Health care analytics
Risk stratification in health care: what it is and how it works
A plain guide for care management, quality and compliance leads. Definitions and rule text are quoted from the American Academy of Family Physicians and from the federal regulation, as read on 8 November 2026. This is not legal or clinical advice.
In health care, risk stratification is a technique for systematically sorting patients by their health status and other factors, often into low, moderate or high risk, so a team can decide where to put limited attention. The American Academy of Family Physicians describes it as using a mix of objective and subjective data and as something to re-check as a patient's status changes. When software or a model does the sorting, the rules for who gets flagged deserve their own oversight.
plain answer
What is risk stratification?
A Family Practice Management (AAFP) In Practice blog entry defines risk stratification as a technique for systematically categorizing patients based on their health status and other factors. In its words, patients are assigned a low, moderate or high risk level.
The same article says the process generally uses a combination of objective and subjective data. Its examples of patients who may sit at higher risk include people with chronic conditions, advanced age, frequent hospital or emergency department visits, and difficulty following a treatment plan.
The term is used in other fields too, such as finance and security. This page covers health care only.
Source: Family Practice Management (AAFP), Three practical ways to assign risk levels to your patients, FPM Editors, 16 May 2019 (https://www.aafp.org/pubs/fpm/blogs/inpractice/entry/risk_stratification.html), read 8 November 2026.
plain answer
How does risk stratification work?
The AAFP article describes the manual version: gather data about each patient, assign a level, and act on it. A practice can do this with a checklist. In Kriv AI's view, larger organizations often use software that scores every patient, so the level comes from a model instead of a person. The AAFP article does not cover that software.
The AAFP article calls risk stratification a dynamic process and advises that you re-evaluate risk scores regularly and as you become aware of changes in the patient's status. A score is a snapshot, not a label for life.
The step from a person using a checklist to a model producing a score is where governance questions begin: what the model was trained to predict, who checked it, and who reviews the people it ranks low.
Sources: Family Practice Management (AAFP), 16 May 2019 (https://www.aafp.org/pubs/fpm/blogs/inpractice/entry/risk_stratification.html), read 8 November 2026. The last paragraph is Kriv AI's view.
how to
What is risk stratification used for?
The purpose is to direct limited resources, such as care manager time, outreach calls or a place in a chronic disease program, to the patients who may need them most. Which patients get that attention depends on where the cut-off between levels is set.
The AAFP article lists chronic conditions, frequent hospital or emergency department visits and difficulty following a treatment plan as examples of patients who may sit at higher risk.
Under shared-savings or capitation contracts the same scores can also affect money, which is why some organizations treat these models like other high-impact decisions. Our page on value-based care analytics governance covers that case.
Source: Family Practice Management (AAFP), 16 May 2019, read 8 November 2026 (purpose and examples). The point about contracts is Kriv AI's view; see /value-based-care-ai-analytics-governance.
security
Does 45 CFR 92.210 apply to risk stratification tools?
It can, if your organization is a covered entity and the model fits the definition below. The federal rule at 45 CFR 92.210 says a covered entity must not discriminate on the basis of race, color, national origin, sex, age or disability in its health programs or activities through the use of patient care decision support tools. It adds an ongoing duty to make reasonable efforts to identify uses of such tools that employ input variables or factors measuring those characteristics, and to make reasonable efforts to mitigate the risk of discrimination from each one identified.
45 CFR 92.4 defines a patient care decision support tool as any automated or non-automated tool used by a covered entity to support clinical decision-making. Whether a risk stratification model falls inside that definition, and whether your organization is a covered entity, is a question for your counsel.
Sources: eCFR text as published by Cornell Law School LII, 45 CFR 92.210 (https://www.law.cornell.edu/cfr/text/45/92.210) and 45 CFR 92.4 (https://www.law.cornell.edu/cfr/text/45/92.4), read 8 November 2026. LII does not show an effective date and we did not check compliance dates or the current enforcement position.
kriv role
Where Kriv helps
Kriv AI helps health systems and health plans put oversight around the models they use to rank patients: who owns each model, how it is checked on your own patient population, how changes are approved, and how the record is kept. Our population health model bias page explains one failure mode in depth.
Kriv does not make clinical decisions, does not provide legal advice and does not replace your compliance team.
limits
What this page could not confirm
We read one clinical practice source and two regulation sections. We did not read peer-reviewed validation studies on this page, HHS guidance on the rule, the rule's preamble, or any current court or enforcement status. Regulation text and its status can change. Check the current text and talk to counsel before you act.
Check the current status and compliance dates of this rule with your counsel before relying on it.
Straight answers
Frequently asked questions about Risk stratification in health care: what it is and how it works
What is risk stratification in simple terms?
Sorting patients into groups, often low, moderate or high risk, by their health status and other factors so a team can decide where to focus limited attention (AAFP, read 8 November 2026).
What data is used for risk stratification?
The AAFP article says the process generally combines objective and subjective data. What a software product uses is often set by its vendor; the AAFP article does not cover software.
How often should risk levels be updated?
The AAFP article advises re-evaluating risk scores regularly and as you become aware of changes in a patient's status.
Is a risk stratification model a patient care decision support tool under the federal rule?
That depends on the facts. The definition in 45 CFR 92.4 covers any tool used by a covered entity to support clinical decision-making in its health programs or activities. Ask your counsel about your specific model.
Who checks whether the model is fair?
Your organization does. Our population health model bias page describes one way teams test a ranking model against an independent measure of illness.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call