The HHS Office of Inspector General updated its 2026 Work Plan in March 2026, and three audit lanes stand out for billing operations: risk adjustment fraud in Medicare Advantage, chronic care management (CCM) billing patterns, and telehealth services. Per the OIG, Medicare Part B payments for CCM services rose substantially between calendar year 2019 and 2024, and that growth is now driving documentation reviews. Combined with the OIG’s expanded use of data analytics to flag outlier providers, the message to practices is direct: billing for these services is not the risk. Billing for these services without audit-ready documentation is.
What the 2026 Work Plan signals
The Work Plan is a public list of the audits and inspections OIG plans to run, organized by service line and risk category. The 2026 update places renewed emphasis on services where Medicare spending growth has outpaced expected utilization patterns, where prior reviews found high error rates, or where provider behavior changed quickly during and after the public health emergency. CCM, transitional care management, principal care management, telehealth, and Medicare Advantage risk adjustment are explicitly named. Practices that bill any of these heavily, especially if they bill them in volumes that put them in the top decile for their specialty, should expect documentation review at some point in 2026 or 2027.
Risk adjustment fraud in Medicare Advantage
Medicare Advantage plans receive higher per-member capitation when their populations carry higher risk scores, and risk scores are driven by the diagnosis codes providers submit. The OIG continues to investigate practices and plans that submit inflated diagnoses without supporting clinical documentation, a pattern the agency calls risk adjustment fraud. The risk to a practice is not only repayment of the affected claims. It is also potential False Claims Act liability if a pattern is established. The defensible posture is straightforward: every diagnosis on the claim must be supported in the encounter note, every diagnosis must be addressed clinically (assessed, monitored, evaluated, or treated), and every chronic condition must be re-documented at least annually under the M.E.A.T. standard.
Chronic care management under the microscope
CCM billing under CPT 99490, 99491, 99437, and 99439 has grown sharply since 2019. The OIG has signaled it will review whether the time documented in the chart matches the time billed, whether the care plan is genuinely individualized, and whether the patient consent on file is current. The most common documentation gaps are non-specific time entries (for instance, “patient called for medication review, 20 minutes” without describing the substance of the encounter), care plans that look identical across patients, and missing or expired consent. Practices that resolve these three issues before billing each month avoid most of the audit findings the OIG has reported in prior cycles.
Telehealth billing patterns
The OIG continues reviewing telehealth claims for compliance with originating site, geographic, and modality rules where those rules still apply, as well as documentation supporting medical necessity. The agency is particularly interested in providers whose telehealth volumes spiked after pandemic-era flexibilities and who continue to bill at high volumes under the extended 2026 rules. Behavioral health practices billing audio-only sessions under modifier FQ are a current focus, as are practices billing the new audio-video CPT codes 98000-98007 alongside high volumes of the traditional E/M codes 99202-99215. Documentation should establish modality, location, time spent, and clinical content for each session.
How providers get flagged
The OIG and most state Medicaid integrity programs now run continuous data analytics across submitted claims. The flags that most often trigger a chart review include:
- Billing volumes more than two standard deviations above the specialty mean for a service.
- An unusually high ratio of complex E/M codes (99204, 99205, 99214, 99215) compared to peers.
- Chronic care management or principal care management billed in months without documented patient contact.
- Diagnosis additions in Medicare Advantage encounters without corresponding new clinical assessments.
- Telehealth claims at facility rates from non-facility settings, or vice versa.
Building audit-ready documentation
Audit defense is not a chart review project run after a notice arrives. It is a documentation discipline applied at the time of each encounter. The five durable habits that hold up under OIG review are: time-in and time-out entries for any time-based code, M.E.A.T. statements on every chronic diagnosis, signed patient consent on file with a date that pre-dates the first billed service, individualized care plans updated at minimum annually, and a clear modality entry for any telehealth service. None of these add significant time to a well-run encounter. Together they reduce the recoupment risk on the most-audited service lines by an order of magnitude.
The price of getting it wrong
OIG findings typically result in extrapolated repayment, where a sample of audited claims is statistically projected across the full billing period. A 30 percent error rate on a sampled subset of CCM claims can translate to six- and seven-figure repayment demands across two or three years of billing. Practices then carry that overhang into payer credentialing reviews, hospital privileging conversations, and any pending deals or sales. The mitigation is in place before the audit notice, not after.
How MHB helps practices stay audit-ready
For practices that want their CCM, telehealth, and Medicare Advantage encounters reviewed by specialty-trained coders before claims go out, our team provides medical coding and audit-readiness support with M.E.A.T. checks, time-entry verification, and documentation review built into the daily workflow. The work runs in the practice’s EHR, with a dedicated account lead and no setup fees.
The bottom line
The OIG 2026 Work Plan is not a threat to practices that bill these services correctly. It is a threat to practices that bill them without the documentation to defend them. CCM, telehealth, and Medicare Advantage encounters all generate substantial revenue when billed correctly and substantial repayment when they are not. The choice between those outcomes happens at documentation time, not at audit time.
