Emerging OIG Risks Compliance Teams Should Be Watching

The HHS OIG’s latest Work Plan updates provide an important look into the compliance risks, billing practices, and operational areas likely to face increased scrutiny in the months ahead.

Refunds of Deductible and Coinsurance Amounts

Under Medicare rules, hospitals, physicians, and other suppliers may collect deductibles and coinsurance from beneficiaries or certain third parties. However, federal regulations require providers to promptly refund any deductible or coinsurance amounts that were collected incorrectly after a claim is adjusted, denied, or otherwise determined to be overpaid. These requirements are found in 42 C.F.R. § 489.20(a), Sections 1815(a), 1833(e), and 1842(l) of the Social Security Act, and the Medicare Claims Processing Manual, Chapter 1, Section 30.1.2, which states that providers must “refund as promptly as possible any money incorrectly collected from Medicare beneficiaries.” (CMS)

The OIG plans to evaluate whether Centers for Medicare & Medicaid Services adequately monitors whether providers refund Medicare Part A deductible and coinsurance amounts after claims are adjusted or denied. It will also assess whether CMS tracks refunds made by physicians and suppliers for Medicare Part B deductible and coinsurance amounts associated with adjusted or denied claims.

Federal agencies have previously taken enforcement action when providers and plans failed to comply with Medicare billing and refund requirements. For example, CMS may impose civil money penalties, sanctions, payment suspensions, or contract terminations against organizations that substantially fail to comply with Medicare requirements. In addition, the OIG has audited providers that improperly handled Medicare deductible and coinsurance obligations, including providers that failed to follow federal rules governing beneficiary collections and Medicare bad debts. (HHS Inspector General)

CMS contractors may also issue overpayment demand letters and recover funds through offsets and recoupment when providers retain money that should be refunded. (CGS Medicare) Courts and enforcement agencies have further treated the failure to return identified Medicare overpayments as potential violations of the False Claims Act, particularly when providers knowingly retain funds owed back to Medicare or beneficiaries.

Medicare Payments for Spravato

Spravato is a prescription nasal spray used to treat severe depression in adults who have not responded to other treatments. Because it is a controlled substance and can be expensive, Medicare payments for Spravato may be vulnerable to fraud, waste, and abuse. Medicare may pay for the drug either through medical benefits or pharmacy benefits. The OIG has started two projects to review how Medicare pays for Spravato and to look for suspicious billing patterns.

One of the projects is an Audit of Medicare Payments for Spravato while the other will be a Data Brief of Medicare Payments for Spravato.

One example of alleged fraud involved two Missouri doctors who were charged with illegally administering ketamine and a nasal spray version of the drug, including Spravato, while also fraudulently billing Medicare. Prosecutors alleged the clinic failed to follow required safety and supervision rules for administering the medication. (justice.gov)

Compliance with Federal Audit Requirements Applicable to For-Profit Grant Recipients

The U.S. Department of Health and Human Services (HHS) is the largest Federal agency that gives out grant funding, awarding $131.6 billion in 2025. About $4.4 billion of that funding went to for-profit organizations in the United States.

For-profit organizations that spend large amounts of HHS grant money must follow Federal audit rules, including submitting yearly audit reports. Past audits have found problems such as missing or late audit reports and organizations failing to fix issues identified during audits in a timely manner.

HHS agencies are responsible for making sure grant recipients follow these rules, while the Office of the Assistant Secretary for Financial Resources (ASFR) oversees compliance across the entire department. In this review, the OIG will examine whether ASFR properly monitored HHS agencies to ensure they followed Federal audit requirements for for-profit grant recipients.

Examples of fraud and misuse that have occurred in this area include:

• A grant recipient submitting false financial information to hide improper spending of Federal grant funds.
• Organizations using HHS grant money for unapproved expenses, such as executive bonuses, personal purchases, or unrelated business costs.
• Recipients failing to report conflicts of interest or creating fake invoices or contracts to divert grant money to affiliated companies or individuals.

Medicaid Payments to Terminated Providers

Federal law requires States to remove dishonest or abusive providers from their Medicaid programs. This includes providers who were already kicked out of Medicare, another State’s Medicaid program, or the Children’s Health Insurance Program (CHIP). To help identify these providers, CMS uses a system called the Data Exchange (DEX), which allows States to share information about providers who have been revoked or terminated.

For this review, the OIG will examine whether providers listed in DEX as terminated or revoked were still connected to Medicaid claims and payments after they were excluded. It will also measure how much Medicaid paid for services connected to those providers.

Examples of this type of fraud and abuse include:

• A doctor who lost Medicare billing privileges for submitting false claims in one State but continued billing Medicaid in another State because the termination was not identified quickly enough.
• A home health agency that was removed from Medicaid for fraudulent billing practices but continued receiving payments through managed care encounter claims.
• Durable medical equipment companies that were excluded for billing for equipment never delivered, yet continued to appear in Medicaid payment records after being terminated.
• In several enforcement actions by the U.S. Department of Justice and State Medicaid Fraud Control Units, providers excluded from Federal health care programs continued to bill indirectly through related companies or under another provider’s identification number, resulting in improper Medicaid payments.

Medicare Advantage Organizations’ Use of Prior Authorization for Post-Acute Care

Medicare Advantage plans are required to cover the same basic services as traditional Medicare. However, these private insurance plans often require patients and providers to get “prior authorization” before the patient can move to a rehabilitation hospital, skilled nursing facility, or long-term care hospital after being discharged from a hospital.

Federal investigators have found that some Medicare Advantage plans improperly denied these requests, even when the patient met Medicare’s medical necessity rules. In many cases, the denials were later overturned on appeal, meaning the care should likely have been approved in the first place. The OIG will review how often these denials occur and whether patients were wrongly prevented or delayed from getting needed post-acute care.

Specific examples of this problem have included:

• A 2022 report where the OIG found that some Medicare Advantage plans denied medically necessary services, including inpatient rehabilitation and other post-acute care, even though the requests met Medicare coverage rules. The report estimated that 13% of denied prior authorization requests actually met Medicare standards and should likely have been approved.
  HHS OIG Report on Medicare Advantage Prior Authorization Denials
• The American Hospital Association submitted comments to federal investigators describing ongoing problems where Medicare Advantage insurers delayed or denied transfers to skilled nursing facilities and rehabilitation centers after hospital stays. Hospitals argued these denials were interfering with patient care and violating Medicare coverage expectations.
  AHA Letter on Medicare Advantage Post-Acute Care Denials
• A widely reported case involved UnitedHealth Group and its Medicare Advantage operations. Lawsuits and investigations alleged that elderly nursing home patients were denied or delayed access to medically necessary hospital and post-acute care services in an effort to reduce costs. Some cases involved patients allegedly being kept in lower levels of care despite worsening medical conditions.
  Guardian Investigation Into UnitedHealth Medicare Advantage Practices
• News reports and lawsuits have also focused on insurers’ use of artificial intelligence tools to deny post-acute care requests. According to reports, denial rates for nursing home and rehabilitation care increased after some insurers adopted automated review systems. Many of these denials were later reversed on appeal.
  Report on AI-Driven Medicare Advantage Denials

Mississippi’s Efforts to Protect Children Missing from Foster Care

When children disappear from foster care, they face serious dangers. Many are at higher risk of being trafficked, abused, harmed, or becoming involved in crime. Missing children in foster care are also more likely to struggle later with school, jobs, health, and safety issues.

For this review, the OIG will examine the case files of children who went missing while in Mississippi’s foster care system. Investigators will look at whether the State identified warning signs that these children were at risk of running away or being exploited. They will also review whether officials tried hard enough to find the children after they disappeared and whether the children received proper support and services once they returned to foster care.

The study will also look for patterns among the missing children, such as age, placement type, or history of abuse, to determine whether the foster care system failed to protect vulnerable children the way it was supposed to.

Many examples show why this issue is important:

• In May 2026, Mississippi launched “Operation Hope,” a joint effort between state and federal officials to locate missing foster children. Thirteen missing children were found and brought to safety.
  Operation Hope announcement
• A 2025 multi-state law enforcement operation recovered 43 missing children, including children found in Mississippi. Authorities said some cases involved possible human trafficking.
  Operation Northern Lights recovery effort

As OIG scrutiny continues to evolve, organizations that proactively evaluate risk areas and strengthen audit readiness will be better positioned to respond confidently to future reviews and enforcement activity.

To download this blog post as a pdf, fill out the form below.