How to answer a Medicare Advantage chart review or RADV request

A Medicare Advantage chart review or RADV request asks the practice for legibly signed records from face-to-face visits in the sampled year, sent by the date in the plan's letter. CMS's 2024 audit covers 2023 dates of service and closes plan submissions on February 5, 2027, and a record missing a signature needs a CMS-generated attestation as page one.

The plan or its vendor sends the request, and CMS audits the plan. Premera names Datavant and Episource as its vendors and Optum names OIR and Datavant, and each plan's own provider pages set the practice's deadline, return routes and copy terms.

How do you answer a Medicare Advantage chart review or RADV request?

A Medicare Advantage chart review or RADV request is answered with the records the letter names, in the form CMS counts, by the letter's date and through a route the letter offers. The job runs in five steps.

1. The letter sets the deadline, names the records and offers the return routes.
2. Only the requested records go, which for CMS's payment year 2024 audit means 2023 dates of service.
3. Each record carries the treating provider's signature and credentials, legible pages, and the identifiers the plan asks for on each page.
4. A physician or hospital outpatient record without a signature or credentials gets a CMS-generated attestation as its first page.
5. The records go by the letter's route, with any barcoded sheet or request letter the plan wants first, and the practice keeps proof of delivery.

A patient's own request for records runs on other HIPAA rules and clocks, set out in how to respond to a medical records request by fax.

Who asks for the records, and why?

The Medicare Advantage plan or its vendor asks for the records, because 42 CFR 422.310 requires MA organizations and their providers and practitioners to submit a sample of medical records for the validation of risk adjustment data, as CMS requires. The same rule lets plans write provider contract terms that require complete and accurate risk adjustment data, and those terms may include financial penalties for failing to submit complete data.

CMS runs contract-specific RADV audits under 422.310(e). Its payment year 2024 RADV audit methods guidance samples 35, 50, 100 or 200 enrollees from each audited contract. The audited plan must then request records from the hospitals and physicians or practitioners who provided services and documented diagnoses associated with the audited HCCs during the data collection period, January 1 through December 31, 2023.

CMS notified the plans with selected contracts on August 28, 2026. Its estimated audit schedule for payment years 2020 through 2025 warns that the years may not be audited in order.

Plans also review charts on their own. Wellmark's Medicare Advantage provider manual lists rendering a decision, investigating quality concerns, and reviewing HEDIS and risk adjustment data among its reasons. Optum's May 2026 Provider Express notice says the provider's contract with Optum requires providing patient records when requested.

How long does the practice have to send them?

The practice's deadline is the date in the plan's or vendor's letter, and each plan sets its own: Wellmark wants records within 10 days unless the request allows longer, Optum encourages a reply within a week, and Premera's goal is 30 days. The table sets each plan's terms side by side from its own pages, with "Follow the letter" where a plan's page leaves the point to the letter.

CMS's window is the plan's deadline for its own upload. Payment year 2024 submissions opened September 18, 2026 and close February 5, 2027, at 11:59 p.m. Eastern, and CMS encourages plans to submit as early as possible in the window.

Premera's July 2026 RADV notice says its requests will be small in volume but urgent because of the compressed review period CMS set. Blue Cross and Blue Shield of Texas calls its RADV audits time sensitive and asks for all records from the sampled year. Premera's 2025 records notice sets the 30-day goal for its risk adjustment requests.

HEDIS reviews by the same plans are a parallel job: Wellmark asks for HEDIS records within 7 days of the request where possible. Medicare fee-for-service additional documentation requests run on a clock of their own, 45 calendar days for a MAC, RAC or SMRC request under chapter 3 of CMS's Program Integrity Manual.

What makes a record count for risk adjustment?

A record counts for RADV when it is a legibly signed medical record from a face-to-face visit with a provider within the data collection period, signed by the credentialed provider who conducted the visit. A record without the provider signature or credentials needs a CMS-generated attestation signed by the physician or practitioner. CMS accepts that attestation only for physician and hospital outpatient records, and a completed attestation must be the first page of the record file.

CMS's RADV medical record reviewer guidance, in effect for audits starting after January 10, 2020, does not accept stamped signatures. It also requires the attestation when an electronic signature or EMR authentication is dated more than 180 calendar days after the encounter.

Plans add page rules of their own. Blue Cross and Blue Shield of Kansas asks for the patient's name and date of birth on each page, and for properly dated entries with a valid signature and credentials. Blue Cross and Blue Shield of North Carolina's D-SNP risk adjustment guide asks for the patient's complete name plus a second identifier, such as date of birth or medical record number, and the date of service on each page, along with the provider's name, signature, credentials and date signed.

CMS's upload rules bind the plan. Its CDAT system takes each record as one PDF on an electronic coversheet, up to 100MB, and CMS provides no printable coversheet. CMS tells plans to check that every page is legible, and warns that a record for the wrong enrollee may cause a PHI or PII issue and makes the submission invalid.

Which records go, and does the patient have to authorize it?

The records that go are the ones the letter asks for, and Blue Cross and Blue Shield of Texas says patient authorization is not required for RADV records because their collection and review is a component of health care operations. 45 CFR 164.506 lets a covered entity disclose protected health information to another covered entity for the receiving entity's health care operations when each entity has or had a relationship with the individual.

The HIPAA minimum necessary rule still applies. Under 45 CFR 164.502, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary when it uses, discloses or requests it. The standard's exceptions include disclosures to or requests by a health care provider for treatment.

How do you send the records, and what goes on page one?

The records go by a route the letter offers, from fax or mail to remote EMR access, and page one is what the plan's instructions put there: a barcoded coversheet, a copy of the request letter, or a CMS-generated attestation at the front of a record. Wellmark or its vendor also offers an onsite visit, and Optum calls EMR access for OIR or Datavant the fastest and least expensive option. Premera says its vendor helps each office choose the submission method that works best.

Page one matters wherever a plan routes records by a coversheet. For post-service claim reviews, Blue Cross and Blue Shield of North Carolina faxes providers a barcoded coversheet that must be the first page of the fax, followed by the record (BCBSNC's records FAQ). When a fax service adds its own cover page in front of that sheet, BCBSNC's automation fails and the records drop to a queue for manual routing. BCBSNC mails back any record sent without a cover sheet carrying the required information, and it mails the barcoded sheet to providers it has no fax number for.

Excellus BlueCross BlueShield uses a different order for claim record requests: the office's own fax cover sheet, then a copy of the request letter as page two, with each request faxed separately. Excellus also asks offices to follow any specific instructions in the record request. Both are claims-review rules, and BCBSNC says its FAQ does not apply to annual chart reviews for Blue Medicare members or to HEDIS requests. They show why page one matters; for a chart review, the plan's letter sets the order.

Humana's routes for the records it requests are listed on Humana's medical records fax numbers. A faxed return is proven by its delivery record, and how to tell if a fax went through lists what that record has to show.

Who pays for copies, and what if a chart is missing?

Wellmark, Wellcare and Blue Cross and Blue Shield of Kansas expect chart review records without a charge, Premera reimburses copy fees only up to the allowed amount in the provider's contract, and Wellmark asks to hear at once when a requested chart is not at the practice. Wellmark's manual says neither Wellmark nor the member pays for producing or retrieving records. Wellcare's 2026 manual requires access without a fee on or before the date Wellcare reasonably requests, and Blue Cross and Blue Shield of Kansas says records should be supplied at no cost under the provider contract.

For a missing chart, Wellmark's manual names who to tell: the Wellmark employee or the designated vendor, immediately. Premera tells offices that receive no letter that nothing is due.

Retention runs 10 years. CMS's RADV questions and answers say MA organizations keep records and documents for 10 years under 42 CFR 422.504(d), and 422.504(i) extends those retention requirements to providers under contract with the plan.

How do you spot a fake records request?

A request that claims to be a CMS audit and arrives by fax is suspect, because CMS says it does not initiate audits by requesting medical records via fax. The CMS fraud alert that Noridian posts adds that legitimate requests for medical records typically arrive by mail or courier, and it says to work with the Medical Review Contractor to confirm a suspicious request. A RADV request comes from the Medicare Advantage plan or a vendor the plan names, such as Datavant for Premera.

How do you send chart review records from a HIPAA fax account?

On Fax Pigeon, the records upload as one PDF and go out from the browser or from email. Because a cover sheet is optional, the plan's barcoded sheet or request letter can be page one. Every delivered fax gets delivery proof, and the plan's replies land in a shared inbox where they can be assigned. Every plan includes a BAA signed at signup.

* Official sources (CMS, the Code of Federal Regulations, each health plan's own provider pages) were read on October 20, 2026. Fax Pigeon prices and plan terms as of October 20, 2026.