Risk Adjustment Review: The Good, the Bad, and the Ugly
A Risk Adjustment Review is not an audit. But what is it?
It is a process insurance companies use to gather clinical information about members in order to understand the health risk level of their insured population. The process expanded under the Affordable Care Act as a way to help insurers balance the financial risk of covering populations with varying health needs.
In risk-adjusted payment systems, insurers receive payments that reflect the health status and expected medical costs of the people they insure. If a plan’s members have more complex health conditions, the insurer receives higher payments to offset those expected costs.
To calculate these payments, insurers collect clinical data from medical records to confirm diagnoses and estimate future healthcare needs.
Originally, the process was meant to balance financial risk across insurance plans so that plans covering sicker populations would receive appropriate funding. In theory, this cost sharing is good. It helps ensure insurers can afford to cover members with complex health conditions. In practice, like many things in healthcare administration, the process has evolved.
How Risk Adjustment Reviews Are Used Today
The current use is not as originally intended. Today, insurance companies use these reviews for data mining as well as risk modeling.
Billing expert Susan Frager describes risk adjustment reviews as sometimes turning into a “diagnosis code data mining expedition” through patient records. This is the bad.
Insurance companies and the vendors they hire (or the AI companies they use) to conduct the reviews and analyze records look for information such as:
- Additional diagnoses
- Severity indicators
- Functional impairment
- Duration of treatment
- Clinical complexity
Why? Because additional documented diagnoses can increase the insurer’s risk score, which can lead to additional payments from programs such as Medicare Advantage or ACA plans.
But the data mining has another purpose as well.
The information collected helps insurers:
- Identify utilization patterns
- Flag providers or services for closer review
- Identify cases that may justify future audits
In other words, risk adjustment reviews can become a way for insurers to gather information that may later support compliance investigations or audits. This is the ugly.
Using these reviews to justify medical necessity audits was not the original intent of the program. But insurance companies, like any large company, will use any data available to them. Especially when that data might save money.
Is a Risk Adjustment Review Mandatory?
Technically, no. Functionally, it’s wise to comply.
Risk adjustment requests are not audits because they do not carry an automatic financial penalty. However, ignoring the request isn’t the best strategy.
If an insurer receives no documentation, they may conclude that the diagnosis on the claim cannot be verified. That can trigger a real audit later, which may involve:
- Full chart reviews
- Documentation evaluation
- Potential recoupment of payments if documentation does not support medical necessity
So, while compliance with a Risk Adjustment Review is technically optional, responding strategically can reduce the likelihood of a more intrusive audit later.
The goal is simple: send only what is legally required and nothing more.
Is a Release of Information Needed?
No. HIPAA allows disclosures without a signed release for healthcare operations, which includes activities such as risk adjustment reviews and insurance documentation verification.
However, how you respond still matters.
Do not send psychotherapy notes. Psychotherapy notes are the notes you use to trigger your memory from session to session. They usually contain sensitive information that is not necessary for insurance purposes.
HIPAA requires providers to disclose the minimum necessary information when responding to these types of requests.
That principle should guide everything you send.
What Insurance Companies Want vs. What They Need
Many risk adjustment letters ask therapists to send “all documentation related to the client.” That phrase alone is enough to make therapists imagine the worst and send the entire chart without questioning what is actually required.
But there is a significant difference between what insurers ask for and what is legally required to send.
Despite what insurance companies request, they do not need to review every progress note to estimate their future cost of care.
What they need is confirmation of:
- The diagnosis
- The severity or complexity of the condition
- Evidence that treatment occurred
The rest is more information than necessary or wise to send.
Why a Summary of Treatment is The Best Response
Susan Frager recommends responding with a brief clinical summary rather than the entire chart, providing only information relevant to the diagnosis and treatment provided.
A Summary of Treatment is similar to a treatment plan and typically includes:
- Diagnosis
- Bio/psycho/social stressors
- Symptoms and functional status
- Treatment goals
- Progress to date and prognosis
- Treatment modalities (individual, family, etc.)
- Frequency of treatment
- Medications monitored for compliance and side effects
- A list of session start and stop times
This information confirms the diagnosis while protecting the detailed clinical content of your progress notes. From both a privacy and efficiency perspective, it is the most practical response.
Why Sending the Entire Chart Isn’t Ideal
Even when your documentation is excellent, sending the full record creates unnecessary risk. A summary works better because it:
Protects client privacy: Progress notes often contain details that are not relevant to the insurer’s purpose.
Saves time: A one-page summary is easier and less time consuming than assembling an entire chart.
Limits data mining: The more documentation you send, the more material insurers have to analyze, which also means more opportunities for them to start asking additional questions.
How to Respond Strategically to an Insurance Record Request
If you receive a documentation request from an insurance company, first confirm exactly what type of review it is.
Email or call your contact person and ask two simple questions.
- “Is there any risk of a clawback associated with this review?”
If the answer is yes, you are dealing with a real audit, not a risk adjustment review. - “Is a Summary of Treatment sufficient?”
If the response is “We want the entire record,” they have avoided directly answering your question. Don’t be deterred.
Ask again, “I understand what you want but is it required?” Remind them that HIPAA requires the minimum necessary information.
Susan Frager recommends citing HIPAA if needed: “A covered entity may not use, disclose, or request an entire medical record except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the request.” 45 CFR §164.514
In other words: send the minimum necessary, not the entire chart. Use a concise Summary of Treatment instead. If you want a structured template for a Summary of Treatment, you can get one here. Using a structured summary allows you to respond efficiently and professionally while protecting both your client and your practice.
If you want to learn how to respond confidently to insurance audits with fully compliant documentation that adds meaning and value to treatment check out my training, Misery or Mastery®: Essential Documentation for Psychotherapists.
The Bottom Line
A Risk Adjustment Review:
- Is not an audit
- Does not carry an automatic financial penalty
- Is primarily used for population risk analysis
However, insurers also use these requests to collect data and identify cases for further review.
Wise Wizard Recommendation
Respond thoughtfully with a concise Summary of Treatment rather than your entire chart.
It allows you to comply with the request without giving away more information than necessary. And it saves you from spending your weekend assembling an 80-page chart that reveals far more than anyone needed (but wanted) in the first place.
Ready to Respond Confidently to an Audit?
In Misery or Mastery®: Essential Documentation for Psychotherapists, you’ll learn how structured, clinically meaningful documentation helps you respond to insurance reviews with clarity and confidence.
Beth Rontal, LICSW, a private practice therapist and the Documentation Wizard® is a nationally recognized consultant on mental health documentation. Her Misery and Mastery® trainings and accompanying forms (in English and Spanish) are developed to meet strict Medicare requirements. Beth’s Documentation Wizard training program helps clinicians turn their clinical skill and intuition into a systematic review of treatment that helps to pass audits, protect income, maintain professional standards of care, reduce documentation anxiety and increase self-confidence. Beth’s forms have been approved by 2 attorneys, a bioethicist, and a billing expert and have been used all over the world. She mastered her teaching skills with thousands of hours supervising and training both seasoned professionals and interns when supervising at an agency for 11 years. Her newest initiative, Membership Circle, is designed to empower psychotherapists to master documentation with expert guidance, efficient strategies, and a supportive community.
