Risk adjustment looks different than it did two years ago. In the calendar year 2026, Medicare Advantage risk scores are calculated entirely with the CMS-HCC 2024 model, commonly called V28, completing the model’s phase-in.
At the same time, CMS has restarted contract-level audits of earlier payment years. Organizations now have to attend to coding accuracy and to the evidence supporting each submitted diagnosis, and those are not the same problem.
This guide covers where AI genuinely helps, where human review remains mandatory, and what to ask vendors. The tools are changing. The underlying requirement is not. Every diagnosis affecting payment must be supported by the medical record.
What changed for 2026
Three shifts matter for planning.
V28 is fully phased in. Retire transition assumptions built into older models and confirm your analytics reflect the current methodology rather than a blend.
Audit activity has resumed. CMS initiated Payment Year 2020 Risk Adjustment Data Validation audits on 20 March 2026, followed by Payment Year 2021 audits on 29 May 2026, publishing methods and contract lists with each announcement.
Model software is changing format. Beginning with calendar year 2028, CMS plans to release only Python-based risk adjustment model software, with Python test software anticipated during 2026. Analytics teams on legacy formats should start planning now rather than in 2027.
Documentation that stands up to review
RADV audits verify that diagnoses used to calculate Medicare Advantage payments are supported by each enrollee’s medical record. Documentation quality is therefore the whole game, and coding accuracy without evidence is exposure rather than revenue.
Many teams use MEAT, meaning monitor, evaluate, assess and treat, as shorthand for supporting evidence. AHIMA notes that MEAT is commonly used in risk adjustment but is not official coding guidance. Official coding guidelines always take precedence.
A practical review confirms each note does three things.
- States the condition and its current status
- Includes the clinical indicators behind the assessment
- Shows how the condition was treated or managed during the visit
Retention matters as much as capture. Under 42 CFR 422.504(d), Medicare Advantage organizations must retain records for 10 years for RADV and other audits, and evidence must remain searchable long after the encounter.
The direction of travel nobody discusses
Here is the part most vendor conversations skip.
Risk adjustment tooling has historically been built to find diagnoses. Recapture rates, gap closure, suspecting engines, all pointed one way. That made sense when the compliance risk was under-coding.
With RADV extrapolation live, the exposure has inverted. A submitted diagnosis without supporting evidence is no longer a neutral outcome, it is a repayment liability multiplied across a contract. Any tool that only adds codes is solving half the problem and creating the other half.
Ask every vendor directly whether their system removes unsupported diagnoses as well as identifying missed ones. Two-way review is the compliance-relevant capability, and it is a genuine differentiator rather than a checkbox.
Where AI helps operationally
Assess AI by workflow rather than product category. It can build pre-visit lists of possible conditions, surface prompts inside a note, reconcile diagnoses after a visit, and organize supporting records for an audit response.
None of that replaces clinical judgment or coding review. AI agents can coordinate tasks across approved systems, but a named person must approve any code affecting payment, and protected health information must never enter public or unapproved tools.
What the market is claiming
Vendors in this space now publish accuracy benchmarks, which makes comparison possible for the first time, though the figures are self-reported and should be tested against your own data.
Among risk adjustment solutions built on newer architectures, RAAPID is a useful reference point for what is being claimed. The company reports 98 percent final accuracy against an industry standard it puts below 45 percent, 92 percent out-of-the-box accuracy against below 30 percent, chart review time of 8 minutes against roughly 40, and 10 to 1 ROI delivered.
Its approach is what the company calls Neuro-Symbolic AI, combining machine learning with knowledge graphs and rules-based reasoning, positioned as producing traceable justification rather than a confidence score. The two-way coding point above is explicit in its own materials: adding missed diagnoses and removing unsupported ones, with MEAT evidence attached to every HCC.
Third-party validation exists. RAAPID was named to the May 2026 KLAS Emerging Company Spotlight, where customers cited accuracy and audit defensibility as standout strengths, and the platform received A+ grades on Support and Would Buy Again on a small emerging-company sample. The company has raised Series A funding from investors including M12 and UPMC Enterprises, reports 15-plus years across healthcare and AI, more than 100 healthcare clients and over 8 million patient records processed annually, and holds HITRUST r2 certification alongside HIPAA compliance.
Treat all of it as a starting point for diligence rather than a conclusion. Self-reported accuracy on a vendor’s data is not accuracy on yours.
A defensible end-to-end process
Five steps, in order.
- Prioritize upcoming visits based on open conditions and gaps in available data
- Prepare a pre-visit chart summary referencing source records
- Present prompts inside the clinician’s workflow, with the basis for each suggestion visible
- Reconcile the record after the visit, adding supported diagnoses and removing unsupported ones
- Export supporting evidence for RADV review and track each response to completion
Useful measures include first-pass coding yield, the percentage of submitted HCCs with linked evidence, and time to a completed signed note. Track how often reviewers reject automated suggestions too, because a rejection rate near zero usually means nobody is reviewing rather than that the model is perfect.
Build governance before scaling
Governance need not be elaborate. A small standing group covering clinical care, coding, compliance and IT can review new use cases and monitor existing ones.
Set minimum vendor security requirements covering HIPAA obligations, independent security assessment, understandable explanations for suggestions, role-based access and complete audit logs. Certifications such as HITRUST are a floor rather than a finish line, and you should ask which products and environments each one actually covers.
Document model and rule updates through a formal change process. Periodic sampling after launch shows whether accuracy holds and whether users are following the review steps you designed.
One staffing consideration is worth planning for early. Automation changes what your coding team does rather than how many people you need, shifting effort from initial review toward exception handling, evidence assembly and audit response.
Those are different skills from production coding, and the market for them is tight. The broader hiring challenges facing employers in 2026 apply here with extra force, because a certified coder who can also defend a RADV response is a narrower candidate pool than a certified coder alone. Plan the role change before deployment rather than discovering it during one.
Vendor evaluation checklist
Look for prospective and retrospective chart review, MEAT evidence validation, EHR integration and RADV workflows. Confirm each capability against your data and clinical processes rather than a demonstration environment.
Verify native V28 support, user roles, audit trails, data migration options and export formats aligned with CMS submission requirements.
Then ask five questions vendors rarely ask.
Does the system remove unsupported codes, or only add them? Covered above, and the most consequential question on this list.
How is a suggestion justified? A confidence score is not an explanation. You need the specific record location and clinical reasoning behind each recommendation.
What is the accuracy of our data? Request a pilot on your own charts. Published benchmarks reflect the vendor’s test conditions.
Which certifications cover which products? Scope is frequently narrower than the badge suggests.
What happens at contract end? Confirm you can retrieve complete records, in usable formats, without additional fees.
A one-quarter starting plan
Begin with one line of business and a small group of clinicians. Record baseline measures, run the five-step workflow for a quarter, then compare against the original performance rather than against the vendor’s projections.
Expand only if internal sampling confirms submitted diagnoses are accurate and supported. Documentation quality matters more than code volume, because unsupported codes create recoupment and compliance exposure that no software removes.
FAQ
What should an organization measure?
First-pass coding yield, the percentage of HCCs with linked supporting evidence, time to final signed note, automated suggestion rejection rate and audit response turnaround. The rejection rate is the one most often ignored and the best early indicator that review has become rubber-stamping.
Does AI create compliance risk in risk adjustment?
The tool is neutral, the workflow is not. Risk arises when suggestions are accepted without review, when the basis for a suggestion cannot be traced to a record, or when protected health information enters an unapproved system. A named human approving every payment-affecting code addresses most of it.
How long must Medicare Advantage records be retained?
Ten years under 42 CFR 422.504(d), for RADV and other audits. Evidence has to remain searchable across that period, not merely stored.
Is MEAT an official coding standard?
No. AHIMA notes MEAT is commonly used in risk adjustment but is not official coding guidance, and official coding guidelines take precedence wherever the two diverge.
What should we expect from vendor accuracy claims?
Treat published figures as directional. Accuracy depends on documentation quality, specialty mix and population, all of which differ between your organization and a vendor’s test set. Insist on a pilot against your own charts before signing.
