Program Integrity: Actions Needed to Reduce Improper Payment and Fraud Risks in VA Community Care and Medicare Advantage

TL;DR

GAO found significant gaps in VA’s Community Care program and CMS’s Medicare Advantage program that leave both designated high-priority for improper payments in FY2025. VA reported a Community Care improper payment estimate of $608 million (2.4% of outlays) and has processes to identify root causes and implement corrective actions, but lacks a comprehensive fraud risk assessment. CMS reported a Medicare Advantage improper payment estimate of $23.7 billion (6.1% of outlays) and, while it identifies root causes, its corrective action plans—especially for expediting Risk Adjustment Data Validation (RADV) audits—are not sufficiently detailed and a RADV audit backlog delays recoveries; CMS also lacks a comprehensive fraud risk assessment. This raises near-term program integrity, recovery, and compliance risk for contractors operating in Healthcare Services, Revenue Cycle, Risk Adjustment, Medical Auditing, and Fraud Detection segments. Immediate implications: heightened audit pressure, potential for increased oversight and recovery actions, and greater scrutiny of billing, documentation, and fraud controls. Contractors should assume follow-on agency activity and prepare to support RADV and related audit workflows while monitoring solicitations and corrective-action opportunities.

Key Points

• What happened: GAO reviewed VA Community Care and CMS Medicare Advantage and found both programs designated high-priority for improper payments for FY2025; VA estimated $608 million (2.4%) and CMS estimated $23.7 billion (6.1%) improper payment estimates, and GAO identified gaps in fraud risk assessments and corrective-action monitoring.
• Who is affected: Healthcare Services and adjacent market segments, including NAICS codes listed in segmentation (621111, 621112, 621399, 621491, 621492, 621493, 621498, 621511, 621610, 621910, 621991, 621999, 622110, 622210, 622310, 623110, 623210, 623311, 623312, 524114, 524292, 541611, 541612, 541990) and agencies VA and CMS (HHS).
• Timeline: Analysis is based on GAO work completed from November 2024 through June 2026 and addresses improper payment estimates for fiscal year 2025; follow-on actions and solicitations timeline—Timeline TBD pending source review.
• What contractors should do NOW: Inventory and harden documentation and coding for claims and risk-adjustment submissions; prepare to support RADV and audit requests; align internal fraud risk and corrective-action processes with federal expectations; configure monitoring and opportunity pipelines in Cabrillo Signals War Room and Match Engine to detect related solicitations and corrective-action contract opportunities.

Who Is Affected

Affected market segments at a glance:

• Healthcare Services / Medical Services
• Healthcare IT
• Revenue Cycle Management / Medical Billing and Coding
• Healthcare Fraud Detection / Healthcare Analytics
• Risk Adjustment Services / Medical Auditing Services
• Healthcare Compliance / Managed Care / Third Party Administration

Specific NAICS codes, agencies, contract vehicles, and compliance regimes explicitly identified in the segmentation:

• NAICS: 621111, 621112, 621399, 621491, 621492, 621493, 621498, 621511, 621610, 621910, 621991, 621999, 622110, 622210, 622310, 623110, 623210, 623311, 623312, 524114, 524292, 541611, 541612, 541990
• Agencies: VA, HHS (CMS referenced in Summary)
• Contract vehicles: VA FSS Schedule 65, T4NG, Stratton VA Medical Center BPAs
• Compliance regimes: HIPAA, HITECH, FAR (Federal Acquisition Regulation) Part 31, DFARS (Defense Federal Acquisition Regulation Supplement) 252.242-7006, Improper Payments Elimination and Recovery Act, Payment Integrity Information Act

Frequently Asked Questions

Q: What specifically did GAO find about improper payments in these programs?

A: GAO found both programs are on OMB’s high-priority improper payments list for FY2025. VA estimated $608 million (2.4% of outlays) for Community Care and has implemented root-cause processes and corrective actions but lacks a comprehensive fraud risk assessment. CMS estimated $23.7 billion (6.1% of outlays) for Medicare Advantage, has root-cause identification but weak corrective-action detail and monitoring—particularly a backlog and insufficient plan for RADV audits—and has not completed a comprehensive fraud risk assessment.

Q: Are there immediate compliance or audit actions contractors should expect?

A: Expect increased agency scrutiny around documentation, coding, risk-adjustment submissions, and audit support requests (including RADV-related activities). Specific enforcement actions, timelines, or new solicitations—Pending source review.

Q: What operational steps should contracting teams prioritize this week?

A: Prioritize secure, audit-ready claims documentation; validate risk-adjustment data and submission controls; review internal fraud risk processes; and activate monitoring and capture workflows to identify corrective-action contract opportunities. For detailed playbook and automation, see the Intelligence Response below.

Definitions

• Improper payment: Payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements (term used in Title and Summary).
• Risk Adjustment Data Validation (RADV) audits: Audits used by CMS to validate risk-adjustment data and identify improper payments in Medicare Advantage (term used in Summary).
• Fraud risk assessment: A structured process to identify inherent fraud risks, assess likelihood and impact, determine tolerance, evaluate controls, and document a fraud risk profile (term and elements referenced in Summary).
• Community Care program: The VA program discussed in the GAO review (term used in Title and Summary).
• Medicare Advantage program: The CMS program discussed in the GAO review (term used in Title and Summary).

Intelligence Response

• Cabrillo operationalization: This event was detected and delivered by Cabrillo Signals War Room. Cabrillo Signals War Room flagged the GAO findings and immediately rescored affected opportunity pipelines via Cabrillo Signals Match Engine. Our Intelligence Hub is tracking VA and CMS (HHS) program integrity activity and will surface RADV-related corrective-action solicitations and audit support requirements to capture teams.
• Products to leverage now:
• Cabrillo Signals War Room — Already detected this event and delivered this briefing. Use it to monitor policy announcements, OMB high-priority lists, and GAO or OIG follow-ons in real time.
• Cabrillo Signals Match Engine — Rescore active and prospective opportunities in healthcare, risk adjustment, and audit-support pipelines to prioritize capture efforts tied to corrective-action work.
• Cabrillo Signals Intelligence Hub — Configure saved searches for VA and CMS solicitations, RADV/audit-support opportunities, and Payment Integrity follow-ons; set alerts for SAM.gov (System for Award Management) postings.
• Proposal Studio (Proposal OS) — Build compliance matrices, win themes, and audit-support narratives for RADV and improper-payment recovery work.
• Proposal Studio Workflow Tracker — Run a 9-gate capture and compliance review for rapid pursuit and to create audit-ready documentation.
• Who to notify:
• Capture/Business Development Lead — immediate bid/no-bid and pipeline reprioritization.
• Compliance/Risk Lead — review fraud-risk and documentation controls.
• Revenue Cycle / Program Delivery Lead — prepare audit response and operational readiness for RADV and claims validation.
• CFO/Contracts Lead — assess financial exposure and potential recoveries.
• First 48-hour response playbook:
• Hour 0–4: Convene war room (Capture Lead, Compliance, Revenue Cycle, Finance). Pull Cabrillo Signals War Room briefing and enable Match Engine rescoring for top-priority opportunities.
• Hour 4–12: Run Intelligence Hub saved searches for VA and CMS corrective-action solicitations; map existing contracts to risk-adjustment and claims-processing exposure.
• Hour 12–24: Use Proposal Studio to generate audit-support templates, compliance matrices referencing relevant acts (Improper Payments Elimination and Recovery Act; Payment Integrity Information Act) and internal fraud controls; assign Proposal Studio Workflow Tracker gates.
• Hour 24–48: Finalize prioritized capture list, assign teams for audit-response readiness, and schedule stakeholder briefings; begin outreach prep for potential task orders or BPAs tied to corrective actions.

See the primary hub for capture fundamentals: Winning Federal Contracts Guide (/insights/winning-federal-contracts). For compliance and CUI (Controlled Unclassified Information) handling references, see CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide) and CUI-Safe CRM Guide (/insights/cui-safe-crm-guide).