Most corporate deadlines are negotiable. Slip a week, adjust the scope, manage expectations. Then occasionally an organisation encounters a deadline that is set externally, cannot be moved, and carries a financial penalty measured in percentages of annual revenue, and everything about how it operates changes in response.
American health insurers are currently living through exactly that, and the operational lessons are worth studying regardless of industry.
The clock
Private insurers cover more than thirty million older Americans under Medicare Advantage, receiving monthly government payments scaled to how ill each member’s documented conditions show them to be. Federal auditors verify those diagnoses, and the verification programme has been substantially expanded: an audit workforce grown from roughly forty reviewers to approximately two thousand certified coders, running on a rolling quarterly cycle rather than occasionally.
When an insurer’s contract is selected, the mechanics are unforgiving. Auditors identify a sample of members, and the insurer must produce the complete medical records supporting every diagnosis submitted for those members, within a five-month window. Records that arrive late do not count. Diagnoses without supporting documentation become errors, and the error rate found in the sample is applied across the entire contract.
Reviews published this spring found 81 to 91 percent of certain sampled high-risk diagnosis codes unsupported at three audited plans. In March, a major insurer settled federal claims for 117.7 million dollars.
What five months actually demands
The interesting part is what organisations discover when the clock starts, because it is rarely what they expected.
The bottleneck is almost never analysis. It is retrieval. The records needed are scattered across hundreds of independent provider practices, in systems the insurer does not control, for care delivered five or six years earlier. Practices have closed, changed systems, or simply lost interest in responding to requests about a patient they last saw in 2020.
The second discovery is that internal knowledge does not survive. The coder who made a particular decision has moved on, and if the reasoning was not captured at the time, nobody can reconstruct it. Organisations find themselves defending judgments they cannot explain.
The third is that the deadline exposes the difference between having data and being able to produce it. Plenty of organisations hold everything they need somewhere, and cannot assemble it into a coherent response in the time available.
How prepared organisations operate differently
The pattern across insurers who handle these audits smoothly is consistent, and it has almost nothing to do with what they do after the notice arrives.
They run internal reviews on the government’s own logic, quarterly. Own sample, own testing against the same standard, corrections made before anyone external asks. By the time a real audit lands, the error rate is already known and already reduced.
They capture reasoning at the moment of decision rather than reconstructing it later. Modern ai tools for medicare risk adjustment coding accuracy attach the supporting evidence to every coded diagnosis as a byproduct of the coding itself: the source sentence, the rule satisfied, the reviewer who confirmed it. Assembling an audit response becomes an export rather than a project.
They rehearse retrieval specifically. Not the analysis, the logistics. Testing how fast records actually arrive from external practices, which relationships are responsive, where the failures cluster, and fixing those before the clock matters.
And they correct in both directions, removing unsupported diagnoses as readily as adding missed ones. Investigators have made one-directional review of the central evidence in enforcement actions, so a self-audit that only ever finds favourable errors is worse than none.
The general principle
Every organisation eventually meets a deadline it did not set. Regulatory response windows, litigation discovery, incident reporting requirements, major customer audits. The characteristic of all of them is that preparation time is not available once the clock starts.
Which suggests one exercise worth running before you need it: pick the most demanding external request your organisation could plausibly receive, and time yourselves assembling the response using only what you already retain. Not a plan for how you would do it. The actual assembly.
The gap between what teams assume they can produce and what they can actually produce within a fixed window is, in most organisations, considerably larger than anyone expects. Better to find that out in a rehearsal than in month four of five.
