For years, Risk Adjustment Data Validation (RADV) audits were something most Medicare Advantage Organizations (MAOs) could treat as a background concern because they only affected a small subset of plans each year.
That era is over. The increased costs of Medicare Advantage plans and a series of CMS audits pushed the agency to modernize its approach to audits by vastly expanding RADV audits to assess whether plans are submitting codes that comply with CMS rules for HCC coding.
The result is that in 2026, RADV has become an operational priority for every payer participating inMedicare Advantage. Changes to audit scope, cadence, and enforcement mechanisms have fundamentally altered the financial risk calculus for every MA plan.
Here's what payer teams need to understand about what has changed, why it matters, and how they can evolve RADV audit preparedness to meet the new reality with confidence .
From 60 Plans to 550: The shift in scale
Historically, CMS audited somewhere between 30 and 60 Medicare Advantage contracts per year, which represented just a small fraction of the more than 500 eligible plans.
In May 2025, CMS announced that it would audit all MA contracts annually for risk adjustment data validation, beginning with Payment Year 2019..
To accomplish that goal, CMS scaled its internal resources. By expanding its certified medical coder workforce from roughly 40 reviewers to about 2,000. In addition, the agency committed to deploying AI-enabled tools to support coder efficiency, though all final overpayment determinations will remain with certified human reviewers.
The new RADV audit reality: At a glance
Quarterly cadence: Why RADV audits are now routine for Medicare Advantage plans
Beyond scale, the rhythm of audits has also changed fundamentally. CMS now initiates newRADV audits approximately every three months. It publishes a formal audit calendar so that MA plans can understand audit timelines and prepare accordingly. Payment Year 2020 audits began in March 2026, with subsequent payment years to follow on a quarterly schedule.
The accelerated audits have the window between audit cycles, generating real operational strain. Plans that previously went years between reviews now need to maintain near-continuous readiness and have to staff and enable their teams accordingly: After closing one payment year audit’s medical record submission, it’s almost immediately preparing for the next initiation. RADV readiness is no longer a periodic project: it is a required program.
The FFS adjuster is gone: What it means for risk adjustment
One underappreciated element of the new RADV framework is the elimination of the Fee-for-Service (FFS) Adjuster. Previously, the FFS Adjuster worked as a buffer: because documentation errors exist in traditional Medicare too, CMS adjusted MA overpayment calculations to account for baseline documentation variance. That meant that not every unsupported HCC translated directly to a dollar-for-dollar recoupment.
Under the 2023 RADV Final Rule, that consideration was removed. Every unsupported HCC is now treated as a 100% overpayment. It’s a zero-tolerance environment for documentation variance. This change resets what "acceptable" documentation quality looks like for HCC code validation.
What the January 2026 CMS memo clarified
In a January 27, 2026 Health Plan Management System (HPMS) memorandum, CMS provided important revisions following stakeholder feedback on its initial May 2025 announcement. Several changes offer meaningful relief for payer and provider teams:
The five-month submission window is restored.
CMS had initially shortened the medical record submission window to three months, exciting significant industry pushback. The January memo retreated from the deadline and restored the five-month window, giving plans and their provider partners more runway to pull, organize, and submit documentation.
Sample sizes are variable, not universal
CMS confirmed that audit samples will range from 35 to 200 enrollees, scaled to contract size. This means smaller plans won’t face the maximum 200-member sample.
Two records per HCC, but only one required.
Plans may submit up to two medical records per audited HCC code, but CMS only needs one valid record to support the diagnosis and maintain payment. This limits repetitive documentation demands and chart chases, but still requires rigorous preparation.
The extrapolation question: Legal uncertainty remains
Risk adjustment professionals specializing in RADV audits are already aware of the statistical and operational framework that CMS intends to use for extrapolated recoveries. CMS has already published detailed audit methodologies, sampling instructions, and payment error calculation approaches for RADV audits, including PY 2020 audit guidance.
What remains unsettled are certain legal questions related to extrapolated recoveries: In September 2025, a federal court vacated portions of the 2023 RADV Final Rule on procedural grounds. The court did not rule that extrapolation is inherently illegal, only that CMS failed to follow the required notice-and-comment rulemaking process. CMS appealed the ruling in November 2025 and has stated that RADV audits will continue in the interim. As a result, most Medicare Advantage plans have continued to prepare as though extrapolated RADV exposure will remain a long-term reality, regardless of the outcome of the current litigation.
The backlog headache: Payment years 2018 through 2024 are all in scope
CMS is committed to auditing all payment years from 2018 through 2024, and to working through a significant backlog that accumulated during years of slower enforcement. That means plans may have to manage audit preparation for multiple payment years at once. Each will have its own member samples, different records to request, and submission deadlines to meet.
Federal estimates suggest MA plans may be submitting unsupported diagnoses resulting in approximately $17 billion in overpayments annually. That figure and the associated negative press, has given the current administration strong political motivation to accelerate enforcement. CMS leadership has been vocal about the agency's commitment to addressing what it characterizes as widespread billing inaccuracies.
How payer teams can prepare
The operational implications demand more than incremental adjustment. Teams that have historically treated RADV as a periodic fire drill need now have to understand it as an inevitability, and must build durable infrastructure across three areas:
1. Medical record retrieval strategy
The five-month submission window sounds manageable until you're managing multiple simultaneous payment year audits across hundreds of providers. Modernizing retrieval infrastructure is increasingly a necessity rather than a nice-to-have.
But perhaps more important than the infrastructure is the strategy: in other words, the ability to prioritize record chases based on timely insights helps plans allocate retrieval resources efficiently across multiple concurrent RADV audit activities.
2. HCC deletion workflows
To adapt to guaranteed CMS scrutiny, leading risk adjustment programs are adopting a more programmatic approach to HCC code deletion approach: retrospective risk adjustment coding is no longer just about finding and adding supported diagnoses. It has to also include a process for proactively identifying and retracting unsupported ones before submission.
In a regulatory environment where every unsupported HCC is a 100% overpayment—and trigger extrapolation—strategic deletions are low-cost insurance against much larger recoupment exposure. While CMS has already closed the window for deletions on the payment years for 2026 RADV audits, plans need to take proactive action going forward toward deleting codes they can’t support during an audit.
This is a much harder task than identifying new codes—one that requires technological efficiencies to be done well.
3. Provider engagement and documentation education.
Finally, the most important line of defense against unsupported codes is the same as the strategy for increasing HCC recapture: increasing encounter-level documentation quality.
Plans should be actively working with providers to close documentation gaps before they become audit findings, particularly for the HCC categories that CMS targets most aggressively, such as acute MI, stroke, major depressive disorder, vascular claudication, and oncology diagnoses like breast, colon, lung, and prostate cancer.
Integrating clinical guidance directly into EHR workflows at the point of care is the most effective way to prevent gaps from occurring in the first place.
RADV: The look ahead
The connection between retrospective HCC coding quality and RADV performance deserves more attention than it typically receives, and most experienced plans have woken up to that reality. The best RADV defense is a strong offense: rigorous provider documentation education, and retrospective chart review vendors with advanced chart parsing technologies, high coding accuracy, and sophisticated deletion strategies.
Frequently asked questions about RADV audits
What is a RADV audit?
A Risk Adjustment Data Validation (RADV) audit is a CMS audit process used to validate whether diagnoses submitted by Medicare Advantage organizations are supported by the medical record documentation used for risk adjusted payment. CMS selects a sample of members and reviews submitted records to determine whether the diagnoses used in risk score calculations are adequately supported under Medicare risk adjustment documentation requirements.
If diagnoses are found to be unsupported, CMS may adjust the associated risk adjusted payments and, depending on applicable audit methodology and regulatory authority, may seek to recover payment differences across a broader contract population through extrapolation methodologies.
What is the purpose of a RADV audit?
The purpose of a RADV audit is to ensure that Medicare Advantage payments accurately reflect the documented health status of enrolled members. Because CMS adjusts payments based on the disease burden of a plan’s population, RADV audits verify that the medical records submitted support the diagnoses used in risk adjustment payment calculations. RADV audits are one of CMS’s primary program integrity mechanisms for identifying and reducing improper payments across the Medicare Advantage program.
How has RADV audit scope changed in 2026?
Prior to 2026, CMS audited fewer than 60 Medicare Advantage contracts per year.
In 2025, CMS announced plans to significantly expand the RADV program by initiating audits across multiple payment years. Rather than limiting RADV reviews to a small subset of contracts and payment years, CMS is moving toward broader audit coverage across all eligible Medicare Advantage contracts. This represents one of the largest operational expansions of the RADV program since its inception.
Beginning with Payment Year 2026, CMS announced it would audit all RADV-eligible MA contracts — more than 550 plans — on a quarterly cadence. This is the most significant expansion of the RADV program since it was established.
What happens if a RADV audit uncovers unsupported diagnoses?
If diagnoses submitted for risk adjustment payment are found to be unsupported during a RADV audit, CMS may seek recovery of associated overpayments tied to those diagnoses. Audit findings are calculated from sampled member records and, depending on applicable methodology and legal authority, may be applied more broadly across a contract population. Under the 2023 Final Rule, the FFS Adjuster that previously offset some of this liability was eliminated, meaning every unsupported HCC now represents a dollar-for-dollar recoupment exposure.
What is HCC coding and why does it matter for RADV?
Hierarchical Condition Category (HCC) coding is an industry term referring to diagnosis coding for Medicare Advantage risk adjustment. CMS uses certain diagnoses submitted by plans to calculate risk adjusted payments through the CMS-HCC model. During a RADV audit, CMS reviews whether those submitted diagnoses are supported by compliant medical record documentation
How can Medicare Advantage plans prepare for a RADV audit?
Effective RADV preparation requires three core capabilities: a robust medical record retrieval strategy to meet submission deadlines, a proactive deletion workflow to identify and retract unsupported HCC codes before an audit, and a provider engagement program that builds documentation quality at the point of care. Plans that treat RADV readiness as a continuous program — rather than a periodic fire drill — are best positioned to manage audit risk.