The environment CMS built over the last 18 months created new risk inside specific parts of the risk adjustment lifecycle, and health plans are now paying a premium for vendors who can go deep in exactly those places. The depth matters more than the breadth it may come with or without. A vendor who can credibly handle prospective risk adjustment, defend coding decisions against audit scrutiny, and bring clinical and compliance judgment into the coding operation is winning scope on CY 2027 evaluations against vendors who cover more of the lifecycle without that specific capability underneath them. The pattern is already visible in which vendors are extending their portfolios, which ones are hiring at the executive level, and which ones are being asked to defend their work in evaluations in ways they were not two bid cycles ago.
If you have watched the health tech category long enough, you have seen the cyclical swing between best-of-breed and all-in-one play out more than once, and the natural read of what plans are doing now would be to call this another turn. But the forces driving this one are different. Plans are reorganizing around where V28, chart review exclusion, universal Risk Adjustment Data Validation (RADV), and the Office of Inspector General (OIG) guidance put new money and new liability on the table, which is a regulatory pressure specific to this environment rather than a procurement preference swinging back the other way. As such, the capabilities inside the risk adjustment lifecycle that carry that new money and that new liability are the capabilities plans are now willing to pay a specialty premium for.
This is Article 2 of a three-part series called Risk Adjustment in the New Regulatory Environment. Article 1 covered the plan-side buying criteria that stopped fitting the current environment and the four properties that replaced them. Article 2 picks up what the vendor response to that shift actually looks like, and what the shape of the response says about where the market goes next. Article 3 covers the organizational separation between Risk Adjustment and Quality Improvement (QI) inside plans, and why the environment CMS built makes that separation structurally unsustainable.
Where Each CMS Move Actually Landed in the Lifecycle
Article 1 walked through V28, chart review exclusion, universal RADV, and the enforcement and OIG guidance that put plans on notice this year, and the mechanics are worth re-reading there. The piece worth adding here is that each of those actions changed the shape of risk inside a specific part of the lifecycle, and the vendor response is sorting itself around which parts of the lifecycle now carry risk that specialty capability can actually address. The regulatory shift did not make all vendor work harder in a uniform way. It made specific capabilities inside the lifecycle meaningfully harder, and plans are rebuilding their vendor stack around the capabilities where that shift lands hardest.
Where Plans Are Reaching for Specialty Depth
Three threads of plan behavior tell you where the demand for specialty depth is strongest right now. Each one is a direct response to a specific place the current conditions created new financial exposure, new audit exposure, or both, and the vendor response is cleanest in exactly those places.
Prospective risk adjustment is where plans are evaluating hardest, because prospective is where audit defensibility can actually be built rather than defended. When a diagnosis is identified prospectively, the plan still has time to get the member in for an appropriate encounter where the treating provider can properly document the condition against Monitor, Evaluate, Assess, and Treat (MEAT) standards. The diagnosis is captured on a linked encounter by definition, which matters because CMS has moved to exclude unlinked chart review diagnoses from the risk score calculation entirely. Prospective capture addresses that exclusion at the source rather than retrofitting a defense after the risk score is already submitted. Retrospective capture, by its nature, cannot do either of those things. It can only code what the record already supports, and if the documentation is thin or the MEAT elements are missing, the vendor has no clinical runway to shore it up. That asymmetry has been true for a long time, but V28 and the chart review exclusion made it material enough that plans are now willing to pay specialty premium for prospective capability that was previously treated as a nice-to-have inside a retrospective-weighted scope.
Audit defensibility is where plans are reaching for depth that used to live outside the vendor relationship. The RADV frequency change and the OIG guidance moved audit defensibility from an episodic concern to a continuous one. Health plans are now evaluating vendors on whether defensibility is a property of how the coding work gets produced, not a service line that gets added after an audit letter arrives. The specialty capability plans want here is coder regulatory literacy, documentation integrity judgment, and willingness to push back on codes the plan or the provider wants captured, but the record cannot defend. That is a different hiring and training profile than the retrospective-era coding operation was built around, and plans are measuring for it on CY 2027 scorecards in ways they were not two bid cycles ago.
Vendors are deepening their clinical and compliance benches because the volume and specificity of what plans are asking for in those areas has grown past what a thin bench can carry. Clinical and compliance leaders at vendors have engaged with prospects, clients, and provider networks all along, and suggesting they were absent misreads the function. What has changed is scope. Health plans are now surfacing clinical and compliance questions continuously, inside evaluations, quarterly business reviews, provider engagements, renewal conversations, and the day-to-day of the coding operations. Vendors already visible on CY 2027 scorecards have added staff beneath their senior clinical and compliance leaders, built specific accountability for how documentation integrity, audit defensibility, and coding judgment live in the work, and increased how often clinical and compliance leadership shows up alongside sales and account management in front of plans.
The Build and the Communication Are Both the Work
Specialty depth is both the build and the communication of the build, and the two are different jobs that each take substantive, patient work. A vendor can do the operational build across people, process, and provider relationships and still lose scope at renewal because plans never saw what was built, and a vendor can run clean messaging and roadmap work and still lose scope because the questions coming in evaluations go deeper than the narrative. The parts of both the build and the communication that plans are scoring hardest cannot be assembled inside one bid cycle, and the sooner the work starts the better.
Prospective capability built credibly requires provider workflow access the vendor does not already have, and provider workflow access is earned over multiple cycles rather than inside one. The prospective capability plans are scoring hardest involves putting the vendor inside the clinician’s documentation flow at the point of care, which requires EMR integration work, provider-side change management, and provider trust that the vendor is additive rather than another layer of friction. Vendors with credible prospective capability today spent multiple bid cycles earning that provider access, often starting with a handful of pilot practices that generated the proof points and the data that opened the next tranche of adoption. For a vendor starting now, the useful first move is picking two or three provider partners the vendor already has credibility with, scoping a prospective pilot that generates clean proof points inside 12 months, and using that pilot as the credential that opens the next twenty. The capability compounds from there, and the plans picking the vendor’s prospective offering off a CY 2028 or CY 2029 bid will be reading the proof points the pilot generated, not the roadmap slide.
For audit defensibility, the training and quality assurance work plans are increasingly asking vendors to walk them through takes real time to build inside a coding operation. Moving coder regulatory literacy from the current baseline to the depth plans are measuring for involves curriculum build against V28 and the OIG guidance, quality assurance protocols that run against audit standards rather than productivity standards, and ongoing calibration against RADV outcomes as those outcomes come back from the first wave of universal audits. A vendor behind on this build should start with a sample audit of its own coding against the specific OIG-flagged practices and the V28 code changes, which produces a measurable baseline of where the coding is weakest right now. The audit gives the vendor a specific document showing where the coding stood, what the vendor changed in the curriculum and QA against those findings, and what the follow-up measurement showed. That document is what the vendor hands a plan in evaluations, which carries more weight than any compliance narrative.
On the clinical and compliance bench, the near-term move is to hire against the specific accountability the vendor needs rather than against a generic C-suite title. The volume problem described in the earlier section does not get solved by posting generic executive roles against the current talent market. The clinical and compliance capability plans are now evaluating for comes from a narrow talent pool, and the hires that do close take two or three quarters to produce visible operational change inside the vendor's coding operation. A vendor losing credit on documentation integrity needs a VP Clinical Informatics or a Senior Medical Director with coding and documentation focus, not a generic Chief Medical Officer. A vendor losing credit on OIG-flagged practice response needs a compliance leader whose track record is specifically on defending vendor practices against regulatory scrutiny, not a generic Chief Compliance Officer. Fractional and advisory arrangements with the right profile can carry weight in the near term while the full hire closes, and in some cases those arrangements become the full hire over time.
Current market conditions will continue to reward these specialty capabilities for several bid cycles. The window to earn premium scope is open for vendors already building the depth and for vendors starting the build now, and the moves above are what the work looks like.
What Comes Next in This Series
The vendor-side reshaping and the plan-side demand for specialty depth are both expressions of the same regulatory pressure, and that pressure is going to show up a third time in a place neither article has reached yet. Article 3 covers the organizational separation between Risk Adjustment and Quality Improvement (QI) inside plans, and why the environment CMS built makes that separation structurally unsustainable. Together, these articles describe one force moving through the system from three vantage points.
If you landed on Article 2 first and have not yet read Article 1, it covers the plan-side buying criteria that stopped fitting the current environment and sets up the vendor-side response that Article 2 traces.
Ryan Peterson is the Founder and Principal of Upward Growth, a health plan market advisory firm that works with health tech vendors, investors, provider organizations, and management consultancies to build strategy around how health plans actually buy, operate, and make decisions. He has 15 years of health tech experience across go-to-market and strategy roles serving the health plan market. He also publishes the weekly Upward Growth newsletter at healthplanweekly.com, covering payor market trends, health tech go-to-market strategy, and CMS regulatory developments for a subscriber base of 7,000+ healthcare executives and investors.