How Medicare Advantage Plans Should Prepare for RADV Audits

Key Takeaways

• The Centers for Medicare and Medicaid Services (CMS) has expanded Risk Adjustment Data Validation (RADV) audits to cover all roughly 550 eligible Medicare Advantage contracts annually, up from approximately 60 per year.
• Unsupported hierarchical condition category (HCC) codes are the most common audit trigger; every diagnosis submitted for risk adjustment must be directly supported by medical records.
• Closing coding gaps before a RADV audit is far less costly than repaying overpayments after findings are issued.
• Year-round clinical documentation improvement (CDI) programs, not just end-of-year chart reviews, are the most effective line of audit defense.
  ‍

The Audit Environment Has Changed

For years, Risk Adjustment Data Validation (RADV) audits were a background concern for Medicare Advantage Organizations (MAOs). CMS was auditing roughly 60 contracts per year, the backlog was growing, and plans had room to breathe. That picture has changed considerably.

In 2025, CMS announced a significant expansion of the RADV program, committing to audit all eligible Medicare Advantage contracts each year, roughly 550 of them. To support that volume, the agency scaled its workforce of medical coders from 40 to approximately 2,000. The stated goal is to clear the audit backlog covering payment years 2018 through 2024 while simultaneously running current-year audits. MedPAC estimates that Medicare Advantage overpayments tied to unsupported diagnoses could be as high as $43 billion per year, which explains why regulators aren't backing down from this.

The practical consequence is that many plans, particularly mid-sized ones that have never been audited, are not operationally ready for this level of scrutiny.

What RADV Auditors Are Looking For

RADV audits are fundamentally a documentation exercise. CMS pulls a sample of enrollees and checks whether the hierarchical condition category (HCC) codes submitted for risk adjustment are supported by medical records. If a code appears in the submitted data but the underlying clinical documentation doesn't clearly establish that diagnosis, CMS treats it as an error. Enough errors, and the plan owes money back.

This differs from billing audits in an important way. Plans don't need to prove intent. They need to show documentation is complete. That sounds manageable until you start looking at how documentation gets captured across thousands of provider encounters. And when you do, the scale of the problem becomes clearer.

Why Most Plans Are More Exposed Than They Think

The gap between what plans submit and what their medical records support is wider than most expect. An HHS Office of the Inspector General analysis, cited by the Committee for a Responsible Federal Budget, found that approximately 70% of selected diagnosis codes in audited Medicare Advantage medical records were not supported in the associated documentation. Certain high-risk HCC codes showed non-support rates above 90%. 

These aren't findings from poorly run plans. They reflect a systemic documentation gap across the industry, driven by incomplete encounter data, inconsistent provider documentation, missed coding opportunities at the point of care, and retrospective submissions that don't match what's in the chart.

Building an HCC Documentation Foundation

Every RADV readiness strategy starts in the same place: clinical documentation that supports each HCC code submitted for risk adjustment. The medical record must reflect the diagnosis with specificity, continuity, and sufficient clinical evidence to satisfy an auditor reviewing it months or years later.

That standard is harder to meet than it sounds, particularly for chronic conditions, which make up the bulk of high-weighted HCC codes. A diagnosis of diabetes with chronic kidney disease requires documentation of both conditions, their interaction, and ongoing management. A vague reference in a progress note won't hold up. Which raises the practical question of where plans should focus first.

Closing Coding Gaps Before CMS Does

The two main leverage points for closing coding gaps are prospective programs (engaging providers at or before the encounter) and retrospective chart review (identifying missed or incomplete codes after the fact). Both have a role to play.

Prospective programs tend to produce cleaner data. When CDI specialists or coders engage providers near the time of the encounter, documentation is more complete, codes are more accurate, and there are fewer downstream corrections needed. Retrospective review is still essential because plans carry years of historical risk data that may contain significant gaps. A structured retrospective CDI program can surface missed HCCs, flag incomplete documentation, and generate retro billing opportunities that strengthen risk scores before the next submission cycle.

What CDI Actually Delivers in a Medicare Advantage Context

In the Medicare Advantage context, CDI isn't just about catching codes for improving revenue. It's also about ensuring that the true severity and complexity of each member's conditions are accurately reflected in the medical record. That determines MRA scores, which drive plan payments.

We, at HOM, worked with a payor covering 15,000+ lives where a structured CDI program, built around chart review and HCC validation, produced a 40% increase in MRA score. Our CDI team maintains more than 98% accuracy, and our standard turnaround for chart review is 24 hours, which keeps pace with high-volume encounter cycles.

A Proactive Approach, Not a Reactive One

The plans that get through RADV audits with minimal exposure aren't the ones that scramble when a notice arrives. They're the ones that run continuous, year-round CDI programs, maintain submission quality as a standard operational process, and have built enough internal visibility into their risk adjustment data to know where their gaps are before CMS identifies them.

For close to 10 years, we've supported healthcare payers with CDI, HCC coding, and EDPS/RAPS work designed around exactly this kind of continuous quality. We've seen what a last-minute audit response looks like, and we've seen what a well-prepared plan looks like. The difference in outcomes is significant.

If you want to understand where your risk adjustment data stands before your next audit cycle, request a free audit now.

‍

Frequently Asked Questions

1. What triggers a RADV audit for a Medicare Advantage plan? 

CMS selects contracts using statistical modeling and data analytics focused on plans with the highest likelihood of improper payments. Submission anomalies in EDPS and RAPS data, significant year-over-year shifts in risk scores, and prior audit history are all factors that draw attention. As of 2025, CMS has moved toward auditing all eligible contracts rather than targeting a subset, so the question of what triggers an audit has become somewhat less relevant. Every plan should assume it will be reviewed.

2. What happens if a plan can't support an HCC code during a RADV audit? 

Unsupported HCC codes are treated as payment errors. In audits conducted without extrapolation (Note that CMS intends to extrapolate under the RADV final rule), the plan repays overpayments calculated from the sampled records. CMS has appealed that ruling, and the legal dispute over extrapolation remains unresolved. If extrapolation is ultimately reinstated, the financial exposure could scale significantly across the full contract population.

3. What's the difference between RAPS and EDPS submissions, and does it matter for RADV? 

RAPS is a legacy pathway that accepts summarized diagnosis data. EDPS is the encounter-level pathway that CMS now uses for more detailed validation and audit support. Both feed into risk adjustment, but EDPS data is increasingly central to how CMS conducts payment reviews. Plans that rely heavily on RAPS without ensuring their EDPS data quality is equally strong carry higher audit risk as CMS shifts its validation focus to encounter-level records.