Readiness for risk starts at the point of care

Value-based care is moving toward greater risk. Are you ready?

The industry's yardstick for payment reform, the HCP-LAN framework, sorts every healthcare dollar into four categories. The first two are fee-for-service: Category 1 with no link to quality at all, Category 2 with quality-linked bonuses or penalties layered on top. In both Categories 1 and 2, volume still drives revenue. The alternative payment models, or APMs, that define value-based care sit in the top two categories. Category 3 covers shared savings and shared risk: arrangements still built on fee-for-service architecture but reconciled against a total-cost-of-care benchmark. Category 4 is population-based payment, commonly called capitation, where the visit volume incentive disappears entirely.¹

The latest national measurement, covering 271 million lives, found 44.9% of U.S. healthcare payments now flow through those two APM categories.¹ That topline was flat year over year but don't read it as stalling. Underneath, risk is deepening, and differently in each payer pool.

Risk trends by payer pool

In traditional Medicare, risk is becoming mandatory: the Ambulatory Specialty Model, finalized last October, imposes compulsory two-sided risk starting in 2027 on selected specialists managing heart failure and low back pain in roughly a quarter of U.S. markets, with no opt-out.² It follows CMS’s mandatory Transforming Episode Accountability Model (TEAM) model for hospitals,³ and together they mark a shift in Medicare's value-based participation from voluntary to required. The 2027 physician fee schedule, still a proposed rule but the signal holds either way, pays clinicians in advanced APMs a 0.75% annual update versus 0.25% for everyone else, a gap that compounds.⁴ However the final rule lands, the signal doesn't change: the fee schedule itself is being rebuilt to reward value-based participation.

Medicare Advantage (MA) is furthest along: roughly 60% of MA dollars flow through shared savings or population-based models, and about 45% carry downside risk, the deepest of any line of business.¹

In Medicaid, states are writing risk into procurement itself — Florida's new statewide contracts require value-based agreements with progressive benchmarks over a six-year term,⁵ Texas requires half of MCO provider payments through APMs,⁶ and Oregon requires 70%, a quarter with downside risk.⁷

And in commercial, the shallowest pool, cost may do what regulation hasn't: employer health benefit costs rose 8.8% in 2026 and are projected to climb more than 8% again in 2027, the steepest climb in two decades.⁸ Employers are already reacting. Disney notified more than 200,000 employees that spouses with access to their own employer's coverage will lose eligibility for the company plan in 2027, citing rising healthcare expenses.⁹ Benefit cuts like that manage the symptom. The structural response is paying for value and 70% of payers already expect their APM activity to increase over the next 24 months.¹

So, the question is no longer whether to take risk. It's whether the risk you sign matches the capability you've built. And beneath every contract in every pool sits the same operational truth: the organizations that perform put data-driven insight in front of clinicians at the point of care. The contract changes the incentive. The insight changes the care.

Start with what you actually control

The 2024 Medicare Shared Savings Program results (75% of 476 ACOs earning a record $4.1 billion) show what capability looks like. Low-revenue ACOs, typically physician-led, generated $316 in net per-capita savings against $175 for high-revenue, typically hospital-led ones.¹⁰ Read that gap carefully, because it's structural, not a verdict on capability. It tells each type of organization something different about where its own work lies.

If you lead an independent medical group, you hold the cleaner hand: when an avoidable admission is prevented, nothing on your P&L takes a hit. But a clean P&L removes the conflict, and it doesn't capture the savings. The groups that capture it run disciplined primary care operations: rising-risk identification, same-day access, post-discharge follow-up within days. They manage the continuum they don't own through data and tightly held transitions.

If you lead a health system, you carry the harder economics — utilization you eliminate comes off your own revenue line — but the assets to match. Systems that perform give the risk book its own governance rather than burying it under service-line P&Ls, pair utilization reduction with a deliberate backfill strategy, and lean into the accountability where system assets are genuine advantages: episodes of care, post-acute performance, specialty co-management.

Either way, the discipline is identical: map which cost and outcome drivers you genuinely control and match your accountability scope to that map. No organizational form wins by default. The contract sets the economic signal; the operating system determines the result.

Score yourself before you sign

Before signing, score yourself across five domains: population clarity, clinical controllability, data actionability, financial capacity, and execution maturity. Let the weakest one, not the average, set your risk level.

Data actionability is a huge part of scale, because that's where execution breaks down. The average primary care physician now faces a dozen value-based contracts carrying some 52 unique quality measures — up to 103 for the most exposed — according to a 2024 JAMA Health Forum analysis.¹¹ No one reconciles that from memory. Dashboards don't close the gap: a study of 49 Medicare ACO leaders found that nearly all of their organizations used them, yet clinician behavior rarely changed as a result.¹² A dashboard shows performance deteriorating; it doesn't tell anyone which patient needs action today. The research on alerts sharpens the point: a review of 54 randomized trials found generic EHR nudges improved documentation but not outcomes.¹³ The lesson isn't that point-of-care guidance fails, it's that generic guidance fails. Insight that is relevant to the patient in the room, trusted, prioritized, actionable inside the workflow, and closed-loop is a different instrument entirely. Delivered through the EHR at the point of care, it's a critical mechanism that operationalizes value-based care at scale: every patient, every visit, every clinician.

Contract for the fine print, not the headline rate

The economics live in the fine print: attribution, benchmark construction, trend assumptions, risk scores, quality gates, payment timing. Model them against your own data before signature, with clinical and data leaders at the table alongside finance and legal. This is because a payout is partially performance and partially contract math, and leaders have to hold both ideas at once. After each performance year, run one audit: how much of the result was contract math, and how much was changed care? That answer, not the size of the check, tells you what to build next.

Take risk in modules, not leaps

Waiting for perfect readiness becomes an excuse to never move; using downside risk as a forcing function for capabilities that don't exist is reckless. The right approach sits between: minimum viable readiness, then staged exposure through caps, corridors, stop-loss, and glide paths. This is similar logic that CMS built into the new ACO LEAD model, whose ten-year performance period is the longest the Innovation Center has ever tested.¹⁴ And stand up governance before risk: one accountable executive, one version of performance, one quantified worst case.

Run a three-part test this quarter: Can you identify a patient whose risk is rising? Reach that patient in time to matter? Prove the intervention worked? If not, that's not a reason to retreat — it's your build list, on a timeline that's no longer yours to set.

Risk should follow capability. And capability, at its core, is the right insight reaching the point of care in time to change the care. Get that right, and the contracts become far easier to manage.