not facility/DRG claims.

Most of the issues can be avoided by following one ICD-10-CM guideline, that I call, “The Prime Directive.”  Section IV J:

Code all documented conditions that coexist at the time of the encounter/visit and that require or affect patient care, treatment or management. Do not code conditions that were previously treated and no longer exist.

The complaint succinctly describes HCC coding and how it relates to payment for MAOs. It continues with a description of the False Claim Act and then the government’s “concerns.” Quotations from the complaint are indicated by paragraph number and are in italics.

60. “The CMS-HCC model is prospective in the sense that it uses diagnoses made in a base year (the “service year”), along with demographic information (such as age and gender, among others), to predict costs for Medicare benefits and adjust payments for the following year (the “payment year”). The diagnoses included in the CMS-HCC model are a subset of diagnosis codes from the International Classification of Diseases. The diagnoses in the CMS-HCC model generally include major, severe, and/or chronic medical conditions.”

• Diagnoses are submitted on claim forms and in supplemental files sent by the MAO to CMS.
• The diagnoses must be associated with a face-to-face encounter.
• Diagnoses submitted in a prior year aren’t carried forward for the calculation. In order to be included in the risk adjustment calculation and affect payment in the coming year, the condition must be reported in the current year.

Key principles

Three paragraphs cited by the complaint support this.

79        “First, given the material impact of diagnoses in calculating the Government’s payments, MA Organizations must ensure that diagnosis codes submitted for risk-adjustment payments are accurate, complete, and truthful.”

80        “Second, diagnosis codes submitted for risk-adjustment payments are valid only if they are documented in the medical record as a result of a face-to-face visit between a patient and physician.”

81        “Third, diagnosis codes submitted for risk-adjustment payments must be in conformance with the ICD, including the ICD Guidelines”.

• These points are stated so clearly, it is hard to add anything to them or paraphrase them. What follows are assertions by the government of actions by Kaiser. (Just a reminder about what the DOJ announcement said. “The claims resolved by the settlement are allegations only and there has been no determination of liability.”)

83        For an outpatient visit (sometimes referred to as an encounter), the ICD Guidelines only permit the coding of documented conditions that both exist at the visit and that “require or affect patient care treatment or management.”

84        As CMS explained in a 2013 Participant Guide: “For a chronic condition to be accepted for risk adjustment, the patient must have a face-to-face visit each year with a provider/physician who assesses and documents that condition.”

• These are the key points to remember for risk -based diagnosis coding. Diagnosis coding is complicated. These two rules are simple. The diagnosis submitted on a claim for an encounter must have been assessed and managed at the encounter, or affect the patient care or treatment. Conditions that are in past medical history, are determined based on a medication list or incidental finding on a diagnostic test should not be included on the claim form if they are not assessed and managed at a face-to-face encounter.

Altering medical records

1. “Kaiser obtained these payments by systematically altering patient medical records to add diagnoses that either did not exist or were unrelated to the patient’s visit with the Kaiser physician. Kaiser altered the patients’ medical records to add these diagnoses retrospectively—after the patient medical visit—using a mechanism called an addendum. Often, these addenda were added months or even a year or more after the visit.” 

• Addenda are used in medical records to correct errors, add information that was left out, add the results of a diagnostic test or document a call from a patient or health care professional related to the encounter. CMS doesn’t describe a time limit for adding an addendum but they are typically added within days of an encounter, particularly in an outpatient setting.
• Adding diagnoses months or a year after the encounter, when the condition wasn’t assessed at the encounter, is incorrect.
• Following the ICD-10-CM guideline quoted above, only conditions that “require or affect patient care, treatment or management” should be used. If the condition wasn’t assessed and managed at the encounter, it should not be added to the patient record.

Data mining, addenda and visit relevance

4. “Kaiser would mine a Medicare Advantage patient’s medical file for potential additional diagnoses, regardless of their relevance to the visit. Kaiser would then seek to have the physician add the new diagnoses to the medical record retrospectively using an addendum, as if the new diagnoses had been addressed in some way during the patient visit when in fact they had not been.”

• One example noted in the complaint was to search in diagnostic reports for incidental findings. The complaint alleges that there was a project to identify aortic atherosclerosis from diagnostic interpretations. Radiologists were instructed to note the presence of any calcium in the aorta in their report, regardless of the significance. The data mining team identified these instances by searching in the medical record, and the physician was then asked to add aortic atherosclerosis to a past encounter. The complaint alleges that some of the diagnostic tests were done years before the encounter, and that the condition was not addressed at the encounter.
• The government alleged that the data mining was done only on patients who were participants in the risk adjustment model.

128. “Kaiser also employed a related data-mining program called “refresh,” where Kaiser would mine patient medical files to find old diagnoses that had not been diagnosed in the current service year. Following a patient visit, if a physician failed to address any of these unrefreshed diagnoses, the physician would receive a list of these “missed-opportunity” diagnoses—i.e., opportunities for risk- adjustment payment. Because Kaiser had numerous different initiatives, physicians would often receive lengthy lists of both data-mined diagnoses and missed-opportunity diagnoses.”

• If a patient has a chronic condition, and the condition is assessed and managed, it is reported on the claim form. Many groups have a process in place to remind a practitioner to assess and manage a condition at the time of the encounter. The reminder is given when the patient is seen. The complaint alleges that when the practitioner did not add the diagnoses at the time of the encounter, they would receive a query about a missed opportunity and a request to add those conditions.

160. “Similar to data mining, once Kaiser identified a missed opportunity diagnosis, it began sending the physician queries to add the diagnosis to a visit record. … As further detailed below, these queries routinely violated national standards.”

• The requests “ignored the ICD Guideline requirement that the diagnoses needed to have mattered to the visit.”

Financial incentives

Adding diagnoses that weren’t supported by ICD Guidelines can result in significant increased revenue. The complaint notes these conditions:

Examples from the complaint:

Patient 1 additional diagnosis of atherosclerosis aorta resulted in an additional payment of $2,780.

Patient 2 had atherosclerosis aorta, emphysema and prostate cancer added for an additional payment of $7,282.

Patient 3 had atherosclerosis aorta, morbid obesity, diabetes with other specified manifestations, and colostomy status added for an additional payment of $13,925.

These are three examples from the complaint, and are single examples. The data mining, refresh, and missed-opportunity processes were applied repeatedly in the patient population.

Follow the guideline

The purpose of this article isn’t to put fear into the heart of coders and practitioners related to simple errors in diagnosis coding. Follow the ICD-guideline, what I call The Prime Directive” in selecting diagnoses for encounter visits.  Code all documented conditions that coexist at the time of the encounter/visit and that require or affect patient care, treatment or management. Do not code conditions that were previously treated and no longer exist. There may be disagreements about documentation “does the HPI and A/P really show it was assessed and managed” and these should be discussed rationally and openly.  But the errors described in this complaint were not “the documentation wasn’t quite there,” or “if only there was a little more detail.” Conditions were added which were not assessed or managed, or in many cases noted, at the time of the encounter.

The two whistleblowers in the case shared $95 million in the settlement.

“The claims resolved by the settlement are allegations only and there has been no determination of liability.”

You can read the claim yourself.

https://www.justice.gov/archives/opa/press-release/file/1444936/dl?inline=