Quick Answer: Defensible RAF scores are risk adjustment factor scores where every submitted diagnosis is encounter-linked, backed by MEAT documentation, and traceable from chart to claim. They survive a RADV audit because accuracy is proven, not just asserted. In 2026, with CMS auditing all eligible Medicare Advantage contracts and the DOJ settling add-only coding cases for millions, defensibility is the difference between keeping legitimate revenue and facing repayment demands. The fix is two-way coding: add missed codes and remove unsupported ones. RAAPID’s Clinical AI Platform builds that evidence trail for every diagnosis.
The Real Problem Is Proof, Not Capture
Medicare Advantage health plans are sitting on legitimate revenue they can’t confidently submit. The problem isn’t finding more codes. It’s proving the ones already identified. Building defensible RAF scores, where each diagnosis carries clinical evidence and a clear documentation trail, is now the foundation of sustainable risk adjustment.
The pressure is real and current. The Centers for Medicare and Medicaid Services (CMS) is auditing all eligible Medicare Advantage contracts annually [1]. The Department of Justice secured a $556 million settlement against Kaiser over invalid diagnosis codes in January 2026 [2]. Two months later, the DOJ settled with Aetna for $11.77 million, largely because Aetna ran an add-only chart review program that submitted codes but never deleted the unsupported ones its own reviewers had flagged [3]. Risk adjustment has changed for good. Organizations that treat RAF scores as a revenue exercise now carry compliance risk they can’t afford. Those that build defensible RAF scores grounded in clinical evidence are set up for sustainable growth.
Key Takeaways
- Defensible RAF scores rest on clinical documentation and evidence validation, not coding volume.
- Every diagnosis must answer three questions: where is it documented, does it meet MEAT criteria, and can you trace it from encounter to claim.
- Two-way coding (adding missed codes and removing unsupported ones) is the clearest signal to regulators that a program codes for accuracy, not revenue.
- The DOJ’s $11.77 million Aetna settlement was driven by an add-only program that ignored its own evidence of unsupported codes [3].
- CMS audits all eligible MA contracts annually, and the September 2025 court ruling paused extrapolation but did not remove audit risk [4][5].
- RAAPID’s Neuro-Symbolic AI links every suggested code to MEAT-based evidence, cutting chart review to 8 to 12 minutes at 92% out-of-box accuracy and 98%+ after human QA.*
Industry First RADV Audit Solution
AI-powered solution enables health plans to efficiently manage and streamline RADV audits
What Are Defensible RAF Scores?
A defensible RAF score is a risk adjustment factor score where every submitted diagnosis is encounter-linked, supported by MEAT clinical evidence, and traceable from the medical records to the claim. A RAF score predicts the expected cost of a Medicare Advantage enrollee, based on that member’s documented health status. A score of 1.0 represents the average Medicare beneficiary; above 1.0 signals higher expected costs and higher reimbursement [4].
Most healthcare organizations treat RAF scores as an output of coding, separate from the documentation behind them. That’s the wrong frame. Defensible RAF scores are the output of clinical documentation, evidence validation, and process integrity.
A defensible score answers three questions CMS demands proof of. Where in the medical records is this condition documented? Does it meet MEAT criteria, meaning the provider is Monitoring, Evaluating, Assessing, or Treating the condition? Can you trace the chain from patient encounter to submitted claim?
Coding accuracy tells you a code is correct. Defensibility proves why. That distinction separates surviving a RADV audit from facing repayment demands.
Why Defensibility Matters More in 2026
Four forces have raised the cost of weak documentation this year: broader audits, a court ruling that paused penalties but not scrutiny, sharper focus on coding intensity, and a tougher V28 model.
CMS Is Auditing Every Eligible Plan
In May 2025, the Centers for Medicare and Medicaid Services announced an accelerated audit strategy, expanding from roughly 60 contracts per cycle to all eligible Medicare Advantage plans annually [1]. The January 2026 memo confirmed Payment Year 2020 audits are underway, with new audits starting quarterly and sample sizes up to 200 enrollee records [5]. Medicare Advantage organizations now face scrutiny on every contract they hold.
The Court Ruling Didn’t Remove the Risk
A September 2025 federal court vacated the RADV rule that would have let CMS extrapolate error rates across entire contract populations [6]. Extrapolation enforcement is paused, not gone. CMS still collects overpayments on sampled records, the ruling may be appealed, and CMS has called RADV a top priority [5]. Treat this as a preparation window, not an all-clear.
Coding Intensity Is Under the Microscope
MedPAC’s March 2025 report estimates that favorable selection and coding intensity together generate about $84 billion in excess Medicare Advantage payments, with coding intensity alone accounting for roughly $40 billion [7]. The FY2025 Part C improper payment rate was 6.09%, or $23.67 billion, with most of it tied to documentation that failed to substantiate diagnosis data [8]. One OIG audit of a Medicare Advantage organization found that 247 of 271 sampled enrollee-years (a 91% error rate) had unsupported high-risk diagnosis codes, because the medical records did not support the submitted HCC codes [9]. Acute stroke and acute heart attack showed 100% error rates. The common pattern: history-of conditions coded as active diagnoses.
V28 Raises the Documentation Bar
Payment Year 2026 marks the full implementation of the CMS-HCC V28 model [10]. V28 removes more than 2,000 diagnosis codes that previously mapped to hierarchical condition categories, expands categories from 86 to 115, and recalibrates weights for chronic conditions, including diabetes and its complications [11]. The bar for the specificity and evidence behind risk scores is now higher across the board.
Transform your coding practice into defensible RAF growth with Novel Clinical AI
Five Principles of Defensible Coding
Defensible RAF scores come from a repeatable discipline, not a one-time cleanup. These five principles hold every diagnosis to the same standard CMS and OIG apply in an audit.
- Link every diagnosis to a patient encounter. CMS requires that codes reflect conditions documented during a face-to-face encounter within the payment year [12]. Diagnoses pulled from chart reviews or health risk assessments without a matching provider visit are the highest-risk category in any audit.
- Meet MEAT documentation standards. Each diagnosis needs evidence that a provider is Monitoring, Evaluating, Assessing, or Treating the condition. A chronic disease listed in the problem list with no clinical context doesn’t meet the bar.
- Revalidate chronic conditions annually. CMS resets risk scores every year. Heart failure, COPD, major depressive disorder, and diabetes with complications must be re-documented during qualifying encounters. Without current-year documentation, the revenue is indefensible.
- Justify severity. Under V28, severity coding matters more than ever. Diabetes without complications no longer maps to an HCC, while diabetes with chronic complications carries real weight. Many chronic conditions now hinge on that level of detail, so clinicians must document specific severity and supporting evidence in each note.
- Maintain data integrity. Defensibility needs organized, retrievable medical records with traceable logic: which coder reviewed the chart, what evidence supported the code, and when the evaluation was completed. Plans that can’t tie their documented diagnoses back to that trail carry unquantified liability.
Two-Way Coding Is the Defensibility Test
Two-way coding means a retrospective program both adds missed diagnoses and removes unsupported ones, which is the clearest proof to regulators that the program codes for accuracy rather than revenue. Most retrospective chart reviews only find missed codes. This add-only approach is exactly what regulators now treat as a red flag.
The Aetna settlement makes the stakes concrete. In March 2026, the DOJ resolved allegations that Aetna’s add-only chart review program submitted additional diagnosis codes to CMS but failed to delete or withdraw unsupported codes the same reviews had identified [3]. The settlement totaled $11.77 million, and the case was brought by a former Aetna risk adjustment coding auditor. The lesson is direct: a program that only ever adds, and never deletes, reads as intent to inflate payments, even when individual codes look accurate.
Defensible programs run both directions. They capture missed diagnoses and remove diagnoses that lack encounter linkage or current-year documentation, and they track the add-to-delete ratio as a core metric. This is the heart of two-way retrospective risk adjustment, and it’s the single fastest way to lower audit exposure.
| Add-only coding | Two-way coding |
| Finds missed codes only | Finds missed codes and removes unsupported ones |
| Optimizes for higher RAF scores | Optimizes for defensible RAF scores |
| No record of deletions | Tracks add-to-delete ratio |
| Reads as revenue intent to regulators | Reads as accuracy intent to regulators |
| Cited in DOJ settlements [3] | Built for audit survival |
The second layer is prospective support. The safest diagnosis is one confirmed during a live encounter. Prospective programs give clinicians pre-visit summaries and decision support at the point of care. This concurrent coding produces encounter-linked documentation by default, and it ties risk capture back to real patient care.
RAF Score Basics: Normal Ranges and Calculation
RAF scoring is how CMS assigns a risk adjustment factor to each enrollee, and how those RAF scores turn documented health status into payment. Understanding the math behind RAF scores makes their defensibility easier to manage.
What Counts as a Normal RAF Score
A score of 1.0 represents the baseline Medicare beneficiary [4]. Below 1.0 suggests a healthier population; above 1.0 signals higher expected costs. There’s no universal “normal,” because the correct score depends on each patient’s actual disease burden. What matters is whether the score reflects documented clinical complexity.
For context, the 2025 base rate is about $10,402 per member per year [13]. Every 0.1 increase translates to roughly $1,040 in additional annual reimbursement. For a plan with 100,000 members, even a 0.05 improvement across the population represents more than $5 million a year. That single data point is exactly why RAF score accuracy carries such weight: the goal is documentation that reflects real complexity, not RAF improvement for its own sake.
How RAF Scores Are Calculated
CMS maps ICD-10 codes to hierarchical condition categories (HCCs), assigns coefficient weights to those HCC codes, and combines them with demographic factors to produce the capitated payment for health plans and provider groups [12]. The raw model output is the risk score. The RAF is the final adjusted figure after CMS applies the normalization factor and the Medicare Advantage coding intensity adjustment [14]. In practice, both terms describe the RAF scores that drive per-member reimbursement. Accurate RAF scores depend on accurate documentation behind each code, not the volume of codes.
How Coding Intensity Becomes Compliance Risk
Coding intensity is the pattern where Medicare Advantage organizations document more HCC codes for the same population than traditional Medicare would [7]. The V28 model was built to reduce the impact of discretionary coding on risk scores [11]. CMS applies a uniform adjustment across all plans, which means organizations with clinically accurate coding are penalized alongside those whose inaccurate coding games the system [7].
The shift from coding intensity to coding integrity isn’t optional. The DOJ’s Kaiser and Aetna settlements, OIG’s ongoing audits, and CMS’s accelerated RADV schedule all point one way: more codes without proportional evidence means more fraud exposure on the balance sheet.
How Neuro-Symbolic AI Supports Defensible RAF Scores
Traditional natural language processing (NLP) systems find codes by scanning clinical notes for diagnosis language. What they don’t do is prove why a code is valid.
Neuro-Symbolic AI combines neural network pattern recognition with a symbolic reasoning layer built on medical rules, ICD-10-CM guidelines, and MEAT logic. Every recommendation comes with a transparent evidence trail: the specific text in the note, the MEAT elements present, and the reasoning chain that links documentation to the suggested code.
For health plans and provider groups, this changes the economics of building defensible RAF scores. Chart reviews that once took 40-plus minutes can be processed in 8 to 12 minutes, at 92% out-of-box coding accuracy and over 98% coding accuracy after human-in-the-loop QA.* The same engine flags unsupported diagnoses for removal and runs audit simulations to surface issues before submission. AI tools like this improve RAF score accuracy without pushing coders toward unsupported codes: it’s two-way coding built into the workflow, not bolted on after the fact.
RAAPID internal benchmark.
Building Your Defensible RAF Strategy
A defensible risk adjustment program is operational discipline as much as clinical judgment. These five moves turn the principles above into daily practice and keep RAF scores defensible at scale.
- Centralize operations. Replace fragmented spreadsheets and siloed EHR systems with real-time, analytics-driven visibility into coding status, documentation quality, and audit readiness.
- Run two-way retrospective review. Capture missed codes and remove unsupported ones. Track the add-to-delete ratio as a key metric.
- Invest in provider education. Strong provider education helps clinicians produce complete documentation during encounters, including severity, chronic complications, and social determinants of health.
- Validate before submission. Run mock audits using CMS logic. Flag weak charts, remediate documentation gaps, and confirm every code has defensible support.
- Align stakeholders. Connect compliance, finance, operations, and IT around shared dashboards, advanced analytics, and metrics.
What Comes Next
Risk adjustment has moved from a revenue function to a clinical, compliance, and enterprise AI discipline. Health plans that build defensible RAF scores on encounter-linked documentation and transparent validation will earn appropriate reimbursement for every dollar they’re legitimately owed. Defensible RAF scores are the foundation of sustainable, value-based care. The revenue isn’t missing. It’s waiting for healthcare organizations with the confidence to claim it.
Ready to see defensible RAF scoring in your own charts? Book a RAAPID demo and watch the evidence trail build itself.
Frequently Asked Questions
A defensible RAF score means every submitted diagnosis has traceable clinical evidence linking it to a patient encounter, meets MEAT standards, and can withstand CMS or OIG review. It goes beyond accuracy to include clinical reasoning and a documented, repeatable process.
Two main techniques. Two-way retrospective review adds missed codes while removing unsupported ones. Prospective point-of-care support helps clinicians capture complete, encounter-linked documentation during the visit itself.
Add-only programs that submit codes but never remove unsupported ones now read as intent to inflate payments. The DOJ’s $11.77 million Aetna settlement targeted exactly this pattern [3]. Two-way coding shows regulators a program codes for accuracy.
A score of 1.0 is the baseline for the average Medicare beneficiary [4]. The correct score depends on each patient’s disease burden, so there’s no universal normal. What matters is whether the score reflects documented clinical complexity.
They’re related but not identical. The risk score is the raw CMS-HCC model output. The RAF is the final figure after CMS applies normalization and the coding intensity adjustment. In practice, both drive per-member reimbursement.
Heart failure maps to a dedicated Heart Failure HCC under V28 with meaningful RAF weight. The exact coefficient depends on the clinical setting and on interaction terms when heart failure co-occurs with conditions like diabetes or kidney disease. Severity documentation is essential.
V28 removes more than 2,000 previously mapped codes, expands categories from 86 to 115, recalibrates condition weights, and requires greater clinical specificity [11]. Medicare Advantage plans must update documentation and coding practices to keep scores defensible.
Sources
[1] Ropes & Gray LLP, “CMS Announces Significant Changes to RADV Auditing Efforts,” May 2025
[4] American Academy of Family Physicians, “It’s Time to Go RAFing,” Family Practice Management, 2018
[5] CMS, Risk Adjustment Data Validation (RADV) program, January 2026 HPMS memo
[6] CMS, Risk Adjustment Data Validation (RADV) litigation status, September 2025 court ruling
[7] MedPAC, March 2025 Report to the Congress on Medicare Payment Policy
[8] CMS, “Fiscal Year 2025 Improper Payments,” Improper Payment Measurement Programs, January 2026
[9] HHS OIG, Medicare Advantage high-risk diagnosis code audit, Report A-07-22-01207, March 2026
[10] CMS, “Advance Notice of Methodological Changes for CY 2026 MA Capitation Rates,” January 2025
[11] HHS OIG, “Trends, Patterns, and Key Comparisons: CMS-HCC Risk Adjustment V24 and V28,” January 2026
[12] CMS, Medicare Managed Care Manual, Chapter 7: Risk Adjustment
[13] CMS, “2025 Medicare Advantage and Part D Rate Announcement”
[14] Health Affairs Scholar, “Coding Intensity Variation in Medicare Advantage,” January 2025
Wynda Clayton, MS, RHIT, CRC
Director of Risk Adjustment Coding & Compliance, RAAPID
Wynda Clayton, MS, RHIT, CRC, is Director of Risk Adjustment Coding & Compliance at RAAPID and a former CMS RADV auditor. She writes on defensible coding, RADV audit readiness, and compliance-first risk adjustment.
