HCC Medical Coding: A Guide to Risk Adjustment

A Medicare Advantage patient comes in with diabetes that now affects the kidneys. The note records the diabetes but not the kidney disease, or the other chronic conditions treated that day. The care happened. The codes that reflect it did not.

The diagnoses that slip in risk adjustment are rarely the rare ones. They are the chronic conditions that were real, treated, and never documented with enough specificity to code.

In this article, we explain what HCC medical coding is, how the CMS-HCC model turns diagnoses into risk scores, what the note must show, and how to keep coding audit-ready.

TL;DR: HCC Medical Coding at a Glance

HCC medical coding is diagnosis coding for risk adjustment. The essentials:

• HCC stands for Hierarchical Condition Category. HCC coding assigns the ICD-10-CM diagnosis codes that map to condition categories used to describe how sick a patient is.

• Each category carries a weight. Those weights combine with demographic factors into a Risk Adjustment Factor (RAF) score that helps determine what the Centers for Medicare and Medicaid Services (CMS) pays a Medicare Advantage (MA) plan per member.

• Risk scores reset every year, so every active chronic condition has to be documented and coded again at each year's visits rather than carried over.

• The CMS-HCC V28 model now sets Medicare Advantage risk scores, and it expects greater documentation specificity than the model it replaced.

• Accuracy runs both directions: code the conditions the record supports, and remove the ones it does not, so the coding holds up under audit.

How HCC Medical Coding Works

HCC medical coding involves reviewing clinical documentation and assigning ICD-10-CM diagnosis codes that describe a patient's chronic and serious conditions. That work, known as risk adjustment coding, feeds value-based and Medicare Advantage payments.

Unlike coding for a single service, this work is about the whole clinical picture. The goal is a complete, accurate account of the patient's overall health, with every diagnosis supported by the record.

From ICD-10-CM Diagnoses to HCCs and RAF Scores

CMS groups thousands of ICD-10-CM diagnosis codes into a smaller set of condition categories under the CMS-HCC risk adjustment model. Each category a patient qualifies for carries a relative weight, and those weights combine with demographic factors into a RAF score.

The RAF score helps set the per-member-per-month amount a plan receives for that patient, no matter which services are delivered that year. A healthier patient scores lower. A patient with more serious, well-documented conditions scores higher.

The categories are also hierarchical. Within a disease group, the most severe condition the record supports is the one that counts, so a vague diagnosis and a specific one are not interchangeable.

How HCC Coding Differs From Fee-for-Service Coding

Fee-for-service coding, also called professional or pro-fee coding, bills a specific service. The provider reports a CPT (Current Procedural Terminology) or HCPCS code for what was done, and ICD-10-CM diagnoses justify medical necessity.

Risk adjustment coding works differently. There is no procedure to bill. The coder abstracts every diagnosis the encounter supports, because each supported condition can affect the patient's risk score for the year. One process bills an action. The other documents a patient's health status.

Why Accurate HCC Coding Protects Revenue and Compliance

Because RAF scores drive payment, HCC coding sits close to both revenue and risk. Coding a condition the record does not support is not extra revenue. That is an overpayment waiting to be found.

CMS estimates that about 9.5 percent of Medicare Advantage payments are improper, driven mainly by unsupported diagnoses. That is why risk adjustment is one of the most scrutinized areas in coding, and why accurate coding matters as much as complete coding.

Risk Adjustment Data Validation (RADV) audits check whether the medical record supports the diagnoses a plan submitted. When it doesn't, the plan may owe money back.

As our VP of Business Operations, Gautam Kumar, puts it, "Documentation quality should be viewed as the 1st and most important revenue cycle control point." Treating HCC work as part of coding in the revenue cycle, rather than a yearly scramble, is what keeps revenue integrity and compliance aligned.

How the V28 Model Changed Risk Adjustment Coding

CMS updates the CMS-HCC model over time. The current version, V28, replaced the long-standing V24 model and now carries the full weight of Medicare Advantage risk scoring after a phase-in across several payment years.

V28 is not a small revision. The update rebuilt the model on an ICD-10-native structure, recalibrated the weights, reorganized the condition categories, and removed many diagnosis codes that used to add risk. For coders, the practical message is specificity. V28 rewards documentation and codes that pin down the exact condition, and it gives little credit for vague ones.

Two things follow. Some codes that carried weight under V24 no longer do, so capture built on old habits quietly erodes. The V24 model also still appears in lookback work and in audits covering earlier years, so it cannot be forgotten entirely. Staying current on these shifts is part of the job, the same discipline behind any effort to improve coding accuracy.

What Documentation HCC Coding Requires

A code is only as defensible as the note behind it. HCC coding depends on documentation that clearly states each condition, shows it was addressed at the visit, and is signed and dated by the provider.

Capture Every Coexisting Condition Each Year

Risk scores reset annually, so a chronic condition documented last year does not carry forward. Each one has to be documented and coded again every year it is active.

Coders abstract every coexisting condition the provider evaluated or managed, because HCCs are additive and each supported condition can affect the score.

Document to the Specificity the Code Requires

General codes rarely map to the right category. Diabetes documented as diabetes says less than diabetes documented with its manifestations, such as chronic kidney disease. Coding to the highest supported specificity, and building a coding compliance program that checks for it, is how capture stays both complete and correct.

Two industry conventions guide this. MEAT (Monitor, Evaluate, Assess, Treat) and the stricter TAMPER framework describe how a note should show that a diagnosis was actually addressed. Neither is a CMS regulation, but auditors look for the same evidence they describe.

How to Keep HCC Coding Accurate and Audit-Ready

Accurate HCC coding is an ongoing workflow rather than a one-time pass.

Three habits keep it defensible:

Code Both Directions, Adding Supported and Removing Unsupported

The defensible standard is two-way review. Add the conditions the record supports that you missed, and remove the ones you coded but that aren't supported.

Removing an unsupported code protects the plan as much as adding a supported one, because both are what an audit checks.

Keep an Audit Trail You Can Defend

When a diagnosis is questioned, the record answers: who coded what, what changed, and why. A clear trail from the note to the final code turns an audit from a scramble into a lookup.

That matters most as more work moves to autonomous coding, where the system's output and every human change must be traceable.

Keep a Credentialed Human in the Loop on AI-Assisted Coding

AI can surface documented conditions faster than manual review and flag where a note is thin, but it shouldn't be the final word on risk-bearing code. Credentialed coders confirm the complex and flagged cases, which is also the honest way to read any vendor's accuracy number, so knowing how to evaluate accuracy claims is part of running these tools well.

That balance is what DeliverHealth is built on: AI-powered solutions that draft the work, with credentialed people accountable for what ships. As our VP of Product and AI, Percy Bhathena, puts it, "We need to have humans in the loop, and I think that's a value. I don't think it's a detriment."

For risk adjustment, that accountability starts in the note. Our InstaNote AI clinical documentation returns a structured note with coding suggestions the provider reviews before sign-off, and its templates follow your organization's and each provider's requests, so the chronic conditions your coding depends on are captured to specificity from the start.

See how it works on your own encounters: Request a demo.

Frequently Asked Questions

Common questions coders and managers ask about HCC medical coding:

What Does HCC Stand for in Medical Coding?

HCC stands for Hierarchical Condition Category.

In risk adjustment, related diagnoses are grouped into categories, and each category a patient qualifies for contributes to their risk score.

Is HCC Coding the Same as Risk Adjustment Coding?

In practice, yes. HCC coding is the diagnosis coding used for risk adjustment models such as the CMS-HCC model for Medicare Advantage.

Some commercial and ACA plans use a related model administered by HHS, and the rules can differ, so check the payer's requirements.

What Is a RAF Score?

A RAF, or Risk Adjustment Factor, score is a number that reflects a patient's expected cost of care, based on documented conditions and demographic factors.

Plans use it to set risk-adjusted payment.

Do Chronic Conditions Need to Be Coded Every Year?

Yes. Risk scores reset annually, so every active chronic condition must be documented and coded at each year's visits.

A condition coded last year does not carry over on its own.

What Credential Do HCC Coders Need?

There is no single legally required credential, but risk adjustment work usually calls for a trained coder, often one holding the CRC (Certified Risk Adjustment Coder) from AAPC or an AHIMA credential such as the RHIA.

Experience with diagnosis coding and risk adjustment rules matters as much as the letters.

Can HCC Coding Be Automated?

Parts of it can. AI can surface documented conditions and flag gaps quickly, which speeds the work.

Risk-bearing codes still need credentialed human review, both for accuracy and to keep the coding defensible under audit.

Conclusion

Risk adjustment rewards a quiet kind of excellence: the same chronic conditions, documented clearly, coded to specificity, every year, in a way that holds up when someone checks. The model will keep changing. The discipline behind it will not.

Complete capture only pays off if the coding behind it holds up under review. That is where InstaCode comes in.

Our AI-powered medical coding solution delivers 95% coding accuracy with human-in-the-loop review, keeps AAPC- or AHIMA-credentialed coders on the complex and flagged cases, and makes every coded encounter auditable, so any diagnosis can be traced from the note to the final code when someone checks.

See where it fits your specialty mix: Explore InstaCode.