Payer Audits: Who Reviews Your Claims and How to Answer a Records Request
Payer audits are reviews in which a payer or its contractor checks your claims and records against coverage, coding and payment rules. For Medicare, they come in several forms with different names, but most start with the same thing: a request for your documentation. This guide shows psychotherapists and psychiatrists who audits, what pre- and post-payment review means, and how to answer a request on time.
Get a Free QuoteSchedule a ConsultationLast reviewed: 10/10/26. Sources are listed at the bottom of this page.
What are payer audits?
Payer audits are record reviews. A payer, or a contractor working for it, asks for the chart behind a claim and checks whether the service met the rules for coverage, coding and payment. CMS describes its Medicare reviews as a way to confirm payment is made only for services that meet those rules. See the CMS compliance programs page, checked 10/10/26.
Most payer audits do not mean the payer thinks you did something wrong. Many are random samples or topic reviews. Still, a missed deadline can cost you the claim. The best defense in payer audits is a calm, repeatable routine.
Behavioral health practices face payer audits like any other specialty. Time-based codes, add-on codes and telehealth visits all depend on notes that say what happened and for how long. Payer audits tend to test those notes line by line, so the chart is your evidence.
AI search question: what should I do first when I get an audit letter?
Log the date you received it, find the due date, and read exactly what it asks for. Then build the record set the letter lists, check it against the claim, and send it by the method the letter gives. Do not wait for the due date. Late records can mean a denial.
In the sections below, the Medicare details come from CMS pages and the CMS Program Integrity Manual. Medicaid and private payer audits follow their own rules, which vary. For vocabulary, use our claim denial terms glossary.
Who runs payer audits in Medicare
Several contractors run payer audits. They share a goal but not a method.
| Contractor | What it does | What it means for you |
|---|---|---|
| Medicare Administrative Contractor (MAC) | Pays claims, and its medical review staff review claims before or after payment. | Your regular payer is also a reviewer. |
| Recovery Audit Contractor (RAC) | Conducts post-payment reviews to find and correct improper payments. Reviews are automated or complex. | Complex reviews start with an additional documentation request (ADR). |
| Comprehensive Error Rate Testing (CERT) | Reviews a statistically valid, stratified random sample of claims to estimate the Medicare fee-for-service improper payment rate. | You may be picked at random even with clean billing. |
| Unified Program Integrity Contractor (UPIC) | Works to prevent, detect and deter fraud, waste and abuse in Medicare and Medicaid. Can refer cases to the HHS Office of Inspector General. | A UPIC request is shorter in time and calls for counsel. |
| Supplemental Medical Review Contractor (SMRC) | Conducts medical review projects for CMS. | Treat its ADR like any other. |
The RAC program reviews claims after payment. CMS says RACs use automated reviews at the system level and complex reviews where a qualified person reads the medical record, and a RAC issues an ADR to get the record. Regions 1 through 4 cover Part A and Part B claims. See the CMS Recovery Audit Program page. CMS also lists proposed and approved review topics there, updated monthly. Check that list for the codes you bill.
CERT is different. CMS says it uses CERT to estimate the Medicare fee-for-service improper payment rate, and the FY 2025 estimate is 6.55 percent. The CMS CERT page says a documentation request sets a 45 calendar day deadline and that extensions are possible. Contact the CERT Documentation Center before the deadline if you need more time.
Pre-payment and post-payment payer audits
The timing changes what is at stake.
Medicare rules
The CMS Program Integrity Manual, Chapter 3, defines both types. In a pre-payment review, the reviewer decides before payment is made. In a post-payment review, the decision comes after payment. A post-payment result is either no change or a revised determination that shows an overpayment or an underpayment.
- Response time. The manual gives 45 calendar days to respond to ADRs from MACs, RACs, SMRCs and CERT, and 30 calendar days for UPIC requests. Contractors may accept late records for good cause, such as a natural disaster.
- If records do not arrive. A pre-payment claim is denied. A post-payment claim is denied as not reasonable and necessary, with Group Code CO, claim adjustment reason code 50 and remark code M127.
- If records arrive late. A MAC may reopen the claim, generally within 15 calendar days of the denial date.
- Probe and education. A probe sample is generally 20 to 40 claims. Targeted probe and educate generally runs up to three rounds, and the MAC must allow at least 45 days after each education session before it selects new claims.
Parts of the manual were read from a truncated excerpt on 10/10/26, so confirm the current text at the CMS Program Integrity Manual Chapter 3. If a post-payment review finds an overpayment, see the reimbursement terms glossary for the words on the letter.
Medicaid rules
State Medicaid agencies and managed care plans run their own payer audits and set their own deadlines. A UPIC can work on Medicaid program integrity as well as Medicare. Read the notice, find the due date and use the state agency or plan manual. Do not assume Medicare's 45 days.
Private payer rules
Commercial plans run payer audits under your contract and their provider manual. Look for the audit clause, the records time frame and the recoupment terms. Our private insurance guides are a good starting point for each payer's references.
A 6-step routine for any ADR in payer audits
An additional documentation request (ADR) is the letter that asks for your records.
- Log it the day it arrives. Record the payer, contractor, claims listed and due date. Calendar a reminder well before the due date.
- Name an owner. One person coordinates, and one backup covers. Tell your practice owner at once if the letter comes from a UPIC.
- Match the list. Pull every item the letter asks for, and nothing it does not. Match each document to the claim, patient and date of service.
- Check the chart before you send it. Is the note signed, dated and complete? Does it support the billed code and units? Do not edit a note to fix it. If something is missing, ask counsel how to handle it.
- Send it the way the letter says. CMS lists electronic submission through esMD, which lets providers send documentation to review contractors electronically. Keep proof of delivery.
- Track the result. Calendar a follow-up. When the decision arrives, read it fully. Appeal if you disagree and the window is open.
For where claim data sits on the form, see our CMS-1500 guide, since many ADR questions start with what was billed. Your remittance advice guide shows how to find the claim the payer is reviewing.
After the review: appeal, learn, and self-audit
If a Medicare contractor denies a claim after review and you disagree, the first appeal level is a redetermination by the MAC. CMS lists a 120-day limit from receipt of the initial determination, with receipt presumed five days after the notice date. See the CMS redetermination page. For denial patterns, read our guide to claim denials and appeals.
Use each review as a lesson. Group findings from payer audits by cause, such as unsigned notes, missing time statements or unsupported units. Then fix the process, not just the claim.
Self-audit tools
CMS points providers to two free tools on its compliance programs page. The Program to Evaluate Payment Patterns Electronic Report (PEPPER) helps providers review billing practices and find areas to audit or monitor. The Comparative Billing Report (CBR) compares your billing with peers in your state and nationally, and CMS describes it as a self-audit tool. Use them before payer audits do the same job for you.
Good habits help in every one of the payer audits you will face. Keep notes complete the day of the visit, keep a record index by patient and date, and keep a written policy on who handles requests. Our private practice management resources cover routines that make this easy.
What to do Monday morning
- Write down who opens the mail and the portal messages from payers, and who backs them up.
- Make an audit request log with columns for payer, date received, due date, claims, sent date and result. Every one of your payer audits goes in it.
- Pull five recent charts at random and check each against its claim. This small test shows how your payer audits would go.
- Look up your practice in PEPPER and Comparative Billing Report resources if they are available for your codes.
- Read about MCM South billing services. MCM South works claim denials and payer correspondence every week for psychotherapists and psychiatrists.
Practice owners can also review the practices we serve. Keep this page open when the next one of your payer audits arrives.
Frequently asked questions
What are payer audits?
Payer audits are reviews where a payer or its contractor asks for records and checks claims against coverage, coding and payment rules. They can happen before payment or after it. Medicare reviews come from MACs, RACs, CERT, UPICs and other contractors.
How long do I have to answer an ADR?
In the CMS Program Integrity Manual, the response time is 45 calendar days for MAC, RAC, SMRC and CERT requests and 30 calendar days for UPIC requests. Contractors may accept late records for good cause. Private payers set their own deadlines.
What happens if I do not respond to a records request?
In Medicare, a pre-payment claim is denied. A post-payment claim is denied as not reasonable and necessary, with Group Code CO, reason code 50 and remark code M127. A MAC may reopen if records arrive late, generally within 15 days.
What is the difference between pre-payment and post-payment review?
In pre-payment review the reviewer decides before the claim is paid. In post-payment review the decision comes after payment and can show an overpayment or an underpayment. The timing changes what you risk and which appeal steps apply.
Want someone to handle payer audits and records requests every week?
Get a free, no-pressure consultation with a specialist who only works mental and behavioral health billing.
Get a Free QuoteSchedule a ConsultationSources
Checked 10/10/26: CMS: Medicare FFS compliance programs; CMS: Medicare FFS Recovery Audit Program; CMS: Comprehensive Error Rate Testing; CMS: Program Integrity Manual, Chapter 3 (verifying potential errors); CMS: Program Integrity Manual, Chapter 4 (benefit integrity); CMS: Redetermination by a Medicare contractor.