01What a RADV audit checks
Risk Adjustment Data Validation (RADV) is how CMS confirms that the diagnoses a Medicare Advantage organization submitted for payment are supported by the enrollee’s medical record.
CMS selects contracts and a sample of enrollees, then asks the plan to provide medical records that support each Hierarchical Condition Category (HCC) that drove payment for the payment year under review. Certified coders review those records, and where a diagnosis isn’t supported, the related payment can be recovered.
The practical takeaway: a RADV audit is a test of documentation that already exists. Most of the work that determines the outcome happens long before the audit letter arrives.
02Why preparation matters more now
In May 2025 CMS announced it would audit all eligible MA contracts in every newly initiated payment-year audit (roughly 550 plans, up from about 60), sample between 35 and 200 records per contract depending on size, and expand its team of medical coders to about 2,000.
CMS’s published schedule shows audits for payment years 2020, 2021 and 2024 initiated in 2026, with 2022, 2023 and 2025 planned through spring 2027. Dates can change, so check the CMS RADV page.
In September 2025 a federal district court in Texas vacated the 2023 RADV final rule, including its extrapolation provisions, on procedural grounds. CMS has appealed to the Fifth Circuit and has said it will comply with the ruling while it stands, so audits continue but recoveries are currently limited to the sampled enrollees. Confirm the current status with your counsel before modelling financial exposure.
Always work from current CMS guidance
Audit scope, timelines, submission limits and methodology are set by CMS and do change. Use this checklist alongside the instructions in your audit notice and the current CMS RADV medical record reviewer guidance.
03What counts as a valid record
Reviewers look for a record from an acceptable source that clearly documents the condition during the data collection period. In general terms:
✓Usually acceptable
- Face-to-face encounter with an acceptable provider type
- Hospital inpatient and outpatient records, physician records
- Date of service within the data collection period
- Patient name and date of birth on every page
- Provider signature and credentials
- Condition assessed or managed, not just listed
✕Usually not acceptable
- Diagnostic radiology reports on their own
- A problem list with no evidence of assessment
- Superbills or claim forms
- Unsigned or uncredentialed notes
- Illegible records
- Encounters outside the collection period
Many coding teams use a framework such as MEAT (Monitor, Evaluate, Assess/Address, Treat) to check that each diagnosis is actively supported in the note, not just mentioned.
04The checklist
Work through it in order. Phases 1 and 2 are ongoing; phases 3 to 5 start when the audit notice arrives. Tick items off as you go; your progress is saved in this browser.
Let’s get started
0 of 30 items complete
Build documentation that holds up
Habits that decide most audit outcomes, long before an audit is announced.
Set up your audit response team
Decide who does what so nobody is improvising under a deadline.
Scope the audit and plan backwards
Read the instructions carefully, then build a calendar from the submission deadline.
Find the best record for each HCC
Gather broadly, then choose deliberately. More pages isn’t better; the right page is.
Package, submit and keep a copy
Leave time for quality control. Last-minute uploads are where mistakes happen.
05Common reasons HCCs fail validation
When audit findings are reviewed afterwards, the same handful of issues tend to come up:
- Diagnosis is listed but not supported. The condition appears in a problem list or history, but there’s no evidence it was assessed or treated at that visit.
- Specificity doesn’t match. The record supports a less severe or different condition than the HCC submitted, for example diabetes without the complication that was coded.
- Wrong source or provider type. The best evidence sits in a record type that isn’t acceptable for RADV.
- Missing authentication. No legible signature or credentials, or a missing attestation where one was needed.
- Date of service outside the period. The right documentation exists, but from the wrong year.
- “History of” conditions coded as current. Resolved conditions submitted as active.
Don’t wait for an audit to find these
A small, regular internal sample review on your highest-value HCCs is one of the most effective ways to surface documentation gaps while there’s still time to address provider education.
06After you submit
Keep a complete, indexed copy of exactly what was submitted, and the coding rationale behind each record choice. When preliminary findings arrive, compare them HCC by HCC against your own review. Where you believe the reviewer reached the wrong conclusion, the dispute and appeal process has defined steps and deadlines, so diarise them as soon as findings are received.
Finally, feed what you learned back into provider education and your year-round coding review, so the next audit starts from a stronger position.
Sources
- CMS: Rolls out aggressive strategy to enhance and accelerate Medicare Advantage audits (May 21, 2025)
- CMS: Medicare Advantage RADV audit schedule
- CMS: RADV program announcements
- Healthcare Dive: Administration appeals decision vacating MA audit rule
This article is general information for healthcare operations teams and isn’t legal or compliance advice. Requirements are set by CMS and can change; always follow the instructions in your audit notice and current CMS guidance.