HHS-OIG Issues Medicare Advantage Industry Segment-Specific Compliance Program Guidance

Highlights

• The U.S. Department of Health and Human Services, Office of Inspector General (HHS-OIG) released the Medicare Advantage Industry Segment-Specific Compliance Program Guidance (Medicare Advantage ICPG) in February 2026, the second ICPG in HHS-OIG's planned series announced in November 2023.
• This is the first update to Medicare Advantage (MA)-specific compliance guidance from HHS-OIG in over 26 years, reflecting the recent rapid growth of the MA program, which now includes more than half of all Medicare beneficiaries and accounts for the largest share of Medicare spending.
• OIG identifies the following key risk areas for Medicare Advantage Organizations (MAOs) and those engaging with the MA program: access to care, marketing and enrollment, risk adjustment, third party oversight, and data integrity.

Overview and Purpose

In Feb. 2026, HHS-OIG issued the Medicare Advantage ICPG, providing updated recommendations for compliance programs across the MA sector. This guidance is intended for a broad array of stakeholders, including MAOs, healthcare providers, agents, brokers, vendors, and other entities engaged in the MA program (collectively, MA Parties).

The Medicare Advantage ICPG serves as a centralized resource to help MA Parties identify and mitigate compliance risks, prevent fraud, waste, and abuse, and ensure high-quality, cost-effective care for Medicare enrollees. It complements HHS-OIG's General Compliance Program Guidance (GCPG) issued in November 2023 and updates the prior 1999 guidance for Medicare+Choice Organizations, reflecting the significant evolution and complexity of the MA program over the past decades. Motivating factors for issuing the Medicare Advantage ICPG included:

• The rapid growth of the MA program, which now represents more than half (54% in 2025) of all Medicare beneficiaries and accounts for the largest share of Medicare spending;
• HHS-OIG, the Department of Justice, and other regulatory oversight agencies' continued focus on the MA program; and
• The increasing complexity of the MA program as the number and types of participating entities have grown.

The guidance offers best practices based on HHS-OIG's extensive oversight experience, current enforcement priorities, and input from industry stakeholders. The rapid growth accompanied by increased scrutiny of the MA sector underscores the importance of robust compliance programs. The new guidance is also notable because it is the first in a series of planned ICPGs to be released by this administration and likely means stakeholders can expect similar guidance in other industries to be forthcoming.

Key Compliance Risk Areas

The Medicare Advantage ICPG identifies several core risk areas for MAOs and provides recommendations for mitigation:

• Access to Care: Emphasizes network adequacy, provider directory accuracy, and appropriate use of utilization management tools such as prior authorization. MAOs are encouraged to routinely review provider networks and ensure enrollees have access to necessary services.
• Marketing and Enrollment: Addresses improper financial incentives and deceptive marketing practices. MAOs should implement systems to track payments to agents and brokers, conduct periodic audits, and ensure marketing materials are accurate and non-discriminatory. Oversight of third-party marketing activities is critical to prevent misleading or abusive practices.
• Risk Adjustment: Highlights the financial incentives inherent in the MA program's capitated payment model, which may encourage overstatement of enrollee health status. MAOs should ensure the accuracy and integrity of diagnosis codes submitted to Centers for Medicare and Medicaid Services (CMS) and provide significant oversight of the risk adjustment process.
• Quality of Care: Stresses the importance of providing high-quality care, as reflected in CMS's quality bonus payment program and Star Ratings. MAOs must submit unbiased, accurate, and complete data to CMS and monitor contracted providers to ensure compliance with quality standards.
• Oversight of Third Parties: Recognizes the challenges of delegating functions to third parties, including providers, marketers, and vendors. MAOs should conduct pre-contracting risk evaluations, require compliance-focused agreements and attestations, and implement ongoing monitoring and corrective action processes.
• Vertically Integrated Organizations: Notes the unique compliance challenges presented by common ownership of MAOs and provider groups, data analytics firms, or utilization review entities. Compliance infrastructure should be tailored to oversee these complex arrangements.Submission of Accurate Claims: MAOs must monitor and audit claims to ensure accurate data submission to CMS, identify and return overpayments, and maintain robust controls to prevent false or fraudulent claims.

Compliance Program Structure and Activities

HHS-OIG aligns many of its recommendations to the seven elements of an effective compliance program, with concrete MA-specific practices. Examples include policies to prevent improper denials and ensure network accuracy; reimbursement and data governance controls to ensure submissions to CMS are accurate, complete, and truthful; rigorous processes to approve and oversee marketing materials and track compensation to agents/brokers; and structured third-party oversight frameworks with pre-contract due diligence, auditing/monitoring, and corrective action.

HHS-OIG also stresses robust reporting channels (including anonymous options), special investigation unit capabilities, focused auditing and monitoring of high-risk areas (especially those that affect payment), and timely identification and return of overpayments.

Key Takeaways

With MA at the forefront of enforcement, and with HHS-OIG's Medicare Advantage ICPG now providing detailed, sector specific guidance, compliance has never been more important for MAOs as well as providers, marketers, and vendors that support MA operations. Organizations should consider assessing their programs against HHS-OIG's recommendations, confirm alignment with CMS's mandatory requirements, and prioritize high-risk areas — access to care, marketing/enrollment, risk adjustment, third-party oversight, and data integrity — to mitigate scrutiny and sustain high-quality, compliant care for enrollees. -specific guidance, compliance has never been more important for MAOs -risk areas-party oversight, and data integrity-quality, compliant care for enrollees.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.