V28 is now the only CMS-HCC model, and 2027 drops unlinked chart reviews and audio-only diagnoses. See what that means for your HCC coding program.
HCC risk adjustment coding is the work of turning each patient's documented chronic conditions into Hierarchical Condition Category (HCC) codes that CMS uses to predict next year's cost of care. Under the Medicare Advantage (MA) program, those predictions set how much a plan is paid for each member. Every HCC submitted has to survive an audit.
Two things make 2026 and 2027 different from any earlier cycle. V28, the 2024 CMS-HCC model, now calculates 100 percent of MA risk scores. And for 2027, CMS stopped counting diagnoses that come only from unlinked chart reviews or audio-only visits. If your program relies on either, its numbers already changed. This guide covers the model, the documentation standard, the audit exposure, and how HCC coding software fits without creating new risk.
In this guide
- What HCC risk adjustment coding is
- How a RAF score is built
- V24 to V28: what changed
- What's different for payment year 2027
- Documentation that holds up in an audit
- The four-gate HCC defensibility test
- Retrospective, prospective and concurrent review
- Compliance exposure: RADV, OIG and DOJ
- The HCC errors that fail audits most often
- Running an HCC coding program in 2027
- Where AI-assisted HCC coding fits
- FAQ
What HCC risk adjustment coding is
The CMS-HCC model is prospective: diagnoses documented in one calendar year predict the member's cost in the next payment year. Each year resets to zero. A chronic condition that isn't documented in a qualifying encounter during the year contributes nothing to next year's risk score, even if the patient still has it.
HCCs group thousands of ICD-10-CM diagnosis codes into clinically related categories. Only codes that map to a payment HCC move the score. A coder can assign a perfectly accurate ICD-10-CM code that carries no risk adjustment weight at all. That distinction trips up new risk adjustment coders more than any other, and it's covered in what an HCC code actually is.
Which programs use it
| Model | Who maintains it | Where it pays | Covered here |
|---|---|---|---|
| CMS-HCC (V28) | CMS | Medicare Advantage Part C; also used in Medicare ACO benchmarks | Yes |
| ESRD CMS-HCC | CMS | MA members with end-stage renal disease | Briefly |
| RxHCC | CMS | Medicare Part D | No |
| HHS-HCC | HHS | ACA individual and small group market | No |
| State Medicaid models | Each state | Medicaid managed care | No |
This guide is about the CMS-HCC model, because that's where the V28 transition, the 2027 changes and the federal audit activity are concentrated. The coding discipline transfers to the other models; the HCC lists and coefficients don't.
How a RAF score is built
A member's risk adjustment factor (RAF) score is the sum of a demographic component and a condition component, adjusted at the population level before it reaches a payment.
- Demographic factors. Age, sex, Medicaid eligibility, original reason for entitlement, and whether the member lives in the community or an institution.
- HCC coefficients. One relative factor for each payment HCC the member has, after hierarchies remove the less severe category in a related group.
- Interaction terms. Extra weight for specific combinations, such as diabetes with heart failure, and a count variable for members with many payment HCCs.
- Normalization. CMS divides by a normalization factor so the average Original Medicare beneficiary scores 1.0. For 2027 the V28 normalization factor is 1.079.
- MA coding pattern adjustment. CMS reduces MA risk scores to offset the difference between MA and Original Medicare coding intensity. For 2027 it's 5.90 percent, the statutory minimum.
The plan's payment for a member is roughly its county-based rate multiplied by that adjusted RAF score. Small coding differences scale fast across a panel of tens of thousands of members, which is why CMS and federal auditors watch the condition component so closely. For the full arithmetic with real coefficients, see the worked RAF calculation, and for a plain-language definition, what a RAF score means.
V24 to V28: what changed
CMS finalized the 2024 CMS-HCC model in the CY 2024 Rate Announcement and phased it in over three years. The clinical classification behind it is version 28, which is why the industry calls it V28.
| 2020 CMS-HCC model (V24) | 2024 CMS-HCC model (V28) | |
|---|---|---|
| Diagnosis classification basis | ICD-9 era clinical groupings | Reclassified on ICD-10 |
| Payment HCCs | 86 | 115 |
| Calibration data | 2014 diagnoses, 2015 expenditures | 2018 diagnoses, 2019 expenditures |
| Coding variation controls | Fewer | Constraints on related HCCs; some HCCs moved to non-payment status |
| Share of MA risk score | 67% in 2024, 33% in 2025, 0% in 2026 | 33% in 2024, 67% in 2025, 100% from 2026 |
More payment HCCs doesn't mean more payment. CMS split broad categories into finer ones and, in the same release, applied constraints and moved certain HCCs to non-payment status specifically to reduce the effect of coding variation.
Three changes matter most on the coding floor:
- Conditions that lost payment status. Several diagnoses that carried weight under V24 map to no payment HCC under V28. Commonly cited examples include protein-calorie malnutrition, stable angina, and atherosclerosis of the extremities without complications. They're still codable and still clinically relevant. They just no longer move the score.
- Constrained severity tiers. Within groups such as diabetes, V28 sets related HCCs to the same coefficient. Coding diabetes with complications versus without no longer changes the payment, which removes the incentive to stretch for the higher tier. Specificity still matters for care, quality measures and audit consistency.
- Hierarchies. When a member has two HCCs in the same family, only the most severe one counts. Coding a more severe category without documentation to support it is the classic hierarchy-driven audit finding.
The full list of what moved, and which member populations lost the most RAF, is in V28 at full weight: what changed and who lost RAF.
What's different for payment year 2027
The CY 2027 Rate Announcement, released in April 2026, made three decisions that change how risk adjustment programs should be run.
V28 stays, unrecalibrated. In the January 2027 Advance Notice, CMS proposed keeping V28 but recalibrating it on 2023 diagnoses and 2024 expenditures. The final announcement kept the existing 2024 model instead. Expect that recalibration to return in a future cycle.
Unlinked chart review diagnoses no longer count. A chart review record (CRR) is a supplemental diagnosis submission. An unlinked CRR is one not associated with a specific beneficiary encounter. From 2027, CMS excludes diagnoses from unlinked CRRs when calculating risk scores, with an exception for members who switched between MA organizations. PACE organizations are exempt for 2027. Plans can still submit them. They just don't pay.
Audio-only diagnoses are excluded. Diagnoses from services identified as audio-only, using modifier 93 or FQ, no longer feed risk scores. Audio-video telehealth is unaffected.
The practical consequence: a retrospective program that finds diagnoses in charts and submits them as standalone chart reviews has lost much of its 2027 value. The diagnosis now has to tie back to a real encounter. That shifts effort toward prospective and concurrent review, covered below, and toward documentation quality at the point of care.
Documentation that holds up in an audit
A diagnosis counts for risk adjustment only when the record proves it. The standard is set by three things: the ICD-10-CM Official Guidelines for Coding and Reporting, CMS's encounter and provider-type rules, and what Risk Adjustment Data Validation (RADV) reviewers will accept.
What RADV reviewers actually check
CMS's RADV medical record reviewer guidance sets the bar a submitted HCC has to clear:
| Requirement | What the reviewer looks for | Common failure |
|---|---|---|
| Face-to-face encounter | Documentation of a face-to-face visit with the enrollee (pathology is the noted exception) | Diagnosis taken from a problem list or a phone call |
| Acceptable provider type | Hospital inpatient, hospital outpatient or physician, from an acceptable specialty | Note signed only as "provider" |
| Authentication | Handwritten or electronic signature with credentials | Stamped signature; missing credentials |
| Date of service | A clear date inside the data collection period | Only a fax, dictation or signature date |
| Coding to the record | Condition coded to the level of certainty documented | "Rule out" or "history of" coded as active |
MEAT is a convention, not a CMS rule
Most programs train coders on MEAT: the condition must be Monitored, Evaluated, Assessed or Treated in the note. TAMPER and similar acronyms do the same job. MEAT is useful. It isn't in the RADV reviewer guidance, which instead points reviewers to the official coding guidelines and requires records that are clear and unambiguous.
That distinction matters in two directions. A note can satisfy MEAT and still fail RADV on a signature or provider-type problem. And a note can support a condition clearly without hitting every MEAT letter. Train to MEAT, but audit to the actual RADV criteria. The coder-level checklist is in MEAT documentation for chronic conditions, with a short definition at what MEAT criteria means.
Annual recapture
Because the model resets every calendar year, every chronic condition has to be documented and supported in a qualifying encounter each year to count. Amputation status, a transplant, or a chronic lung disease doesn't carry forward on its own. How programs plan for that, and the edge cases, are in how often HCC diagnoses must be documented.
The four-gate HCC defensibility test
Every HCC a program submits should pass four gates, in order. If it fails one, it doesn't go out. This is the frame we use to check both human and AI-suggested codes.
| Gate | Question | Passes when | Fails when |
|---|---|---|---|
| 1. Eligible encounter | Did this come from an encounter that can count? | Face-to-face or audio-video visit, acceptable provider type and specialty, date inside the year | Audio-only (modifier 93 or FQ), unacceptable provider, date outside the period |
| 2. Documented support | Does the note show the condition was addressed? | Evidence of monitoring, evaluation, assessment or treatment, authenticated with credentials | Problem list only, "history of", unsigned or stamped note |
| 3. Correct code and hierarchy | Is the code as specific as the record, and no more? | Specificity matches documentation; hierarchy applied | Severity tier the note doesn't support; a resolved condition coded as active |
| 4. Linked submission | Will the diagnosis tie to an encounter record? | Submitted on the encounter or a linked chart review | Unlinked chart review (excluded from 2027 risk scores for non-PACE plans) |
Gate 4 is new for 2027. Before the CY 2027 Rate Announcement, a defensible diagnosis found on retrospective review could still pay through an unlinked chart review. Now it can't. Any program that hasn't added this gate is running a 2026 process against 2027 rules.
The test also runs in reverse. A defensible program deletes HCCs that fail a gate, even ones already submitted. That obligation is where the largest recent enforcement actions started, as the compliance section below shows.
Retrospective, prospective and concurrent review
Programs find and validate HCCs at three points in time. Most run more than one.
| Prospective | Concurrent | Retrospective | |
|---|---|---|---|
| When | Before the visit | During or right after the visit, before claim submission | After the claim, often months later |
| What it does | Flags suspected or unrecapped conditions for the clinician to evaluate | Codes and validates from the note while it can still be corrected | Reviews charts for missed or unsupported diagnoses |
| 2027 position | Unaffected | Unaffected | Diagnoses submitted as unlinked chart reviews no longer pay |
| Main risk | Prompting a diagnosis the clinician doesn't independently evaluate | Coder bandwidth at volume | Add-only reviews; late addenda |
Retrospective review still has a job: finding unsupported HCCs to delete, and catching documentation problems to feed back to clinicians. What it can no longer do well is generate standalone revenue. The full trade-off is in retrospective vs prospective vs concurrent risk adjustment.
Compliance exposure: RADV, OIG and DOJ
Risk adjustment is one of the most heavily scrutinized areas in Medicare. Three federal channels matter.
RADV audits
In May 2025, CMS announced it would audit every MA contract and expand staffing and technology to clear its backlog. In September 2025, a federal court in Humana Inc. v. Becerra vacated the 2023 RADV final rule on procedural grounds, the rule CMS would use to extrapolate audit findings without a fee-for-service adjuster. CMS appealed in November 2025 and, in a January 2026 memo, said it would comply with the order while continuing audits starting with payment year 2020.
The court didn't rule that extrapolation itself is unlawful. Plans should assume it comes back.
OIG
The HHS Office of Inspector General found that diagnoses reported only on health risk assessments and HRA-linked chart reviews, with no other service record, generated an estimated $7.5 billion in 2023 MA payments, and that 20 companies drove 80 percent of it. CMS agreed only with the recommendation to examine which HCCs are most susceptible to misuse. Diabetes and heart failure were among the conditions OIG named.
DOJ and the False Claims Act
In January 2026, five Kaiser Permanente affiliates agreed to pay $556 million to resolve allegations that they submitted unsupported diagnoses. DOJ alleged the affiliates mined records for new diagnoses, pushed clinicians to add addenda months or more than a year after visits, tied incentives to risk adjustment targets, and didn't remove diagnoses later found unsupported.
The pattern across all three channels is the same: add-only programs, late documentation, and no deletion process. A program that only adds codes looks like an upcoding program to an auditor, whatever its intent.
The HCC errors that fail audits most often
Most RADV and internal audit findings fall into a short list of patterns. They're worth training on by name, because each one has a specific fix.
| Error pattern | Example | Why it fails | Fix |
|---|---|---|---|
| Problem-list coding | Chronic kidney disease stage 4 pulled from the problem list of a visit for a sprained ankle | No evidence the condition was addressed at that encounter | Code only conditions the note shows were evaluated or managed |
| History coded as active | "History of breast cancer," no current treatment, coded as active malignancy | Active cancer HCC without active disease or treatment | Use the personal history code; it carries no payment HCC |
| Unsupported severity | Major depressive disorder coded as severe when the note says "depression, stable" | Specificity goes beyond the documentation | Code to the level of certainty and severity documented |
| Status conditions not recaptured | Amputation or ostomy status missed in the year | The model resets annually | Prospective flag so the clinician documents the status at a visit |
| Late addenda | Diagnosis added to a note months after the visit following a coding query | Timing suggests documentation was created for payment | Query during the concurrent window; follow your addendum policy |
| Unacceptable source | Diagnosis from an audio-only visit, a lab-only encounter, or a non-acceptable provider type | Fails the encounter gate | Check source and modifier before the code is submitted |
Two of these, history coded as active and unsupported severity, are also the patterns most likely to be generated by an AI tool trained only to find conditions. That's why the evidence link and the human sign-off in the next section aren't optional.
Running an HCC coding program in 2027
The rules above translate into a small number of operating decisions. Programs that handled the V28 transition well tend to make them explicitly, in writing, before the year starts.
Set the source rules first. Decide which encounter types, provider types and modifiers your coders will accept, and hard-stop audio-only and unlinked sources at submission. This is gate 1 and gate 4 turned into policy.
Balance adds and deletes. Track both, and report both to leadership. A program reporting only "HCCs captured" or "RAF lift" is measuring the thing auditors look for. Report the delete rate, the query rate and the RADV-style validation rate alongside it.
Audit a sample every month. Pull a random sample of submitted HCCs, not just a sample of charts, and run them through the four gates with a second credentialed coder. Track failures by pattern from the table above, and feed them back to coders and clinicians by name of pattern.
Move effort earlier. With unlinked chart reviews no longer paying, the return on prospective and concurrent review rises. A suspected condition flagged before a visit and properly evaluated by the clinician is worth more, and is easier to defend, than one found in a chart a year later.
Document the program itself. Written coding policies, query templates, training records and audit results are what a compliance officer hands to an auditor first. If the program uses AI, the policy should say what the AI does, who reviews its output, and how disagreements are resolved.
Where AI-assisted HCC coding fits
AI is useful in risk adjustment for the same reason it's risky there: it reads every note, every time, at volume. Pointed at the wrong objective, it finds more HCCs to add. Pointed at the right one, it finds what's supported, what isn't, and what to delete.
A defensible AI-assisted workflow does four things:
- Links every suggestion to evidence. Each proposed HCC carries the note, date of service, provider and the specific text that supports it, so the coder checks gates 1 to 3 in seconds instead of re-reading the chart.
- Suggests deletes, not just adds. Unsupported or unlinked diagnoses are flagged for removal with the same weight as missed ones.
- Keeps a credentialed coder on every submission. AI proposes, a Certified Risk Adjustment Coder (CRC) or equivalent confirms. The decision and the reviewer are logged.
- Routes gaps to the clinician, not into the claim. Where documentation is missing, the output is a compliant query or a prospective flag for the next visit, never a retroactive addendum target.
Accuracy claims need the same scrutiny as any other vendor claim. Ask what the reference standard was, whether precision and recall were measured separately (one shows overcoding risk, the other shows missed conditions), and whether the evaluation used V28 mappings and 2027 submission rules.
FAQ
Is V28 fully in effect?
Yes. From payment year 2026, CMS calculates 100 percent of non-PACE Medicare Advantage risk scores with the 2024 CMS-HCC model (V28), and the CY 2027 Rate Announcement kept that model for 2027. PACE organizations still use a blend.
Do chart reviews still count for risk adjustment in 2027?
Linked chart reviews, which tie to a specific encounter, still count. Diagnoses from unlinked chart reviews are excluded from 2027 risk scores for non-PACE plans, except for members who switched MA organizations. Plans can still submit them, but they don't affect payment.
Do telehealth visits count for HCC coding?
Audio-video telehealth visits can support risk adjustment diagnoses when other requirements are met. From 2027, diagnoses from audio-only services, identified by modifier 93 or FQ, are excluded from risk score calculation.
Is MEAT required by CMS?
No. MEAT is an industry convention for showing that a condition was addressed. CMS's RADV reviewer guidance relies on the ICD-10-CM Official Guidelines and requires clear, authenticated documentation from an acceptable face-to-face encounter. MEAT is a useful training tool, not the audit standard.
Which credential fits risk adjustment coding?
The Certified Risk Adjustment Coder (CRC), issued by AAPC, is the credential built for this work. CCS and CPC holders often code risk adjustment too, but CRC covers the HCC model, hierarchies and documentation requirements specifically.
This guide is general education on risk adjustment coding. It isn't a coding determination for any specific patient or encounter, or legal advice on audit exposure.
