The Audit Queries OIG Published on Purpose

Sitting in a PDF on the Inspector General's website is a SELECT statement.

It runs against CMS_VDM_VIEW_MDCR_PRD.V2_MDCR_BENE_RAPS_MAO_DGNS, filters RAPS provider type 20 for physician claims, and returns every enrollee who picked up an acute stroke diagnosis on a single office encounter with nothing corroborating it in an inpatient or outpatient record. Next to the enrollee key there is a comment: /*CMS enrollee unique identifier, replace with HIC, MBI or plan identifier*/.

That is the query OIG ran in its risk adjustment audits, published verbatim, with the instructions for pointing it at your own data left in the margin.

It has been free since December 2023, on a page called Compliance Toolkits that carries six of them and describes itself without ceremony as "Resources to help providers ensure they are in compliance with health care laws."

Eight Groups, One Test

The Medicare Advantage toolkit (report A-07-23-01213) covers eight high-risk diagnosis groups, and every one of them runs the same test: a diagnosis that pays, with none of the clinical wake that diagnosis should leave behind.

• Acute stroke. One HCC 100 diagnosis on a physician claim, no acute stroke on a corresponding hospital claim. The toolkit lists all 94 diagnosis codes.
• Acute myocardial infarction. One HCC 86 diagnosis, no inpatient claim within 60 days either side. 17 codes, which OIG's clinicians pulled out of the 21 that CMS maps to that HCC.
• Embolism. An HCC 107 or 108 diagnosis with no anticoagulant dispensed. 63 codes, plus the 812 NDCs that count as an anticoagulant.
• Lung, breast, and colon cancer. One diagnosis, no surgery, radiation, or chemotherapy within six months either side.
• Prostate cancer. Same six-month test, ages 74 and under, and a single code: C61.
• Mis-keyed codes. 3,780 published code pairs where a transposition lands the enrollee in a different HCC. I720 typed as I270 moves someone from vascular disease to heart failure.

For each group OIG also names the code it believes was actually supported. History of stroke. History of lung cancer.

Neither maps to an HCC, which is the whole point.

Then it prints its own scorecard. Across the eight groups the table totals 4,081 errors out of 4,543, an error rate of 90%, with acute stroke and breast cancer both at 96%.

OIG puts the caveat in its own footnote, and it deserves repeating: the toolkit "includes only those high-risk groups that had high error rates." Across its MA audits generally the figure is approximately 70%.

The Threshold Comes With a Median

The telehealth toolkit (OEI-02-20-00723, April 2023) does the more unusual thing. It publishes the cutoff and the typical provider side by side.

Seven measures, each with a definition, the arithmetic, and a number where a plan decides you are worth a second look. Four of them print the median too, and the distance is not subtle (chart below).

Billing 2,000 or more telehealth beneficiaries in a year makes you high risk. The median provider billed 21.

Three hundred days of telehealth in a year makes you high risk; the median was 26 days. Order DME after a telehealth visit for half your patients and you are flagged, against a median of 3%.

The other three measures skip the median and say it plainly instead. Bill 100% of a category at the top level and you are out on the tail, because "most providers rarely, if ever, billed at the highest level." Bill Medicare fee-for-service and an MA plan for the same service on more than 20% of your services, or a telehealth service plus an originating site facility fee on more than 75% of visits, and the toolkit's language is the same both times: most providers never billed this way.

Every threshold section then tells the reader to move the number. OIG calls its own cutoffs conservative and points users at central tendency and the distribution to pick their own.

Whose Desk This Lands On

Read the audience lines and neither toolkit is addressed to you. The MA toolkit is written for plans; the telehealth one names "Medicare Advantage plan sponsors, private health plans, State Medicaid Fraud Control Units, and other Federal health care agencies."

"So why would a physician group read the queries a plan runs?"

Because the diagnosis codes in that stroke query came off your claims. When a plan adapts OIG's SQL and it returns a list, that list is a chart request, a retro review, or a deletion that walks back a risk score someone already budgeted against. If you carry delegated risk, it is a recoupment.

And the underlying coding question resolves before any of that. Any patient carrying an acute stroke or acute MI diagnosis from one encounter, with nothing on the inpatient side, is a chart your coders can look at this week.

Same for a solid tumor diagnosis with no treatment in the window. The answer is usually a Z-code that the auditor will reach anyway.

Final Thoughts

OIG has been formalizing this posture for a while. The Medicare Advantage Industry Segment-Specific Compliance Program Guidance landed February 3, 2026, and the toolkits are the operational half of that same argument: here is the risk, here is how we find it, go find it first.

What nobody publishes is whether anyone runs them. There is no uptake statistic, no counter on the page, no way to know how many compliance shops have pasted ACTIVE_STROKE_DX_CODES into a query window. The MA queries have been up for nearly three years and are still sitting there, which cuts both ways.

The auditor's own thresholds, the auditor's own code lists, and a median so you know where you stand: that is an unusual thing for an enforcement agency to hand out, and it costs a download. Whether it changes anything depends entirely on who opens it.

Thanks for reading.