CMS Announces Significant Changes to RADV Auditing Efforts: Considerations and Next Steps for the Medicare Advantage Industry

I. Introduction

On May 21, 2025, the Centers for Medicare and Medicaid Services (“CMS”) announced plans to substantially increase both the pace and the scale of Risk Adjustment Data Validation (“RADV”) audits of the Medicare Advantage (“MA”) Program (the “Press Release”).¹ After historically auditing a limited sample of MA plans, CMS announced plans to audit all eligible MA plans on an annual basis and complete its backlog of RADV audits for Payment Years (“PY”) 2018-2024 by early 2026. Perhaps not coincidentally, CMS’s final rule permitting extrapolation of RADV audit overpayments also commences as of PY2018.² This Alert highlights key implications of CMS’s announcement and details practical considerations for MA plans, their vendors, and providers participating in the MA Program, as federal scrutiny of the MA Program intensifies.

II. Background

CMS’s latest announcement comes amid increased federal scrutiny of the MA Program, as its size and cost to federal taxpayers have increased over time. By one estimate, as of 2023, the MA Program enrolled approximately 31.6 million beneficiaries at a cost of $455 billion (not including Medicare Part D drug plan payments).³ In addition to concerns about increasing expense, CMS has long expressed concerns about waste in the Program. In 2013 alone, for example, CMS estimated that it made $14.1 billion in improper payments to MA plans.⁴

CMS has historically sought to combat fraud, waste, and abuse relating to overpayments for inaccurate, or unsupported, “risk-adjusting” diagnosis codes, which could result in inflated payments made to MA plans, primarily through RADV auditing. CMS now estimates that MA plans overbill by $17 billion annually,⁵ a figure that the Medicare Payment Advisory Commission (“MedPAC”) estimated could actually be as high as $43 billion.⁶ MedPAC also estimated that, in 2024, payments to MA plans for MA beneficiaries would be $83 billion higher than if those beneficiaries had been enrolled in traditional fee-for-service Medicare.⁷

Scrutiny of risk adjustment data has resulted in multiple U.S. Department of Justice (“DOJ”) enforcement actions—and significant financial settlements—under the federal False Claims Act (“FCA”) against MA plans, vendors, and providers, based on arguments that these market players knowingly submitted unsupported diagnosis codes that resulted in inflated risk-adjustment scores and thus inflated MA payments.⁸

In response to these concerns, CMS has, in recent years, sought to reinvigorate its approach to RADV audits. In 2023, following more than a decade of discussion regarding extrapolation of RADV audit findings and subsequent legal challenges, CMS finalized a rule outlining an updated methodology for the RADV audit program and announced that, beginning with PY 2018, it would begin extrapolating RADV audit findings across the entire subject audit population for a given MA plan and PY under audit.⁹ This development introduced new risks for MA plans, as CMS historically had sought repayment only for overpayments identified in an audit sample, but may now seek to recoup across a much larger population for the audited year based on audit findings (regardless of the sample size). Adding to the uncertainty, CMS has not yet publicly clarified, nor has it expressed any intent to clarify, its extrapolation methodology. That said, to date, progress on the RADV audits has been slow, with CMS previously slated to begin issuing PY 2018 audit findings in 2026.¹⁰

III. Summary of Policy Changes and Implications

CMS’s most recent announcement featured four significant changes to the scope and pace of the RADV program:

1. Effective immediately, all eligible MA contracts will be audited annually. Currently, CMS audits approximately 60 plans a year. Those plans historically have been selected by CMS based on analysis identifying outliers or other indicia that certain plans were likely to have received overpayments. The Press Release reflects CMS’s intent to expand the RADV program scope to audit all eligible MA plans each year (currently a total of approximately 550 plans), signifying CMS’s view that the risks of fraud, waste, and abuse are endemic to the MA Program. MA plans, therefore, will need to prepare for audits every year, whereas plans previously might have gone years without being subjected to audits (if ever). Plans may want to prepare for increased administrative burden in providing rolling and updated claims data, and also increased risk of recoupments by CMS, as well as subsequent administrative or judicial challenges. Further, downstream providers with substantial MA patient panels that participate in risk-sharing agreements with MA plans (“at-risk providers”) may be exposed to claw-backs for overpayments from prior payment years, as well as a reduction in future income for payment years where a final plan reconciliation has not yet occurred, depending on the terms of their participating provider agreements (“PPAs”). As CMS’s aggressive new RADV audit work plan is implemented, MA plans are likely to become more aggressive in requiring providers to agree, through PPA amendments or changes in MA plan policies, to repayments for losses tied to errors in those providers’ medical records, to the extent identified by CMS and subject to extrapolation.
2. CMS intends to complete all PY 2018-PY 2024 audits by early 2026. This aggressive work plan marks a significant acceleration from the current timetable where, due to the complexity of RADV audits and consequent resources required, audits traditionally have endured for several years (e.g., as noted above, CMS previously intended to issue its PY 2018 findings in 2026). The updated timetable proposed by CMS suggests that MA plans can expect to receive RADV record requests for those years imminently, in some cases several years before requests otherwise might have been expected. Further, if CMS identifies and extrapolates overpayments for a given MA plan for those years, financial losses due to recoupment will be concentrated over a much shorter time period than they would have under the prior timetable.
3. Each audit will review additional records. To improve the reliability of its audit findings for extrapolation purposes, CMS plans to review as many as 200 records per MA plan each year, as opposed to the 35 records it currently reviews. While reviewing a larger sample size should improve the precision of and narrow the confidence interval associated with its audit findings, it will also substantially increase the burden on MA plans (and their provider networks) associated with collecting the necessary records to respond to RADV request.
4. CMS plans to invest in enhanced technology and expanded human resources. To facilitate its more aggressive and expansive RADV program, CMS intends to utilize “enhanced technology” systems to streamline review of medical records to identify unsupported diagnoses. While CMS has not detailed what technology it will use, given the ambitious scale of the RADV program, it is possible CMS will rely on artificial intelligence (“AI”) technology as part of this effort. Notably, the 2025 Federal Budget Reconciliation Bill currently under consideration in the U.S. Senate (after passage in the U.S. House) would require the U.S. Department of Health and Human Services to implement AI tools to facilitate the identification and reduction of improper payments under Medicare Parts A and B.¹¹ Such reliance could amplify existing uncertainty around CMS’s RADV methodology, as questions would likely emerge as to how CMS developed or trained such programs, which in turn could lead to MA plans mounting legal challenges to CMS’s methodology, especially if it is not disclosed in connection with RADV audits. CMS also intends to increase its medical coder team from 40 members to approximately 2,000 by September 1, 2025, though it has yet to offer details on how it intends to accomplish such a significant staff increase in such a limited timeframe. Additionally, CMS has not announced any corresponding increases in personnel necessary to coordinate with MA plans (e.g., personnel to enforce recoupment obligations or respond to administrative appeals or legal challenges).

IV. Practical Considerations

Much about the RADV program remains uncertain, including details as to how CMS will execute this significant expansion of the RADV program on the expedited timeline being proposed. Beyond the logistical challenges associated with hiring and deploying the necessary resources, CMS’s proposal could be further stymied by MA plans filing preemptive legal challenges or mounting other means of opposition.

If implemented, however, the changes enumerated above pose substantial financial and operational threats to MA plans and, indirectly, to providers and MA vendors. In the immediate term, plans should endeavor to minimize historical risk by correcting or deleting unsupported diagnoses for any time periods for which they are still able to do so. In the longer term, MA plans and at-risk providers should also take steps to solidify internal capacity for managing RADV audits. Steps plans should consider include:

• Expediting internal self-audits and at-risk provider audits, and/or making updates to corporate compliance programs on an ongoing basis;
• Proactively working with at-risk providers to address deficiencies identified through self-audits (e.g., missing signatures or similar documentation gaps) through appropriate amendments, to avoid needing to complete this (sometimes arduous) process under the time constraints posed by an RADV audit;
• Establishing clear timelines and workflows (with the potential support of software and third-party vendors) to facilitate the collection and preparation of medical records, which typically are required to be produced to an auditor within 25 weeks, and may be demanded more quickly under CMS’s accelerated program. Relatedly, MA plans and at-risk providers should ensure that applicable staff are familiar with CMS’s RADV documentation standards (e.g., submission forms, requirements for record amendments/supplements collected from providers); and
• Understanding the RADV appeal timelines and process to be able to timely respond to any negative audit findings.

Additionally, downstream at-risk providers should expect MA plans to become more aggressive in passing the risk of RADV recoupment onto providers. Providers should pay particular attention to indemnification and claw-back provisions, both in existing contracts and, especially, as they renegotiate contracts in future years. Where possible, providers should seek clarity and guardrails as to their potential exposure, require use of an independent actuary in any challenges to methodologies, and seek more protective arbitration rights in the event of a dispute.

In addition, all participants in the MA ecosystem that play a role in identifying and coding diagnoses should be mindful that more frequent and expansive RADV audits may increase the risk of FCA investigations and potential liability for MA Plans, providers, and vendors. FCA investigations in related industry segments regularly begin when CMS auditors and program integrity contractors alert prosecutors to potential fraud based on their findings. Given DOJ’s focus on combating fraud in the MA program, it is likely such DOJ referrals in the MA space will substantially increase with the expansion of the RADV audit program.

Ropes & Gray will continue to monitor developments in the RADV program. Should you have any questions, please do not hesitate to contact one of the authors or your regular Ropes & Gray advisor.