In Part One of this series, I described how healthcare compliance has become a chess match between AI on the provider side and AI on the enforcement side. This week, I want to make that real. Because the story that matters is not the framing, it is what is already happening on the ground, in practices that thought they were doing everything right.
A Story You Need to Hear
Picture a mid-sized cardiology practice. They deploy an ambient AI documentation tool — the kind that listens to the encounter, drafts the note, suggests diagnoses, and recommends CPT codes. The clinicians review the output and, because the suggestions are usually right, they accept them about ninety percent of the time. That is reasonable clinical behavior. Nobody is gaming anything. The tool is doing exactly what the vendor promised.
Six months later, the practice’s E&M distribution has shifted measurably toward higher-level visits. They are now sitting in the upper quartile of their specialty peer group. And here is the part that should concern you: nobody inside the practice noticed. No individual chart looks wrong. Every note would hold up under review. The CDI program reported no concerns. The internal coding audit reported no concerns.
But somewhere in a Medicare contractor’s data warehouse, a model noticed that, because that is exactly what the model was built to do.
Eighteen months after deployment, the demand letter arrived.
The Sentence That Matters Most
Here is the line I want you to sit with, because it is the whole story in one sentence:
You can be defensible, chart by chart, and still end up facing an extrapolated overpayment demand.
The audit was not triggered by a bad chart. It was triggered by the shape of the practice’s data relative to its peers. And that kind of distributional problem is completely invisible to a chart-level compliance program. The coders were doing their job. The CDI team was doing their job. The internal auditors were doing their job. The problem is that the job, as currently defined, is no longer sufficient to catch the kind of issue that triggers the modern audit.
This is not about anyone doing something wrong. This is about the surveillance environment changing faster than most compliance programs have adapted to.
Why This Gets Legally Serious
I am not a lawyer, and I am not offering legal advice. But I need you to understand something about the regulatory environment you are working in.
The False Claims Act includes a standard called “reckless disregard.” Courts have interpreted that to include situations in which a provider should have known about a problem but failed to investigate it. Now put that next to our cardiology practice. They deployed an AI tool. Their coding distributions shifted. They did not investigate the shift. The shift increased reimbursement.
You can see where that goes. And the sixty-day overpayment rule does not give an organization much room to say they just had not gotten around to checking.
The defense against that argument is monitoring. If an organization can show that it was watching its distributions, that it saw the shift, that it investigated, and that it reached a documented conclusion — that is a defense. If it cannot show any of that, the question becomes, why not?
The Pattern That Worries Me Most
Of everything I am seeing right now, the pattern that concerns me most is in Medicare Advantage and RADV audits.
AI documentation tools are very good at surfacing chronic conditions that were historically underdocumented — diabetic complications, vascular disease, CKD staging, heart failure with preserved ejection fraction. Clinically, this is arguably an improvement. Patients who actually have these conditions are now getting them documented, and that matters for care.
From a RADV audit standpoint, however, it is a magnet. The contractors are now running their own natural language processing against the same charts to test whether the documentation actually supports those surfaced conditions. Provider AI suggests the diagnosis. Contractor AI audits it. The validation has become algorithmic on both ends.
What this means for CDI specialists and coders is straightforward. Every HCC your AI tool captures is graded by a model designed specifically to identify the gap between what was coded and what was clinically supported. If the documentation is solid, that model is your ally. If the documentation is aspirational, that model will be a problem.
Three Things You Can Do Right Now
One — know where your organization sits. Track your E&M distributions monthly against specialty peer benchmarks, not just your own historical baseline. Your own history will not protect you when the comparison is to your peers. If your compliance department is not already sharing this data with you, ask for it.
Two — watch the modifiers. Modifier 25 and modifier 59 utilization are among the most heavily watched signals in claims surveillance. If either one has increased since your organization deployed a new documentation or coding tool, that is something worth flagging. You do not need to have the answer. You need to have asked the question.
Three — ask who owns AI accuracy. When the AI suggests a code, and the clinician accepts it, who in your organization is responsible for ensuring it is correct? If nobody can answer that question clearly, that is a gap. And it is a gap that matters when the demand letter arrives.
In Part Three, I will talk about what defense actually looks like when the algorithmic audit shows up at your door — and why building that defense before you need it is no longer optional.
