GAO Flags Unfinished Fraud Controls in Medicare and VA Payments

A Government Accountability Office review published July 21, 2026, found that Medicare Advantage and the Department of Veterans Affairs’ Community Care program reported large fiscal year 2025 payment-error estimates while neither program had completed a comprehensive fraud-risk assessment.

GAO said Medicare Advantage reported an estimated $23.7 billion in improper payments, equal to 6.1% of program outlays. VA Community Care reported an estimated $608 million in combined improper and unknown payments, or about 2.4% of outlays.

The figures do not mean that every dollar involved fraud, theft or a recoverable loss. The Centers for Medicare & Medicaid Services says improper-payment estimates can include overpayments, underpayments and payments for which available documentation is insufficient to determine whether the payment was proper.

What GAO found in Medicare Advantage

GAO’s report, issued as GAO-26-107946, said CMS’s Medicare Advantage improper-payment rate had not decreased and that the agency’s corrective-action plans were not detailed enough to address underlying problems or measure progress effectively.

CMS reported a fiscal year 2025 Medicare Part C improper-payment estimate of $23.67 billion, or 6.09% of payments. CMS said most of the estimate involved supporting documentation that failed to substantiate diagnosis information submitted by Medicare Advantage organizations for payment.

In practical terms, records reviewed by CMS did not adequately support some diagnoses used in the payment process. That is a payment-integrity finding, not a determination that all affected plans, providers or claims were fraudulent.

Why the RADV backlog matters

Risk Adjustment Data Validation, or RADV, audits are CMS’s primary method for addressing Medicare Advantage overpayments. During an audit, CMS checks whether diagnoses submitted by a Medicare Advantage organization are supported by enrollees’ medical records. If diagnoses are unsupported, CMS may collect overpayments.

GAO said a backlog of RADV audits has contributed to significant delays in recovery efforts. The agency recommended that CMS establish and document a plan to expedite the audits, including cost estimates, planned completion dates and metrics for monitoring implementation and effectiveness.

CMS’s current schedule lists August 2026 as the intended month to initiate audits for Medicare Advantage payment year 2024. The schedule says the dates are subject to change. It is therefore a planned initiation month, not confirmation that all audits will begin or finish in August.

What the review found at VA

VA Community Care allows eligible veterans to receive authorized care from outside providers when services are unavailable through VA or a veteran cannot reasonably travel to a VA facility.

VA’s fiscal year 2025 financial-report material lists $607.67 million, or 2.39% of program outlays, in combined improper and unknown payments for Community Care. The report says VA tested payments made in fiscal year 2024 as part of its fiscal year 2025 reporting. It also identifies $40.19 million as unknown payments, meaning the available information did not allow the agency to determine whether those payments were proper.

VA’s report says most of the Community Care estimate resulted from failures to validate that payments matched contract rates and regulatory requirements. GAO said VA had processes for identifying root causes and corrective actions, but its work to identify fraud risks did not meet the key elements of a comprehensive assessment aligned with the government’s Fraud Risk Framework.

The finding adds scrutiny to VA’s controls as veterans’ reliance on community providers grows. It does not establish that all reported payments were fraudulent or that veterans’ benefits and access to care are changing.

Three recommendations remain open

GAO listed three open recommendations:

VA should complete a comprehensive fraud-risk assessment for Community Care.
CMS should establish and document a detailed plan to expedite RADV audits.
CMS should complete a comprehensive fraud-risk assessment for Medicare Advantage.

VA concurred with its recommendation. CMS neither agreed nor disagreed with the two recommendations directed to it and cited past actions it believed addressed GAO’s concerns. GAO concluded that new CMS action remained warranted.

What happens next

GAO’s analysis was based on work completed from November 2024 through June 2026. The next accountability tests are whether CMS produces the requested audit-expediting plan, whether either agency completes the missing fraud-risk assessment, whether the RADV schedule changes and whether future audits produce documented recovery results.

For Medicare Advantage beneficiaries, the report by itself does not change coverage, benefits or enrollment decisions. For veterans, it signals continued oversight of payments made through outside providers. For taxpayers, the central question is whether federal agencies turn large estimates and known control gaps into measurable improvements.

Sources

Discover more from Interactive News

Subscribe to get the latest posts sent to your email.