RADV audits went from roughly sixty plans a year to all of them. The documentation that decides those audits is written in your organization.
For years, Medicare Advantage oversight was a slow-motion affair: a few dozen plan audits annually, findings that took a decade to collect, and enforcement that most provider organizations could safely ignore. That era is over. CMS has rebuilt its audit machinery, the OIG is running its own plan-by-plan reviews, and Congress is asking pointed questions about how risk scores get made. Every one of those threads leads back to the same place — the clinical documentation and diagnosis coding produced inside provider organizations.
In May 2025, CMS announced a dramatic expansion of its Risk Adjustment Data Validation (RADV) program — the mechanism that checks whether the diagnosis codes MA plans submit for payment are actually supported by medical records. The agency committed to clearing its entire audit backlog for payment years 2018 through 2024 and, going forward, to auditing every eligible MA contract every year instead of a small sample.
A January 2026 CMS memo confirmed the program is executing on that plan: payment year 2020 audits began in early 2026 on a rolling cadence, the medical record submission window was restored to five months, and sample sizes now scale with plan size. To do the work, CMS scaled its coder workforce by an order of magnitude and deployed AI-assisted review to flag unsupported diagnoses — with final determinations still made by certified human coders.
Meanwhile, the HHS Office of Inspector General has continued publishing its own compliance audits of individual MA organizations, repeatedly finding diagnosis codes submitted for risk adjustment that the medical record did not support. And a federal court ruling in late 2025 vacated the extrapolation methodology in CMS's 2023 RADV final rule — a decision now on appeal. Extrapolated recoveries are paused; the audits themselves are not. Unsupported diagnoses are still being identified and tallied, and if extrapolation returns in any form, those findings become the multiplier.
Whether or not the extrapolation fight goes the plans' way, the underlying audit engine is now permanent, annual, and pointed at documentation your providers wrote.
It's tempting for provider organizations to treat RADV as someone else's audit — CMS recovers from the plan, after all. Three realities cut against that comfort:
When a plan is selected, it has months — not years — to produce supporting records for sampled enrollees. Those requests flow downstream to the practices and hospitals that treated the patients. Organizations without a clean release-of-information and chart-retrieval workflow become the bottleneck, and plans remember which provider groups made an audit harder.
If your organization participates in risk-sharing or capitated MA arrangements, unsupported HCCs aren't an abstract plan problem — they're your revenue. Contract terms frequently allow plans to push audit adjustments to the provider groups whose coding generated the risk scores. The financial chain ends where the documentation began.
CMS has proposed excluding diagnoses captured only through chart reviews from risk scoring in future payment years, and congressional investigations have focused on how plans generate diagnoses that providers never treated. The direction of travel is unmistakable: risk adjustment is being anchored back to what the treating clinician documented during real encounters. Organizations whose coding already lives on that standard have nothing to unwind.
Medicare Advantage now covers more than half of Medicare beneficiaries, and the payment integrity apparatus around it has finally caught up to its size. For HIM and revenue cycle leaders, this is less a threat than a clarifying moment: the organizations that treat every diagnosis code as something they may one day have to defend — because they will — are the ones that keep their revenue and their reputations intact.
CODEMED's credentialed coders and auditors perform HCC coding reviews, risk-adjustment-focused CDI, and documentation audits for hospitals and physician groups nationwide — 100% US-based, since 1999.
