Risk adjustment started as a fairness mechanism and became a business line.

The RealityThe diagnosis has to be supported, not just entered

⚠️

The Problem

Capture pressure outruns the documentation.

Codes chased through prompts and assessments, with the supporting note written afterwards or not at all.

🔧

The Solution

Document the condition, then let the code follow.

Face-to-face encounter, acceptable provider, an assessment that stands on its own, and a record that survives being pulled.

✅

The Resolution

Accurate capture that holds up.

The population’s real risk reflected in payment, and nothing in the file that a reviewer can take apart.

The risk adjustment model is fully implemented now

This is the most commonly out-of-date fact in circulation, and it changes how practices should read any guidance written before 2026.

In the CY2026 Medicare Advantage rate announcement, published 7 April 2025, CMS completed the phase-in of the 2024 CMS-HCC model by using 100 per cent of the risk score calculated under it. The CY2027 announcement, released 6 April 2026, continues the 2024 model at full implementation, in place of an updated model calibrated on newer data that had been proposed and was not adopted.

So material describing a blend of the 2017 and 2024 models is describing CY2024 and CY2025. For non-PACE Medicare Advantage it is no longer accurate. If your coding guidance or your vendor’s prompts were built on the blended assumption, they are running on an old picture of which conditions map where.

What OIG found in the health risk assessments

The oversight side of this is where the practice-level risk sits, and the numbers are specific enough to be worth knowing.

HHS OIG’s October 2024 report on the use of health risk assessments in Medicare Advantage found that diagnoses reported only on enrollees’ HRAs and HRA-linked chart reviews, and on no other 2022 service record, resulted in an estimated 7.5 billion dollars in risk-adjusted payments for 2023. In-home HRAs and HRA-linked chart reviews generated almost two-thirds of that. Twenty MA companies drove 80 per cent of it.

The finding that matters clinically is the one about follow-up. For 1.7 million enrollees there were no other visits, procedures, tests or supplies in the encounter data for those diagnoses, which OIG frames as raising concerns that either the diagnoses are inaccurate and the payments improper, or the enrollees did not receive needed care for serious conditions.

Documentation requirements, as the regulation states them

The rules here are short, and reading them directly is more useful than reading a summary of them.

Under 42 CFR 422.310, MA organisations must obtain the risk adjustment data required by CMS from the provider, supplier, physician or other practitioner that furnished the item or service. The same section requires MA organisations and their providers and practitioners to submit a sample of medical records for the validation of risk adjustment data as required by CMS, and notes there may be penalties for submission of false data.

CMS’s RADV medical record reviewer guidance, in effect from January 2020, states that a medical record for these purposes is documentation of a single face-to-face encounter for physician and hospital outpatient visits, or a single admission for inpatient stays, and that records must come from an acceptable provider type. We flag the date deliberately, because this document may have been superseded and we could not confirm a current replacement.

RADV audit exposure and extrapolation

The reason all of this now has teeth is a single change in how audit findings are applied.

The RADV final rule published in the Federal Register on 1 February 2023 established that CMS will extrapolate RADV audit findings beginning with payment year 2018, will not extrapolate for payment years 2011 through 2017, and will not apply a fee-for-service adjuster. The codified version at 42 CFR 422.310 carries the same payment year 2018 starting point.

Extrapolation is what turns a sampling exercise into a material number. A handful of unsupported diagnoses in a sample becomes an estimate applied across a contract. That pressure lands on plans first and reaches practices through contract terms, chart requests and attestations, which is why the documentation question is worth getting right before somebody else asks it.

What good capture looks like in the EHR

The practical work is mostly about sequencing: document the clinical reality, and let the coding follow it rather than lead it.

Conditions should be assessed at a face-to-face encounter by a provider whose specialty is acceptable for risk adjustment, and the note should show the condition was evaluated, not merely listed. A problem list entry carried forward for six years is not an assessment. Where the EHR prompts for suspected conditions, the prompt should lead to a clinical decision, and a declined prompt should be as easy to record as an accepted one. Chronic conditions need reassessment each year because risk adjustment resets annually, which is a legitimate reason to review them rather than a reason to re-enter them.

Most of the system-side work here is making the right thing fast and the wrong thing visible, which is the ordinary business of EHR workflow optimization rather than a specialised risk adjustment project.

Where practices get into trouble

The patterns are consistent enough to list.

• Codes with no downstream care. The pattern OIG named explicitly.
• Problem lists as documentation. A carried-forward entry is not an assessment.
• Assessments built around capture. If the form’s purpose is codes, a reviewer will see that.
• No record of declined prompts. Only accepted suggestions leave a trail.

Qventive works as an HCC capture EHR documentation company for New Jersey practices, and this work usually belongs inside broader IT support for internal medicine practices rather than as a standalone engagement.

Where capture depends on prompts, problem list behaviour or reporting, the configuration work runs through internal medicine EHR and IT support, and the data paths involved should already appear in your HIPAA risk analysis.

Risk adjustment: common questions