35 to 200
Enrollees per contract
- By size stratum [2]
Home / White papers / RADV
White paper · RADV
RADV audit response playbook 2027: intake, retrieval, validation, discrepancies
Short answer: the CMS schedule puts PY 2023 in November 2026, PY 2022 in January to February 2027 and PY 2025 in April to May 2027, on top of three payment years already open [1]. This playbook turns the PY 2024 instructions [2], the CMS record checklist [3] and the reviewer guidance [4] into a four-phase response a plan or a provider group can run.
6 payment years · Mar 2026 to May 2027Samples 35 to 200 · 2 records per HCCUp to 3 coder reads per recordFeb 5, 2027 · PY 2024 records due
Edition
1 · 2027
Focus
RADV response
Audience
MA plans · provider groups
Framework
4 phases
Metric
550 plans a year
Length
13 min
Six payment years, not in order
A plan can be answering three audits at once: PY 2024 records are due February 5, 2027, PY 2023 opens in between, and PY 2022 starts the month before that deadline. A provider group serving several plans sees requests from all of them in the same quarter. Data collection year is the year before payment; CMS says dates are subject to change [1] [2].
| MA payment year | Data collection year | Planned initiation | Actual initiation |
|---|---|---|---|
| 2020 | 2019 | March 2026 | March 20, 2026 |
| 2021 | 2020 | May 2026 | May 29, 2026 |
| 2024 | 2023 | August 2026 | August 28, 2026 |
| 2023 | 2022 | November 2026 | Not yet started |
| 2022 | 2021 | January to February 2027 | Not yet started |
| 2025 | 2024 | April to May 2027 | Not yet started |
TakeawayThe record you will be asked for in 2027 was written in 2021, 2023 or 2024. Audit readiness in 2027 is mostly retrieval readiness.
May 2025, measured
RADV scale before and after the May 2025 strategy [5]
Sample sizes landed as 200 enrollees for the ten largest contracts, then 100, 50 and 35 by sampling frame size; each valid record can receive up to three independent coder reviews [2]. The 2023 extrapolation rule was vacated in 2025 and is under appeal; for PY 2024 CMS collects sampled-enrollee amounts and reserves extrapolation [2] [6].
~60
Plans audited per yearbefore
~550
9x
Plans audited per yearall eligible contracts
35
Records per planbefore
35 to 200
up to 6x
Records per planby size
40
CMS codersbefore
~2,000
50x
CMS codersby Sep 1, 2025
BeforeAfterWorkforce
Four stages, and the PY 2024 dates
The PY 2024 methods document is the clearest public description of the process; PY 2022 and PY 2025 will almost certainly follow the same shape [2].
- 1Planningsampling frame, sampleContinuously enrolled, 12 months Part B, at least one HCC, no ESRD or hospice, no OIG overlap, not in a C-SNP, I-SNP or FIDE-SNP, top quartile of the improper payment model; random within that frame
- 2Initiationnotice, EDL in CDATAudit Notice to four executives; Enrollee Data List two weeks later
- 3Record submissionfive-month windowRecords and coversheets as PDF, one record per file; intake feedback as you go
- 4Analysispayment error, reportAudit Report Package with an outcome per audited HCC
| Milestone | PY 2024 date | What happens |
|---|---|---|
| Audit initiation | August 28, 2026 | Audit Notice to the CEO, CFO, COO and Medicare Compliance Officer; Lead Point of Contact form |
| Enrollee Data List available | September 11, 2026 | Sampled enrollees, audited HCCs and diagnosis codes posted in CDAT |
| Submission window opens | September 18, 2026 | Medical records and coversheets uploaded as PDF, one record per file |
| Submission deadline | February 5, 2027, 11:59 pm EST | Window closes; invalid records can be replaced only while it is open |
| Hardship exception deadline | February 19, 2027, 11:59 pm EST | Requests for a contract, enrollee or HCC with documentation of extraordinary circumstances |
| Audit Report Package | After analysis | Audit Results Notice and workbook with an outcome per audited HCC |
The first ten business days
Nothing moves until the Lead POC is registered. The Enrollee Data List is an Excel file with three tabs: data dictionary, sampled enrollees with HCCs and submitted diagnosis codes, and the sampling frame with a non-PHI RADV enrollee ID. The sampled list is the work order for the whole audit [2].
1
Day 1
Name the Lead POC
An executive submits the Lead Point of Contact form; compliance opens the audit file and calendars the window. CMS warns processing can take up to five business days.
2
Days 2 to 5
Register in CDAT
Add the record retrieval lead and coding lead as POCs, up to seven per contract; download the EDL the day it posts.
3
Day 5
Suspend
Plan-identified overpayment reporting to RAOR and EDPS corrections for enrollees in the sampling frame, until further notice; normal reporting continues outside the frame [2].
4
Days 6 to 10
Build request lists
Break the sampled list into provider-level requests: enrollee, HCC, diagnosis codes, data collection year, the providers who billed those codes.
The long middle, and what fails at intake
A valid record is a legibly signed medical record from a face-to-face visit with an acceptable provider inside the data collection period: one physician or hospital outpatient record for a single date of service, or one inpatient record with admission date, discharge date in the year and a signed discharge summary. Reason codes INV1 to INV17 from Appendix A; codes not shown are not in the published list [2].
| Code | Reason | The check CMS applies |
|---|---|---|
| INV1 | Wrong record or no name | Does the record identify the sampled beneficiary? |
| INV2 | Missing signature | Is the record signed? An attestation does not cure this code |
| INV3 | Name variation | Is the name an acceptable variance of the sampled beneficiary? |
| INV4 | Date missing | Is there a complete date of service? |
| INV5 | Invalid source | Hospice, home health, lab only, superbill and non-face-to-face encounters are invalid |
| INV7 | Credentials missing | Can an acceptable credential or specialty be confirmed for the named practitioner? |
| INV14 | Date outside the data collection period | Is the date of service inside the audited year? |
| INV17 | Not a medical record | Something other than a record is attached |
100MB
Maximum file size
- PDF only, one record per file, one file per coversheet [2]
Page 1
Attestation placement
- CMS-generated form only, physician and outpatient records only, completed, signed and dated by the practitioner who conducted the visit [2]
Weekly
Intake Feedback Report
- Shows pass or fail with the reason; a failed record can be replaced while the window is open [2]
2x
Records per enrollee
- Three audited HCCs allow six records; a record covering several HCCs is submitted once with each HCC ticked
TakeawayRetrieval is a request-tracking problem. One row per enrollee per HCC, with provider, request date, receipt date, intake status and the reason code if it failed. The window is five months and the first month is usually lost to registration.
The CMS checklist, before anything is uploaded
The plan cannot change or amend documentation at audit time; asking a provider to amend a record for the audit may have legal implications. It can submit records from other approved providers and other dates in the period, even if those diagnoses were never submitted for payment [4]. The industry shorthand is MEAT; CMS does not use the acronym. Two reviewer rules decide many findings: "DM, neuropathy" under one bullet links and separate lines do not; outpatient diagnoses qualified as probable, suspected or rule out are not coded [3] [4]. Checklist questions paraphrased; the failure column is our field observation.
- 1Right patient, right yearcoversheet matchCorrect enrollee, correct calendar year
- 2Valid recordsigned, dated, face to faceLegible; valid provider type; credentials and acceptable signature
- 3Supports the HCCspecificity and linkageThe requested HCC, not just an HCC; current treatment for cancer; causal link for manifestations
- 4Uploador find another recordAny approved provider, any date in the data collection period; the treating specialist is usually the better record
| Question CMS asks | Source | Common failure in practice |
|---|---|---|
| Is the record for the correct enrollee and the correct calendar year? | Checklist | Right patient, wrong year |
| Is a date of service present for the face-to-face visit, and is the record legible? | Checklist | Portal printouts with the date on a header that did not print |
| Is it from a valid provider type: hospital inpatient, hospital outpatient or physician? | Checklist | Home health, hospice or lab-only documents |
| Are valid credentials or a physician specialty on the record, with an acceptable signature? | Checklist | Electronic note with no authentication line |
| Does the diagnosis support the requested HCC, not just an HCC? | Checklist | A lower-severity code in the same family |
| For a cancer code, is current treatment documented rather than a history? | Checklist | History of cancer last treated in another year |
| For a manifestation code, does the note state the causal link to the disease? | Checklist | Diabetes and neuropathy listed separately |
| Is the problem list dated as part of this encounter and consistent with the note? | Reviewer guidance | Undated carry-forward lists |
| Is an outpatient diagnosis stated with certainty, not probable, suspected or rule out? | Reviewer guidance | Working diagnoses coded as confirmed |
Findings, and the money
Outcome labels from Section 10 of the PY 2024 instructions. The payment error for a sampled enrollee is the difference between what the plan was paid and what the RADV risk score would have paid, month by month, through that year's model with its normalization and coding pattern factors. Additional HCCs in the same hierarchy can offset an overpayment; spontaneous HCCs outside it cannot, and an audit never produces an additional payment. Appeal levels and deadlines arrive with the results; credit for additional HCCs is not appealable [2].
Confirmed
- Supported
Confirmed Higher
- A higher HCC in the same hierarchy was found
Discrepant Lower
- A lower HCC in the hierarchy was found
Discrepant
- Not supported
Administrative Exception
- Granted by CMS; does not negatively affect the payment error
| Step | What CMS does | What the plan can do |
|---|---|---|
| 1 | Re-runs the enrollee through the payment year model using abstracted diagnoses | Nothing at this stage; the inputs were fixed at submission |
| 2 | Compares RADV monthly payment to the original monthly payment, sums the year | Check the enrollee months and county rates in the workbook |
| 3 | Sums enrollee payment errors; a positive total is an overpayment | Appeal under 42 CFR 422.311(c) using only records that passed intake |
| 4 | May estimate a sampling-frame amount by extrapolation if the 90 percent lower bound is above zero | For PY 2024, CMS collects the sampled amount and reserves extrapolation |
Twelve weeks to retrieval readiness
RADV audits the plan, but the records come from you. A Discrepant finding on a condition the group documented is a documentation finding about the group, and plans increasingly share results with delegated providers. The same note that fails RADV would have failed a payer retrospective review, so the fix is upstream, in the encounter: our 2027 unlinked chart review playbook. Milestones for the next two years: RADV schedule timeline; the 90-day plan: late-November HCC Operator.
- 1Weeks 1 to 2inventoryWhich plans you contract with, which payment years are open, who owns record requests
- 2Weeks 3 to 4sample yourself30 charts from the 2021, 2023 and 2024 data years against the CMS checklist: signatures, credentials, dates, specialist records
- 3Weeks 5 to 8fix retrievalOne queue, one request template, a two-business-day turnaround target, a log of what was sent to whom
- 4Weeks 9 to 12fix the noteProblem-list hygiene, linkage language for manifestations, treatment status for cancers, specificity for kidney disease and diabetes, prospectively
Takeaway
The record either supports the code or it does not. We do not promise a confirmation rate or state client audit outcomes; what we can do is make sure every record you send has been through the checklist before CMS sees it.
Before the January requests
Confirm who receives the Audit Notice at each planAnd who in your group they will call.
Pull 30 charts from 2021 dates of serviceScore each against the checklist; count the INV codes you would have drawn.
Set the two-business-day targetOne queue, one template, one log.
Check attestation practiceCMS form only, first page, signed by the treating practitioner; it never cures INV2.
Find the specialist recordFor every condition where the primary care note is thin.
Ask us for the checklist runOur risk adjustment coding services run two reads per chart, a certified coder then an independent second-read auditor, with the supporting evidence attached to every code. The engine on our HCC risk adjustment AI page reads charts only after de-identification, through a 7,903-code V28 crosswalk audited at 1,500 of 1,500 codes, and leaves the decision with the coder; for a RADV response it reads the sampled charts fast and finds the second record when the first fails.
Frequently asked questions
How many medical records can we submit per audited HCC?
For PY 2024, up to twice the number of audited HCCs per sampled enrollee, in any combination. An enrollee with three audited HCCs allows six records. A record that supports more than one audited HCC is submitted once with every applicable HCC selected on the coversheet.
Can a missing signature be fixed with an attestation?
Only with the CMS-generated attestation form, only for physician and hospital outpatient records, completed, signed and dated by the practitioner who conducted the visit, and placed on the first page of the PDF. Inpatient records cannot use an attestation, and a record with no signature at all fails intake code INV2 regardless.
Will CMS extrapolate the PY 2024 findings?
CMS designed the PY 2024 audit to calculate extrapolated overpayments but said it has not decided whether to collect them. It will collect the sum of sampled-enrollee payment errors and reserves the right to collect extrapolated amounts later if legally permissible. The 2023 rule that authorized extrapolation was vacated by a district court in 2025 and is under appeal.
Which dates of service count for the PY 2022 audit?
The data collection year is the year before the payment year, so PY 2022 audits validate diagnoses from 2021 dates of service. The record must be from a face-to-face visit within that year, with the exception CMS has stated for telehealth under its guidance.
What happens if we cannot find any record?
CMS allows a hardship exception request for a contract, specific enrollees or specific HCCs, with comprehensive documentation of extraordinary circumstances such as natural disasters or law enforcement actions. For PY 2024 the request deadline is February 19, 2027. A change of ownership does not by itself excuse an audit.
- CMS: Medicare Advantage Risk Adjustment Data Validation (RADV) Audit Schedule, planned and actual initiation dates by payment year
- CMS: Payment Year 2024 Medicare Advantage Contract-Specific RADV Audit Methods and Instructions (August 28, 2026)
- CMS: Risk Adjustment Data Validation (RADV) Medical Record Checklist and Guidance
- CMS: Contract-Level RADV Medical Record Reviewer Guidance, Version 2.0 (in effect January 10, 2020)
- CMS press release: CMS Rolls Out Aggressive Strategy to Enhance and Accelerate Medicare Advantage Audits (May 21, 2025)
- CMS fact sheet: Medicare Advantage Risk Adjustment Data Validation Final Rule, CMS-4185-F2 (January 30, 2023)
- CMS fact sheet: 2027 Medicare Advantage and Part D Rate Announcement (April 6, 2026)
Checked October 25, 2026. Rules change; confirm against the source before relying on them. CMS has said the RADV audit schedule is subject to change.
Want your charts run through the CMS checklist before a plan asks?
We sample your 2021, 2023 and 2024 charts against the RADV record checklist, report the failure modes by provider, and set up the retrieval queue. Certified coders, two reads per chart.