Key Takeaways

• CMS is now auditing all 550+ eligible Medicare Advantage contracts annually – up from about 60 per year
  
• Plans have just 12 weeks to respond to a RADV audit, down from 22 weeks, with only 2 medical records allowed per HCC
  
• Audits now run on a quarterly cadence – beginning with Payment Year 2020 in March 2026
  
• CMS estimates $17 billion in annual MA overpayments tied to unsupported diagnoses; MedPAC puts the figure as high as $43 billion
  
• V28 is fully in effect for Payment Year 2026 – organizations running V24-era workflows face unmapped diagnoses and unexpected revenue drops
  
• A March 2026 DOJ settlement made two-way coding the new enforcement standard – add-only coding is no longer just a compliance risk
  

CMS is now auditing every eligible Medicare Advantage contract – all 550-plus of them – every single year.

The certified coding workforce reviewing those charts has grown from 40 to approximately 2,000. Audits now launch on a quarterly cadence. Plans have 12 weeks to respond – down from 22 – and may submit only two supporting medical records per HCC, reduced from five. Federal estimates peg MA overpayments tied to unsupported diagnoses at $17 billion annually; MedPAC’s independent analysis puts the figure as high as $43 billion.

The audit environment that most Medicare Advantage organizations built their risk adjustment services workflows around no longer exists. What follows is a precise accounting of the ten mistakes most likely to cost your organization money – and credibility – when the next RADV notice arrives.

The Stakes in 2026

More than 35 million people – 55% of all eligible Medicare beneficiaries – are now enrolled in Medicare Advantage plans, according to KFF’s June 2026 analysis. CMS reimburses MA plans based on the documented clinical complexity of their members, expressed through each patient’s Risk Adjustment Factor (RAF) score, which directly shapes capitated monthly reimbursement.

MedPAC’s March 2026 Report to Congress estimated the federal government will pay MA plans $76 billion more in 2026 than it would spend on the same enrollees in traditional Medicare, with coding intensity a primary driver. In response, CMS launched what it describes as an aggressive expansion of RADV audits.

What changed in the RADV audit program:

• Audit volume: approximately 60 MA contracts per year → all 550+ eligible contracts annually
  
• Sample size per contract: 35 records → up to 200 records
  
• CMS coding workforce: 40 certified coders → approximately 2,000
  
• Response window for plans: 22 weeks → 12 weeks
  
• Records allowed per HCC: 5 → 2
  
• Audit cadence: irregular → quarterly, beginning February 2026 (Payment Year 2020)
  
• Extrapolation: findings from sampled records may now be projected across the full contract population
  
• Look-back scope: all payment years from PY 2018 through PY 2024
  

The message is clear: risk adjustment is no longer a back-office function. It is the financial backbone of your Medicare Advantage operation — and every submitted diagnosis now carries audit exposure.

The 10 Mistakes

Mistake 1: Relying on Add-Only Coding Practices

Rolling forward historical HCCs without current-year clinical support is now the DOJ’s most active enforcement target.

The Mistake: Submitting historical Hierarchical Condition Category (HCC) codes automatically through EHR templates without confirming that each diagnosis was actively evaluated during a face-to-face encounter in the current calendar year.

The Consequence: The enforcement environment has shifted decisively. A March 2026 DOJ settlement resolved allegations against an add-only chart review program that deliberately ignored its own evidence of unsupported codes – two-way coding, meaning adding supported diagnoses and removing unsupported ones, is now the explicit compliance benchmark. Add-only patterns trigger OIG audit activity and, increasingly, False Claims Act exposure. Organizations that have not yet built two-way coding into their workflows are operating under a standard CMS and DOJ have publicly rejected.

Mistake 2: Failing the MEAT/TAMPER Documentation Standard

A code is only as defensible as the documentation behind it – and RADV auditors test the documentation, not the claim.

The Mistake: Listing a chronic condition on the problem list without documenting the active clinical management plan during that specific face-to-face encounter.

The Consequence: If a chart cannot demonstrate that a condition was Monitored, Evaluated, Assessed, or Treated (MEAT) during the encounter in question, CMS auditors will disallow the code and initiate recoupment. With plans now permitted to submit only two medical records per HCC – down from five – the margin for documentation error has never been smaller. Every submitted HCC needs to be supported by the best available evidence, selected deliberately, before an audit notice arrives.

Mistake 3: Treating RAF Capture as a Multi-Year Cycle

Risk adjustment operates on an annual benefit-year cycle – not a rolling average.

The Mistake: Assuming that once a complex diagnosis – such as major depressive disorder or stage 4 chronic kidney disease – is captured, it carries forward automatically into subsequent payment years.

The Consequence: For Medicare Advantage risk adjustment, most HCC diagnoses must be documented and supported within each benefit year. Failing to recapture eligible chronic conditions during the current year reduces the patient’s RAF score for the following payment year. Organizations that do not build structured annual recapture workflows into their clinical operations watch tracked clinical complexity – and the reimbursement that reflects it – erode steadily through Q3 and Q4.

Mistake 4: Chronic Undercoding via Non-Specific ICD-10 Selections

Vague codes bypass HCC payment mapping entirely – making high-complexity patients look like low-risk ones.

The Mistake: Clinicians default to unspecified or generic ICD-10 codes – for example, coding generic “diabetes” instead of “type 2 diabetes mellitus with diabetic nephropathy” – out of time pressure or habit.

The Consequence: Non-specific selections often fail to map to payment HCC categories, leaving the payer unable to capture the true clinical complexity of the patient. The resulting RAF gap means the organization absorbs high-complexity operational costs while receiving baseline, low-risk reimbursement. Under V28, the specificity requirement has become more demanding – codes that previously mapped to payment HCCs under V24 may no longer do so under the current model.

Mistake 5: Inadequate Clinical Documentation Improvement (CDI) Alignment

Coders can only capture the clinical vocabulary that providers actually document – the gap between the two is where revenue disappears.

The Mistake: Maintaining a structural disconnect between back-end coding specialists and frontline clinical staff, with no active CDI framework bridging the two.

The Consequence: Without integrated CDI, providers continue using clinical shorthand and vague terminology that certified coders cannot translate into billable HCC categories under ICD-10-CM guidelines. The documentation gap that results is systematic, not incidental — and it compounds across every encounter, every provider, and every patient in the population.

Mistake 6: Underestimating CMS-HCC V28 Transition Risks

V28 is not a future concern – it fully governs Payment Year 2026 risk scores today.

The Mistake: Continuing to operate V24-era coding workflows without aligning clinical operations to V28’s structural changes, which removed thousands of diagnosis codes from payment mapping and reclassified specific cardiac, psychiatric, and metabolic conditions.

The Consequence: The phase-in that began in 2024 is complete. Payment Year 2026 risk scores are calculated entirely under V28. Organizations still relying on V24 code maps face unmapped diagnoses, tracking errors, and revenue drops that will not be visible in current-year reports until reimbursement arrives — by which point the correction window has closed. V28 introduced 115 condition categories and mapped only 7,770 diagnosis codes, versus 9,797 in V24. That difference is not administrative; it represents real revenue.

Mistake 7: Over-Reliance on Unsupervised AI

AI accelerates review – but without certified human oversight, it creates the exact liability CMS is now auditing for.

The Mistake: Allowing automated EHR suggestion algorithms to push diagnosis codes directly to billing without certified human review and validation.

The Consequence: Fully automated systems pull historical notes out of context, generate systemic overcoding, and create the precise documentation pattern RADV auditors are trained to identify. Notably, CMS itself pairs its AI-enabled audit tools with approximately 2,000 certified human coders who make every final determination. Provider organizations should hold themselves to the same standard. Human-validated AI delivers speed and scale; unsupervised AI delivers audit exposure.

Mistake 8: Ignoring Hierarchical Dropping Risks

Submitting a lower-severity code in the same HCC family as a higher-severity code doesn’t add both – it can eliminate payment for the lower one.

The Mistake: Failing to recognize how hierarchical disease models behave when multiple related codes are submitted simultaneously within the same HCC family.

The Consequence: Within an HCC family, a more severe manifestation overrides a minor one. If documentation supports only a minor secondary condition while failing to meet MEAT criteria for the primary, high-severity manifestation, the entire hierarchy drops to a lower payment tier – significantly eroding the RAF score. This is a structural coding error, not a documentation error, and it requires workflow-level correction, not individual chart review.

Mistake 9: Lack of Pre-Bill and Post-Bill Audit Integration

Retrospective chart review at year-end catches errors too late to fix – and the quarterly audit cadence has made this worse.

The Mistake: Relying solely on retrospective chart review at year-end rather than deploying prospective coding and concurrent validation mechanisms throughout the year.

The Consequence: CMS now initiates new RADV audits on a quarterly cadence, beginning with Payment Year 2020 in February 2026. Documentation gaps found months after a patient encounter can rarely be corrected, leaving revenue on the table permanently. Organizations that build routine pre-bill and post-bill audit integration into their workflows – rather than treating audit preparation as a year-end event – consistently produce cleaner encounter data, lower denial rates, and stronger RADV outcomes.

Mistake 10: Partnering with Generalist RCM Vendors

Fee-for-service billing expertise does not transfer to risk adjustment – the two disciplines require fundamentally different skills.

The Mistake: Treating risk adjustment like high-volume fee-for-service medical billing and handing it to a general revenue cycle management vendor without specialized risk adjustment credentials.

The Consequence: Fee-for-service workflows are built for transaction speed and volume. Risk adjustment demands clinical depth, regulatory expertise specific to HCC models, RADV audit familiarity, and documentation precision that generalist vendors do not typically carry. The result is higher denial rates, overlooked clinical data, undercaptured HCCs, and greater exposure to federal audit clawbacks. Specialized risk adjustment coding companies exist precisely because the compliance and clinical requirements are categorically different – not incrementally more complex – than standard billing.

How AI Is Changing Risk Adjustment

Artificial intelligence is now a standard component of both MA risk adjustment operations and CMS’s own audit infrastructure. Used correctly, AI and natural language processing tools can:

• Identify documentation gaps before claims are submitted
  
• Surface potential HCC opportunities in unstructured chart notes
  
• Prioritize charts for human review based on audit risk and revenue impact
  
• Detect coding inconsistencies across providers, sites, and payers
  
• Flag add-only patterns before they become enforcement targets
  

The critical caveat – and it cannot be overstated – is that AI must augment certified coders, not replace them. CMS’s own expanded audit infrastructure pairs AI-enabled tools with approximately 2,000 certified human coders who make every final overpayment determination. Provider organizations operating without that human layer are building the same liability that RADV auditors are now systematically identifying.

The right framework is one where AI prioritizes the work and surfaces candidates — and certified clinical coders validate every finding before submission. Human-validated AI delivers speed, scale, and defensibility. Unsupervised AI delivers audit exposure.

Operational Profile: Traditional vs. Optimized Risk Adjustment

Metric	Traditional Workflow	Optimized Risk Adjustment Strategy
Annual HCC Recapture	Inconsistent or retrospective	Structured prospective annual workflow
MEAT Compliance	Variable across providers	Standardized, monitored, auditable
RAF Accuracy	Lower – gaps across population	Higher – validated before submission
RADV Audit Readiness	Reactive – triggered by notice	Continuous – built into operations
CDI Collaboration	Limited or absent	Integrated – clinical and coding aligned
AI Oversight	Minimal or unsupervised	Human-validated – certified coder review
Pre-Bill Review	Rare	Routine – catches errors before submission
Add-Only Coding	Common	Eliminated – two-way coding standard
V28 Alignment	Incomplete	Full – V24-era maps retired
Reporting	Periodic, lagged	Real-time dashboards, quarterly reviews

What to Do Before Your Next RADV Notice

The organizations that will navigate the new audit environment successfully are not the ones that start preparing when a RADV notice arrives. They are the ones that have already built documentation precision, two-way coding discipline, CDI integration, and prospective audit readiness into their standard workflows.

The ten mistakes outlined here are not theoretical. They are the patterns CMS, OIG, and DOJ are actively targeting – supported by a coding workforce that has grown fifty-fold and an audit cadence that now runs every quarter.

The window to correct them proactively is narrower than it has ever been.

Frequently Asked Questions

What is risk adjustment in healthcare?

Risk adjustment is the payment methodology CMS uses to calibrate MA plan reimbursement based on the documented health status and demographics of each enrolled member. Diagnosed conditions map to Hierarchical Condition Categories (HCCs), which generate a Risk Adjustment Factor (RAF) score that determines the monthly capitated payment for each patient. Accurate documentation and coding are what translate clinical complexity into reimbursement.

Why are RADV audits important in 2026?

Because they now happen to every eligible MA contract, every year. CMS expanded from auditing approximately 60 contracts annually to all 550-plus eligible contracts, on a quarterly cadence, with a certified coding workforce of approximately 2,000 reviewers. Plans have 12 weeks to respond and may submit only two medical records per HCC. Extrapolation of findings across the full contract population means that a small percentage of unsupported codes can translate into a multimillion-dollar recoupment. Proactive internal RADV readiness reviews – conducted before an audit notice arrives – are now an operational necessity, not an option.

How often should HCC diagnoses be recaptured?

Every benefit year. Most chronic conditions must be documented and supported during a valid face-to-face encounter each calendar year to count toward the following payment year’s RAF score. Best practice is to schedule comprehensive annual wellness and documentation visits early in the year – before Q3 reimbursement gaps become visible.

What is MEAT documentation?

MEAT is the evidentiary standard auditors use to validate a submitted diagnosis. The encounter note must demonstrate that the condition was Monitored, Evaluated, Assessed, or Treated during that specific encounter. A condition listed only on the problem list, without MEAT evidence within the dated encounter, will not survive a RADV audit. With plans now permitted to submit only two supporting records per HCC, selecting the strongest available documentation is critical.

What changed with CMS-HCC V28?

V28 recalibrated the risk adjustment model using ICD-10 encounter data, restructured HCC categories, reduced the number of mapped diagnosis codes from 9,797 to 7,770, and constrained several high-frequency condition groups. The model was phased in starting in 2024 and now fully governs Medicare Advantage risk scores for Payment Year 2026. Organizations still using V24-era coding workflows face unmapped diagnoses and unexpected revenue drops.

What is the difference between add-only and two-way coding?

Add-only coding submits new or recurring diagnoses without ever removing unsupported ones. Two-way coding – the current compliance standard – both adds diagnoses supported by current-year documentation and removes those that cannot be validated under MEAT criteria. A March 2026 DOJ settlement resolved allegations against an add-only program that ignored its own evidence of unsupported codes, establishing two-way coding as the explicit enforcement benchmark.

Why work with a specialized risk adjustment coding company?

Because risk adjustment requires clinical depth, regulatory expertise specific to HCC models, and documentation precision that generalist billing vendors do not carry. Specialized organizations bring certified coders trained in HCC methodology, CDI expertise aligned to risk adjustment requirements, and audit-readiness workflows built for the current RADV environment – not the one that existed three years ago.

About 3Gen Consulting

3Gen Consulting is a healthcare revenue intelligence company specializing in risk adjustment coding, HCC documentation improvement, and RADV audit readiness for Medicare Advantage plans, ACOs, and PACE programs. Our AAPC/AHIMA-certified specialists combine clinical expertise with AI-powered workflows to help organizations improve RAF accuracy, strengthen documentation, and maintain continuous audit readiness.