What Are Risk Adjustment Data Validation (RADV) Audits?

As discussed last week, payments to Medicare Advantage (MA) plans are adjusted to account for expected healthcare resource consumption by enrollees.

Higher risk scores increase payments. The primary risk adjustment mechanism is the Centers for Medicare & Medicaid Services (CMS) Hierarchical Condition Categories (CMS-HCCs).

Diagnoses reported on inpatient and qualified outpatient claims accumulate each calendar year, per MA beneficiary, to predict the costs associated with future healthcare needs.

CMS requires MA plans to submit about one-fourth of their risk adjustment data at least quarterly, using the Risk Adjustment Processing System (RAPS) format.

Because it is more difficult to anticipate when acute medical conditions will arise, the CMS-HCC model is heavily based upon chronic conditions. Additionally, not all acute medical conditions will influence future healthcare needs.

Many inpatient clinical documentation integrity (CDI) professionals are familiar with CMS-HCCs, because their condition categories are also used for risk-adjusting outcome measures associated with mandatory quality programs defined within the Inpatient Prospective Payment System (IPPS).

CDI workflows that include capturing CMS-HCCs can help build an MA beneficiary’s risk profile if they have an inpatient admission during the calendar year. More than likely, the bulk of risk-adjusting diagnoses will be collected from outpatient claims data, including professional claims.

Diagnoses reported on professional claims are likely to be less accurate due to a lack of utilizing professional risk-adjustment coders.

The impact of unsubstantiated diagnoses can be significant. The 20 most common CMS-HCCs affecting MA plans increase payments by $1,000 to $5,500 per beneficiary, with an average of about $3,400 per year. MedPac illustrated how additional CMS-HCCs increase payment for MA plans for an 80-year-old, non-Medicaid male with a demographic component risk score valued at $6,726.

Adding one or more CMS-HCCs can impact payment as follows:

• Adding the CMS-HCC for diabetes without complication (HCC 19, valued at $1,284) increases the annual payment to $8,010.
• Adding the CMS-HCCs for vascular disease (HCC 108, valued at $3,620) increases the annual payment to $11,630.

CMS is trying to reduce the impact of coding intensity with CMS-HCC version 28, which was introduced in 2024. This updated version was phased in over the past three years, with full migration occurring by 2026. Version 28 is expected to reduce MA risk scores, coding intensity, and payments to MA plans.

The V28 risk model differs from the prior model as follows. It:

• Excludes some HCCs, with much higher rates of coding in MA relative to FFS Medicare;
• Constrains the coefficients of some HCCs with the same group of related conditions, where there are differential rates of MA and FFS coding among the HCCs in the group; and
• Implements mapping based on International Classification of Diseases (ICD) –10-Clinically Modified (CM) diagnosis codes, which had the effect of removing several diagnoses from the payment model.

Because of the impact of claims data on MA plan reimbursement, CMS is required to conduct Risk Adjustment Data Validation (RADV) audits to verify that diagnoses reported by MA plans are supported by evidence in the patients’ medical records. These audits demonstrate continued significant issues regarding adequate medical-record support.

Risk-adjusting diagnoses must:

• Appear on a claim from a hospital inpatient stay, a hospital outpatient visit, or a face-to-face visit with a physician or other healthcare professional (there is a specified list of whose documentation can be used); and
  • Diagnoses resulting from telehealth services meet the face-to-face requirement when provided using interactive audio and video that enables real-time communication with the beneficiary.
• Be supported by evidence in the patient’s medical record.

If diagnoses do not meet specified requirements, plans must return payments to Medicare. Unfortunately, CMS is several years behind in completing these audits. The last significant recovery of MA overpayments occurred following the 2007 payment year (PY). Federal estimates suggest that MA plans overbill the government by approximately $17 billion annually, while the Medicare Payment Advisory Commission estimates this figure could be as high as $43 billion per year.

The current administration has introduced a plan to complete all remaining RADV audits for PY 2018 to PY 2024 by early 2026. Key elements of the plan include the following:

• Enhanced technology that efficiently reviews medical records and flags unsupported diagnoses;
• Workforce expansion from 40 to approximately 2,000 medical coders, who will manually verify flagged diagnoses to ensure accuracy; and
• Increased audit volume by leveraging technology to allow review of up to 200 records per health plan for all eligible MA plans each year. High volumes of audited cases ensure that CMS’s audit findings are more reliable and can be appropriately extrapolated as allowed under the RADV Final Rule.

RADV audits confirm that compliant sources of provider documentation support risk-adjusting diagnoses submitted by an MA plan. CMS RADV audit instructions require diagnosis code abstraction in accordance with ICD-10-CM Guidelines for Coding and Reporting and Coding Clinic for ICD-10-CM/PCS, among other requirements. Many physicians code their own patient visits and may lack the skills to accurately assign diagnosis codes, since their payment methodology is based upon Current Procedural Terminology ® (CPT) codes.

If the diagnosis codes abstracted through the RADV process do not map to the same CMS-HCCs reported by the MA plan, they may be required to refund payments to CMS.

Even though RADV audits have not been occurring, the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) has been conducting audits. Their audits have identified diagnoses at higher risk of being miscoded.

• One common theme is the reporting of an acute diagnosis code based on a physician claim that cannot be substantiated with a corresponding inpatient claim suggesting a coding error for failure to use a history code. This problem was commonly found with acute stroke and acute myocardial infarction.
• Another common error is the absence of appropriate medication to treat a reported chronic condition. It may be that either no corresponding medication was dispensed, or that the patient’s medication list supported a different diagnosis than what was reported by the MA plan. These diagnoses included embolism, vascular claudication, and major depressive disorder.
• Lastly, diagnosis codes may be reported incorrectly due to data entry errors like transposing numbers, resulting in the reporting of an unsubstantiated CMS-HCC.

Although CMS allows MA plans to use health risk assessments (HRA) and chart reviews as sources of diagnoses for risk adjustment, an OIG audit revealed an overreliance on them. In-home HRA and chart reviews are often conducted by the MA plan or a third-party vendor, rather than the enrollee’s own provider, which does not have a vested interest in the outcome. There are many instances of diagnoses used for risk adjustment only appearing on a HRA, without corroboration from a corresponding service record.

The OIG and other entities are concerned that some MA plans may be misusing these mechanisms to report unsupported diagnoses and inflate their risk-adjusted payments. In fact, a $172 million settlement was reached with The Cigna Group and its subsidiaries in 2023 to resolve allegations that Cigna improperly increased its risk-adjusted payments from CMS by misusing chart reviews and in-home HRAs.

But that is just a fraction of the estimated $7.5 billion in overpayments associated with these types of errors in PY 2023. Consequently, the OIG recommended and CMS agreed to impose restrictions on the use of diagnoses reported using these types of data collection tools, and conducting audits to validate diagnoses using these collection methods.

Interestingly, one of the audited MA plans challenged the OIG findings by arguing that CMS regulations do not expect MA plans to submit perfect risk-adjustment data. They argued that they only need to make a good-faith effort to certify data accuracy, completeness, and truthfulness, because they collect a great volume of data from a variety of sources. Perhaps CMS should consider imposing data validation requirements like a second-level review process staffed by outpatient CDI and coding professionals to ensure the accuracy of data impacting healthcare reimbursement prior to submitting the data to CMS.

MA plans should be held to the same standard as other Medicare healthcare providers, like hospitals, whose claims data is scrutinized by payors, including MA plans. When an inaccurate or unfounded diagnosis is reported on a hospital claim, MA plans and other payers are quick to issue a denial.

CMS does not have the same ability to issue denials within the MA payment methodology, even though the impact of CMS-HCCs is similar to the impact of a diagnosis classified as a complication/comorbidity or major complication/comorbidity (CC or MCC).

Consequently, it appears that more oversight of MA plans is needed, and that healthcare data that impacts Medicare reimbursement should be equally scrutinized across all healthcare providers for all Medicare services.