HCC Coding: Risk Adjustment Without Upcoding Risk

Risk adjustment pays for the diagnosis a clinician documented at a visit, not the one a chart hinted at. Medicare Advantage pays plans on risk scores built from submitted diagnoses, and every submitted diagnosis has to sit in a medical record that resulted from a face-to-face encounter. The model that turns those diagnoses into money changed in 2026, and the audit that checks them reads a sample of enrollees and can project the result across a contract.

The record has to earn the code. A diagnosis the note does not show as a result of the visit is a number you will pay back.the documentation standard every RADV review applies

Group practices meet risk adjustment from two directions. A care gap closed with a diagnosis the record does not support turns into a refund obligation. A chronic condition that nobody re-documented this year quietly stops counting toward payment. Both failures trace to the same mistake: treating risk adjustment as a coding exercise when it is a documentation one.

What a valid capture requires

CMS states the rule in three parts. Diagnosis codes submitted for risk adjustment must be documented in the medical record, must be documented as a result of a face-to-face visit, and must be coded according to the ICD-10-CM Official Guidelines for Coding and Reporting. The acceptable sources are hospital inpatient, hospital outpatient and physician records. CMS also publishes an acceptable physician specialty list for each payment year, and a diagnosis documented by a provider outside that list will not survive review.

The agency restated the obligation in an April 15, 2022 HPMS memo titled Reminder of Existing Obligation to Submit Accurate Risk Adjustment Data. Its operative sentence is blunt: a diagnosis code that is not properly documented in a patient’s medical record is not a valid basis for CMS risk adjustment payments. The same memo requires an organization to delete incorrect diagnosis data once it identifies it.

Two kinds of failure get confused in daily work. A diagnosis can be real and still not submit: a stable chronic condition nobody addressed at the visit is not part of that encounter. A diagnosis can also be addressed and still code poorly: diabetes, stable, continue current medication supports little beyond the least specific code for the condition.

Diagnoses do not carry forward

The CMS-HCC model is prospective. A payment year’s risk scores are built from diagnoses collected during a defined data collection period, so a condition documented in one year carries no weight in the next until a clinician documents it again. Nothing about the patient changed. The submission did. That mechanic is why recapture shapes the whole operating calendar.

The conditions carrying most of a Medicare panel are known before the year starts: diabetes, heart failure, chronic kidney disease, chronic obstructive pulmonary disease, major depression. A standing list of them, checked against each patient’s last visit date, turns recapture into scheduling work instead of a fourth-quarter discovery project.

Which model you are coding for

CMS calls the current Part C risk adjustment model the 2024 CMS-HCC model, also referred to as V28. It replaced the 2020 CMS-HCC model, V24, through a three-year phase-in that is now complete, and CMS continued the 2024 model into CY 2027.

Two numbers explain most of the revenue change practices saw. The 2020 model mapped 9,797 ICD-10-CM codes to a payment HCC. The 2024 model maps 7,770, which is 10.5 percent of the code set, and it added 209 codes the earlier model did not recognize. A code that no longer maps to a payment category scores nothing, however specific the documentation behind it. The 2024 model was calibrated on 2018 diagnoses and 2019 expenditures.

PACE organizations sit on a different schedule. For CY 2026, CMS calculated PACE risk scores as a blend of 10 percent from the 2024 CMS-HCC model and 90 percent from the 2017 CMS-HCC model, so a 100 percent figure does not apply to a PACE contract.

What the model change did to behavioral health

CMS addressed the question itself. In its 2025 Advance Notice fact sheet, the agency confirmed that the 2024 model includes fewer diagnosis codes for mental health conditions, and fewer for diabetes, than the 2020 model, and stated that payments continue for the more severe manifestations of depression. The 2026 Advance Notice fact sheet gave the reasoning: codes with wide variation in how they were diagnosed and documented predicted cost poorly, particularly where the clinical indicators were broad or the condition did not require or affect care. For a behavioral health practice the reading is direct. Severity and current status belong in the note, because the general symptom code no longer carries the weight the discontinued codes used to.

Documentation that supports a higher-value diagnosis

Specificity is how severity gets recorded. A note that reads diabetes with diabetic chronic kidney disease, stage 4 supports the combination code E11.22 and the stage code N18.4. A note that reads diabetes, stable, continue metformin, with a kidney finding noted elsewhere, supports neither the complication nor the stage. The clinical facts can be identical. Only one version codes to the level that reflects them.

The same logic runs through the rest of the model. Site, laterality, type, stage and status change the code, and often decide whether a code reaches a payment category at all. History of a condition is not the active condition, and a resolved problem does not carry a current code.

The MEAT shorthand

MEAT stands for monitor, evaluate, assess or treat. It is not CMS language. It is industry shorthand for the evidence a record needs to show that the clinician engaged with the condition during the visit, and it holds up as a test: labs ordered or reviewed, a stated status, a medication change, a referral. CMS’s own standard is narrower, and it is the one that counts. The diagnosis must be documented in the record as a result of the face-to-face visit and coded per the Official Guidelines.

Pre-submission checklist

• The encounter is an accepted source with a date of service inside the data collection period.
• The rendering provider is on the CMS acceptable physician specialty list for that payment year and is identified by signature and credentials.
• The diagnosis appears in the assessment and plan of that visit, not only in the history or on the problem list.
• The note states the clinical status of the condition and at least one action that supports the diagnosis.
• The code reflects every element the documentation supports: type, site, laterality, stage and status.
• History of stays separate from the active condition, and no code is carried forward without support in this note.

Put that list in front of whoever reviews charts before the data goes out and the audit response stops being a scramble. A review run against the submission standard catches the same failures a RADV reviewer would, while the visit is recent enough to re-document. Practices that want it handled end to end pair medical coding services with comprehensive chart auditing, so the review and the submitted code are held to one standard.

The patterns that get a contract audited

RADV is CMS’s main corrective action for unsupported diagnoses, and it runs after the final risk adjustment data submission deadline for the audited year. CMS selects contracts, draws a random sample of 35, 50, 100 or 200 enrollees sized to the contract’s sampling frame, and asks the plan for the records supporting every HCC in those enrollees’ risk scores. Certified coders abstract the records and decide what the documentation actually supports. 42 CFR 422.311 allows extrapolation for payment year 2018 and later audits, and CMS designed the payment year 2024 audits to calculate a projected overpayment for the whole frame. The 2023 rule that codified that methodology was vacated in 2025 and is under appeal, so CMS has not decided whether it will collect the projected amount or only the sampled enrollees’ errors.

The audit targets the plan’s data, but a practice’s records are what the plan submits. Patterns that repeat across reviews include:

• One diagnosis family supplied for a large share of a panel, well above what comparable records show.
• Chart review or health risk assessment diagnoses with no linked encounter behind them.
• Notes that repeat the prior visit’s text, including identical findings, from one year to the next.
• Signature and credential defects: unsigned notes, signature stamps, illegible credentials.
• Dates of service outside the data collection period, or a record that does not match the beneficiary.
• A condition submitted every year with no change in status, no monitoring and no treatment recorded.

The HHS Office of Inspector General runs parallel reviews. Its work plan page for a series of 11 targeted diagnosis reviews reports recommended refunds in the millions per contract, including $7,058,246 from Blue Cross and Blue Shield of Alabama and $6,777,385 from Humana Health Plan. The same page cites CMS’s estimate that 9.5 percent of payments to Medicare Advantage organizations are improper, mainly from unsupported diagnoses the plans submitted.

Two rules shape how a practice answers a record request. Medical records must be kept for 10 years under 42 CFR 422.504(d), and that requirement extends to providers under contract with the plan, so a note from four years ago is still retrievable. An audited organization that disagrees with a finding has reconsideration rights in CMS’s RADV dispute and appeal guidance, and those run on the plan’s clock. For a heavy chronic-disease panel, this work usually sits with the rest of internal medicine revenue cycle management, since the visit that supports a claim also supports the risk score.

HCC coding questions practices ask

This article describes federal risk adjustment requirements as published by CMS and is not coding or legal advice for a specific record.