Here’s something that should get your attention: the Centers for Medicare & Medicaid Services (CMS) announced they’re expanding Risk Adjustment Data Validation (RADV) audits from roughly 60 Medicare Advantage plans per year to all 550 eligible contracts. And they’re not just auditing more plans. They’re scaling up their medical coder workforce from 40 to 2,000 by September 2025, while cranking up record reviews from about 35 charts per plan to as many as 200.
This isn’t a gradual shift. CMS explicitly called their strategy “aggressive” and they mean it. They’re planning to complete all audits for Payment Years 2018 through 2024 by early 2026, which means audit notices that organizations thought were years away could hit any day now.
The financial stakes? CMS estimates Medicare Advantage plans overbill by $17 billion annually, though the Medicare Payment Advisory Commission puts that figure closer to $43 billion. With extrapolation now in play for Payment Year 2018 forward, a handful of unsupported diagnoses in your audit sample could translate into millions in clawbacks.
But you don’t have to wait around for CMS to find problems in your documentation. The smarter move is getting ahead of it by auditing your own high-risk Hierarchical Condition Category (HCC) codes first. At MDAudit, we’ve seen organizations that take this proactive approach consistently outperform those that wait for the audit notice to arrive.
Why Some HCC Codes Get Flagged More Than Others
Not all HCC codes carry the same audit risk. CMS specifically targets codes that show significant coding differences between Medicare Advantage and fee-for-service Medicare, or conditions where documentation practices tend to get sloppy.
The transition to CMS-HCC Version 28 makes this even more critical. Version 28 removed 2,294 codes that previously mapped to payment HCCs in Version 24, while adding 115 total HCCs (up from 86). This restructuring means some codes that used to generate revenue now carry zero weight, and practices that haven’t updated their coding strategies are leaving money on the table or worse, documenting conditions that won’t stand up in an audit.
One major shift is “constraining,” where CMS assigns the same coefficient to related conditions. Take diabetes. Under the old model, diabetes with complications paid more than diabetes without complications. Now? Diabetes with unspecified complications, diabetes with acute complications, and diabetes with chronic complications all have the same coefficient (except for pancreas transplant status at the top). This flattening means that vague documentation like “diabetes, unspecified” doesn’t hurt you as much under V28, but auditors will scrutinize whether that diabetes diagnosis is even supported.
The Usual Suspects in HCC Audits
Based on RADV audit patterns and coding intensity reviews we’ve observed, certain HCC categories consistently draw more scrutiny. Here’s what we recommend auditing internally:
Diabetes With Complications
Diabetes HCCs are everywhere in Medicare Advantage populations, which makes them prime audit targets. The challenge isn’t just coding them; it’s proving they’re still active and require ongoing treatment.
Under Version 28, diabetes now maps to HCC 35 through 38. HCC 35 is pancreas transplant status (highest payment). HCC 36 covers severe acute complications. HCC 37 handles chronic complications. HCC 38 is the catch all for glycemic, unspecified, or no complications. The kicker is that HCC 36, 37, and 38 all carry the same weight now thanks to constraining.
What gets providers in trouble? Using diabetes with complications codes when the chart doesn’t actually document those complications being addressed during the encounter. CMS requires Monitor, Evaluate, Assess, and Treat (MEAT) criteria for each chronic condition. If you’re billing E11.65 (Type 2 diabetes with hyperglycemia) but the note only says “diabetes stable, continue metformin,” that’s insufficient. You need evidence that hyperglycemia was monitored (recent A1c or glucose readings), evaluated (discussion of control), and treated (medication adjustment or continued management).
The other trap is failing to recapture diabetes annually. HCC conditions reset every year. If a patient had diabetes with nephropathy documented in 2023 but comes in for unrelated visits in 2024 and the diabetes never shows up in your coding, you lose that HCC for the year. Your Risk Adjustment Factor (RAF) score drops, your payments decrease, and if CMS audits that gap year, they’ll assume coding intensity inflation.
Congestive Heart Failure
Congestive Heart Failure (CHF) is the other constrained category in Version 28, and it underwent a massive expansion. What used to be a single HCC (HCC 85) in Version 24 is now split into five payment HCCs in Version 28: HCC 222 through 226, based on clinical severity.
Auditors love heart failure because it’s simultaneously very common and frequently miscoded. The documentation requirements are strict. You need specificity about whether it’s systolic, diastolic, or combined. You need to know if it’s acute, chronic, or acute on chronic. Generic codes like I50.9 (Heart failure, unspecified) leave risk adjustment value on the table and signal lazy documentation to auditors.
Here’s a scenario that triggers audit findings: A patient comes in for a routine follow up. The provider lists CHF in the assessment but doesn’t document any monitoring (no BNP, no weight check, no discussion of edema or dyspnea), doesn’t evaluate current status, and doesn’t adjust or continue treatment. That’s a problem. MEAT criteria apply just as strictly to heart failure as diabetes.
Also, watch out for coding historical heart failure when it’s resolved. If a patient had heart failure five years ago, was treated, and now has normal ejection fraction with no symptoms or medications, you can’t keep billing CHF codes. Chronic heart failure means ongoing management, not ancient history.
Chronic Kidney Disease
Chronic Kidney Disease (CKD) stages map to payment HCCs, and specificity matters enormously. Version 28 replaced HCC 138 with more granular categories (HCC 324, 325, 328, 329) based on CKD stage, which means you absolutely must document the stage.
Coding N18.9 (Chronic kidney disease, unspecified) when you have lab values showing estimated glomerular filtration rate (eGFR) is inadequate documentation. If the patient’s eGFR is 28, that’s CKD Stage 4 (N18.4), which maps to a higher paying HCC than unspecified CKD. But more importantly for audit purposes, vague staging suggests the provider isn’t actually managing the condition.
One red flag for auditors: CKD coded without any supporting lab values in the chart. If you bill Stage 3 CKD but there’s no creatinine, no eGFR, and no mention of kidney function anywhere in the note, CMS will disallow that code in an audit. Similarly, if the eGFR improved and the patient no longer meets criteria for that stage, you can’t keep using the old code just because it pays more.
COPD and Respiratory Conditions
Chronic Obstructive Pulmonary Disease (COPD) (HCC 111 in Version 24, restructured in V28) gets audited frequently because it’s often coded based on patient history rather than current management. Saying “patient has a smoking history” doesn’t justify a COPD diagnosis. You need documented evidence of chronic airflow limitation.
Best practices include referencing spirometry results, describing current symptoms (chronic cough, dyspnea, wheezing), and documenting treatment (inhalers, oxygen, pulmonary rehab). Just listing “COPD” in the problem list without addressing it in the encounter doesn’t meet MEAT criteria.
Also be careful with acute exacerbations versus chronic stable disease. These code differently and carry different weights. If you’re billing for COPD with acute exacerbation (J44.1), you better have documentation showing actual exacerbation, not just maintaining on usual inhalers.
Vascular Disease and Peripheral Artery Disease
Vascular disease HCCs expanded significantly in Version 28. What was previously HCC 107 and 108 now includes three new HCCs (263, 264, 267) that focus more on severe atherosclerosis of extremities.
The audit risk here is double: providers either undercode (using generic atherosclerosis when specific sites and severity exist) or overcode (billing Peripheral Artery Disease (PAD) when the patient just has hypertension with smoking history). True peripheral artery disease requires documented symptoms (claudication, rest pain, ulcers) or diagnostic evidence (abnormal ankle-brachial index (ABI), imaging showing stenosis).
CMS also tightened up on amputation status codes. Acquired absence of toe or finger moved to non-payment HCCs in V28. If you’ve been relying on those for risk adjustment, that revenue disappeared.
What a Real Internal Audit Looks Like
If you’re serious about staying ahead of CMS, your internal audit process should mirror what CMS will do. We recommend pulling a random sample of charts for patients with high-value HCCs. Look at 50 to 100 records and dig into the documentation.
Check for MEAT criteria on every chronic condition coded. If the condition was coded, was it monitored? Was it evaluated? Was there an assessment of current status? Was treatment provided or continued? All four elements don’t need to be in every note, but at least one should be clearly documented.
Flag unsupported diagnoses. If you find codes that appear on the claim but have no corresponding chart documentation, those are ticking time bombs. Either the coder grabbed something from a historical problem list without verifying it was addressed, or the provider documented it so vaguely that it won’t survive scrutiny.
Look for unspecified codes when specific information exists in the chart. If a patient has diabetes with documented neuropathy and you’re only coding E11.9 (Type 2 diabetes without complications), you’re missing both reimbursement and creating audit risk by showing inconsistency between clinical care and coding.
Review deletions closely. With CMS’s accelerated audit timeline, they issued tight deadlines for submitting closed period deletions for Payment Years 2020 through 2024. Organizations scrambling to clean up errors before sampling suggests problems, and CMS knows it. If you’re doing deletions now, document why. Was it a coding error? Was the diagnosis not supported? Track it so you understand your patterns.
How We Can Help
Running effective internal HCC audits requires more than coding knowledge. You need auditors who understand both the clinical side (is this diagnosis clinically appropriate?) and the risk adjustment side (does this documentation meet CMS standards?).
Our compliance audits are designed specifically for this. We review your high-risk HCC codes using the same criteria CMS auditors will apply. We identify documentation gaps, unsupported diagnoses, and coding inconsistencies before they become audit findings and extrapolated overpayments.
We also provide provider education that goes beyond generic training. We work directly with your physicians and coders to improve documentation practices for the conditions where your organization has the most risk. If your diabetic patients consistently lack Monitor, Evaluate, Assess, and Treat (MEAT) criteria documentation, we fix that. If your heart failure coding is inconsistent, we tighten it up.
For organizations facing imminent audits, our audit response services help you manage chart retrieval, review records for accuracy before submission, and prepare appeals when CMS makes incorrect determinations. With record requests jumping from 35 to 200 per plan and timelines compressing dramatically, having experienced support makes the difference between manageable compliance and financial disaster.
The Bottom Line
CMS isn’t playing games anymore. Their audit expansion represents the most aggressive enforcement strategy in Medicare Advantage history. Every eligible contract will face annual audits. Record samples are quintupling. Extrapolation is real and retroactive to 2018. And with Artificial Intelligence (AI) assisted review tools coming online, CMS will find documentation problems faster than ever before.
You can wait for the audit notice to show up and scramble to respond. Or you can start auditing your high-risk HCC codes now, fix the problems, train your providers, and clean up your documentation before CMS ever looks at your charts.
In our experience working with Medicare Advantage organizations, we’ve seen that those who take the proactive approach consistently perform better in RADV audits. They have fewer unsupported diagnoses, cleaner documentation, and stronger appeal positions when disputes arise. They also avoid the cash flow disruptions and financial penalties that come with failing a RADV audit in the extrapolation era.
Don’t let CMS be the first to find your documentation problems. Audit yourself first. If you need help, reach out to our team. We’ve been through hundreds of these audits and know what works.
