A primary care practice in Arizona received a letter last spring from a Medicare Advantage plan asking for the complete 2018 records of 14 patients, due in three weeks, "in connection with a CMS audit." The office manager assumed it was a HEDIS request, sent the vitals pages, and heard nothing for a month. Then the plan called: it needed the full signed progress notes for every 2018 visit, because CMS was checking whether the diagnoses the plan had been paid for in 2019 were actually documented. The practice had archived 2018 records to a storage vendor when it changed EHRs, and it took six weeks and a retrieval fee to produce them.
That kind of request is about to become routine. On March 20, 2026, CMS notified Medicare Advantage organizations which of their contracts have been selected for payment year 2020 Risk Adjustment Data Validation audits. Two weeks earlier, on March 4, CMS published an audit timeline covering payment years 2020 through 2025 and a consolidated question-and-answer document. And in a January 27, 2026 memo, CMS told plans that payment year 2020 audits would begin as early as February 2026, that audits would follow a roughly quarterly cadence, that the medical record submission window would be five months, and that samples would run from 35 to 200 enrollees per contract depending on plan size.
All of this follows the May 21, 2025 announcement in which CMS said it would audit every eligible Medicare Advantage contract every year, about 550 contracts instead of roughly 60, and would clear the backlog of payment years 2018 through 2024. For practices, the operational meaning is simple: plans have five months to find the charts, and the charts are yours. This article explains what a RADV audit checks, what the plan will ask you for, and how to handle RADV audit medical record requests without losing a month.
Key takeaways
- RADV audits check whether the diagnoses a Medicare Advantage plan submitted for payment are supported by a face-to-face encounter record from the year before the payment year; payment year 2020 means 2019 dates of service.
- CMS notified plans of payment year 2020 selections on March 20, 2026; plans have a five-month record window, and requests to practices will land inside it.
- Plans may submit up to two records per audited diagnosis, but CMS needs only one valid record, so the plan's request may cover several of a patient's visits.
- Your Medicare Advantage contracts almost certainly require you to retain records for ten years and to provide them for CMS audits at no charge.
- Whatever the plan owes CMS is the plan's problem; what a practice controls is whether its 2019 notes were signed, dated, credentialed and specific, and whether its 2026 notes are.
What a RADV audit actually checks
Medicare pays Medicare Advantage plans a monthly amount per enrollee adjusted for the enrollee's risk score. The risk score is built from demographic factors and from hierarchical condition categories (HCCs), which are groups of diagnosis codes that plans submit to CMS from provider claims and encounter data. A diagnosis from a 2019 visit feeds the 2020 payment. Risk Adjustment Data Validation is CMS checking a sample of enrollees to see whether each HCC the plan was paid for is supported by a medical record.
The standard for support is specific. The record must come from a face-to-face encounter (or a qualifying telehealth visit with audio and video) with an acceptable provider type in the data collection year. It must be signed and dated by the provider, with the provider's credentials, and the diagnosis must be documented as a condition that was monitored, evaluated, assessed or treated at that visit, not merely listed in a problem list or a past medical history. A diagnosis coded from a lab result, a radiology report or an unsigned note does not count. Glossary line: coders summarize the support test as MEAT, for monitor, evaluate, assess, treat.
When the sampled record does not support the HCC, CMS calculates an overpayment. CMS finalized a rule in January 2023 to extrapolate audit findings across a plan's contract beginning with payment year 2018; that rule has been the subject of litigation between plans and CMS, and the outcome affects how much plans owe. It does not change what the plan asks you for, which is charts.
RADV audit medical record requests: what the plan will ask for and when
The plan receives its enrollee sample and the HCCs under review, then works backward to the providers whose claims generated each diagnosis. You will receive a request naming patients, dates of service or a service year, and usually the diagnoses at issue, asking for complete progress notes. Because plans may submit up to two records per HCC and CMS needs only one valid record, a plan will often ask for every 2019 visit for a patient rather than one, so it can pick the strongest. Expect the request to arrive through a retrieval vendor, by fax, portal or a request for remote EHR access, with a deadline of two to four weeks; the plan has five months in total but must review, select and submit within it.
| Date | What CMS did | What it means for practices |
|---|---|---|
| May 21, 2025 | Announced annual audits of all eligible MA contracts, acceleration of PY 2018 to 2024 audits, expanded coding staff, five-month record window, samples of 35 to 200 enrollees | Record requests from every MA plan you contract with, every year, going forward |
| January 27, 2026 | Memo confirming PY 2020 audits begin as early as February 2026 on a quarterly cadence | Requests for 2019 dates of service starting spring 2026 |
| March 4, 2026 | Published audit timeline for PY 2020 to 2025 and a consolidated question-and-answer document | Plans can now tell you which year a request relates to; ask |
| March 20, 2026 | Notified MA organizations of contracts selected for PY 2020 audits | Five-month record window opens; expect requests within weeks |
| Later 2026 and 2027 | Subsequent payment years initiated roughly quarterly per the published timeline | Requests for 2020, 2021 and later charts will follow in waves |
When the request arrives, ask the plan two questions in writing. First, is this request for RADV, for HEDIS, for the plan's own risk adjustment review, or for something else? The answer changes what you send: a RADV request needs the complete signed note, not the vitals page. Second, which payment year and therefore which service year? CMS has published the timeline, so the plan can tell you.
Handling the request without losing a month
Verify the requester through the plan's provider services line before releasing anything or granting EHR access, exactly as you would for any records request. HIPAA permits the disclosure: providing records to a health plan for its payment activities and for a federal audit is a permitted disclosure without patient authorization, and your participation agreement almost certainly requires it. Medicare Advantage regulations require plans to obligate their contracted providers to retain records for ten years and to make them available to CMS, so a 2019 record is squarely within the retention period; a practice that cannot produce it has a contract problem as well as a documentation gap.
Then pull the complete record for each visit: the signed and dated progress note with the provider's credentials, the problem list as of that date if your EHR can reproduce it, and any addenda. Check three things before sending. Is the note signed, and does the signature include credentials (MD, DO, NP, PA)? Is the date of service on the note? Does the note name the diagnosis and say something about it: a status, a medication, a plan? If the signature is missing, do not add it now; an attestation signed in 2026 for a 2019 note is a separate document with its own rules, and the plan will tell you whether CMS accepts one for the situation. Send what exists.
Log every request with the plan, the payment year, the patients, the date received, the deadline, what was sent and when. Assign one person to own RADV requests for the year, the same way you would for HEDIS season. Most plans will not pay for the copies; check the contract, and do not let a fee dispute delay a response, because a plan that misses its CMS window because of you will remember it at contract renewal.
The 2026 lesson: your current notes are 2027's audit
The practice in Arizona could not change its 2018 notes. It could change its 2025 and 2026 notes, and it did: every chronic condition the physician addressed got a status and a plan in the assessment, the problem list stopped carrying resolved conditions, and every note was signed within 48 hours with credentials. That is the real return on a RADV request. Under the expanded program, every payment year will be audited, so the visits you document this year will be sampled for payment year 2027 audits in a few years' time.
Two habits carry most of the weight. First, address means address: if a condition is on the claim, the note says what you did about it, even if it is "stable on current regimen, continue." Second, specificity: a diagnosis code for diabetes with a documented complication is a different HCC than unspecified diabetes, and it should be coded only when the note supports the complication. Practices with a large Medicare Advantage panel benefit from a coder holding the Certified Risk Adjustment Coder credential reviewing a sample of notes each quarter, and from an annual RCM audit that includes diagnosis documentation. Our medical coding team runs HCC documentation reviews for exactly this purpose.
Questions we hear
Are we liable if CMS finds an unsupported diagnosis in our note?
RADV recovers overpayments from the plan, not the provider. But your contract with the plan may allow the plan to seek recovery from you in some circumstances, and a pattern of unsupported diagnoses is the kind of thing that attracts separate attention from federal enforcement. Read the risk adjustment clauses in your Medicare Advantage contracts, and if they worry you, ask counsel.
The plan wants remote access to our EHR for its reviewer. Should we allow it?
Many practices do, and for a large request it is faster for everyone. Set up a time-limited, read-only, audit-logged account restricted to the listed patients and the service year, confirm the reviewer's identity through the plan, and set the account to expire on the deadline. If your EHR cannot restrict access to a patient list, send copies instead.
We changed EHRs in 2021. Do we still have to produce 2019 records?
Yes. The retention obligation follows the practice, not the software. If the old records are in an archive, at a storage vendor or in a read-only legacy system, find out now how long retrieval takes and what it costs, before the first request arrives. This is also a reason to negotiate archive access when you next change systems.
What to do this week
- Name the owner for Medicare Advantage audit record requests in 2026 and set up a request log with plan, payment year, patients, deadline and what was sent.
- Confirm you can retrieve complete 2019 and 2020 records, including from any legacy system or archive, and find out how long it takes.
- Pull the risk adjustment and record retention clauses from each Medicare Advantage contract and note any recovery rights the plan holds against the practice.
- Write the two-question reply (RADV or other program; which payment year) as a template and use it for every request.
- Sample twenty recent Medicare Advantage visit notes and check each addressed diagnosis for signature with credentials, date, and a status or plan; give the results to the clinicians.
