On May 21, 2025, CMS changed the economics of Medicare Advantage risk adjustment. Risk Adjustment Data Validation (RADV), long treated by many organizations as a low-probability event that touched a few dozen contracts a year, is now meant to reach every eligible Medicare Advantage contract, every payment year. For health plans, and for the provider groups and MSOs that carry risk under them, the question is no longer whether a sample of records will be reviewed. It is whether the documentation behind each submitted diagnosis will hold up when it is.

What CMS Announced

The agency described an aggressive acceleration of its audit program with several concrete elements:

  • Every eligible contract. Newly initiated RADV audits will cover all eligible MA contracts, roughly 550, compared with about 60 per year historically.
  • Larger samples. Records reviewed per contract will rise from 35 to between 35 and 200, depending on contract size.
  • More reviewers. CMS plans to expand its medical coder workforce from about 40 to approximately 2,000 by September 1, 2025, with coders manually verifying diagnoses that the agency's systems flag.
  • Technology-assisted review. CMS said it will deploy advanced systems to review records efficiently and flag unsupported diagnoses.
  • Clearing the backlog. CMS intends to complete outstanding audits for payment years 2018 through 2024 by early 2026.
  • Recovery of past findings. CMS will work with the HHS Office of Inspector General to pursue uncollected overpayments from prior audits.

CMS framed the change against federal estimates that MA plans may be overpaid by about $17 billion annually because of unsupported diagnoses, and noted that completed audits for payment years 2011 through 2013 found overpayment rates between 5 and 8 percent.

Why Extrapolation Is the Real Story

Larger samples matter because of the RADV final rule CMS issued in early 2023. That rule allows CMS to extrapolate audit findings to the full contract beginning with payment year 2018, and it declined to apply a fee-for-service adjuster that would have offset part of the recovery. A small sample of 35 records gives limited statistical footing for projecting an error rate across hundreds of thousands of members. A sample approaching 200 records gives CMS a much firmer basis.

In practical terms, the financial exposure is no longer limited to the payment tied to the specific records that fail. An error rate measured in the sample can be applied across the contract's enrolled population for that payment year. A documentation weakness that seemed trivial at the level of a single chart becomes material when it is projected at scale.

Timing compounds the risk. Payment year 2018 audits reach back to 2017 dates of service. The clinicians who wrote those notes may have left the group, practices may have changed record systems, and signatures or credentials may be missing from archived documents. Organizations that assumed old payment years were effectively closed now need to plan for retrieval and defense of records that are many years old.

What Changes for Health Plans

Plans should assume that every contract will be audited and model reserves accordingly. That means estimating a realistic support rate for submitted HCCs, using internal sampling that mirrors RADV methodology rather than relying on anecdote. It also means reviewing the sources that feed risk scores. The OIG has repeatedly flagged diagnoses that appear only on health risk assessments or chart reviews, without any follow-up care, as an area of elevated concern. In an October 2024 report, it estimated about $7.5 billion in 2023 MA payments tied to such diagnoses. Codes that rest on a single encounter with no downstream treatment are the ones most likely to fail validation.

What Changes for Provider Groups and MSOs

Provider organizations are not the direct target of a RADV audit, but they are rarely insulated from it. Many risk-sharing and capitation agreements allow plans to recoup or adjust payments when diagnoses are not supported. Groups should expect more record requests, tighter turnaround times and, in some cases, financial adjustments tied to audit outcomes. The groups that respond well will be those that can produce a complete, signed, clinically coherent note for each submitted diagnosis without a scramble.

What "Audit-Ready" Means Now

Audit readiness used to mean having a process to pull charts when an audit letter arrived. Under universal audits with extrapolation, it means every diagnosis is defensible at the moment it is submitted. A practical standard looks like this:

  1. Every HCC traces to a qualifying encounter. The diagnosis appears in a face-to-face encounter note from an acceptable provider type, authenticated with a signature and credentials.
  2. The note shows active management. Each condition is supported by evidence that it was monitored, evaluated, assessed or treated, not merely listed in a problem list or history.
  3. Specificity matches the code. The documented severity, type and complications match the ICD-10 code submitted.
  4. Retrieval is fast and complete. Records, including those from prior years and former clinicians, can be located and produced without gaps.
  5. High-risk categories get extra scrutiny. Diagnoses that OIG has identified as frequently unsupported, such as acute stroke or acute myocardial infarction coded in outpatient settings, and certain cancers without evidence of active treatment, are reviewed before submission.
  6. Deletes are part of the program. When review finds an unsupported diagnosis, it is removed and the correction is tracked. A program that only adds codes is not a compliance program.

Where to Start This Quarter

Three steps give most organizations a clear picture quickly. First, run a RADV-style internal sample on a recent payment year, scoring each HCC as supported or unsupported using the same standards an auditor would apply. Second, segment the results by diagnosis source (office visit, in-home assessment, chart review, specialist encounter) to see where support is weakest. Third, inventory record retention and retrieval for payment years 2018 onward, including records held by practices that have since been acquired, merged or closed.

The results should drive both financial planning and workflow change. If support rates are weak for a particular source or provider cohort, the fix is upstream: better documentation at the point of care, and review before claims leave the building.

How a Platform Approach Helps

Curitics approaches this as a documentation and review problem rather than a retrieval problem. AI chart classification separates documented HCCs from inferred ones so coders confirm only what the record supports, prospective, concurrent and retrospective coding review runs with AI summaries and provider queries that end in signed addenda, and patient-level CMS-HCC V28 scoring shows the financial impact of each decision. With SOC 2 Type 2 and HITRUST certification, the evidence trail is held to the standard an audit now demands.

The Bottom Line

CMS has signaled that RADV will be routine, comprehensive and statistically consequential. Plans and provider groups that treat every submitted diagnosis as if it will be audited, because it may well be, will protect revenue they earned. Those that wait for the audit letter will be defending documentation they can no longer improve.