Surviving a Payer Audit: A Clinician's Field Guide
What should you do when you get a payer audit letter?
Read it for three things: which claims are in scope, what documents they want, and the response deadline. Calendar the deadline immediately with a week of slack built in. Then pull the complete record for every date of service listed, including the assessment, the treatment plan, and every plan review, and read it the way a stranger would. Do not edit a single note.
First, work out what kind of request this is
The letterhead tells you more than the body does, and the correct level of alarm varies enormously.
A routine records request or documentation request is often a pre-payment review, sometimes triggered by nothing more interesting than a billing pattern that differs from your specialty's average. Claims are held pending review. This is the mildest version and it is frequently resolved by simply sending good documentation.
A post-payment review means the payer already paid you and now wants to decide whether it should have. If it comes from a special investigations unit, the framing has shifted from education to recovery.
On the Medicare side, the acronyms matter. Targeted Probe and Educate comes from your Medicare Administrative Contractor, arrives in rounds, and genuinely does include an education component between rounds. A Recovery Audit Contractor is looking for improper payments and is paid contingently. A Unified Program Integrity Contractor is investigating potential fraud, waste, or abuse, and a letter from one is a reason to involve a healthcare attorney before you respond. Comprehensive Error Rate Testing is a national accuracy sample and is not about you specifically.
Whatever the source, identify two facts before doing anything else: whether the review is pre-payment or post-payment, and whether the letter mentions statistical sampling or extrapolation. Those two determine how much is at stake.
The first week
Calendar the deadline the day the letter arrives. If the window is tight, request an extension in writing immediately rather than at the end. Payers grant short extensions far more readily to someone who asks on day two than day nineteen.
Assemble the complete record for each date of service, not only the progress notes. That means the intake assessment, the current treatment plan and every prior version with its review dates, releases and consents, assessment instrument scores, relevant correspondence, supervision documentation if you are pre-licensed, and the claim itself so you can compare what you billed against what you wrote. Missing context is scored as missing documentation.
Then read the chart cold. Not as the clinician who remembers this client, but as someone who has never met them and has a few minutes per note. This is uncomfortable and it is the single most valuable hour you will spend, because it tells you what the finding will be before the finding arrives.
Now the rule that matters most: do not change anything. Not a typo, not a date, not a clarifying phrase. Metadata in modern systems records edits, and an audit response containing notes modified after the request date converts a documentation problem into an integrity problem. If something genuinely needs clarifying, you write a separately dated addendum that says what it is, and you produce both. If you have never read your own system's audit log, now is a reasonable time.
If the letter involves extrapolation, alleges a pattern, or comes from a program integrity contractor, talk to a healthcare attorney before responding. This article is not legal advice and cannot be a substitute for someone who knows your state and your contracts.
What the reviewer is actually scoring
Reviewers work from checklists, and the findings repeat with tedious regularity.
| Finding | What the reviewer saw | Typical consequence |
|---|---|---|
| Time not supported | 90837 billed; note documents 45 minutes, or no time at all | Recoupment down to 90834, or full denial when no time appears |
| Medical necessity not established | Narrative session summary with no diagnosis-linked goal or rationale | Full denial of the date of service |
| Signature missing or invalid | Unsigned note, initials only, a stamp, or no credentials | Full denial regardless of how good the content is |
| Service not documented | A paid claim with no corresponding note in the chart | Full denial, and the finding most likely to expand the review |
| Treatment plan absent or expired | Plan last signed 14 months ago with no interim review | Denial across the entire period the plan should have covered |
| Cloned documentation | Notes substantially identical across dates or across clients | Denial plus an expanded sample |
| Intervention not identified | "Processed feelings," "supportive therapy," "continued to explore" | Denial for lack of a skilled, billable service |
Notice that four of the seven have nothing to do with the quality of your clinical work. You can be an excellent therapist and lose every claim in the sample on signatures and stale treatment plans.
Twelve dates of service: a worked example
A request arrives for twelve dates across eight months for one client: adult with posttraumatic stress disorder (F43.10), weekly individual psychotherapy, mostly billed 90837.
You read the chart cold and find this. Six of the twelve notes contain no documented duration. The treatment plan was signed fourteen months ago and never reviewed. Four notes describe "continued trauma processing" without naming a protocol. One note is dated a day after its claim. The PCL-5 was administered at intake, scored 62, and never administered again.
Here is a representative note from that chart:
As written: Continued trauma work. Client tearful at times. Grounding at end of session. Continue weekly.
There is nothing in that sentence a reviewer can pay for. It names no diagnosis, no duration, no technique, no goal, and no measurable response. It does not distinguish a licensed clinician delivering a trauma protocol from a supportive conversation.
What the same session looks like documented: 08/04/2026, 4:00 to 4:57 p.m., 57 minutes face-to-face, individual psychotherapy, office. Dx F43.10. Session 9 of Cognitive Processing Therapy. Reviewed Impact Statement homework, then delivered Socratic dialogue targeting the assimilated belief "I should have seen it coming," addressing Goal 2 (reduce PCL-5 from 62 to below 33 by 01/2027). Client identified two pieces of counter-evidence and revised the stuck point in writing. SUDS 70 at the start of the trauma account, 35 at close. PCL-5 today 41, from 62 at intake 12/2025. Grounding to baseline before close; client alert, oriented, and calm at exit, denies SI. Homework: two Challenging Questions Worksheets. Continue weekly; treatment plan review 09/2026. — Signed, credentials, date.
The second version takes roughly ninety seconds more to write. Multiplied across twelve dates of service, it is the difference between keeping the payment and writing a check.
Appeals, extrapolation, and what you can actually contest
You almost always have appeal rights, and the letter states them along with the deadlines. Under Medicare, the first level is a redetermination by the MAC, followed by a reconsideration by a Qualified Independent Contractor, followed by a hearing before an Administrative Law Judge. Commercial payers run their own internal levels, usually one or two, with external review available afterward depending on your state.
Extrapolation is the mechanism that makes small audits expensive. The payer reviews a sample, calculates an error rate, and projects that rate across the full universe of your claims for the period. This is how a twenty-claim review produces a demand vastly larger than twenty claims. Challenging an extrapolation is usually an argument about the statistical validity of the sample rather than about clinical content, and it is not a fight to have without counsel.
Be clear-eyed about what an appeal can and cannot do. It can show that the reviewer misread a note, that an element they called missing is present elsewhere in the record, that they applied a policy that does not govern your service, or that the sample was drawn improperly. It cannot create a note that does not exist, and it cannot retroactively sign one. Never let a deadline pass by default; an unanswered demand typically becomes final and gets offset against your future payments.
The audit is decided by the note you wrote two years ago
By the time a letter arrives, the outcome is already determined. Everything in the response is archaeology. The only real intervention point is the moment you sign a note, which is why the checks worth having are the ones that run then.
That is what Congruent's Golden Thread Check does. Before you sign, it reads the note against the active diagnosis and treatment plan and flags what a reviewer would flag: no documented duration, an intervention with no named technique, no reference to a plan goal, a plan that expired, a session length that will not support the code about to be billed. It is included in both plans, $20 per clinician per month for Solo and $29 for Practice, with no compliance add-on fee, and migration from your current system is free.
Pick one client at random this week and read their chart as if you had never met them. If you cannot tell what you did in session six, neither can the reviewer. The specific elements are in what CMS requires of a psychotherapy note, and the plan side, which is where whole periods of care get denied at once, is in writing goals that survive utilization review.