Medical Coding Risk Adjustment and How to Code It Defensibly
Risk adjustment coding decides how Medicare Advantage and value-based payments reflect patient complexity. Here is how the model works, and how to keep every submitted code defensible under V28 and expanded RADV audits.
If you code for a Medicare Advantage or value-based population, you already know that a single diagnosis can change what a plan gets paid. Medical coding risk adjustment turns a patient's documented diagnoses into ICD-10-CM codes that map to condition categories and set a risk score, which payers use to fund care for sicker patients. The score holds up only when the record supports each code and an auditor can confirm it; the CMS-HCC V28 model has raised that bar.
In this guide, you will find how the model works from diagnosis to risk score, what changed under V28, how to support a diagnosis so it survives an audit, and how to keep your coding defensible as RADV audits expand.
TL;DR: Risk Adjustment Coding at a Glance
Risk adjustment coding comes down to a few core points:
Risk adjustment coding maps documented diagnoses to ICD-10-CM codes and condition categories that set a patient's risk score and the plan's payment.
The CMS-HCC V28 model now sets 100% of Medicare Advantage risk scores, with no V24 blend, so guidance built on older habits is out of date.
Every diagnosis needs support in the note, and chronic conditions must be recaptured each calendar year.
Defensible coding runs both ways: add the codes the record supports, and remove the codes it does not.
Audits now reach every eligible Medicare Advantage plan each year, so audit readiness is a routine coding discipline, not an exception.
How Medical Coding Risk Adjustment Works
Risk adjustment is how payers fund care for populations with different health needs. The model equates a patient's health status to a number and adjusts payment so a plan caring for sicker members is not penalized for doing so.
From a coder's seat, the abstract idea becomes concrete. The diagnoses you code determine the score.
From Diagnosis Code to Risk Score
The mechanics are direct. A clinician documents a condition during a face-to-face encounter, a coder assigns the most specific ICD-10-CM (International Classification of Diseases, Tenth Revision, Clinical Modification) code the record supports, and that code maps to a Hierarchical Condition Category (HCC).
The patient's HCCs then combine with demographic factors such as age and sex to produce a Risk Adjustment Factor (RAF) score, which payers use to predict cost and set payment, as the Centers for Medicare and Medicaid Services describes it.
Two features of the model shape everything a coder does. Risk scores reset every year, so a chronic condition coded last year does not carry forward on its own. Only a subset of ICD-10-CM diagnosis codes map to a payment category, so specificity decides whether a diagnosis counts at all.
What HCCs Are and How They Map
An HCC is a group of clinically related diagnoses that share similar cost patterns. The Centers for Medicare and Medicaid Services (CMS) organizes diagnoses into these categories, assigns each a weight, and uses the combination to predict a patient's future cost. Conditions such as heart failure, chronic kidney disease, and diabetes with complications carry more weight than a routine acute problem, because they drive ongoing care.
The hierarchy matters.
Within a related family of conditions, the most severe category supersedes the less severe ones, so a patient is credited once for the highest-acuity condition documented. The design rewards accurate specificity over the sheer number of codes.
Where Risk Adjustment Applies
Risk adjustment is most associated with Medicare Advantage (MA), where the CMS-HCC model sets plan payment. It also drives payment in Affordable Care Act marketplace plans, many Medicaid managed care programs, and accountable care and value-based contracts. The model, the code set, and the review rules differ by program, so confirm which model applies to each population before coding it.
One point is worth keeping straight. Risk adjustment coding is diagnosis coding drawn from qualifying outpatient encounters, which is a different job from the procedural focus of much inpatient and outpatient coding work. The codes that matter here describe how sick the patient is, not what procedure was performed.
What Changed Under the CMS-HCC V28 Model
The model coders work in changed with the move to V28. CMS has completed its phase-in of the V28 version of the CMS-HCC model, which now sets 100% of Medicare Advantage risk scores with no blend from the older V24 model, per CMS's risk adjustment implementation guidance. Guidance and habits built during the V24 years no longer describe how payment is calculated.
The practical effects for a coding team are direct:
V28 was rebuilt on ICD-10 rather than the older ICD-9 foundation, with recalibrated condition categories and updated diagnosis mappings.
A substantial number of diagnosis codes that mapped to a payment category under V24 no longer do under V28, so codes that once added to a risk score may now add nothing.
The model puts more weight on documented severity and less on the count of conditions, which changes where specificity pays off.
With no V24 cushion, any gap between documentation and the new mappings shows up in payment right away.
How to Support a Risk-Adjusted Diagnosis in the Record
A code only counts when the record supports it. Risk adjustment auditors do not accept a diagnosis because it appears on a claim; they look for evidence in the note that the condition was addressed at the encounter. Two documentation disciplines carry most of the weight.
The MEAT Standard
MEAT is the industry convention auditors use to decide whether a diagnosis is supported. It is not a federal regulation, but it reflects how reviewers read a note, and any one of the four elements documented at the encounter can validate a condition.
The four elements, with what each looks like in practice:
Element | What it means | Example in the note |
|---|---|---|
Monitor | Signs, symptoms, or disease progression are tracked | "Diabetes stable, reviewing home glucose logs" |
Evaluate | Test results or response to treatment are assessed | "A1c reviewed today, adjusting therapy" |
Assess | The condition is discussed or worked up | "CKD stage 3, discussed progression risk" |
Treat | A medication, referral, or plan is documented | "Continue current therapy, refer to nephrology" |
A diagnosis listed on a problem list with none of these signals is the kind of code an auditor removes.
Annual Recapture of Chronic Conditions
Risk scores reset every calendar year, so a chronic condition has to be documented and coded each year again to count, even when it has not changed. A patient with diabetes, heart failure, and chronic kidney disease needs each condition addressed and documented at a qualifying encounter within the year.
A missed recapture understates the patient's complexity and the resources their care requires.
Specificity Starts in the Note
The most common risk adjustment errors start as documentation problems before they become coding problems. A vague note produces a vague code, and a vague code often maps to nothing under V28. When a clinician documents "diabetes" without the present complication, the coder cannot assign the more specific code the record could have supported.
As Gautam Kumar, VP of Business Operations at DeliverHealth, puts it, "Every downstream workflow is, in some form, an interpretation of what was or was not in the note." Accurate risk adjustment starts at the encounter, not in the coding queue, which is also where teams working to improve coding accuracy get the most return.
DeliverHealth's AI clinical documentation is built to capture that specificity at the encounter. InstaNote captures the visit through ambient conversation or dictation and returns a structured note with coding suggestions the provider reviews before sign-off; its speech recognition is designed not to add anything that wasn't said, and it leaves a section blank rather than inferring a condition the clinician did not state.
Note formats follow each organization's and provider's requests, so the detail risk adjustment depends on how it fits the way clinicians already work.
See InstaNote in action to understand how it captures specific, review-ready documentation at the encounter.
Why Defensible Coding Runs in Two Directions
For years, many risk adjustment programs treated coding as an addition problem: find every supportable diagnosis and submit it. Auditors and regulators have made the standard clear. Defensible coding adds the codes the record supports and removes the codes it does not.
The stakes show up in federal audit findings. The HHS Office of Inspector General (OIG) has repeatedly found unsupported high-risk diagnosis codes in Medicare Advantage submissions, including acute conditions such as stroke coded when the record shows only a history of the condition.
The pattern behind those findings is familiar to any auditor: a resolved condition submitted as current, a history-of diagnosis coded as acute. Removing those codes is as much a part of accuracy as capturing the ones that were missed, which is why strong medical coding compliance programs review in both directions.
Knowing when a diagnosis needs a second look is part of the discipline. As Percy Bhathena, VP of Product and AI at DeliverHealth, describes it, "That human oversight becomes really key, and knowing when to send it to the humans is another part of the technology."
How to Stay Audit-Ready as RADV Expands
Risk Adjustment Data Validation (RADV) is the audit CMS uses to confirm that submitted diagnoses are supported by medical records, and the program has changed scale. CMS now audits every eligible Medicare Advantage contract each year, up from roughly 60 plans, and has increased its review workforce to match. For coding teams, an audit is now a routine event to prepare for rather than a rare one.
A few disciplines keep a program ready for that review:
Confirm every submitted diagnosis has MEAT-level support in a qualifying, face-to-face encounter note.
Recapture chronic conditions each calendar year rather than carrying forward last year's codes.
Run two-way reviews that remove unsupported codes, not searches for missed ones alone.
Keep an audit trail that shows what was coded, what changed, and why.
Reconfirm mappings against the current V28 model rather than V24 habits.
The teams that treat these as everyday practice absorb an audit request. The teams that treat them as a special project scramble, which is one reason risk adjustment belongs inside a program's broader view of coding in the revenue cycle.
Frequently Asked Questions
A few questions come up often when teams tighten their risk adjustment coding:
What is the Difference Between Risk Adjustment Coding and Regular Medical Coding?
Procedural coding with CPT (Current Procedural Terminology) captures what was done at a visit.
Risk adjustment coding captures the diagnoses, coded in ICD-10-CM, that describe how sick a patient is, so payers can set risk-based payments. One coder may do both, but the goals are different.
Which Credential Covers Risk Adjustment Coding?
AAPC offers the Certified Risk Adjustment Coder (CRC) credential, and AHIMA offers a risk adjustment coding microcredential. Both signal training specific to HCC and diagnosis-based coding rather than general procedural coding.
How Often Do Chronic Conditions Need to Be Recoded?
Every calendar year. Risk scores reset annually, so you must document and code a chronic condition each year for it to count, even if the condition is unchanged.
Does Risk Adjustment Apply Outside Medicare Advantage?
Yes. It also applies in Affordable Care Act marketplace plans, many Medicaid managed care programs, and value-based and accountable care contracts, though the model and the rules vary by program.
What is the Most Common Risk Adjustment Coding Error?
Coding a diagnosis the note does not support, and its mirror image, failing to recapture a chronic condition that was addressed but not documented specifically.
Both are documentation problems as much as coding problems.
Keep Risk Adjustment Coding Accurate and Defensible
Risk adjustment rewards what an auditor looks for. Document, support, and code a diagnosis to the specificity the record earns. The programs that hold up are not the ones chasing the most codes. They are the ones whose notes and codes tell the same story, in either direction.
That is where DeliverHealth's AI-powered medical coding fits. InstaCode turns documentation from any source into accurate, defensible codes, delivering 95% coding accuracy with human-in-the-loop review, with AAPC- or AHIMA-credentialed coders on the complex and flagged encounters. Every coded encounter is auditable, with a record of the AI's output and the human changes behind it, and InstaCode stays current on code updates and payer rules as models such as V28 shift.
Request a demo to see how InstaCode can support accurate, defensible coding across your risk-adjusted populations.
Stay Updated
Subscribe to our newsletter for the latest healthcare AI insights and company updates.