Medicare Part C & Part D: How defensible is your data?
Medicare Part C & Part D data validation isn't just an annual compliance exercise. It's a test of how defensible your data really is.
Medicare Part C and Part D data validation is one of the most consequential and most frequently misunderstood compliance requirements facing Medicare Advantage organizations and Part D sponsors. Every year, sponsoring organizations must participate in an annual retrospective data validation of their Part C and Part D reporting requirements data, conducted by an independent external contractor per CMS specifications.
In 2026, this requirement carries more weight than ever. CMS has eliminated audit scoring, deployed real-time automated oversight, and confirmed that RADV audits are continuing at a quarterly cadence. The margin for data inaccuracy has narrowed significantly.
At HealthSpective, our healthcare consulting and data validation teams work with Medicare Advantage organizations and Part D sponsors year-round on exactly these requirements. This FAQ addresses the questions we hear most often in plain language, with current 2026 guidance.
Section 1: The Basics
Q: What is Medicare Part C and Part D data validation?
Medicare Part C and Part D data validation (DV) is a CMS-required annual process in which Medicare Advantage organizations (for Part C) and Part D sponsors verify the accuracy, completeness, reliability, and consistency of the reporting requirements data they submit to CMS. The validation is conducted retrospectively meaning it occurs in the year following the contract year being reviewed. For example, CY 2024 data was validated in 2025.
CMS uses the validated data to support payment calculations, quality measurement, program integrity activities, and public reporting. The accuracy of this data directly affects risk adjustment payments, Star Ratings, and regulatory compliance standing.
Q: Is participation in data validation mandatory?
Yes. CMS regulations require that all Medicare Advantage organizations and Part D sponsors participate in annual retrospective data validation. There is no exemption for small plans, new plans, or plans with limited membership. Failure to participate or failure to engage a qualified independent contractor is itself a compliance deficiency.
Q: Who conducts the data validation can we use our own staff?
No. CMS explicitly requires that the data validation be conducted independently. Sponsoring organizations cannot use their own staff. Per CMS policy, each organization must select an external data validation contractor and is responsible for acquiring and funding these external resources.
This independence requirement exists because organizations have an inherent conflict of interest in validating their own data. External validation brings the objective perspective, standardized methodologies, and specialized tools necessary to conduct a credible review.
Q: What data is covered by Part C and Part D data validation?
The validation covers the full set of Part C and Part D Reporting Requirements data that organizations submit to CMS. This includes but is not limited to:
Part C Data Elements | Part D Data Elements |
Enrollment and disenrollment data | Prescription drug event (PDE) data |
Grievance and appeals processing data | Formulary and benefit design data |
Coverage determination data | Medication therapy management (MTM) program data |
Utilization management data | Low-income subsidy (LIS) data |
Care coordination and SNP model of care data | Transition-of-care policy data |
HEDIS quality measure data | Part D reporting requirements submissions |
Section 2: The Process
Q: How does the Part C and Part D data validation process work step by step?
The data validation process follows a structured sequence:
Contractor selection: The sponsoring organization selects a qualified, independent data validation contractor and executes a contract.
Audit period and universe development: The contractor works with CMS specifications to define the audit period, develop required universes of data, and design the sampling approach.
Data submission by the sponsor: The organization submits the required data universes and supporting documentation to the contractor.
Universe integrity validation: The contractor validates that the submitted universes are complete, accurate, and consistent with CMS requirements.
Focused sampling and testing: The contractor draws samples from the validated universes and conducts detailed testing of the sampled records.
Findings documentation: The contractor documents all findings, error rates, and supporting evidence.
Results submission to CMS: The contractor submits findings to CMS, and CMS publishes contract-level data following the validation process.
Q: When does the data validation occur relative to the contract year?
Data validation is retrospective. CMS conducts validation of a given contract year (CY) in the subsequent year. For example:
CY 2023 data → validated in 2024
CY 2024 data → validated in 2025
CY 2025 data → validated in 2026
Organizations should be aware that they may be simultaneously managing current-year data quality and responding to a prior-year validation requiring concurrent attention to both operational compliance and audit response.
Q: What is the difference between Part C/D data validation and a RADV audit?
These are two distinct CMS processes that are frequently confused:
Factor | Part C/D Data Validation | RADV Audit |
Focus | Accuracy of all Part C/D reporting requirements data | Accuracy of risk adjustment diagnosis codes specifically |
Frequency | Annual (retrospective) | Contract-specific, ongoing; PY 2020 audits began Feb 2026 |
Trigger | Required for all MA and Part D sponsors annually | CMS-initiated; all MA contracts eligible |
Primary outcome | Data quality assessment; potential corrective action | Payment adjustment; potential recoupment |
Medical records required? | Depends on measure being validated | Yes medical records required for all sampled diagnoses |
Both require independent external expertise. Both can result in corrective action requirements. And both are governed by the same overarching principle: data submitted to CMS must be accurate, complete, and defensible.
Q: What role does HEDIS data play in Part C data validation?
HEDIS® quality measurement data is a component of Part C reporting requirements and is subject to data validation review. For HEDIS data specifically, CMS uses the audit designation assigned by the NCQA-certified HEDIS auditor. A "BR" (biased rate) designation indicating that a measure's data is materially biased is treated as a data quality failure that can affect Star Rating calculations. A "NR" (not reported) designation indicates the organization chose not to report that measure.
Organizations must ensure that their HEDIS data pipelines including administrative data, hybrid measure medical record abstraction, and ECDS submissions meet the accuracy standards required to avoid BR designations.
Section 3: Contractor Selection
Q: What qualifications should we look for in a data validation contractor?
CMS sets forth specific criteria for data validation contractor selection. Beyond CMS's minimum requirements, organizations should evaluate contractors on:
CMS expertise: Deep familiarity with current-year CMS audit protocols, data validation specifications, and universe integrity requirements
Part C and Part D coverage: Ability to validate across both programs, not just one
Independence: No organizational, financial, or operational relationship with the sponsoring organization that could compromise independence
Track record: Demonstrated history of conducting Part C and Part D data validations that result in clean or defensible findings
Analytics capability: Specialized tools for universe integrity testing, error rate calculation, and sampling methodology
Q: Can we use the same contractor for both Part C and Part D validation?
Yes and for most organizations, using a single contractor with expertise across both programs is more efficient and produces more integrated findings than engaging separate contractors for each program.
Q: How far in advance should we engage our data validation contractor?
Best practice is to engage your data validation contractor at least 90 to 120 days before the validation period begins. Earlier engagement allows more time for universe development, contractor orientation to your data systems, and identification of any upfront data quality issues that can be addressed before the formal validation begins.
Section 4: Findings and Consequences
Q: What happens when data validation identifies errors?
The consequences depend on the nature, severity, and scope of errors identified. Common outcomes include:
Corrective action plans (CAPs): Organizations must develop and implement remediation for identified deficiencies within CMS-defined timelines
Data corrections: Specific data submissions may need to be corrected and resubmitted
Payment adjustments: In cases involving risk adjustment or payment data errors, CMS may adjust payments accordingly
Star Rating impacts: Validated data quality failures can affect Star Rating calculations for affected measures
Independent Validation Audit (IVA): Under the 2026 CMS program audit framework, independent auditors are required when a sponsor has more than five conditions needing validation audit
Q: What are the most common types of errors found in Part C and Part D data validation?
Based on published CMS findings and audit enforcement reports, recurring error categories include:
Part D: Missing or invalid documentation (75% of all Part D payment errors per FY 2025 reporting), formulary compliance gaps, LIS eligibility errors, PDE submission inaccuracies
Part C: Grievance and appeals processing failures, prior authorization timeline violations, enrollment and disenrollment data errors, coverage determination documentation gaps, delegated entity data oversight failures
Both programs: Universe integrity failures, incomplete data submissions, inadequate oversight of downstream vendors and subcontractors
Q: What is an Independent Validation Audit (IVA) and when is it required?
An Independent Validation Audit (IVA) is a formal third-party review of a plan's corrective action plan following a CMS program audit. Under 2026 CMS guidelines, IVAs are required when a sponsor has more than five conditions identified as needing a validation audit a refinement from prior years that focuses IVA requirements on organizations with more significant compliance gaps.
The IVA process tests whether the corrective actions implemented by the plan have actually resolved the identified deficiencies. HealthSpective's team includes experts who support organizations through both the IVA audit process and the corrective action implementation that precedes it.
Q: Can data validation findings affect our ability to bid for new contracts or expand our service area?
Yes. Significant or recurring data validation deficiencies can affect CMS's assessment of an organization's operational fitness and compliance track record factors that CMS considers in contract-related decisions including bids, service area expansions, and contract renewals.
Section 5: Preparation and Best Practices
Q: How should we prepare for annual data validation?
Best-practice preparation includes:
Year-round data quality monitoring do not wait for validation season to assess data accuracy; build continuous monitoring into operations
Universe development practice runs periodically generate and review the data universes that will be submitted for validation, identifying anomalies before the formal process begins
Documentation quality assurance ensure that documentation supporting all submitted data meets CMS standards, particularly for Part D claims and Part C coverage determinations
Delegated entity oversight regularly audit data quality from downstream vendors, PBMs, and subcontractors whose data affects your submissions
Pre-validation internal review conduct a focused internal review of the prior year's data 60 to 90 days before validation begins to identify and address obvious gaps
Q: Does HealthSpective provide Medicare Part C and D data validation services?
Yes. HealthSpective provides CMS Medicare Part C and D data validation services, Independent Validation Audit support, and comprehensive audit readiness and compliance monitoring services for Medicare Advantage organizations and Part D sponsors. Our team includes subject matter experts with deep CMS audit experience across both Part C and Part D programs. Contact Info@HealthSpective.net or (713) 581-4320 to learn more.
Partner With HealthSpective for Medicare Part C and D Data Validation
Navigating Medicare Part C and Part D data validation requirements demands technical expertise, regulatory knowledge, and organizational independence that most plans cannot build internally. HealthSpective's data validation and healthcare consulting services are built to provide exactly that helping Medicare Advantage organizations and Part D sponsors meet their validation obligations with confidence and protect their compliance standing year after year.
Comments