The Medicare Advantage Audit Wave Is Here

Ned Barrett
March 27, 2026
Business

The Medicare Advantage Audit Wave Is Here: What Providers Need to Know — and Do — Right Now

Something Fundamental Just Changed in Medicare Advantage Oversight

For most of the history of Medicare Advantage, RADV audits — the Risk Adjustment Data Validation process through which CMS verifies that submitted diagnosis codes are supported by clinical documentation — were a background concern. CMS audited roughly 60 contracts per year. Most providers and plans operated with the reasonable expectation that their particular contract would not be selected, and that any audit findings would be manageable. That calculation informed how organizations prioritized their coding compliance investments.

That calculation is now wrong — and the consequences of continuing to operate under the old assumptions are potentially severe.

On May 21, 2025, CMS announced a dramatic and immediate expansion of its RADV audit program. Rather than selecting approximately 60 contracts per year, CMS committed to auditing all eligible Medicare Advantage organizations annually — approximately 550 contracts — with new audits initiated on a quarterly cadence. CMS simultaneously committed to completing all outstanding audits for Payment Years 2018 through 2024, pledging to close that backlog by early 2026. Payment Year 2020 RADV audits began in February 2026 and are now actively underway.

The scale of this shift cannot be overstated. What might have been staggered as a series of smaller repayments over a decade could become a tidal wave of obligations concentrated around 2025–2026. For health plans and — critically — for the providers whose documentation forms the evidentiary foundation of every RADV audit, the environment has fundamentally changed.

Federal estimates suggest that MA organizations may be submitting unsupported diagnosis data, resulting in approximately $17 billion in overpayments annually. CMS is now building the infrastructure — expanded workforce, AI-assisted review technology, quarterly audit cadence — to find and recover those dollars. The question for every organization participating in Medicare Advantage is not whether they will face scrutiny. It is whether their coding and documentation practices will withstand it.

At Coding & Billing Solutions, this is one of the most consequential compliance developments we’ve seen in our 15+ years of serving healthcare organizations. This post explains exactly what the RADV audit expansion means for providers, what auditors are looking for, and what organizations must do right now to protect themselves.

What RADV Audits Actually Review — and Why Documentation Is Everything

Understanding RADV audits requires understanding the payment architecture they are designed to validate.

Medicare Advantage plans receive per-member, per-month payments from CMS that are risk-adjusted upward or downward based on the documented health status of their enrolled populations. That adjustment is driven entirely by Hierarchical Condition Category (HCC) coding — ICD-10-CM codes that represent chronic and serious conditions and map to specific HCC categories that carry defined risk weights. A patient with documented heart failure, diabetes with complications, and chronic kidney disease will generate a higher Risk Adjustment Factor (RAF) score — and therefore higher capitated payments — than a patient whose record reflects only hypertension and hyperlipidemia.

The financial integrity of this system depends on one thing: that the diagnoses driving those elevated RAF scores are genuinely present and genuinely documented in the patient’s medical record. RADV audits are the mechanism CMS uses to verify that dependency. Auditors pull a sample of enrolled members, request the medical records supporting the diagnoses submitted for those members, and determine whether each submitted HCC is validated by clinical documentation.

Federal auditors apply MEAT criteria to validate every diagnosis submitted for risk adjustment. MEAT stands for Monitored, Evaluated, Assessed, or Treated. Even one MEAT element technically supports a diagnosis, but auditors scrutinize whether that single element demonstrates active clinical management rather than passive documentation. A chronic condition mentioned in the history without evidence of monitoring, evaluation, assessment, or treatment will not survive an audit challenge. Common MEAT failures that trigger recoupments include diagnoses listed in problem lists or past medical history without evidence that the condition was addressed during the encounter.

This is the specific, granular standard against which every submitted HCC will be measured in a RADV audit — not whether the condition exists, not whether it was ever diagnosed, but whether the documentation in the encounter record for the applicable service date demonstrates active clinical management according to the MEAT framework. A diagnosis that meets this standard generates no audit risk. A diagnosis that doesn’t — even if the underlying condition is genuinely present and being managed elsewhere in the patient’s care — is a finding that generates a recoupment demand.

The Legal Landscape: What the September 2025 Court Ruling Actually Means

Any discussion of the 2026 RADV environment must address the significant legal development that occurred in September 2025 — and precisely what it does and doesn’t change for providers.

On September 25, 2025, a federal district court vacated the Medicare Advantage risk adjustment and data validation final rule that would have enabled CMS to extrapolate RADV audit results across a contract’s entire population. Under the vacated rule, if auditors found a 5% error rate in a sample of 200 enrollees from a contract generating $1 billion in payments, CMS could have extrapolated that error rate to the entire contract population — potentially generating a $50 million recoupment demand from a single audit cycle.

The court’s ruling is meaningful for Medicare Advantage organizations managing large contracts, because it removes the extrapolation methodology that would have multiplied sample findings into contract-wide recoupments. That is a genuine — and significant — legal protection for plans.

What it does not do is stop RADV audits. While legal challenges to portions of the 2023 RADV Final Rule remain ongoing, CMS has confirmed that RADV audits will continue while the appeals process plays out. MA organizations should not assume that legal uncertainty equates to reduced audit activity. CMS has emphasized that it will comply with applicable court orders while continuing to pursue outstanding and future payment year RADV audits.

The fundamental RADV audit process — sample selection, medical record review, overpayment identification, and recoupment for unsupported diagnoses within the sample — continues on the accelerated quarterly cadence CMS announced in May 2025. Even without extrapolation, a 200-enrollee sample with significant unsupported diagnoses creates meaningful repayment demands. And as the OIG’s own completed audit work demonstrates, those demands are real: in one recent OIG audit of a single plan for a two-year period, 232 of 286 sampled enrollee-years showed medical records that did not support the diagnosis codes, resulting in $830,334 in net overpayments — with estimated total overpayments for the plan of at least $4.3 million for 2018 and 2019.

For providers, the court ruling changes the extrapolation math at the plan level. It does not change the documentation standard their records must meet, the audit cadence their plans will face, or the downstream pressure plans will pass to their provider networks when recoupment demands arrive.

Why This Matters Directly to Providers — Not Just Plans

The RADV audit conversation is often framed as a health plan compliance issue. That framing is incomplete — and dangerous for providers who interpret it as meaning RADV risk belongs to someone else.

When RADV audits find unsupported diagnoses and generate recoupment demands, plans absorb the immediate financial hit from CMS. But plans do not absorb those costs quietly. The financial strain caused by the increased audits could lead MA plans to reduce options, supplemental benefits, and payments to providers. Providers should look out for these changes and plan accordingly. It will remain to be seen whether the increased RADV audit efforts lead to MA plans seeking to revise audit liability and recoupment language in future provider contracts.

That last point deserves direct attention. MA plans whose RADV findings are traceable to specific provider documentation failures have increasing incentive — and, in some contract structures, existing mechanisms — to pass recoupment liability back to the providers whose records generated the unsupported findings. As CMS accelerates audits and recoupment activity, provider contracts that were written under a lower-intensity audit environment may be renegotiated to shift more risk downstream.

Beyond contractual exposure, providers whose documentation patterns are flagged as high-risk within an MA plan’s internal pre-audit monitoring may face enhanced scrutiny, prepayment reviews, or reduced reimbursement as the plan attempts to reduce its own audit exposure. DOJ is pursuing qui tam whistleblower cases, conducting independent investigations, and targeting not just MA organizations but also vendors, providers, and third-party entities involved in risk adjustment.

The RADV audit wave is a plan-level event with provider-level consequences. Organizations that treat it as someone else’s problem are not protected by that interpretation.

The High-Risk HCC Categories Auditors Are Targeting

Not all HCC codes carry equal audit risk. CMS and OIG have consistently focused RADV scrutiny on HCC categories where documentation failures are most common, where the financial stakes per code are highest, and where the gap between diagnosed prevalence and documented support is widest. Understanding where auditors look first is the foundation of any effective RADV readiness program.

Major Depressive Disorder and Psychiatric Diagnoses. Mental health diagnoses consistently appear on OIG’s high-risk list because they require explicit documentation of diagnosis, assessment, and management plan — criteria that busy primary care documentation often fails to capture with sufficient specificity.

Diabetes with Complications. The HCC system distinguishes between diabetes without complications (lower weight) and diabetes with specific complications — neuropathy, nephropathy, retinopathy, peripheral vascular disease — each of which carries a higher RAF weight. Providers who document “diabetes” without specifying complications present in the patient systematically undervalue those patients’ RAF scores — leaving legitimate revenue uncollected while also failing to accurately represent patient complexity.

Chronic Kidney Disease. CKD staging is a perennial audit focus because the HCC weight varies significantly by stage, and vague documentation — “CKD, stage unknown” or simply “CKD” — both fails to capture the appropriate HCC and triggers audit scrutiny for specificity gaps.

Congestive Heart Failure. Like CKD, CHF coding requires specificity — systolic vs. diastolic, acute vs. chronic vs. acute-on-chronic — that provider documentation frequently glosses over. Imprecise documentation generates either a lower HCC weight than the patient’s actual condition supports, or an unsupported HCC when auditors can’t find the specific language required.

Cancer Diagnoses. Active vs. history cancer coding has significant HCC implications. Active cancer carries substantially higher RAF weight than a history of cancer, and the documentation standard for establishing active vs. resolved status is specific. Providers who document cancer in ways that don’t clearly establish current active treatment generate audit vulnerabilities regardless of the patient’s actual clinical status.

Morbid Obesity. BMI-based obesity documentation requires that the BMI value be documented by a provider in the encounter note — not just captured in a vital signs flowsheet — and that the diagnosis be explicitly linked to clinical management. Flowsheet-only BMI documentation without provider narrative is a common MEAT failure that generates recoupment in RADV audits.

The Five Documentation Practices That Fail RADV Audits

Understanding what auditors reject is as important as understanding what they require. Based on OIG audit findings and the MEAT validation framework, these are the documentation patterns most consistently found to be non-supportive in RADV reviews:

Problem List Diagnoses Without Encounter-Level Evidence of Management. A diagnosis appearing only on a patient’s problem list — without any evidence in the encounter note that the condition was monitored, evaluated, assessed, or treated at that specific visit — does not meet the MEAT standard for that service date. HCC codes can only be submitted for dates of service where the documentation supports active management.
Copy-Forward Notes Without Condition-Specific Updates. Copy-and-paste documentation that recycles prior visit notes — including chronic condition diagnoses — without demonstrating that each condition was individually assessed at the current encounter generates diagnoses that are documented but not validated. Auditors look for evidence that the provider engaged with each listed condition, not merely carried it forward.
“History Of” Language for Actively Managed Conditions. Documenting a condition as “history of” when it remains active and under management is a coding and documentation error that removes the diagnosis from HCC eligibility. “History of Type 2 Diabetes” describes a resolved condition. “Type 2 Diabetes Mellitus, currently managed with metformin” describes an active condition. The difference in RAF value — and audit defensibility — can be substantial.
Specificity Gaps in Complication and Staging Language. Vague characterizations of conditions with HCC-relevant subclassifications — “CHF,” “CKD,” “Diabetes” — without the specificity required to assign the appropriate ICD-10 code fail to support the HCC even when the underlying condition is genuinely present and managed. Documentation must reflect the level of specificity that coding guidelines require.
Diagnoses Documented Only in Test Results or Nursing Notes. CMS requires that HCC-supporting diagnoses be documented by the treating provider — physician, NP, or PA — in the encounter note. Diagnoses appearing only in lab reports, radiology reads, or nursing flowsheets without corresponding provider documentation do not satisfy the MEAT standard for risk adjustment purposes.

Building RADV Readiness: What Needs to Happen Now

CMS has made clear that data accuracy is a year-round responsibility, not just an audit year exercise. For organizations participating in Medicare Advantage — whether as plans, provider groups, hospital systems, or ACO participants — the time to build RADV readiness infrastructure is before the audit notice arrives, not after.

A comprehensive RADV readiness program has several non-negotiable components:

Proactive Internal Auditing. Organizations cannot wait for federal audits to identify compliance gaps. By the time CMS or OIG selects a plan for audit, the exposure has already accumulated across multiple payment years. Internal auditing programs that routinely sample HCC-supporting documentation against the MEAT standard — before CMS does — allow organizations to identify and remediate documentation patterns before they become recoupment findings.

Provider Education Focused on MEAT Documentation. The most common RADV failures are not the result of intentional miscoding. They are the result of providers who don’t know that their documentation habits — problem list reliance, copy-forward shortcuts, vague complication language — are creating unsupported HCC submissions. Targeted education that teaches providers specifically how to document chronic conditions in ways that meet the MEAT standard at every encounter is the highest-leverage RADV prevention investment available.

HCC Recapture and Annual Closure Programs. Medicare Advantage risk adjustment operates on an annual cycle — conditions must be documented and coded in each payment year to be included in that year’s RAF calculation. An HCC that was fully supported in 2024 but not recaptured in 2025 is treated as resolved for 2025 payment purposes, even if the condition is still actively managed. Structured annual recapture programs, driven by CDI specialists who review patient records before and during encounters to ensure all qualifying conditions are addressed, prevent the year-over-year RAF erosion that silently costs organizations revenue.

High-Risk HCC Monitoring. Comparing your organization’s HCC capture rates for high-risk categories against national prevalence benchmarks adjusted for your population demographics identifies statistical outliers — both in the direction of undercapture (a revenue and accuracy problem) and overcapture (an audit and compliance problem). Monitoring should be continuous, not periodic, because problematic patterns that persist for months generate proportionally greater exposure.

CDI-Coding Integration for MA Populations. The same CDI-coding collaboration that drives inpatient DRG accuracy is equally critical for outpatient Medicare Advantage encounters. CDI specialists working prospectively with MA patient populations — prompting providers to address and document all qualifying chronic conditions before each encounter — generate the concurrent documentation that both supports HCC submission and withstands MEAT-based audit scrutiny.

The Compliance Stakes: False Claims Act Exposure for Providers

For organizations whose RADV exposure stems from systematic documentation failures rather than isolated errors, the compliance stakes extend beyond recoupment into False Claims Act territory. The FCA imposes liability for knowingly submitting false or fraudulent claims to federal healthcare programs — and in the risk adjustment context, “knowing” has been interpreted broadly by DOJ to include situations where an organization was aware of documentation problems but failed to implement corrective action.

Recent fiscal year recoveries have totaled billions in healthcare False Claims Act settlements, with Medicare Advantage fraud identified as an area of critical importance. Several major MA organizations have settled FCA claims related to risk adjustment coding practices for amounts ranging from tens of millions to hundreds of millions of dollars. While most of these settlements have involved plans rather than individual providers, the DOJ’s expanding investigation activity — including qui tam whistleblower cases that name vendors and provider entities — signals that provider-level FCA exposure in the MA risk adjustment context is no longer theoretical.

Organizations that proactively identify and remediate documentation gaps, self-disclose overpayments through appropriate channels, and implement robust compliance programs are in a fundamentally different legal position than those that allow known problems to persist. The investment in RADV readiness is not just a revenue protection strategy — it is a legal risk management imperative.

How CBS Supports Medicare Advantage Compliance

Coding & Billing Solutions brings the specific expertise that Medicare Advantage risk adjustment and RADV readiness require: deep HCC coding knowledge, CDI specialists trained in MEAT-standard documentation, proactive auditing programs, and the ability to work directly with provider teams to improve documentation at the source.

Our 100% domestic, AHIMA- and AAPC-credentialed coders understand the ICD-10-CM specificity requirements that HCC coding demands — and the difference between documentation that supports an HCC submission and documentation that will fail audit scrutiny. Our CDI specialists work prospectively with clinical teams to ensure that chronic conditions are documented with the encounter-level specificity that RADV validators require, not just carried forward in problem lists.

And because our team is U.S.-based and available for real-time communication, the feedback loop between auditing findings and provider education actually functions. When our auditing programs identify a documentation pattern that creates RADV exposure, the correction happens through direct, timely collaboration with clinical staff — not through a report delivered weeks later across time zones.

For organizations that have not yet conducted a comprehensive review of their HCC documentation and coding practices against the MEAT standard and current RADV audit criteria, the window to do that proactively is narrowing. Payment Year 2020 audits are active. Payment Years 2019 through 2024 are in various stages of the expanded audit program. The organizations building their readiness posture now will navigate this environment with confidence. Those that wait will be building it under audit pressure — which is always more expensive, more disruptive, and more consequential than building it before the audit notice arrives.

The Bottom Line: RADV Is Not a Future Risk. It Is a Present One.

The Medicare Advantage RADV audit expansion is not a regulatory proposal, a pilot program, or a future policy direction. It is active federal enforcement, underway right now, with quarterly audit initiation cycles that mean every eligible MA contract will face scrutiny every year going forward. The $17 billion in estimated annual MA overpayments that CMS is working to recover will not be recovered politely or slowly.

For providers whose Medicare Advantage patients represent a meaningful share of their population — and for organizations participating in ACOs, shared savings programs, or capitated MA arrangements — RADV readiness is now a first-tier compliance and revenue protection priority. The documentation practices that were acceptable under a low-intensity audit regime are the same ones that will generate findings under the regime that replaced it.

The organizations that survive and thrive in this environment will be those that treat HCC coding accuracy not as a billing function, but as a clinical documentation discipline — one that requires ongoing education, proactive auditing, CDI collaboration, and the kind of expert coding partnership that ensures every submitted diagnosis is both clinically accurate and audit-defensible.

Ready to Assess Your RADV Readiness?

Coding & Billing Solutions provides HCC coding accuracy reviews, CDI consulting, Medicare Advantage documentation auditing, and coding compliance programs for hospitals, physician practices, ACOs, and specialty providers participating in Medicare Advantage arrangements.

Contact us today for a complimentary RADV readiness consultation.

Please call us at 610-428-9034 or fill out our Contact Form.

Coding & Billing Solutions is a U.S.-based health information management (HIM) and medical coding company serving healthcare providers since 2010. Our team of credentialed, experienced professionals delivers accuracy, accountability, and results — 7 days a week, including holidays.

Related Posts: