RADV audits just became every plan's reality.
CMS is moving from a handful of audits a year to all eligible MA contracts — across six open payment years. Health Data Max keeps your submissions continuously audit-ready.
What is a RADV audit?
Risk Adjustment Data Validation is how CMS checks whether the diagnoses an MA plan submitted for payment are actually supported in the member's medical record.
CMS pays MA organizations a risk-adjusted amount for each enrollee. Diagnoses submitted by providers map to Hierarchical Condition Categories (HCCs), each carrying a factor that raises the member's risk score — and the monthly payment to the plan.
Because payment follows diagnosis, CMS validates a sample of those diagnoses against the underlying charts. In a RADV audit, the plan must produce a medical record that supports each sampled HCC. If the record doesn't support the diagnosis, the HCC is invalidated, the risk score is overstated, and the associated payment is recovered.
CMS can then extrapolate the sampled error across the contract's full sampling frame, turning a modest sample into a large recovery. The 2023 rule that authorized extrapolation (and removed the fee-for-service adjuster) was vacated by a federal court in 2025 and is under appeal — but CMS has expressly designed its PY2020 and PY2021 audits to support extrapolated recoveries and reserves the right to collect them if legally permissible. Plan for extrapolation; don't bank on the litigation.
How a diagnosis becomes a payment — and an audit target
The audit landscape changed in 2025
On May 21, 2025, CMS announced an aggressive strategy to enhance and accelerate MA audits — clearing the backlog and auditing everyone.
From ~60 to ~550 plans
CMS will audit all eligible MA contracts each year in newly initiated audits — roughly a 900% increase in audit volume, reaching nearly every contract.
35 to 200 records each
Sample size scales with contract size (200 / 100 / 50 / 35 by stratum), and members aren't picked at random — CMS targets the enrollees its improper-payment model predicts will lose the most risk score.
PY2018–PY2024 backlog
CMS expanded its coder workforce from ~40 to ~2,000 and is using AI-assisted review to clear years of open audits on a compressed timeline — though final overpayment determinations stay with human coders.
How a contract-specific RADV audit works
CMS's PY2020 and PY2021 Audit Methods & Instructions lay out the full mechanics — from how members are selected to how overpayments are calculated and extrapolated.
It starts before you know it. CMS defines a sampling frame, draws a statistically valid random sample, and sends an Audit Notice to your CEO, CFO, COO, and Compliance Officer. Your team designates points of contact, registers in CMS's secure CDAT portal, and downloads the Enrollee Data List (EDL) naming the exact enrollees, HCCs, and diagnosis codes under review.
From there the clock runs hard: pull a valid medical record — legibly signed and dated, from a face-to-face visit by a credentialed provider, within the data collection year — for every audited HCC, and submit it through CDAT before the deadline. CMS coders then abstract diagnoses through up to three rounds of review and classify each HCC as Confirmed, Confirmed Higher, Discrepant, Discrepant Lower, or Administrative Exception.
The audit lifecycle
How CMS picks the members it audits
The sample isn't random across your whole book. CMS first ranks audit-eligible enrollees — broadly, those enrolled for all 12 months of the data-collection year and at least one month of the payment year — with a "predicted improper payment" model, then samples from the top quartile most likely to lose risk score under review. The exact formula isn't published, but it's expected to lean on circumstantial coding-risk signals:
- HCCs supported by only a single encounter
- HCCs added solely through chart review (no underlying encounter)
- HCCs with little corroborating medical or pharmacy utilization
// These are the exact OIG high-risk signatures below — acute Dx with no inpatient claim, cancer with no treatment, embolism with no anticoagulant. The audit target and the OIG pattern are the same thing.
Sample size is set by your stratum
CMS sorts RADV-eligible contracts by sampling-frame size into four strata. The ten largest contracts draw the deepest samples — which is exactly why our data shows audit probability rising with enrollment.
When CMS intends to initiate audits
The month CMS plans to begin RADV audits, by MA payment year. Six payment years are now on the calendar.
Audit milestones
Audit milestones
OIG's high-risk diagnosis findings
HHS-OIG built a public toolkit from its MA audits, identifying diagnosis codes that — when paired with other data — are at high risk of being unsupported. The error rates are striking.
Across its audits, OIG found that roughly 70% of the high-risk diagnosis codes it reviewed were not supported by the associated medical records — and within specific groups, error rates exceeded 90%. These aren't edge cases; they're patterns a plan can detect and correct before CMS arrives.
| High-Risk Group | Records in Scope | Errors | Error Rate |
|---|---|---|---|
| Acute stroke | 945 | 908 | |
| Acute heart attack | 791 | 751 | |
| Embolism | 754 | 593 | |
| Lung cancer | 391 | 345 | |
| Breast cancer | 390 | 373 | |
| Colon cancer | 390 | 368 | |
| Prostate cancer | 360 | 322 | |
| Potentially mis-keyed codes | 522 | 421 | |
| Totals | 4,543 | 4,081 | 90% |
Source: HHS-OIG, "Toolkit To Help Decrease Improper Payments in Medicare Advantage Through the Identification of High-Risk Diagnosis Codes" (Dec 2023, A-07-23-01213), errors as of Nov 2023.
Where unsupported HCCs hide
Each high-risk group follows a recognizable signature: an acute diagnosis submitted without the clinical evidence you'd expect to accompany it. In most cases, a "history of" code — which doesn't map to an HCC — was what the record actually supported.
Acute stroke
One acute stroke diagnosis on a physician claim, with no matching inpatient or outpatient hospital claim.
Acute heart attack
An acute MI on a single physician/outpatient claim with no inpatient claim within 60 days before or after.
Embolism
An embolism diagnosis with no anticoagulant medication dispensed — the treatment you'd expect for an active embolism.
Lung cancer
A lung cancer diagnosis with no surgery, radiation, or chemotherapy within six months before or after.
Breast cancer
A breast cancer diagnosis without surgical, radiation, chemotherapy, or relevant drug treatment in the window.
Colon cancer
A colon cancer diagnosis with no surgical therapy, radiation, or chemotherapy in the six-month window.
Prostate cancer
A prostate cancer diagnosis in members 74 or younger with no treatment evidence in the surrounding window.
Potentially mis-keyed codes
A single transposed or mistyped code (e.g., I720 → I270) that mapped to an unrelated, unvalidated HCC.
One platform. Continuous audit readiness.
HDM doesn't wait for an Audit Notice. Provider claims, encounters, CMS response files, payment and risk-score data, and chart coding all live in one database — so every submitted diagnosis stays continuously linked to the record that has to support it. When CMS initiates on its new accelerated timeline, you're already prepared instead of scrambling inside a four-month window.
Unify in one DB
Claims, encounters, CMS response files, risk scores, payments, and chart coding — reconciled and member-linked in a single source of truth.
→Flag the suspects
Mirror CMS's improper-payment signals and OIG high-risk logic — single-encounter HCCs, chart-review-only adds, thin utilization — before they're ever sampled.
→Match the evidence
Plans upload medical records; HDM surfaces the strongest supporting chart for each suspect member-HCC.
→Validate or correct
Confirm defensible HCCs, and route truly unsupported diagnoses for correction — accurate payment, clean record.
Be ready before the audit notice arrives.
With PY2020–PY2025 on the CMS schedule, the question isn't whether your plan will be audited — it's whether your records are ready. Let's review your highest-risk HCCs together.