Risk adjustment is a revenue problem before it is a clinical problem. CMS calculates your plan's monthly capitation payment based on the risk scores of your enrolled members. Those scores are built from diagnosis codes submitted through encounter data. If your encounter data is incomplete, your payment is lower than your population's actual acuity warrants — and no amount of clinical quality work corrects that.

For regional MA plans, this gap is not hypothetical. The Office of Inspector General estimates that CMS's improper payment rate for MA is 9.5 percent, driven primarily by unsupported diagnoses submitted by plans. The flip side of that finding is that plans with documentation failures are also missing compliant diagnoses that would have supported higher payments had the data been submitted correctly. Both problems originate in the same place: encounter data workflows that are not built to capture what the care actually was.

What Changed in 2026

Two regulatory shifts make this a now problem for plan operations.

V28 is fully in effect. CMS completed the phased transition to the CMS-HCC Risk Adjustment Model V28 in payment year 2026. The blend is gone — all RAF scores are now calculated exclusively under V28 rules, V28 HCC mappings, and V28 coefficients. CMS projected that the V28 transition would reduce average MA risk scores by 3.12 percent, representing approximately $11 billion in net payment reduction across the industry. V28 removed 2,294 ICD-10 codes from the crosswalk and added only 268. Codes that previously mapped to HCCs may no longer. Plans that have not updated their encounter data processes to reflect V28 mappings are likely submitting codes that no longer carry payment weight — while missing codes that do.

RADV audits now cover every eligible contract. In May 2025, CMS announced it would expand RADV audits from roughly 60 contracts per cycle to all eligible MA contracts — more than 550 — on an annual basis. CMS simultaneously grew its coding review workforce from 40 to approximately 2,000 reviewers and announced plans to deploy AI as a support tool for audit coders. In January 2026, CMS restored a five-month medical record submission window for audited plans, walking back a shorter window it had proposed in 2025.

The extrapolation question is not settled. A federal district court vacated CMS's rule that would have allowed it to extrapolate error rates from an audit sample across a plan's entire contract population — which would have multiplied financial exposure significantly. CMS appealed that ruling in November 2025. Plans should not treat the current legal uncertainty as a reason to deprioritize documentation quality. The underlying audit activity is expanding regardless of how extrapolation is ultimately resolved.

What RADV Actually Tests

A RADV audit is a record validation exercise. CMS selects a sample of risk-adjustable diagnoses your plan submitted and asks for the medical records that support them. CMS's coders then review those records against a documented standard.

The standard is not complex, but it is specific. Every diagnosis submitted for risk adjustment must be supported by a medical record demonstrating that the condition was addressed during an encounter — not just listed in a problem list, not imported from a prior note, not documented only on a health risk assessment with no follow-up care. The standard typically used is MEAT: the record must show the condition was Monitored, Evaluated, Assessed, or Treated during the visit.

The most common audit failure is not fabrication. It is the absence of active management documentation for conditions the member genuinely has. A provider notes a chronic condition in a problem list and does not address it in the visit note. A specialist encounter is never submitted as an encounter record. A diagnosis is coded from a health risk assessment that generated no additional care. In each case, the condition may be real, but the documentation does not meet the standard CMS applies.

The OIG's October 2024 report on health risk assessments found that HRAs with no linked additional care spending led to $7.5 billion in increased MA payments in 2023. CMS and OIG have flagged in-home HRAs specifically as a high-risk documentation source. Using HRAs as a primary diagnosis capture mechanism — without ensuring those diagnoses are also documented in subsequent care encounters — is both a compliance risk and a RADV audit failure waiting to happen.

The Compliance Line

This is worth stating directly: a compliant risk adjustment program and a revenue maximization scheme are not the same thing, and the distinction matters operationally.

Compliant risk adjustment captures diagnoses that are supported by contemporaneous clinical documentation, submitted through proper encounter data channels, and reflect care that actually occurred. When a plan closes diagnosis gaps by ensuring that documented conditions appear in encounter data submissions, that is compliant revenue recovery.

Upcoding is something different. Assigning higher-severity codes than the documentation supports, using HRAs as the sole documentation source for conditions that receive no treatment, coaching providers to add diagnoses not reflected in the clinical record — these are the practices that generate OIG referrals and False Claims Act exposure. The OIG has been explicit about this distinction in its reporting on the HRA overpayment issue.

The plans with the largest compliance exposure are not always the ones with the most aggressive coding programs. They are often regional plans that have neither: no systematic upcoding, but also no systematic process for capturing diagnoses that are legitimately present and documented. The revenue loss from the second problem is just as real, and it carries none of the legal risk associated with the first.

Where Encounter Data Breaks Down

Diagnosis capture gaps in regional MA plans almost always trace back to encounter data workflow failures, not clinical documentation failures. The care is documented. The data does not reach the submission system in a form that supports risk adjustment.

Provider encounter submission gaps. Smaller regional plans typically contract with independent practices, community health centers, and single-specialty groups that do not have dedicated billing staff oriented toward MA encounter data requirements. Fee-for-service claims may be submitted accurately. MA encounter records — which require more complete data elements than a standard claim — may be submitted late, submitted with missing required fields, or not submitted at all. A specialist encounter that never reaches the plan's encounter data processor never contributes to risk adjustment.

EDPS transition errors. As of 2025, the Encounter Data Processing System (EDPS) is the primary source for risk adjustment calculations. RAPS-based submission pathways are largely phased out. Plans that have not fully transitioned their encounter data pipelines to meet EDPS requirements — or that have delegated encounter data submission to vendors without verifying data quality — are likely losing diagnoses to submission failures that do not generate obvious error flags.

V28 crosswalk misalignment. Plans or vendors that have not updated ICD-10-to-HCC mapping tables to reflect V28 may be submitting codes that no longer carry payment weight. This is a systems configuration problem, not a coding problem. It requires a deliberate audit of the crosswalk logic in your encounter data processing system against the current V28 mapping.

Late or missing supplemental data submissions. CMS allows supplemental data sources — pharmacy data, lab data, prior authorization records — to support risk adjustment, but these require timely submission within defined windows. Plans that rely on supplemental data to fill encounter gaps but do not have automated submission processes miss deadlines at a rate that scales with volume and organizational complexity.

Reconciliation failures. After submission, CMS's system generates acceptance and rejection responses. Plans that process encounter data without a systematic reconciliation workflow do not know which records were rejected and why. Rejections may stem from invalid member IDs, missing NPIs, duplicate submission flags, or data formatting errors. Without a process to catch and resubmit rejected records, legitimate diagnoses are lost.

What a Compliant Capture Operation Looks Like

Operationally, the difference between plans that consistently leave money on the table and plans that do not comes down to a few process structures.

A complete encounter data submission process covers the full provider network — not just large hospital systems and multispecialty groups, but independent practices, behavioral health providers, and specialists. Each contract with a downstream provider should include encounter data submission obligations with defined timelines.

A V28-aligned crosswalk audit is a one-time operational task that should have been completed before payment year 2026 began. If it has not been done, it needs to happen now. Map your current ICD-10 submission volume against V28 HCC assignments. Identify codes you have been submitting that no longer carry weight, and identify conditions with supporting documentation that may map to HCCs you are not currently capturing.

A RADV-ready documentation standard means that every risk-adjustable diagnosis in your encounter data can be matched to a medical record that shows active management of the condition — not just a problem list entry. This does not require changing how providers practice. It requires knowing, before CMS asks, whether the records exist and where they are.

A closed-loop rejection management process means someone sees every EDPS rejection, every record fails for a documented reason, and every correctable rejection is resubmitted within the relevant window. This is a workflow design problem, not a technology problem, though technology can make it significantly easier to operate at scale.

The Audit Exposure Assessment

Before the next audit cycle, regional MA plans should know the answer to three questions. First: what percentage of your encounter records are accepted by EDPS on first submission, and what is happening to the rejections? Second: have your encounter data crosswalk tables been updated to reflect V28 mappings, and do you have documentation to verify that? Third: for the diagnoses driving your highest RAF contributions, do you have medical records demonstrating active management at an encounter — not just a health risk assessment or a problem list?

If the answer to any of those is unclear, the audit risk is real. The record submission window CMS provides in a RADV audit is finite. Documentation assembled reactively during that window is harder to defend and less likely to be complete than documentation that exists as a natural output of a functioning encounter data process.

If your plan is assessing encounter data workflow gaps or preparing for RADV audit activity, Ayin works with regional MA plans on risk adjustment operations — or contact us to talk through where the gaps are.