CMS RADV Audit Expansion in 2026: What HCC Coders Need to Know

The Biggest Shift in Medicare Advantage Oversight in a Decade

If you work in risk adjustment coding, the single most important development of 2026 is already underway. The Centers for Medicare and Medicaid Services (CMS) launched Payment Year 2020 Risk Adjustment Data Validation (RADV) audits in February 2026 under a dramatically expanded enforcement strategy. The agency is scaling from auditing roughly 60 Medicare Advantage (MA) plans per year to auditing all eligible plans -- approximately 550 contracts -- every single year.

For Hierarchical Condition Category (HCC) coders, this is not a distant policy discussion. It is a direct change to how your work will be scrutinized, and the audits are happening right now.

What Changed and Why It Matters

CMS has made three structural changes to the RADV program that every risk adjustment professional should understand.

Massive resource expansion. CMS increased its certified medical coder workforce supporting RADV audits from 40 to approximately 2,000. That is a 50-fold increase in review capacity. The agency is also deploying artificial intelligence (AI)-enabled tools to support coder efficiency, though all final overpayment determinations will remain with certified human coders.

Quarterly audit launches. Under the accelerated program, CMS plans to initiate new audits approximately every three months. This means plans cannot treat RADV as a once-in-a-decade event. Every eligible MA contract should expect to be audited on a recurring basis.

Variable sample sizes. CMS is expanding the number of enrollee records reviewed per audit from a flat 35 to a range of 35 to 200 records per plan, based on contract size and other criteria. Larger plans will face deeper scrutiny.

These changes come against the backdrop of federal estimates that unsupported diagnosis data results in approximately $17 billion in annual MA overpayments -- a figure MedPAC's February 2026 CY2027 Advance Notice comment letter has repeatedly highlighted when urging CMS to tighten risk-adjustment validation. CMS completed audits for Payment Years 2011 through 2013 and found overpayment rates between five and eight percent.

What RADV Auditors Actually Review

Understanding the audit process helps coders produce documentation-supported work from day one. During a RADV audit, CMS selects a sample of enrollees from a plan and requests the medical records that support the diagnosis codes submitted for risk adjustment. Auditors then review each record to determine whether the submitted International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM) codes -- cross-referenced against the official CMS ICD-10-CM code set -- are supported by the clinical documentation.

A diagnosis is considered unsupported when:

For each audited condition, plans may submit up to two medical records, but CMS only needs one valid record to confirm support. The five-month medical record submission window has been restored following stakeholder feedback, giving plans more time to retrieve records from providers.

The Legal Landscape Is Still Evolving

It is worth noting that the methodology for calculating RADV repayments remains in flux. A September 2025 federal court ruling vacated portions of the 2023 RADV Final Rule (originally published in the Federal Register rulemaking portal), and CMS is appealing. However, CMS has made it clear that RADV audits will continue moving forward regardless of the legal proceedings around extrapolation methodology.

For coders, this means the standard has not changed: every HCC you capture must be fully supported by clinical documentation from a qualifying encounter. The legal questions are about how overpayments are calculated at the plan level, not about whether individual diagnoses need documentation support.

Five Things HCC Coders Should Do Right Now

The expanded RADV program raises the stakes for coding accuracy. Here are practical steps every risk adjustment coder can take today.

1. Audit your own work before CMS does. Pull a sample of recently coded charts and verify each submitted diagnosis against the full record, official classification, and applicable program requirements. Do not substitute an internal MEAT checklist for CMS audit instructions.

2. Stop coding from problem lists alone. A problem list entry without corresponding assessment, plan, or treatment notes in the body of the encounter does not meet RADV standards. If the provider listed "Type 2 Diabetes Mellitus with chronic kidney disease" on the problem list but did not address it during the visit, it is not a valid HCC capture.

3. Verify face-to-face encounter requirements. RADV only accepts diagnoses from qualifying face-to-face encounters with eligible provider types. Lab-only visits, phone calls, and certain telehealth encounters may not qualify. Know which encounter types are acceptable for risk adjustment submission.

4. Check the model source. CY2026 non-PACE risk scores use V28 at full weight, while PACE follows a separate blend. The current CMS 2026 model software and ICD-10 mappings provides generic V28, not generic V24. Historical V24 must come from the official source for the payment year under review.

5. Document your coding rationale. When a diagnosis requires clinical judgment -- for example, distinguishing between acute and chronic conditions, or determining the appropriate specificity level -- make a note of why you selected the code you did. This is invaluable during internal audits and can help your organization respond to RADV inquiries.

The Connection Between RADV and V28

CY2026 non-PACE risk scores use V28 at full weight. The source-checked comparison has 8,019 unique payable codes in CY2026 V28 and 9,927 in the historical PY2025 V24 reference. Of the union, 7,660 map in both, 2,267 map only in historical V24, and 359 map only in V28.

Under RADV, the audit applies the model version that was in effect for the payment year being reviewed. Payment Year 2020 audits, for example, use the V24 model. But as RADV catches up to more recent payment years, V28 mapping accuracy will become the standard under review -- the OIG's work plan project on V24 vs. V28 trend comparisons is the clearest public signal of how federal oversight is bridging the two generations. Building V28 accuracy into your workflow now is an investment in future audit readiness.

The CRC reference page is a useful resource for checking which condition categories are active under V28 and understanding how the hierarchy rules apply.

Staying Ahead of the Curve

The era of RADV as a low-probability event is over. With 550 plans audited annually, quarterly audit cycles, and 2,000 coders reviewing records, the odds of any given MA plan facing a RADV audit have gone from slim to near-certain. For coders on the front lines, the best protection is the same discipline that has always defined excellent HCC coding: specificity, documentation support, and clinical accuracy.

> RAF Calculator: The RAF Calculator supports CMS-HCC V28 for Payment Year 2026 and requires complete member context. HCC Buddy shows a score only after the server confirms the required source and calculation checks. If a check is unavailable or does not pass, no score is shown.

If your organization is preparing for RADV readiness, building these verification steps into your daily workflow is one of the simplest and most effective changes you can make.

Ready to strengthen your coding accuracy? Create a free HCC Buddy account and start verifying HCC mappings, Risk Adjustment Factor (RAF) weights, and code specificity in seconds.