Responding to a payer records audit means confirming exactly which claims and records the payer wants, by when and how, then pulling, checking and sending only those records, complete and signed, before the deadline. A careful response answers the audit's questions without handing the auditor new problems, and keeps a log of everything sent.
Types of payer records audits
Payer records audits come in four common types: prepayment reviews, post-payment reviews, risk adjustment audits and coding audits. Each type asks for records for a different reason, which changes what the auditor looks for and how much money is at stake. The audit letter usually says which type it is.
Prepayment review. The payer holds a claim until it sees records that support it. Nothing has been paid yet, so the risk is a denial, not a repayment. Medicare's version is explained in the Medicare Program Integrity Manual, chapter 3, which covers both prepayment and post-payment reviews by its contractors.
Post-payment review. The payer reviews claims it already paid and can ask for money back. The CMS Recovery Audit Program page describes Medicare recovery auditors as conducting "complex and automated post-payment reviews". Complex reviews are the ones where a person reads the medical record, so they are the ones that generate records requests.
Risk adjustment audit. A health plan, or CMS reviewing a plan, checks that the diagnoses reported for a member are supported by the chart. The CMS Medicare Advantage RADV page says CMS confirms in these audits that diagnoses submitted for risk adjustment "are supported in the enrollees' medical records". The regulation behind it, 42 CFR 422.310 on the eCFR, paragraph (e), requires Medicare Advantage plans "and their providers and practitioners" to submit a sample of medical records for validation.
Coding audit. A commercial plan checks whether the codes on a set of claims match the documentation. The audit letter and the provider's contract with the plan set its terms, so read the contract's audit clause before anything else.
Medicare's own documentation requests follow a fixed process with deadlines in regulation. The Medicare ADR checklist, item by item covers that case, and this post focuses on the steps any payer audit shares.
The first week after a payer audit letter arrives
The first week after a payer audit letter arrives is for confirming four facts: the exact sample of claims, the deadline, the payer's contact, and the delivery method. Getting these right before pulling a single record prevents the most expensive mistakes, such as answering for the wrong claims or sending records the wrong way.
Confirm the sample. List every claim in the letter with its patient, date of service and claim number. Check each against your billing system. If a claim is not yours, or the date does not match a visit, ask the payer in writing before you respond.
Confirm the deadline. Write down the due date and how it is counted, from the letter date or from receipt. For Medicare, 42 CFR 405.929 on the eCFR gives 45 calendar days for most post-payment requests and 30 for a UPIC request. For a commercial plan, the letter and your contract set the date. Ask for an extension early and in writing if the sample is large.
Confirm the contact. Note the auditor's name, phone and email, and the audit reference number. Every message should quote that number.
Confirm the delivery method. Payers accept records by portal, secure upload, mail or fax, but each audit names its own. Records sent to a general claims address may never reach the auditor.
Then name one internal owner. An audit spread across billing, coding and front-desk staff with no single owner is how deadlines slip.
A response timeline from day 1 to day 30
The timeline below is an example for a fictional audit: reference AUD-2026-0912, 25 claims, due 30 days after receipt. All values are made up. Shift the days to fit your actual deadline.
| Day | Tasks |
|---|---|
| Day 1 | Log the letter's received date. Name the owner. Enter the 25 claims in a tracking sheet. Put the deadline on the calendar with a reminder at day 20. |
| Day 7 | Sample confirmed against billing. Questions sent to the auditor in writing. Delivery method and format confirmed. Extension requested if needed. Record pulls started for every claim. |
| Day 14 | All records pulled. First check done: every date of service present, every note signed, every page readable. Gaps listed with the person responsible for each. |
| Day 30 | Final check against the sample list. Cover letter and page index written. Records sent by the confirmed method. Submission receipt saved. Log closed for this stage. |
If day 14 shows that a record is missing, that is the moment to find it, not day 29. Pulling records from another facility or a storage vendor is its own process, explained step by step in the guide to medical records retrieval.
Pulling and checking records for a payer audit sample
Pulling and checking records for a payer audit sample means collecting, for each sampled claim, the records that support that date of service, then checking every page for completeness, signatures and dates before anything leaves the office. The check is where most avoidable findings are prevented.
Start from the claim, not the chart. For each line in the sample, ask what the claim billed and what documentation supports it: an order, a note for the visit, results the note relies on and any required forms. Pull those items and nothing else.
Then check each set against three questions.
Is it complete? Every date of service in the sample has a note. Multi-page notes have every page. Attachments the note refers to, such as a test result, are present.
Is it signed? Each note carries its author's signature. For Medicare reviews, the manual's section 3.3.2.4 accepts signature logs for illegible signatures and attestations signed by the author, and says stamped signatures "are not typically acceptable". Commercial payers set their own rules, often in the provider manual.
Are the dates right? The date on the note matches the date of service on the claim. A note printed with the wrong encounter, or a date in the header that differs from the date in the body, needs to be resolved before sending.
A fictional example: claim 7740-2026-3381 for patient Marcus Delgado, date of service 05/12/2026. The note is signed, but its second page, with the plan of care, is missing from the export. The checker finds it in the EHR and adds it. Without the check, the auditor would have reviewed a one-page note.
Checking hundreds of pages by hand is slow. Software that reads records and points each fact to its page can speed it up, and the guide to medical record review software explains which features matter for this kind of work.
Does a payer audit need a patient authorization?
A payer audit usually does not need a patient authorization, because the HIPAA Privacy Rule permits disclosures for payment without one. A records request tied to a claim's payment, coverage or medical necessity review falls within the rule's definition of payment. A practice's privacy officer should still confirm each request fits.
The rule's text is the primary source here. 45 CFR 164.506 on the eCFR, paragraph (c)(3), lets a covered entity disclose protected health information to another covered entity "for the payment activities of the entity that receives the information." The definition of payment in 45 CFR 164.501 on the eCFR includes "review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges" and "risk adjusting amounts due".
Two other parts of the rule still apply. The minimum necessary standard in 45 CFR 164.502 on the eCFR, paragraph (b), requires reasonable efforts to limit what is disclosed. 45 CFR 164.514 on the eCFR, paragraph (d)(3)(iii), lets a covered entity rely on a request from another covered entity as the minimum necessary, if that reliance is reasonable. A plan's audit request is such a request, so its list of records is a sound boundary.
Disclosures for payment are also excluded from a patient's right to an accounting of disclosures, under 45 CFR 164.528 on the eCFR, paragraph (a)(1)(i). Keeping your own log is still good practice. Wider questions about disclosure rules belong to the HIPAA and PHI category.
Payer audit responses that create new findings
Payer audit responses create new findings when they give the auditor more to question than the original sample did. The three most common causes are sending extra records, adding late addenda without marking them, and sending copies of the same note that do not match each other.
Sending extra records. A whole chart sent for a single date of service lets the auditor read every other visit. If another visit has a coding problem, it may become a new finding. Send what the sample asks for.
Late addenda. A note amended after the audit letter arrived, without a clear date and author, looks like an attempt to fix the record after the fact. Medicare's manual, section 3.3.2.5, says the date and author of any amendment, correction or delayed entry "should be identifiable" and the change "clearly and permanently denoted". If an addendum is legitimate, it should show when it was made.
Inconsistent copies. The same note printed from the EHR on two different days can differ if it was edited between prints. If the payer already holds one version from an earlier claim submission and receives another now, it will ask why.
Explaining in the cover letter. A cover letter that argues medical necessity or admits an error can become part of the finding. Keep the cover letter to facts: the audit reference, the claims, the pages and the contact.
What happens after a payer audit response is sent?
After a payer audit response is sent, the practice logs what it sent and when, then waits for the payer's findings letter. The payer reviews the records, decides claim by claim, and reports any overpayment or denial with a deadline to respond or appeal.
Log the submission. Record the date, the method, the confirmation number and the exact pages sent for each claim. Keep a copy of the full package as sent. If the payer later says a record was missing, the log answers the question.
Know the review clock. Medicare's manual, section 3.3.1.1(H), gives contractors their own deadlines once records arrive: a MAC makes a post-payment determination and mails the results letter within 60 calendar days of receiving the documentation, and a RAC makes and communicates its determination within 30 calendar days. Commercial plans set their own timelines in the contract or the letter.
Read the findings by claim. A findings letter usually lists each claim as supported, partly supported or not supported, with a reason. Compare each reason with the records you sent before deciding what to do.
Decide on next steps. Accepting a finding, sending a rebuttal or filing an appeal are separate paths with their own deadlines. Appeal letters are covered in the revenue cycle automation category.
A good log is the thread that ties all of this together. Schema Care keeps a record of each approval and correction a reviewer makes, with who made it and when, as the human review workflow on the homepage describes, for the documents it reads.