Get a Medical Records Request from Datavant?

What You Need to Know About HHS-RADV Audits

Bottom Line: If you receive a records request from Datavant as part of an HHS-RADV audit, don’t panic! These audits historically have been a review of the Medicare Advantage plan, making sure they are following all requirements, rather than an examination of the provider.

This week, the MAC office has received a number of calls regarding medical record requests from Datavant for Medicare Plus Blue patients. Datavant, formerly CIOX Health, conducts audits under the Health and Human Services-Risk Adjustment Data Validation (HHS-RADV) program. Below are answers to Frequently Asked Questions regarding this program.

What is the HHS-RADV Program?

HHS-RADV is the Centers for Medicare and Medicaid Services’ (CMS) primary way to address overpayments to Medicare Advantage Organizations (MAOs). These audits are done to ensure that diagnosis codes submitted by Medicare Advantage Organizations (MAOs) are supported by medical record documentation and to recover improper risk-adjustment payments.

How Are a Medicare Advantage Plan’s Risk-Adjusted Payments Determined?

Medicare Advantage plans receive risk-adjusted payments based on the diagnoses they submit for enrollees. Plans receive higher payments for patients with more serious or chronic conditions. To verify the accuracy of these claims, CMS conducts Risk Adjustment Data Validation (RADV) audits to confirm that diagnoses used for payment are supported by medical records and then recover improper payments.

Are These Overpayments a Serious Problem?

According to CMS, estimates suggest that Medicare Advantage plans may overbill the federal government by approximately $17 billion each year. The Medicare Payment Advisory Commission (MedPAC) estimates this figure could be as high as $43 billion per year.

How Often Do These Audits Occur?

CMS requires all insurers participating in the HHS-RADV program to perform an annual HHS-RADV audit of a random sample of members enrolled in a participating individual or small group plan.

How Will I Know If One of My Patients Is Chosen as Part of an HHS-RADV Audit?

Datavant will send a notification letter to the provider’s office. This letter includes the name of the selected patient, submission instructions, deadlines, and more.

We’re working with Datavant for medical record retrieval. Datavant will begin mailing notification letters to provider offices in June 2026. Letters will include the name of the selected member, submission instructions and deadlines.

What Should I Do If I Receive a Record Request?

If you receive a records request as part of an HHS-RADV audit, you are required to provide medical records to validate diagnosis codes. Be sure to pull the records for the requested time frame and submit them prior to the deadline provided in the initial notification letter. If needed, contact Datavant and ask for a deadline extension.

Information you may be asked to submit include diagnostic reports, history and physical exam, progress notes from office visits, discharge summary, and more.

What Exactly Are They Looking For?

Historically, medical records requests as part of an HHS-RADV audit have been more of an examination of the MAO, making sure they are following all requirements, rather than an examination of the provider. If the MAO does not perform well, they could face significant repayment penalties.

During an RADV audit, CMS confirms that any diagnoses submitted by an MAO are clinically supported in the enrollees’ medical records. If diagnoses are not supported by the medical records, CMS may collect overpayments from the MAO.

In our experience, these audits are not to review the care provided by the health care practitioner. They do not review any of the core factors insurers usually use when performing an audit, such as determining medical necessity, coding accuracy, documentation quality, data analytics, etc. And, their goal is to recoup improper payments from the insurer, not from the provider.

A Note of Caution: While it has been our experience that these audits are not aimed at recoupling funds from providers, it is possible that if, after review, medical necessity is not demonstrated in the provider’s documentation, the MAO could conduct a wider audit in an attempt to claw back any overpayments from the provider to mitigate their own financial exposure.

What If You Discover Your Records Were Never Signed?

Clinical notes should be completed, electronically signed, and locked in the EHR as soon as possible after the date of service, ideally within 24–48 hours. While there is no universal Medicare requirement that all notes be signed within a specific number of days, timely completion is an important compliance practice.

Once a note is finalized, it cannot be altered or overwritten. If additional information or corrections are necessary, a separately dated and authenticated addendum should be created, preserving the original documentation.

Missing Signatures: If you discover that a record was never signed, do not backdate the signature or make it appear that the note was authenticated on the original date of service. CMS permits the use of a signature attestation statement in certain circumstances to authenticate an otherwise unsigned medical record.

The WPS form can serve as a template for the provider to attest that they authored the original documentation. An attestation should be completed and signed with the current date. It authenticates the original record; it does not permit the provider to retroactively create or change clinical documentation. Acceptance remains subject to the reviewing payer’s requirements.

Sources / More Information