Medicare Advantage Risk Adjustment: The New Chart-Audit Pressure

The request looks routine: a health plan wants records for several Medicare Advantage patients. Then another vendor asks for overlapping charts, a coding team sends diagnosis queries, and someone flags a possible payment adjustment. For a practice already stretched between patient care and collections, these requests can become an expensive second workflow—especially when staff cannot tell which ones are routine data collection and which belong to a formal audit.

Two developments make Medicare Advantage risk adjustment particularly important in September 2026. The transition to CMS’s 2024 risk adjustment model is fully phased in for the standard Medicare Advantage population, changing how documented diagnoses translate into plan payments. Separately, CMS announced a major expansion of its Medicare Advantage audit work in 2025. Neither development turns every chart request into a provider repayment demand. Both make a disciplined response more valuable. Practices need to know what records support, what reviewers are actually requesting, and where their contractual financial exposure begins.

1. Why risk adjustment is creating pressure now

Medicare Advantage plans receive payments that reflect, among other factors, their members’ documented health risks. Diagnoses feed into hierarchical condition categories, or HCCs, under CMS risk adjustment models. An HCC is a payment classification—not a substitute for an ICD-10-CM diagnosis and not permission to code a condition that the medical record does not support.

CMS phased in the 2024 CMS-HCC model over three payment years. Its 2026 Medicare Advantage and Part D Rate Announcement confirmed completion of that transition for the applicable Medicare Advantage risk scores. Often called V28 in operational discussions, the model changes diagnosis-to-category mappings and payment relationships. Separate rules and models apply to certain populations, so staff should not assume one mapping fits every beneficiary.

Meanwhile, CMS’s May 2025 audit initiative announced broader Risk Adjustment Data Validation review of eligible Medicare Advantage contracts and efforts to address an audit backlog. That announcement is a reason to prepare, not evidence that every announced review has been completed or that your practice is currently under investigation.

The practical consequence is more scrutiny of the path from clinical documentation to diagnosis submission. A chart that once generated an HCC under an earlier model may behave differently now. The answer is to validate the coding and applicable model—not rewrite the patient’s clinical story to preserve a score.

2. Identify the request before releasing the chart

“Risk adjustment review” can describe several different activities. A plan may be collecting encounter records, checking diagnoses before submitting data, conducting an internal compliance review, or responding to a CMS audit. Vendors may perform any of these functions on the plan’s behalf. Their emails can look remarkably similar.

A formal CMS Risk Adjustment Data Validation audit tests whether diagnoses used for plan payment are supported by medical records. A commercial vendor’s chart-retrieval campaign is not automatically that audit, even if its correspondence uses words such as validation, compliance, or required. Classifying the request correctly determines who should handle it and how urgently it needs escalation.

• Confirm the requesting organization, the payer it represents, and its authority to obtain the records.
• Identify the review type, patients, requested dates of service, record components, and submission deadline.
• Determine whether the request concerns an earlier payment year, a current data-submission cycle, or a contractual reconciliation.
• Verify the secure delivery method and document exactly what was transmitted and when.
• Route requests mentioning recoupment, extrapolation, contractual offsets, or legal deadlines to the appropriate compliance or legal owner.

3. Keep plan risk scores separate from practice reimbursement

A diagnosis can affect a health plan’s risk-adjusted payment without changing the fee-for-service amount owed for the office visit. That distinction matters when staff see an HCC removed and assume the underlying claim is no longer payable. Coding validity, service medical necessity, and the plan’s risk adjustment calculation are related questions, but they are not the same question.

Your exposure depends heavily on the contract. A practice paid under a conventional fee schedule may primarily face record-production work and coding corrections. A group with capitation, shared savings, risk-score-linked incentives, or delegated responsibilities may face broader financial consequences. A payer’s recovery from CMS does not, by itself, establish an identical debt owed by the treating practice.

Before accepting a proposed offset, identify the contractual provision, the specific disputed diagnoses or services, the calculation, and the available dispute process. Ask whether the payer is alleging an unsupported diagnosis, an improperly paid service, or failure to meet a contractual obligation. Those allegations require different responses.

This is also where outside support needs a defined boundary. A team providing medical billing services can organize claim histories, reconcile adjustments, and track deadlines. Interpretation of disputed contract terms and significant repayment exposure belongs with qualified legal and compliance advisers, not an unattended adjustment queue.

4. Understand the calendar: payment year is not encounter year

Risk adjustment creates a timing trap. For many beneficiaries in the standard prospective model, diagnoses from one calendar year inform risk scores for the following payment year. Consequently, a request received in 2026 may concern encounters from 2025—or substantially earlier records associated with an audit. The date on the vendor’s email tells you little about which coding rules or documentation requirements apply.

Current documentation has a different purpose. Encounters occurring in 2026 generally contribute to a later payment cycle, subject to the applicable model, submission rules, and beneficiary circumstances. Staff should not automatically apply a payment-year mapping to a same-year encounter without checking the relationship between the two.

Maintain a simple reference for each review: dates of service, relevant payment year, applicable ICD-10-CM version, model information supplied by the payer, and submission or response deadlines. Keep historical coding references available rather than overwriting them with the newest files.

The next routine ICD-10-CM annual transition is October 1, 2026. Practices should prepare their coding systems and education for the applicable fiscal-year files while preserving the references needed for older encounters. A chart audit does not convert an old service into a current-year coding exercise.

5. Build documentation around care, not an HCC shopping list

The most defensible note tells another clinician what conditions were present, how they affected the encounter, and what the treating professional did about them. It does not need to read like a risk adjustment worksheet. Conversely, a long diagnosis list does not become persuasive simply because it contains many potential HCCs.

In outpatient coding, follow the applicable ICD-10-CM guidelines for reporting documented conditions, including conditions that coexist and require or affect care, treatment, or management. Do not report uncertain outpatient diagnoses as established merely because a decision-support tool identifies a likely condition. Do not infer a diagnosis solely from medication use or an abnormal laboratory result.

Common weak spots include a historical condition carried forward as current, a severity level unsupported by the documentation, and a problem list copied into every encounter without clinical context. Cancer status, complications of diabetes, and pressure-ulcer staging deserve careful attention because seemingly small wording differences can materially change coding. Apply the relevant coding conventions rather than blanket rules about what every note must contain.

Many teams teach MEAT—monitor, evaluate, assess or address, and treat—as a documentation aid. It can encourage useful clinical detail, but it is not a standalone CMS regulation or a universal test that replaces official coding guidance. Train reviewers to explain the actual deficiency: missing clinical support, unclear status, unsupported specificity, or an encounter that does not meet the applicable risk adjustment requirements.

6. Put controls around AI-generated diagnosis suggestions

Risk adjustment software increasingly searches charts for possible diagnoses, compares current documentation with historical records, and prioritizes opportunities for human review. Used carefully, those tools can surface a condition that deserves clinical attention. Used carelessly, they turn an old mention or ambiguous phrase into a diagnosis that appears more certain each time it is copied.

Treat every machine-generated suggestion as a prompt for evaluation, not an instruction to code. A medication may have several indications. A specialist’s differential diagnosis may never have been confirmed. A condition may have resolved, changed severity, or been incorrectly entered years earlier.

Ask vendors to show the source passage, its date, the author, and whether the finding comes from a current assessment, historical note, or problem list. A confidence score without traceable evidence is not an audit trail. Also ask whether the system identifies unsupported existing diagnoses for removal, rather than only suggesting additions.

Provider queries should be clinically grounded and nonleading. The treating professional must be able to disagree, identify another explanation, or state that the record does not permit a conclusion. Preserve the query and response according to your policies. Do not let productivity targets reward staff solely for added HCCs or increased risk scores; that incentive can undermine the accuracy the review is supposed to improve.

7. Make record production defensible without overproducing

A good record-production process protects both privacy and the integrity of the submission. HIPAA can permit disclosures for qualifying payment and health care operations activities without a separate patient authorization, but that does not make every vendor request self-validating. Confirm the legal basis, the requester’s role, applicable minimum-necessary requirements, and any additional restrictions affecting the records.

Send the relevant, complete documentation—not an arbitrary export and not selected fragments designed to make a diagnosis look stronger. Depending on the review, the submission may need the encounter note, identifying information, authentication, and supporting material specified in the request. Verify that scans are readable and that pages have not been omitted.

Retrospective corrections require particular care. Never backdate a signature or silently replace the original note. Use the organization’s compliant amendment process, preserving the original entry, the amendment date, the author, and the reason. A later clarification is not guaranteed to satisfy the rules of a particular audit.

• Retain the original request, scope clarification, and verified recipient details.
• Record the exact documents and encounter dates included in the submission.
• Keep delivery confirmation and any portal acknowledgment.
• Log queries, amendments, follow-up requests, and final findings together.
• Escalate missing authentication or documentation promptly instead of inventing a workaround.

8. Audit for unsupported diagnoses as well as missed ones

A review program focused only on finding additional diagnoses is incomplete. Accuracy requires checking both directions: conditions that should have been reported and diagnoses already reported without adequate support. That is especially important when a vendor’s compensation or performance score depends on increased risk adjustment revenue.

Start with a targeted sample rather than attempting to reread every chart. Useful priorities include diagnoses added through retrospective review, high-specificity conditions with thin documentation, repeated carry-forward entries, and records associated with payer disputes. Select some apparently ordinary charts too; a sample composed entirely of known trouble spots cannot describe your overall performance.

For each finding, identify where the failure occurred: clinical documentation, code assignment, data mapping, claim or encounter transmission, or payer processing. A sound diagnosis can be lost in transmission, while a perfectly transmitted code can still be unsupported. The corrective action should match the failure.

If you use outside billing audit support, define whether reviewers are assessing documentation, coding, claims, or all three. Require written findings tied to the applicable guidance and a process for resolving disagreements. Track unsupported-code findings, documentation-query volume, duplicate record requests, and time spent per completed request. These measures show operational cost and control quality without treating a higher risk score as proof of success.

9. Give the next 30 days a concrete work plan

Practice managers do not need a new committee for every payer initiative. They do need a named owner and a repeatable handoff between records staff, coding, clinicians, billing, and compliance. Otherwise, the same request gets answered twice while a consequential dispute sits untouched.

During the first week, inventory open risk adjustment requests and identify any contractual deadlines or payment offsets. Next, review a small set of recently submitted records and diagnosis queries. Look for missing pages, unsupported specificity, ambiguous amendments, and duplicated work. Then update staff instructions and test the revised workflow on actual requests.

Before closing the month, meet with your highest-volume requesting payer or vendor. Clarify overlapping campaigns, acceptable record formats, escalation contacts, and how the organization communicates coding disagreements. Ask for enough information to distinguish routine collection from a formal audit without requiring front-desk staff to interpret legal language.

The goal is not to maximize HCC capture at any cost, nor to resist every records request. It is to produce accurate, traceable documentation, submit supported diagnoses, and challenge financial conclusions that do not follow from the record or contract. In the current Medicare Advantage environment, that separation of clinical truth, payment methodology, and contractual responsibility is one of a practice’s strongest audit controls.