HCC Coding Explained: Risk Scores, Audits and Documentation

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

HCC coding is the reporting of each patient's diagnoses so a risk adjustment model can group them into condition categories and produce a risk score. In Medicare Advantage, CMS pays plans using those scores. For a practice, the work is documentation: a diagnosis only counts if the record supports it.

HCC stands for hierarchical condition category. In a medical setting the same three letters can also mean hepatocellular carcinoma, a liver cancer. This guide is about the billing meaning only: the disease groups CMS uses for risk adjustment.

It replaces four older posts on this site that overlapped and used outdated category numbers. It covers the basics, the 2026 model change, what auditors review, the diabetes question, and how to build a review process. It is written for practice owners and billing managers, not for coders learning the model software.

What HCC coding means in practice

HCC coding means reporting diagnoses accurately enough that a risk adjustment model can use them. CMS describes the Medicare Advantage model’s disease groups as HCCs, and it turns the groups into a risk score for each enrollee. The score is often called a RAF, short for risk adjustment factor. Plans are paid on these scores, so a chronic condition that is real but missing from the record can leave the score too low.

Most practices do not receive the risk-adjusted payment directly. In Medicare Advantage, CMS pays the plan; whether the practice shares in it depends on its contract with the plan. Practices are still pulled in, because the diagnoses in the plan’s data come from provider encounters. For the wider payment context, see our explainer on fee-for-service versus value-based care.

Where HCC models are used

The CMS-HCC model is not the only one. The table shows three programs that use diagnosis-based risk adjustment. The details below come from CMS’s 2026 Medicare Advantage rate announcement fact sheet and its 2024 benefit year risk adjustment summary report.

Source: CMS, CY 2026 Medicare Advantage and Part D Rate Announcement fact sheet (2025); CMS CCIIO, Summary Report on Individual and Small Group Market Risk Adjustment Transfers for the 2024 Benefit Year (2025).

What changed for payment year 2026

For calendar year 2026, CMS is using the 2024 CMS-HCC model for all risk scores, ending a three-year phase-in. The fact sheet names this model the “2024 CMS-HCC risk adjustment model”; many coding vendors call it V28. CMS reports the combined effect of the model update and normalization on payment as -3.01% in its 2026 fact sheet, and separately expects underlying coding trend to raise risk scores by 2.10% on average.

For a practice the lesson is practical. Do not rely on a reference sheet from two or three years ago. If your coders, EHR prompts or training slides still show older category numbers, update them before the next review cycle.

Two limits apply to this section. CMS also keeps separate Part D models, which this guide does not cover. And the fact sheet describes payment to plans, not what any single practice will earn.

What auditors check in the record

CMS’s risk adjustment data validation (RADV) reviews check whether the record supports the diagnoses a plan submitted. CMS’s Medical Record Reviewer Guidance sets out the minimum requirements, and a record that misses one can be marked discrepant. The version we reviewed is version 2.0, effective January 10, 2020, and its examples use older payment years, so confirm the current edition with the plan.

Source: CMS, Contract-Level RADV Medical Record Reviewer Guidance, v2.0 (effective Jan. 10, 2020).

The same guidance says physician group partners may not sign for each other unless both saw the patient. That matters in busy group practices where a colleague closes charts. It also says authors of entries must be clearly identified, so shared logins and unattributed templates create risk.

Accurate coding is not the same as more coding

Accuracy means every reported condition is supported by that year’s documentation. OIG audits show what happens when it is not. In a September 2026 audit of one Medicare Advantage contract, the plan’s medical records did not support the diagnosis codes for 172 of 230 sampled enrollee-years, according to OIG report A-07-24-01215. The audit looked at specific high-risk diagnosis codes, not all codes, and the plan disputed some findings.

That finding was against a plan, not a practice. But the plan’s data came from provider records, and plans audit their own providers in response. An unsupported diagnosis can mean a recoupment request, a compliance conversation, or a harder contract renewal.

Older posts here quoted uplift figures such as “20-30%” and a “$500,000” case study. We removed them because no primary source supports them, and because they frame coding as revenue extraction. Our medical billing compliance guide covers the broader rules.

Example: why diabetes documentation matters

Diabetes is the example practices ask about most, and it shows the pattern. The diagnosis only carries its full meaning when the record states the type and any complication that the clinician has actually evaluated. A note that says only “diabetes” supports less than a note that names the type and a linked complication.

Three habits help. State the diabetes type and any complication in the assessment, not only in the problem list. Record the clinician’s link between the condition and the complication, since a code that assumes the link without it may not be supported. Report the condition at least in each year it is managed. The diabetes ICD-10-CM codes guide lists the code families; the principle of specificity applies to every chronic condition.

Which diabetes category a code maps to, and how the categories rank, depends on the model version. Older articles list HCC 17, 18 and 19. We could not verify those against the current model, so we do not repeat them. Use the current CMS mapping or your coding software’s current-year table.

When to review: before, during or after the claim

Review is cheapest when it is closest to the visit. A prospective review prepares the chart before the appointment, a concurrent review checks the note before the claim goes out, and a retrospective review looks back after submission.

Most practices do best by combining the first two, with a retrospective sample for learning. A late addendum should follow your compliance policy and payer rules; it is not a general fix for a missing diagnosis.

Sources for a review typically include the visit note, medication lists, hospital and specialist records the practice has received, and any supplemental data a plan sends. Treat plan-supplied suspect lists as prompts to check, not as diagnoses. For the audit side, see coding audits: types and benefits.

Documentation habits that hold up

Strong risk adjustment documentation is ordinary good charting done consistently. The goal is a record that a reviewer who never met the patient can follow.

• Document each chronic condition the clinician manages at the visit, with the status and plan in the assessment.
• Keep the problem list clean: remove duplicates and resolved conditions so stale entries do not drive coding.
• Make sure every note has a visible date of service, provider name, credentials and a valid signature.
• Avoid carrying a diagnosis forward by copy and paste. Each note should reflect that visit.
• Use EHR prompts as reminders, never as a reason to add a diagnosis the clinician did not assess.

Many coding teams use the mnemonic MEAT (monitor, evaluate, assess, treat) as a checklist for whether a note supports a condition. It is an industry convention, not a CMS term in the reviewer guidance we reviewed, so use it as an internal prompt rather than a rule. Clinician education works better when it shows what a thin note and a supported note look like side by side.

This work sits between coding and the front office. A practice management system can help with the mechanical parts: a practice management system that tracks claims by stage can check that required fields are complete before submission, assign each held claim an owner, and keep an audit log of who changed what. It does not decide whether a diagnosis is clinically supported; that stays with the clinician and coder.

If you outsource coding, what to ask

Outsourced coding can add capacity, but accountability for the record stays with the practice. Ask any vendor how it works before you hand over charts. Medical billing and coding support should be clear about scope, who reviews, and how problems are reported back.

• Which coders handle risk adjustment, what credentials do they hold, and how is their work audited?
• Does the vendor code only from signed, supported notes, and how does it handle a missing signature?
• How are query questions sent to clinicians, and can the vendor show that queries are non-leading?
• Will the vendor sign a Business Associate Agreement before seeing patient data?
• What reports will you get on documentation gaps, not only on coded volume?
• How are findings from plan audits fed back into coder training?

For the whole billing workflow, end-to-end revenue cycle management puts coding, claims and follow-up in one process, so a coding fix reaches the front end. For clinical settings where this matters most, such as internal medicine billing and coding, patient panels carry many chronic conditions, so the documentation gap is wider.

Our recommendations

1. Retire old HCC cheat sheets. Replace any chart, template or training deck that shows category numbers with the current-year mapping. For 2026 CMS uses the 2024 model for all risk scores.
2. Check five basics on every note. Right patient, acceptable provider, dated visit, valid signature with credentials, and an assessed diagnosis. These come straight from the CMS reviewer guidance.
3. Assess chronic conditions in the visit note. Make sure the clinician’s assessment states status and plan, not only the problem list. Support belongs in the note for that visit.
4. Review before the claim. Add a short pre-claim review for risk-adjusted patients. A retrospective sample is useful for training, but it is a late place to find a gap.
5. Treat plan suspect lists as prompts. A list from a plan tells you what to check, not what to code. If the clinician did not assess it at a visit, it does not belong on the claim.
6. Write down who may sign and who may not. Ban stamped signatures and signing for a colleague who did not see the patient. Put the rule in your compliance policy.
7. Audit a small sample each quarter. Pull a handful of charts per provider and score them against the five basics. Share results with clinicians in plain terms.

Bottom line

Bottom line: HCC coding turns documented diagnoses into risk scores that CMS uses to pay Medicare Advantage plans, and auditors test whether the record supports each one. Keep your reference tables current, check the basics on every note, and review before the claim. If you want help tracing where support is lost in your billing process, see our end-to-end revenue cycle management service or talk to the team.

Frequently asked questions

What does HCC stand for in medical coding?

HCC stands for hierarchical condition category. CMS refers to the Medicare Advantage model’s disease groups as HCCs. Outside billing, the same letters can mean hepatocellular carcinoma, so context matters. In revenue cycle work it almost always refers to risk adjustment, the method CMS uses to adjust payment for how sick a plan’s members are expected to be.

What is a RAF score?

RAF means risk adjustment factor, the risk score a model produces for an enrollee. CMS uses these scores in Medicare Advantage payment. A practice does not set the score, but the diagnoses documented at its visits feed the plan’s data, which is why documentation quality matters. Ask your plan how it shares risk-adjustment data with practices, since arrangements vary by contract.

Do HCC category numbers stay the same each year?

No. CMS updates the model, and for 2026 it uses the 2024 CMS-HCC model for 100% of risk scores. Category numbers and groupings differ between versions, so do not rely on older lists. Check the current-year mapping from CMS or your coding software before training staff.

What do auditors look for in a record?

CMS’s RADV reviewer guidance lists minimum requirements: the right beneficiary, an acceptable provider type with a face-to-face encounter, a date of service in the review period, and a valid signature with credentials. The diagnosis must also be clearly documented in the record.

Is MEAT required by CMS?

MEAT, meaning monitor, evaluate, assess and treat, is a common coding checklist. It was not found in the CMS reviewer guidance we reviewed, so treat it as an internal convention, not a CMS rule. The practical test is whether a reviewer can see the clinician addressed the condition at that visit, with the date, provider and signature intact.

How does diabetes affect HCC coding?

Diabetes is a chronic condition where specificity matters: the type and any complication the clinician evaluated should be stated in the note. Which category it maps to depends on the model version, so confirm against the current CMS mapping. Our diabetes ICD-10-CM guide lists the code families, and your coding software or a certified coder can confirm the current mapping for the payment year.

Sources

1. Contract-Level RADV Medical Record Reviewer Guidance (v2.0, effective 01/10/2020) — CMS (2020)
2. CY 2026 Medicare Advantage and Part D Rate Announcement fact sheet — CMS (2025)
3. Summary Report on Individual and Small Group Market Risk Adjustment Transfers, 2024 Benefit Year — CMS CCIIO (2025)
4. OIG report A-07-24-01215 highlights — HHS Office of Inspector General (2026)