The case for bringing HCC coding in-house: what generative AI changes about the outsourcing math

Originally published in Health IT Answers and MedCity News, November 2025.

HCC coding is where Medicare Advantage economics meet compliance risk. Risk scores drive 2025 payments to plans covering roughly 35.7 million beneficiaries (more than half of Medicare), and every diagnosis submitted has to be supported somewhere in the medical record or it becomes recoverable under a CMS RADV audit. For the last decade, the operating assumption was that HCC coding at scale required third-party vendors: they had the coders, the technology, and the risk-adjustment expertise. That assumption is coming apart. Generative AI changes the build-versus-buy math, and the audit posture CMS announced in 2025, which audits all eligible MA plans annually and pursues a backlog of 2018–2024 payment years, makes the control, transparency, and audit-readiness of in-house coding a much better fit for where the enforcement environment is heading.

Why outsourced HCC coding is becoming a worse trade

The outsourcing arrangement that worked in 2015 has four characteristics that are increasingly at odds with where CMS is going.

Vendors get paid for the codes they find. The economic incentive is to maximize diagnoses in the near term. The audit exposure, which shows up years later, sits with the plan. That mismatch has been flagged repeatedly by the OIG, which has warned about diagnoses that come only from health risk assessments or chart reviews but aren’t supported elsewhere in the medical record. In 2025, CMS estimated that MA plans overbill by $17 billion annually; MedPAC’s independent estimate was up to $43 billion. The enforcement posture that follows from those numbers is not one where “our vendor coded it that way” is a durable defense.

Coding decisions happen in a black box. The plan sees the output (a list of codes per member) but typically not the reasoning, the source text, or the confidence behind each code. When an auditor asks why a code was submitted and what supports it in the record, the plan has to reconstruct an answer from a vendor system it doesn’t control. The audit preparation cost of that reconstruction has grown faster than anyone budgeted for.

The technology gap that justified outsourcing has closed. A few years ago, bringing HCC coding in-house meant building a clinical NLP platform from scratch, a multi-year effort that most plans and providers couldn’t justify. Today, healthcare-specific generative AI models read messy, multimodal data, map findings to HCC-relevant ICD-10 codes, and produce auditable provenance at a fraction of the cost of doing it manually. The Generative AI Lab’s HCC coding support, for example, automatically links ICD codes to HCC categories and prioritizes high-value tasks for human review, inside the customer’s environment.

Medicare Advantage enrollment is becoming too strategic to leave to vendors. More than half of Medicare beneficiaries are now in MA, and CMS’s 2026 rate announcement and expanded audit program signal that coding integrity is now a top-three performance variable for plans. Risk-adjusted revenue, member care accuracy, and regulatory compliance all depend on HCC coding being done well, and all three are weakened when the work happens at arm’s length.

What CMS’s 2025 audit expansion actually means

The audit environment changed materially in 2025. CMS announced it would complete its RADV backlog for payment years 2018 through 2024 by early 2026. The audit footprint expanded from roughly 60 MA contracts per year to all eligible plans (approximately 550 contracts), with record samples of 35 to 200 per plan based on plan size. CMS expanded its medical coder workforce from 40 to an intended 2,000 by September 2025, with AI-assisted review tools flagging unsupported diagnoses before human coders confirm findings.

A federal district court in Texas vacated parts of the 2023 RADV final rule in September 2025, removing, pending appeal, CMS’s ability to extrapolate audit findings across an entire contract population. That was a meaningful legal win for plans, but it did not reduce the underlying scrutiny. CMS has continued the audits, reverted to earlier methodology, and signaled that recoveries from the 2011–2013 audits are still coming.

The operational posture for plans is now: more audits, more records reviewed per audit, a coder workforce at CMS that grew 50x in a year, and AI-assisted flagging of unsupported codes before human review. Every diagnosis submitted has to hold up under that posture.

In-house HCC coding with generative AI fits that posture better than outsourced coding does, for one structural reason: the plan controls the audit trail. Every code ties back to specific source text in a specific note on a specific date, with a confidence score and a reviewer signature. When CMS asks, the answer is in the plan’s own system.

What AI-native in-house HCC coding looks like

Modern in-house HCC coding architecture combines four components.

Healthcare-specific extraction models read clinical notes, discharge summaries, operative reports, and HRAs to identify conditions, their status (active, resolved, historical), and supporting evidence. Healthcare-specific models outperform general-purpose LLMs on this task: peer-reviewed benchmarks show medical language models consistently ahead on clinical entity extraction, assertion detection (is this condition present, absent, or uncertain), and mapping to ICD-10 codes.

ICD-to-HCC mapping automatically links each extracted diagnosis to its HCC category, applies the current CMS risk-adjustment model (V28 for 2025 coding), and flags conditions with the highest revenue and compliance impact for coder review first.

Human-in-the-loop review by the plan’s own certified coders. This is where the audit-readiness comes from. Coders see the AI’s suggested code, the source text that supports it, the date, the provider, and the confidence score. They accept, reject, or modify, and their decision is logged. For RADV purposes, the audit trail is complete.

In-environment deployment. The pipeline runs on-premises or in the plan’s private cloud tenant. PHI never leaves the firewall. No external API calls, no vendor data-sharing agreements, no cross-organization data movement that auditors have to untangle. HIPAA, GDPR where applicable, and internal data-sovereignty requirements are satisfied by architecture rather than by policy.

The economic case

The unit economics of in-house AI-assisted HCC coding are different from outsourced coding in a specific way: the cost is mostly fixed.

Outsourced HCC coding typically runs on a per-chart or per-member basis. Volume scales linearly with cost. AI-native in-house coding has a higher setup cost (software, integration, coder training), but the marginal cost of processing an additional chart is effectively zero. Once the pipeline is running, processing 100,000 charts versus 10,000 charts is a GPU-hours difference, not a headcount difference.

Customers implementing HCC coding tools from Martlet AI report 80% less manual abstraction, go-live in under two months, and around 60% lower operating costs on risk adjustment and related workflows. The Martlet AI sub-brand focuses specifically on the in-house HCC coding use case, with workflows that combine healthcare-specific models with the audit, review, and reporting infrastructure plans need for CMS compliance.

The second-order effect matters more than the first. When coding is in-house, plans can iterate the model on their own patient population, tune it to their provider network’s documentation patterns, and close the feedback loop between coders and models faster than an outsourced vendor could. Accuracy improves over time; the system learns the plan’s data.

What this doesn’t mean

Bringing HCC coding in-house does not mean firing the clinical coders. It means giving them better tools. Certified coders remain the audit defense; they’re the humans whose judgment signs off on every submitted code. The AI is the first pass that lets them operate at 5–10x productivity, focus on the high-risk and high-value cases, and spend less time clicking through irrelevant charts looking for something to code.

It also doesn’t mean every plan should build this tomorrow. Small plans without an existing clinical data pipeline, without in-house coding staff, and without the engineering capacity to operate a healthcare AI system in production will get to an acceptable risk position faster by working with a vendor whose technology they can inspect, whose models they can audit, and whose output they control. The “in-house” argument is not “always build.” It is “when outsourcing means losing control over the audit trail, the risk calculus has shifted.”

What to evaluate before making the change

Four questions to work through before bringing HCC coding in-house:

Does your existing data pipeline deliver clean, current, de-identified-where-necessary clinical narrative to the coding workflow? If charts are still faxed, if notes arrive as unstructured PDFs without OCR, or if claims and clinical data aren’t linked, fix that first.

Is your coding team ready to shift from bulk chart review to AI-assisted exception review? Workflow redesign, training, and change management are the variables most commonly underestimated.

What does your audit trail look like today, and what would it need to look like to answer a CMS RADV request in a week? If the answer involves reconstructing vendor logs, the in-house case is stronger than it looks on the surface.

Can the technology run in your environment, on your security perimeter, with your data never leaving your control? If not, the audit and compliance advantages of in-house coding are muted.

Where this ends up

The CMS enforcement posture announced in 2025 (annual audits of all eligible MA contracts, a 50x increase in CMS’s coder workforce, AI-assisted flagging of unsupported codes) makes coding integrity a permanent top-three operational priority for Medicare Advantage plans. Outsourced coding arrangements that worked when audit exposure was nominal don’t survive contact with a world where 200 records per plan per year are reviewed and the vendor who coded them three years ago is not the entity on the hook for the recovery.

Generative AI closed the technology gap that justified outsourcing in the first place. The plans that move first, build the in-house pipeline, and own their audit trail will have a structural advantage in both revenue integrity and compliance defense for the rest of the decade.

Frequently asked questions

What is HCC coding?

Hierarchical Condition Category coding is the CMS system for risk-adjusting payments to Medicare Advantage plans. Each ICD-10 diagnosis that maps to an HCC category increases the plan’s risk score and the per-member-per-month payment. Accurate HCC coding requires both identifying diagnoses in the medical record and ensuring they are supported by documentation that will withstand a RADV audit.

How does a RADV audit work?

CMS selects a sample of members from an MA contract, requests the medical records, and checks whether the submitted diagnoses are supported. Unsupported diagnoses are considered overpayments and recoverable. Starting in 2025, CMS is auditing all eligible MA contracts annually, with 35 to 200 records reviewed per plan per year.

Is CMS really using AI in RADV audits?

CMS has stated it will deploy AI-assisted technology to flag unsupported diagnoses before human coders confirm findings. The agency has also committed that all overpayment determinations will be made by a human, not an algorithm. The practical effect is more records reviewed faster, with AI expanding the audit surface area.

What’s the difference between Medical LLMs and general-purpose LLMs for HCC coding?

Healthcare-specific models are trained on clinical documentation and biomedical literature, map output to clinical terminologies like ICD-10 and SNOMED CT, and handle clinical assertion, negation, and temporality in ways that general-purpose LLMs don’t reliably do. Peer-reviewed benchmarks show healthcare-specific models outperforming frontier LLMs on clinical information extraction by meaningful margins.

Does in-house HCC coding require large model deployment?

Not necessarily. Modern healthcare-specific models run on commodity GPUs, inside the customer’s environment, without requiring external API access. Deployment footprints range from a single professional-grade GPU for smaller plans to scaled Kubernetes clusters for large plans processing millions of charts per year.

How do plans think about the CMS court ruling on extrapolation?

The September 2025 Texas district court ruling vacated parts of the 2023 RADV rule and, pending appeal, removed CMS’s ability to extrapolate audit findings across a full plan population. That reduced the worst-case audit exposure significantly. The underlying audit activity, including RADV audits of individual records, continues; plans that are audit-ready at the record level are well-positioned regardless of how the extrapolation question finally resolves.

What role do clinical coders play in an AI-native HCC workflow?

Certified coders review AI-suggested codes, make the final call on accept, reject, or modify, and own the audit trail. The workflow shifts from reading every chart to reviewing flagged cases and validating the AI’s reasoning. Productivity per coder increases materially; coder judgment remains the compliance backstop.