RADV audits: how they work and how to be ready

What a RADV audit is

CMS describes RADV as its primary way to address overpayments to Medicare Advantage organizations. In an audit, CMS confirms that the diagnoses an organization submitted for risk adjustment are supported in the enrollees' medical records; where they are not, CMS may collect the overpayment. Audits take place after the final risk adjustment data submission deadline for the payment year.¹ The legal basis is 42 CFR 422.310(e), which requires organizations to submit a sample of medical records on request.²

Contract-level RADV is distinct from the HHS Office of Inspector General's own audits, which examine specific high-risk diagnosis codes at individual organizations. The two feed each other: CMS uses the results of past CMS and OIG audits when it selects contracts, enrollees already in an OIG audit or settlement are excluded from the PY2024 sampling frame, and the same dispute and appeal process covers findings from either.^{3, 2, 5}

How an audit runs

CMS notifies a selected contract through HPMS, addressing the CEO, CFO, COO and Medicare compliance officer; each contract may name up to seven points of contact, and the audit is administered in CMS's CDAT system.^{2, 3} Contract selection is risk-based and uses what CMS calls advanced data analysis.³ For payment year 2024 the sampled enrollees are drawn from the top quartile of CMS's improper-payment prediction models; enrollees in ESRD, hospice, C-SNP, I-SNP or FIDE-SNP status are excluded.²

The sample is a simple random sample whose size depends on the contract's stratum.²

For PY2024, the enrollee lists became available on September 11, 2026; the medical record submission window opened on September 18, 2026 and closes on February 5, 2027, with hardship requests due by February 19, 2027. An organization may submit up to twice as many records as it has audited HCCs.² Records are read by certified medical record coders, and each gets up to three independent reviews: an initial review, a second if the HCC is not substantiated, and a third if the first two disagree. The outcomes are confirmed, confirmed higher, discrepant, discrepant lower, or administrative exception.^{3, 2}

Appeals run through three levels: reconsideration, a hearing, and CMS Administrator review. A reconsideration request is due within 60 days of the audit report. The organization may appeal the medical record review determination and, only after that is resolved, the payment error calculation; it bears the burden of proof, may submit only one record per disputed HCC, and may not introduce new records.⁵

What reviewers accept

CMS's Medical Record Reviewer Guidance, version 2.0, sets the minimum requirements: the correct beneficiary; an acceptable risk-adjustment provider type, source and physician specialty for the face-to-face encounter; dates of service within the data collection period; valid signatures and credentials; and coding to the ICD Official Guidelines and Coding Clinic.⁴ The three acceptable provider types are hospital inpatient, hospital outpatient and physician. For PY2024, hospice, home health, lab-only, superbill and non-face-to-face sources are invalid, and telehealth counts only when it used interactive audio and video.^{4, 2}

Signatures decide many records. Stamped signatures are not acceptable. An electronic signature must carry the name, credentials and date signed, within 180 calendar days of the encounter. A signature log created at the time of the RADV request cannot cure a missing signature; a CMS-generated attestation may, but only for physician and outpatient records, not inpatient.^{4, 2} Diagnoses must be documented as a result of a face-to-face visit. Problem lists are evaluated case by case when they are not clearly tied to the encounter, and superbills, claim forms and lists of codes without narrative are unacceptable.^{2, 4}

Extrapolation and the 2023 rule

The RADV final rule, CMS-4185-F2, was published on February 1, 2023 at 88 FR 6643 and took effect on April 3, 2023. It said CMS would not extrapolate audit findings for payment years 2011 through 2017 and would begin extrapolation with the PY2018 audit, and that CMS would not apply a fee-for-service adjuster. CMS's fact sheet added that it would rely on any statistically valid method for sampling and extrapolation.^{6, 7}

On September 25, 2025, in Humana Inc. v. Becerra, the U.S. District Court for the Northern District of Texas granted summary judgment to Humana and vacated and remanded the rule, on the ground that CMS had not followed notice-and-comment requirements for its finding that actuarial equivalence does not apply to RADV.⁹ CMS describes the decision as under appeal. For PY2024 it is calculating extrapolated amounts but has not decided whether to collect them; collection for now is limited to errors found in the sampled enrollees, and CMS reserves the right to extrapolate if legally permissible.² As of this review the appeal is pending in the Fifth Circuit.

The 2025 expansion

On May 21, 2025, CMS announced that it would audit all eligible contracts, approximately 550, in each newly initiated payment year, up from about 60 a year; that sampled records would rise from 35 per plan to between 35 and 200; that its medical coder workforce would grow from 40 to approximately 2,000 by September 1, 2025; and that it would complete the remaining PY2018 to PY2024 audits by early 2026. The release cited CMS estimates of roughly $17 billion a year in overbilling and overpayment rates of 5 to 8 percent in the PY2011 to PY2013 audits.⁸

CMS's later documents show the backlog target slipping: PY2018 findings are expected in mid-2026 and PY2019 findings in 2026, while the PY2020, PY2021 and PY2024 audits were initiated on March 20, May 29 and August 28, 2026.^{3, 1}

What OIG keeps finding

OIG's December 2023 toolkit, built from its audits of high-risk diagnosis codes, reported that approximately 70 percent of those codes were not supported by the medical record, and that some codes were unsupported more than 90 percent of the time.¹⁰ In May 2026 OIG estimated that CMS potentially overpaid organizations $462 million on unsupported acute stroke codes for 2021; the code was unsupported for all 97 sampled enrollees.¹¹ Audits of individual organizations follow the same pattern:

Two 2026 developments widen the exposure beyond the diagnosis itself. OIG's February 2026 compliance program guidance for Medicare Advantage, which is voluntary, names two risk areas: failing to remove diagnosis codes previously submitted to CMS when chart reviews show they were unsupported, and using chart reviews to identify additional diagnoses that increase risk scores inappropriately.¹⁵ On March 11, 2026, Aetna agreed to pay $117.7 million to resolve False Claims Act allegations that its 2015 chart review added codes but did not delete or withdraw codes the same reviews did not support, along with allegations about morbid-obesity codes from 2018 to 2023. The settlement resolves allegations only, with no determination of liability.¹⁶

Readiness checklist

Each item below is a rule a reviewer or an appeal panel applies, not a best practice.

1. Every submitted diagnosis traces to a record of a face-to-face encounter. Diagnoses must be documented in the medical record as a result of a face-to-face visit; superbills, claim forms and lists of codes without narrative are not acceptable.⁴
2. The record comes from an acceptable provider type and specialty. The three acceptable risk-adjustment provider types are hospital inpatient, hospital outpatient and physician; hospice, home health, lab-only and non-face-to-face sources are invalid.²
3. The date of service falls inside the data collection period. One of the reviewer’s minimum requirements, along with the correct beneficiary and coding to the ICD Official Guidelines.⁴
4. The signature carries a name, credentials and a date within 180 days of the encounter. Stamped signatures are not acceptable, and a signature log created at the time of the RADV request cannot cure a missing signature.⁴
5. Telehealth encounters used interactive audio and video. For PY2024, audio-only encounters do not count outside the public-health-emergency dates.²
6. The "one best" record for each HCC is identified before the audit, not during an appeal. Only one medical record may be submitted per disputed HCC-enrollee combination at reconsideration, and no new records are allowed after the audit.⁵
7. Chart reviews run in both directions. OIG lists failing to remove unsupported codes found in chart review, and using chart reviews only to add diagnoses, as risk areas; DOJ’s March 2026 settlement with Aetna alleged exactly that pattern.¹⁵
8. The 60-day appeal clock and the HPMS contact list are ready before the notice arrives. A reconsideration request is due within 60 days of the audit report; notices go to the CEO, CFO, COO and compliance officer, with up to seven points of contact per contract.⁵

The MedChartScan Audit Module keeps the link between every submitted claim, the accepted diagnosis and the supporting clinical documentation, so the record behind each HCC can be produced on demand and shared with the health plan through a secure, auditable log. That is the standing capability the checklist describes; the announcement post explains why the module was built that way.

About MEAT

Monitor, Evaluate, Assess and Treat is a useful way to read a note, and it appears throughout industry training. It is not a CMS-defined standard: it does not appear in the reviewer guidance, the PY2024 audit methods or the RADV questions and answers. What CMS applies is the ICD-10-CM guideline that a reported condition must require or affect patient care, treatment or management, together with the requirement that the diagnosis be documented in a face-to-face encounter by an acceptable provider.^{4, 2} Use MEAT to write the note; expect the reviewer to test the record against the rules above.

Questions

Sources

1. Medicare Risk Adjustment Data Validation Program (opens in a new tab) — Centers for Medicare & Medicaid Services (page updated March 4, 2026)
2. Payment Year 2024 RADV Audit Methods and Instructions, version 1 (opens in a new tab) — Centers for Medicare & Medicaid Services (August 28, 2026)
3. RADV Questions and Answers, version 3 (opens in a new tab) — Centers for Medicare & Medicaid Services (August 28, 2026)
4. Contract-Level RADV Medical Record Reviewer Guidance, version 2.0 (opens in a new tab) — Centers for Medicare & Medicaid Services (in effect as of January 10, 2020)
5. Medicare Advantage RADV Reconsiderations Guidance (opens in a new tab) — Centers for Medicare & Medicaid Services (January 16, 2025)
6. Medicare Program; Medicare Advantage Risk Adjustment Data Validation final rule (CMS-4185-F2), 88 FR 6643 (opens in a new tab) — Federal Register (February 1, 2023)
7. Medicare Advantage RADV Final Rule (CMS-4185-F2) fact sheet (opens in a new tab) — Centers for Medicare & Medicaid Services (January 30, 2023)
8. CMS Rolls Out Aggressive Strategy to Enhance and Accelerate Medicare Advantage Audits (opens in a new tab) — Centers for Medicare & Medicaid Services (May 21, 2025)
9. Humana Inc. v. Becerra, No. 4:23-cv-00909-O, order on motion for summary judgment (opens in a new tab) — U.S. District Court, N.D. Texas (September 25, 2025); court record hosted by the Georgetown Health Care Litigation Tracker
10. Toolkit To Help Decrease Improper Payments in Medicare Advantage Through the Identification of High-Risk Diagnosis Codes (A-07-23-01213) (opens in a new tab) — HHS Office of Inspector General (December 14, 2023)
11. CMS Potentially Overpaid Medicare Advantage Organizations $462 Million Based on Certain Unsupported Acute Stroke Diagnosis Codes (A-02-23-01020) (opens in a new tab) — HHS Office of Inspector General (May 28, 2026)
12. Medicare Advantage Compliance Audit of Specific Diagnosis Codes That UnitedHealthcare Benefits of Texas, Inc. (Contract H0609) Submitted to CMS (A-07-24-01215) (opens in a new tab) — HHS Office of Inspector General (September 23, 2026)
13. Medicare Advantage Compliance Audit of Specific Diagnosis Codes: Humana Health Benefit of Louisiana (Contract H1951) (A-06-21-02001) (opens in a new tab) — HHS Office of Inspector General (December 8, 2025)
14. Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Coventry Health and Life Insurance Company (Contract H1608) Submitted to CMS (A-02-22-01020) (opens in a new tab) — HHS Office of Inspector General (June 3, 2025)
15. Medicare Advantage Industry Segment-Specific Compliance Program Guidance (opens in a new tab) — HHS Office of Inspector General (February 2026)
16. Aetna Agrees to Pay $117.7 Million to Resolve False Claims Act Allegations (opens in a new tab) — U.S. Department of Justice (March 11, 2026)