Risk adjustment is a system that changes how much a health insurance plan gets paid based on how sick or healthy its members are. Plans covering sicker people receive more money, while plans covering healthier people receive less. The goal is straightforward: prevent insurers from profiting simply by enrolling healthy people and punishing those that take on patients with serious medical needs.
The system works differently depending on the market. Medicare Advantage, the Affordable Care Act marketplace, and Medicaid all use their own versions. But the core logic is the same: measure each person’s expected health costs, assign a score, and adjust payments accordingly.
How a Risk Score Gets Built
Every person enrolled in a risk-adjusted plan receives a numerical risk score. That score starts with basic demographics: age, sex, whether the person qualifies for both Medicare and Medicaid, and disability status. These factors alone create a baseline prediction of what someone’s healthcare will cost in the coming year.
Then diagnoses get layered on. When you visit a doctor and receive a diagnosis, that condition is translated into a standardized code (called an ICD-10 code). Certain diagnoses, particularly chronic and serious ones like diabetes, heart failure, chronic kidney disease, and HIV, map to what are called Hierarchical Condition Categories, or HCCs. Each HCC carries a weight reflecting how much it typically adds to a person’s healthcare costs. The “hierarchical” part means that when multiple related conditions exist, only the most severe one in a given category counts, preventing double-counting.
The model is prospective. It uses your diagnoses from the prior year to predict your costs for the coming year. So a diabetes diagnosis documented in 2024 influences the payment your plan receives for covering you in 2025.
What a Score of 1.0 Means
CMS sets the average risk score for traditional Medicare beneficiaries at 1.0. This serves as the benchmark. A person with a risk score of 1.2 is expected to cost about 20% more than average, while someone at 0.8 is expected to cost about 20% less. The score doesn’t set a fixed dollar amount on its own. Instead, the plan submits a bid projecting its average revenue needs, and the risk score adjusts that amount up or down based on each enrollee’s health status.
Certain populations consistently score higher. People who qualify for both Medicare and Medicaid, along with those in special needs plans, have predicted risk scores 45 to 55 percent higher than non-dually eligible individuals, reflecting their greater medical complexity.
The Zero-Sum Transfer in ACA Markets
In the individual and small group insurance markets created by the Affordable Care Act, risk adjustment works as a direct transfer between insurers. The system is budget neutral: every dollar one plan receives comes from another plan. Plans that enroll people with higher-than-average health risk get a payment. Plans with healthier-than-average members pay into the pool.
The transfer formula measures the gap between what a plan would need to charge given the health of its members and what it’s allowed to charge under standard rating rules. If that gap is positive (meaning the plan attracted sicker members and can’t fully cover their costs through premiums alone), it receives a transfer payment. If the gap is negative, the plan owes money. Across the entire market, these transfers sum to zero.
Consider a simplified example from the CMS transfer formula documentation: Plan 1, which covers a sicker population, might receive a $116.67 transfer payment, while Plan 2, with healthier enrollees, pays that same $116.67. The system doesn’t reward or penalize plans for their efficiency or negotiating power. It specifically targets differences in the health risk of their members.
The ACA model uses its own set of HCCs calibrated for a younger population (ages 0 to 64), since the Medicare model was designed for people 65 and older with different disease patterns and cost profiles.
Why Documentation Matters So Much
A condition only counts toward a risk score if it’s properly documented in the medical record and coded during a face-to-face visit. The diagnosis must appear in the provider’s notes, be supported by evidence that the condition was evaluated or managed during that encounter, and be recorded by an eligible provider type at an acceptable service location. A condition that exists but never gets documented simply doesn’t factor into the score.
This creates a significant incentive gap. In traditional Medicare, physicians are generally not compensated for how thoroughly they record diagnoses. A doctor treating someone for back pain may not bother re-documenting that patient’s stable diabetes or well-controlled hypertension during that visit. The condition is real, but it vanishes from the coding record for that year.
Medicare Advantage plans, by contrast, receive higher payments when their enrollees have higher risk scores. This gives them strong motivation to ensure every condition is captured. MA plans use chart reviews, health risk assessments (often conducted during annual wellness visits or home visits), and provider incentive programs to close documentation gaps. This isn’t necessarily fraudulent coding. In many cases, these are real conditions that traditional Medicare simply undercounts. But the difference in coding intensity between MA and traditional Medicare has become one of the most debated issues in health policy.
Retrospective vs. Prospective Chart Reviews
Health plans use two main strategies to find diagnoses that were missed during routine visits. Retrospective reviews go back through existing medical records to find conditions that were documented but never coded for risk adjustment. These reviews follow strict rules: the diagnosis must appear in an eligible encounter, be written by the provider (not inferred by the coder), and include evidence the condition was addressed. A retrospective review can generate a reportable diagnosis without any additional provider involvement, which makes it popular with insurers.
Prospective reviews take a different approach. Instead of looking for fully documented diagnoses, coders search for “clinical indicators,” clues scattered across lab results, medication lists, or clinical notes that suggest an undiagnosed or undocumented condition. These clues can’t be reported directly. Instead, they get flagged for a clinician to evaluate during a future face-to-face visit, often an annual wellness exam or home health assessment. If the clinician confirms the condition, it can then be coded and reported through normal channels.
How CMS Audits the System
The Risk Adjustment Data Validation program, or RADV, is how CMS checks whether the diagnoses plans submit are actually supported by medical records. During an audit, CMS pulls a sample of enrollees from a Medicare Advantage contract and requests their medical records. Reviewers then verify whether the documented diagnoses match what the plan reported for risk adjustment purposes.
If diagnoses can’t be supported by what’s in the medical record, CMS can collect overpayments from the plan. These audits happen after the final risk adjustment data submission deadline for a given contract year, so they function as an after-the-fact accountability mechanism rather than a real-time check.
The Shift to Model Version 28
In 2024, CMS began transitioning Medicare Advantage payments from version 24 of the HCC model to version 28. The update made two notable changes in opposite directions: it significantly reduced the number of diagnosis codes that map to an HCC (meaning fewer conditions influence risk scores) while increasing the number of HCC categories that CMS uses to calculate payments. The net effect was designed to pay more accurately for the sickest patients while trimming payments linked to less costly conditions.
CMS projected that the transition to version 28 would save over $7.6 billion in MA payments for 2024 alone. The HHS Office of Inspector General is now analyzing whether those projected savings materialized, or whether plans adjusted their coding practices to compensate. That tension between model refinement and coding response has defined risk adjustment policy for more than a decade, and it’s unlikely to resolve anytime soon.