Risk Adjustment and HCC Coding Software Problems: The 7 That Cost Real Money, and How to Avoid Them
The most expensive failure in risk adjustment software is that no single identifier follows a diagnosis from the chart page through abstraction, submission and the CMS response. A coder finds a condition, it is submitted, it is rejected for a reason nobody works, and the revenue simply never arrives. The same break runs the other way: an unsupported diagnosis your reviewer deleted was never submitted as a delete, so it is still in your risk score and it is still your exposure. The plan sees one undecomposable variance at year end. With RADV extrapolation applied from payment year 2018 forward, that second half is no longer a sampling problem, it is a payment year.
Why does chart retrieval scope get underestimated so often?
Because retrieval is described as a vendor relationship and quoted as an integration. In reality it is an orchestration problem whose difficulty is set by your provider mix, not by anyone's software. A plan whose membership sits with three large health systems on one electronic health record can pull most of what it needs through direct connections. A plan with a long tail of independent practices, federally qualified health centres and behavioural providers is dealing with fax, portal downloads, on site retrieval and offices that treat a records request as an imposition.
The visible symptom is a status report saying 41,000 charts were requested and 28,000 received, with the gap concentrated exactly where the documentation is hardest to get. The invisible symptom is that chase priority is being set by a vendor's generic suspecting rather than by your own knowledge of which providers document well.
Scope it as orchestration from the start. One record of every attempt against every chart, across every channel, with the source, the date and the outcome. Chase priority computed from expected yield, which is a function of the member's suspected conditions, that provider's historical documentation quality with you, and the cost of the channel. That last input is the one no vendor holds, because it is your history with your providers, and it is the reason retrieval strategy is worth owning even when the physical retrieval stays outsourced.
What goes wrong when you migrate historical abstraction and chart data?
Your own abstraction history is the best input to suspecting you will ever have, and it is usually the worst prepared dataset in the project. It lives in a vendor platform, keyed to that vendor's identifiers, with coder decisions recorded as accept or reject and little else. The reason a condition was accepted, the passage it rested on and the guidance version in force are often absent, because the original system never asked for them.
Migrate that as it stands and you inherit a pile of outcomes with no reasoning attached. It is still useful for suspecting, and it is useless for defence. Plans discover the difference during their first self audit, when a diagnosis from two years ago cannot be tied to a page.
Handle it in two tiers. Migrate the full history for analytics, keyed to your member and encounter identifiers rather than the vendor's, and accept that older records carry no evidence chain. Then set the cutover date after which every abstraction carries the complete record: coder, decision, the documentation criteria met, the page image reference, the passage and the guidance version. Be explicit with your compliance team about which years are defensible and which are not, because that boundary will be tested and it is far better as a known fact than a discovery.
Why do EHR, health information exchange and submission integrations break after launch?
Clinical connections break because each one is a separate legal, technical and data quality arrangement that moves at the provider's pace. A FHIR bulk export that worked in testing changes when the practice upgrades. A health information exchange changes its participation terms. A provider who supplied structured documents starts supplying PDFs because their scanning vendor changed. None of that is a defect in your system and all of it stops your pipeline.
The submission side breaks differently. Encounter data submission has its own validation, and rejections arrive with reason codes that are meaningful only if somebody works them as a queue. Plans that summarise rejections as a rate rather than working them individually leave accepted revenue on the table and, worse, leave deletes unsubmitted.
Design for both. Treat a provider who can only supply PDFs as a supported path rather than a workaround, because that path will always exist somewhere in your network. Version every connection's expected shape and alert on drift rather than on failure, since silent partial delivery is more common than an outright outage. And carry one lineage identifier from chart to abstraction to submission to response, so reconciliation is a query rather than a quarterly project in a spreadsheet.
What happens when RADV evidence packaging is not covered?
It gets deferred because it is not needed this year, and then it is needed with a deadline. The task is to produce, for each sampled member and hierarchical condition category, the medical record page supporting it, signed and dated by a valid provider, from a valid encounter type, inside the correct service window. If charts sit in a retrieval vendor's repository, abstractions in a coding platform, submissions in an electronic data interchange system and provider validation in a credentialing database, assembling that package takes weeks per audit and the assembly itself introduces errors.
The deeper problem is that assembling under deadline tells you nothing you could have acted on. You find out your error rate at the moment you can no longer change it.
Build it as generation, not assembly. Every accepted diagnosis already points at the page image, the passage, the signature block, the provider's validated credential at the date of service and the encounter type, so a package is a query. Prepare a one best record selection in advance for your high value conditions rather than under pressure. Then run self audits quarterly on your own samples using the same rules an auditor would use. That produces your real error rate rather than your coder accuracy rate, and the gap between those two numbers is where repayment risk lives.
Should you build custom or configure what you already own?
Under roughly 20,000 risk adjusted lives, stay with Reveleer or Inovalon and spend the money on certified coders and on getting clinicians to document properly at the point of care. A build at that scale is a distraction from the two things that actually move your accuracy.
Keep buying retrieval even if you build everything else. Physical and on site chart retrieval is a logistics business with field staff and provider relationships, and Inovalon, Cotiviti and Reveleer are genuinely good at the industrial parts: outreach cadence, on site scheduling, image intake. Recreating that is effort with no return. Similarly, if your gap is the encounter pipeline itself rather than the round trip, Edifecs is strong there and configuring it is the cheaper answer.
Build when two of these are true. Your provider mix is fragmented enough that retrieval strategy materially affects revenue and no vendor's generic prioritisation reflects it. You run more than one line of business and maintain parallel processes for each, since Medicare Advantage, commercial risk adjustment through the EDGE server and state Medicaid arrangements are effectively three calculation engines with three calendars. You cannot trace a single diagnosis from chart to payment. Or you have been through an audit and found that assembling evidence took weeks. That last one is the honest trigger for most plans that come to us, and it is a good one.
How do hidden costs get into the quote?
Risk adjustment quotes go wrong in five predictable places.
- Each clinical connection is priced as one integration. Every electronic health record and health information exchange carries its own authentication, data quality quirks and legal agreement, and the agreements move at the provider's pace rather than the project's.
- Multi line support is quoted as configuration. Each risk model is a separate calculation engine with its own calendar and submission path, not a setting.
- Model version handling is assumed. The transition from CMS-HCC version 24 to version 28 changed which conditions map to a payment category, so the system has to hold two versions at once during a phase in year and treat a mapping update as a data load with a validation run.
- Coder staffing models are ignored. A mix of internal coders and outsourced partners in the same tool needs separate permission structures and separate audit trails.
- Historical migration is treated as a copy. Rekeying a vendor's identifiers to yours, and deciding which years carry an evidence chain, is real work with a compliance dimension.
The honest bands from Digital Heroes delivery experience are $90,000 to $190,000 over 14 to 20 weeks for a first release covering retrieval orchestration, a coder workspace with two way review, model versioned mapping and diagnosis level submission reconciliation, and $250,000 to $600,000 across 8 to 14 months for a full platform adding prospective suspecting, provider facing gap workflows, multi line support and evidence packaging with self audit.
What separates a build that works from one that fails here?
Symmetry between adds and deletes, first. A review programme that structurally favours adding conditions is the pattern federal enforcement has repeatedly focused on, and a plan that cannot demonstrate it removes unsupported diagnoses with equal diligence has an exposure that coding accuracy does not fix. Build both paths the same way, measure them the same way, and make sure deletes flow through submission, because an unsubmitted delete is a documented exposure you failed to act on.
Second, the coder sees the extracted passage and the surrounding page image together. Validating a snippet is not validating a chart, and the difference shows up in an audit rather than in a productivity report.
Third, model version is data. If a mapping change requires engineering work in your system, you will be late in every year CMS moves the model, and lateness compounds into a suspecting list built on last year's economics.
Fourth, start with reconciliation. It is the fastest payback in the category because it usually surfaces submitted and rejected revenue nobody was working, and it funds the rest of the programme.
Fifth, settle ownership before kickoff, in writing: the repository, the cloud environment and every byte of abstraction history. At Digital Heroes the client owns all of it from the first commit. For a data asset that doubles as your audit defence, any other arrangement is a risk you are choosing to accept.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- Companies in the top quartile of McKinsey's Developer Velocity Index had 2014-18 revenue growth four to five times faster than bottom-quartile peers, showing that software-building capability is a driver of business performance, not just a support function. Source: McKinsey & Company (2020) →
- Median SaaS spend reached $9,455 per employee, and organizations leave an average of 36% of their SaaS licenses unused. Source: Zylo (2026) →
- Brandon Hall Group research on onboarding reports that done well, structured onboarding drives measurable gains in new-hire productivity, employee engagement, and retention; the page notes 41% of organizations experience greater than 5% turnover among new hires. Source: Brandon Hall Group (2024) →
- APQC's Open Standards Benchmarking data on the monthly financial close found median performers take about 6.4 calendar days to close the books, while top performers (top 25%) do it in 4.8 days or fewer and bottom performers (bottom 25%) take 10 or more days. Source: APQC (2018) →
Beau runs performance marketing for APAC clients, which at an agency that builds the underlying software means he sees both the ad spend and the tracking behind it. He writes about measurement: what a platform can honestly report, what it cannot, and how that changes a budget decision.
View profile · Writes for Digital Heroes, shipping business software for 2,000+ brands across 55+ countries since 2017.
Frequently asked questions
How do we find out whether we are leaking accepted revenue right now?
Take one quarter and try to trace fifty diagnoses your coders added from the chart page to the MAO-004 response. Count how many you can follow the whole way. If the answer is low, the leak is not a rate you can estimate, it is a queue nobody is working, and it usually sits in encounter rejections with reason codes that never reached a person. That exercise takes a few days and it produces both the size of the problem and the scope of the first release.
Should we keep our retrieval vendor if we build the rest?
Almost always yes. Physical and on site retrieval is a field logistics business with staff, scheduling and provider relationships, and there is no advantage in recreating it. What you build is the layer above: the record of every attempt across every channel, the chase prioritisation using your own history of which providers document well, and your own identifiers rather than the vendor's. Agree the data feed and the identifier mapping before you start, because retrieving it later becomes a commercial negotiation.
How should the system handle the move from CMS-HCC v24 to v28?
By treating model version as first class data rather than logic. Every diagnosis, suspect and revenue projection carries the version it was computed under, and the system holds more than one version at once because during a phase in year you genuinely need both. Coder guidance and query templates get versioned alongside, since documentation that satisfied one model year may not support the next. A mapping update should be a data load with a validation run against last year's population, never a development ticket.
Can natural language processing decide which conditions to accept?
It can surface candidate conditions with the supporting passage reliably enough to make coders substantially faster, and that is real value. It should not make the final call, because the accept or reject judgment is exactly what an auditor examines and it needs a named human, a documented criterion and a guidance version attached to it. Design it as extraction plus evidence presentation, with the coder validating against the page image in context rather than against an isolated snippet.
What does a defensible self audit actually look like?
Pick your own sample using the same selection rules an auditor would use, then attempt to produce the full evidence package for each sampled condition: the page image, the passage, the signature, the provider's credential at the date of service and the encounter type. Count how many fail and why. Run it quarterly. The output is your real error rate, which is a different number from your coder accuracy rate, and the gap between them is the figure your compliance committee should be tracking.
How do we handle providers who can only send PDFs or paper?
Make that a first class path rather than an exception, because it will exist somewhere in your network permanently. That means intake that handles scanned images at variable quality, page level indexing so a coder can be pointed at the right page, and an evidence chain that references the page image itself rather than an extracted text blob. Plans that design only for structured clinical data end up with a manual side process that carries their hardest to defend conditions.
Does this work for commercial and Medicaid lines as well as Medicare Advantage?
Yes, provided you treat each as its own risk model with its own calendar and submission path rather than assuming one engine covers all three. Commercial risk adjustment runs a different model through the EDGE server and Medicaid arrangements are state specific. The shared parts are retrieval, the coder workspace and the evidence chain, which is precisely why plans running several lines get the strongest return from building the common layer once and configuring the models on top.
How long does a first release take, and what usually delays it?
Fourteen to twenty weeks for the first release, and the delay is almost never the software. It is clinical data access: each connection carries authentication, data quality surprises and a legal agreement that moves at the provider's pace. Start those conversations on day one in parallel with development rather than when the code is ready. The second most common delay is deciding, internally, which coding policy the tool should enforce, which is a governance question your own team has to answer.
How small can the first version of my software be and still be worth building?
When does a company outgrow Airtable?
How long does it take to build an internal tool from scratch?
Who owns the code when an agency builds our internal tool?
Should we build our internal tool in Retool instead of hiring developers?
How do I calculate the ROI of a custom internal tool?
What are the most common mistakes companies make when building internal tools?
What does it cost to keep an internal tool running after launch, and do we need to hire a developer?
How long does it take to build a custom web or mobile app from scratch?
Who can build a custom internal tools system?
Digital Heroes builds custom internal tools systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other internal tools companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.