CMS RADV Audit Expansion in 2026: What HCC Coders Need to Know

The Biggest Shift in Medicare Advantage Oversight in a Decade

If you work in risk adjustment coding, the single most important development of 2026 is already underway. The Centers for Medicare and Medicaid Services (CMS) launched Payment Year 2020 Risk Adjustment Data Validation (RADV) audits in February 2026 under a dramatically expanded enforcement strategy. The agency is scaling from auditing roughly 60 Medicare Advantage (MA) plans per year to auditing all eligible plans -- approximately 550 contracts -- every single year.

For Hierarchical Condition Category (HCC) coders, this is not a distant policy discussion. It is a direct change to how your work will be scrutinized, and the audits are happening right now.

What Changed and Why It Matters

CMS has made three structural changes to the RADV program that every risk adjustment professional should understand.

Massive resource expansion. CMS increased its certified medical coder workforce supporting RADV audits from 40 to approximately 2,000. That is a 50-fold increase in review capacity. The agency is also deploying artificial intelligence (AI)-enabled tools to support coder efficiency, though all final overpayment determinations will remain with certified human coders.

Quarterly audit launches. Under the accelerated program, CMS plans to initiate new audits approximately every three months. This means plans cannot treat RADV as a once-in-a-decade event. Every eligible MA contract should expect to be audited on a recurring basis.

Variable sample sizes. CMS is expanding the number of enrollee records reviewed per audit from a flat 35 to a range of 35 to 200 records per plan, based on contract size and other criteria. Larger plans will face deeper scrutiny.

These changes come against the backdrop of federal estimates that unsupported diagnosis data results in approximately $17 billion in annual MA overpayments -- a figure MedPAC's February 2026 CY2027 Advance Notice comment letter has repeatedly highlighted when urging CMS to tighten risk-adjustment validation. CMS completed audits for Payment Years 2011 through 2013 and found overpayment rates between five and eight percent.

What RADV Auditors Actually Review

Understanding the audit process helps coders produce documentation-supported work from day one. During a RADV audit, CMS selects a sample of enrollees from a plan and requests the medical records that support the diagnosis codes submitted for risk adjustment. Auditors then review each record to determine whether the submitted International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM) codes -- cross-referenced against the official CMS ICD-10-CM code set -- are supported by the clinical documentation.

A diagnosis is considered unsupported when:

For each audited condition, plans may submit up to two medical records, but CMS only needs one valid record to confirm support. The five-month medical record submission window has been restored following stakeholder feedback, giving plans more time to retrieve records from providers.

The Legal Landscape Is Still Evolving

It is worth noting that the methodology for calculating RADV repayments remains in flux. A September 2025 federal court ruling vacated portions of the 2023 RADV Final Rule (originally published in the Federal Register rulemaking portal), and CMS is appealing. However, CMS has made it clear that RADV audits will continue moving forward regardless of the legal proceedings around extrapolation methodology.

For coders, this means the standard has not changed: every HCC you capture must be fully supported by clinical documentation from a qualifying encounter. The legal questions are about how overpayments are calculated at the plan level, not about whether individual diagnoses need documentation support.

Five Things HCC Coders Should Do Right Now

The expanded RADV program raises the stakes for coding accuracy. Here are practical steps every risk adjustment coder can take today.

1. Audit your own work before CMS does. Pull a random sample of your recently coded charts and re-review them as if you were a RADV auditor. Is every HCC-mapped diagnosis supported by clinical documentation? Does the documentation meet MEAT criteria? Are codes assigned to the highest level of specificity supported by the record?

2. Stop coding from problem lists alone. A problem list entry without corresponding assessment, plan, or treatment notes in the body of the encounter does not meet RADV standards. If the provider listed "Type 2 Diabetes Mellitus with chronic kidney disease" on the problem list but did not address it during the visit, it is not a valid HCC capture.

3. Verify face-to-face encounter requirements. RADV only accepts diagnoses from qualifying face-to-face encounters with eligible provider types. Lab-only visits, phone calls, and certain telehealth encounters may not qualify. Know which encounter types are acceptable for risk adjustment submission.

4. Double-check specificity under the V28 model. With the CMS-HCC V28 model now at 100 percent implementation for 2026, the ICD-10-CM to HCC mapping has changed significantly -- all final mapping files are published on the CMS 2026 model software and ICD-10 mappings page. Codes that mapped to HCCs under V24 may no longer map under V28, and vice versa. Using outdated crosswalk knowledge can lead to both missed captures and unsupported submissions. You can verify any code's current HCC mapping instantly using a tool like the ICD-10 encoder.

5. Document your coding rationale. When a diagnosis requires clinical judgment -- for example, distinguishing between acute and chronic conditions, or determining the appropriate specificity level -- make a note of why you selected the code you did. This is invaluable during internal audits and can help your organization respond to RADV inquiries.

The Connection Between RADV and V28

The full implementation of the V28 risk adjustment model in 2026 adds another layer of complexity to the RADV landscape. V28 expanded HCC categories from 86 to 115 while reducing the total number of ICD-10-CM codes that map to any HCC from approximately 9,797 to about 7,770. This means coders are working with a different code-to-HCC crosswalk than they used even a year ago.

Under RADV, the audit applies the model version that was in effect for the payment year being reviewed. Payment Year 2020 audits, for example, use the V24 model. But as RADV catches up to more recent payment years, V28 mapping accuracy will become the standard under review -- the OIG's work plan project on V24 vs. V28 trend comparisons is the clearest public signal of how federal oversight is bridging the two generations. Building V28 accuracy into your workflow now is an investment in future audit readiness.

The CRC reference page is a useful resource for checking which condition categories are active under V28 and understanding how the hierarchy rules apply.

Staying Ahead of the Curve

The era of RADV as a low-probability event is over. With 550 plans audited annually, quarterly audit cycles, and 2,000 coders reviewing records, the odds of any given MA plan facing a RADV audit have gone from slim to near-certain. For coders on the front lines, the best protection is the same discipline that has always defined excellent HCC coding: specificity, documentation support, and clinical accuracy.

Tools like HCC Buddy's RAF calculator and ICD-10 encoder can help you verify mappings in real time as you code, reducing the risk of submitting unsupported diagnoses. If your organization is preparing for RADV readiness, building these verification steps into your daily workflow is one of the simplest and most effective changes you can make.

Ready to strengthen your coding accuracy? Create a free HCC Buddy account and start verifying HCC mappings, Risk Adjustment Factor (RAF) weights, and code specificity in seconds.