Respond to payer audits and record requests

A payer audit is a request to justify claims you have already been paid for. The response determines whether you keep the money. Deadlines are strict, first responses matter, and extrapolation can turn a small sample into a very large demand. Engage counsel before responding to anything beyond a routine records request. For a subpoena, a civil investigative demand, or any government inquiry, stop and call counsel before responding at all. What you say first shapes everything after. See When to call a lawyer.

Know which kind you have

Type	Who	Character
Routine records request	Any payer	Documentation for specific claims. Low stakes if handled promptly.
Prepayment review	Any payer	Claims held pending documentation before payment. Cash-flow impact is immediate.
Postpayment audit	Any payer	Review of paid claims; overpayment demands possible
RAC, Recovery Audit Contractor	Medicare	Contingency-fee contractors identifying improper payments
UPIC, Unified Program Integrity Contractor	Medicare/Medicaid	Fraud-focused. Engage counsel immediately.
CERT	Medicare	Error-rate measurement; usually low stakes
SIU, Special Investigations Unit	Commercial	Fraud-focused. Engage counsel immediately.
State Medicaid program integrity	Medicaid	Varies from routine to investigative
OIG / DOJ inquiry	Federal	Stop. Counsel before any response.

UPIC, SIU, OIG, and DOJ are different in kind, not degree. These are fraud investigations. Treat any contact from them as a counsel matter from the first letter, including the decision about what to produce.

Steps

Log it the day it arrives

Date received, payer, auditor, claims at issue, deadline, and the response method required. Assign an owner immediately.Audit letters are frequently sent to an address nobody monitors, and the deadline runs from the letter date. Make sure your correspondence addresses are watched.

Calendar the deadline with a lead time

Missing an audit deadline generally means automatic adverse determination — you lose by default, on claims you might have defended easily.

Determine whether counsel is needed

Engage counsel	Handle internally
UPIC, SIU, OIG, DOJ	Routine records requests
Extrapolation is threatened	Small-sample postpayment reviews
Large dollar amounts	Prepayment review with clear documentation
Allegations of fraud or abuse
Repeat audits from the same payer
Anything you don’t understand

Pull the records requested, and only those

Send exactly what was asked for, for exactly the claims and dates specified.For each claim, typically: the clinical documentation supporting the service, the physician signature and credentials, orders and referrals, the authorization, and the itemized bill.

Do not send more than requested. Extra records expand the audit’s scope and can surface issues on claims that weren’t under review.Do not alter or add to records. Late-signed notes, addenda created after the request, and any modification to an existing entry are the single most damaging thing you can do — it converts a documentation dispute into a fraud allegation. If a note is unsigned, say so.

Review before sending

Have someone qualified read every chart against the code billed. You want to know what the auditor will find before they find it.If you discover a genuine overpayment, that is an identification, and for Medicare and Medicaid the 60-day report-and-return clock starts. Discuss with counsel how to handle it in the context of the audit. See Report and return overpayments.

Submit properly, with proof

Use the required method. Include a cover letter indexing what you sent, organized by claim. Number the pages. Keep a complete copy of exactly what you submitted, and retain delivery confirmation.

Respond to the findings

Findings letters usually offer an appeal or rebuttal window that is short. Review every disputed claim individually — auditors make errors, and a well-documented rebuttal on a subset frequently reduces the demand materially.

Extrapolation

The mechanism that turns a modest audit into an existential one. An auditor reviews a sample of claims, calculates an error rate, and extrapolates it across the entire universe of similar claims in the audit period. A 30-claim sample with a 40% error rate can produce a demand covering thousands of claims. Grounds on which extrapolation is commonly challenged:

Sampling methodology, was the sample properly random and statistically valid?
Universe definition, were the claims in the universe genuinely similar to those sampled?
Sample size, too small to support the precision claimed
Error determinations, if individual errors are overturned on appeal, the extrapolation must be recalculated
Statutory and program requirements for when extrapolation may be used at all

Extrapolation challenges are specialist work requiring a statistician as well as counsel. If extrapolation is on the table, the cost of expert help is almost always less than the demand. Do not attempt this alone.

While the audit runs

Do not change your billing practices in a way that looks like concealment. Do fix genuine problems, and document that you fixed them.
Preserve everything. Institute a litigation hold if counsel advises.
Limit internal communication about the audit; discuss through counsel where privilege matters.
Keep operating. Prepayment review affects cash flow — plan for it.

After it closes

Root-cause every sustained finding

Documentation gaps, coding errors, missing authorizations, or an actual compliance problem.

Fix the process, not just the claims

Consider whether the finding implies broader exposure

If the audit found a systematic error, similar claims outside the audit period may also be overpayments, which triggers the 60-day analysis. Counsel decides how to handle this.

Document the remediation

A demonstrated corrective action is what reduces exposure on the next audit.

Formation & Corporate

Agreements

Credentialing & Payer Enrollment

Billing Operations

Patient Payments & Refunds

Banking & Finance

Compliance Tasks

Respond to payer audits and record requests

Know which kind you have

Steps

Extrapolation

While the audit runs

After it closes

Verify it worked

​Know which kind you have

​Steps

​Extrapolation

​While the audit runs

​After it closes

​Verify it worked

Know which kind you have

Steps

Extrapolation

While the audit runs

After it closes

Verify it worked