> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Respond to payer audits and record requests

> Audit types, deadline discipline, chart submission practice, when to engage counsel, and how extrapolation works and can be challenged.

A payer audit is a request to justify claims you have already been paid for. The response determines whether you keep the money. **Deadlines are strict, first responses matter, and extrapolation can turn a small sample into a very large demand.**

**Engage counsel before responding to anything beyond a routine records request.** For a subpoena, a civil investigative demand, or any government inquiry, stop and call counsel before responding at all. What you say first shapes everything after. See [When to call a lawyer](/concepts/compliance/when-to-call-a-lawyer).

## Know which kind you have

| Type                                           | Who               | Character                                                                        |
| ---------------------------------------------- | ----------------- | -------------------------------------------------------------------------------- |
| **Routine records request**                    | Any payer         | Documentation for specific claims. Low stakes if handled promptly.               |
| **Prepayment review**                          | Any payer         | Claims held pending documentation before payment. Cash-flow impact is immediate. |
| **Postpayment audit**                          | Any payer         | Review of paid claims; overpayment demands possible                              |
| **RAC**, Recovery Audit Contractor             | Medicare          | Contingency-fee contractors identifying improper payments                        |
| **UPIC**, Unified Program Integrity Contractor | Medicare/Medicaid | **Fraud-focused.** Engage counsel immediately.                                   |
| **CERT**                                       | Medicare          | Error-rate measurement; usually low stakes                                       |
| **SIU**, Special Investigations Unit           | Commercial        | **Fraud-focused.** Engage counsel immediately.                                   |
| **State Medicaid program integrity**           | Medicaid          | Varies from routine to investigative                                             |
| **OIG / DOJ inquiry**                          | Federal           | **Stop. Counsel before any response.**                                           |

**UPIC, SIU, OIG, and DOJ are different in kind, not degree.** These are fraud investigations. Treat any contact from them as a counsel matter from the first letter, including the decision about what to produce.

## Steps

<Steps>
  <Step title="Log it the day it arrives">
    Date received, payer, auditor, claims at issue, **deadline**, and the response method required. Assign an owner immediately.

    Audit letters are frequently sent to an address nobody monitors, and the deadline runs from the letter date. Make sure your correspondence addresses are watched.
  </Step>

  <Step title="Calendar the deadline with a lead time">
    Missing an audit deadline generally means automatic adverse determination — you lose by default, on claims you might have defended easily.
  </Step>

  <Step title="Determine whether counsel is needed">
    | Engage counsel                    | Handle internally                          |
    | --------------------------------- | ------------------------------------------ |
    | UPIC, SIU, OIG, DOJ               | Routine records requests                   |
    | Extrapolation is threatened       | Small-sample postpayment reviews           |
    | Large dollar amounts              | Prepayment review with clear documentation |
    | Allegations of fraud or abuse     |                                            |
    | Repeat audits from the same payer |                                            |
    | Anything you don't understand     |                                            |
  </Step>

  <Step title="Pull the records requested, and only those">
    Send exactly what was asked for, for exactly the claims and dates specified.

    For each claim, typically: the clinical documentation supporting the service, the physician signature and credentials, orders and referrals, the authorization, and the itemized bill.

    <Warning>
      **Do not send more than requested.** Extra records expand the audit's scope and can surface issues on claims that weren't under review.

      **Do not alter or add to records.** Late-signed notes, addenda created after the request, and any modification to an existing entry are the single most damaging thing you can do — it converts a documentation dispute into a fraud allegation. If a note is unsigned, say so.
    </Warning>
  </Step>

  <Step title="Review before sending">
    Have someone qualified read every chart against the code billed. You want to know what the auditor will find **before** they find it.

    If you discover a genuine overpayment, that is an identification, and for Medicare and Medicaid the **60-day report-and-return clock** starts. Discuss with counsel how to handle it in the context of the audit. See [Report and return overpayments](/guides/compliance/report-and-return-overpayments).
  </Step>

  <Step title="Submit properly, with proof">
    Use the required method. Include a cover letter indexing what you sent, organized by claim. Number the pages. Keep a complete copy of exactly what you submitted, and retain delivery confirmation.
  </Step>

  <Step title="Respond to the findings">
    Findings letters usually offer an appeal or rebuttal window that is **short**. Review every disputed claim individually — auditors make errors, and a well-documented rebuttal on a subset frequently reduces the demand materially.
  </Step>
</Steps>

## Extrapolation

The mechanism that turns a modest audit into an existential one.

An auditor reviews a **sample** of claims, calculates an error rate, and **extrapolates** it across the entire universe of similar claims in the audit period. A 30-claim sample with a 40% error rate can produce a demand covering thousands of claims.

Grounds on which extrapolation is commonly challenged:

* **Sampling methodology**, was the sample properly random and statistically valid?
* **Universe definition**, were the claims in the universe genuinely similar to those sampled?
* **Sample size**, too small to support the precision claimed
* **Error determinations**, if individual errors are overturned on appeal, the extrapolation must be recalculated
* **Statutory and program requirements** for when extrapolation may be used at all

**Extrapolation challenges are specialist work requiring a statistician as well as counsel.** If extrapolation is on the table, the cost of expert help is almost always less than the demand. Do not attempt this alone.

## While the audit runs

* **Do not change your billing practices in a way that looks like concealment.** Do fix genuine problems, and document that you fixed them.
* **Preserve everything.** Institute a litigation hold if counsel advises.
* **Limit internal communication** about the audit; discuss through counsel where privilege matters.
* **Keep operating.** Prepayment review affects cash flow — plan for it.

## After it closes

<Steps>
  <Step title="Root-cause every sustained finding">
    Documentation gaps, coding errors, missing authorizations, or an actual compliance problem.
  </Step>

  <Step title="Fix the process, not just the claims" />

  <Step title="Consider whether the finding implies broader exposure">
    If the audit found a systematic error, similar claims outside the audit period may also be overpayments, which triggers the 60-day analysis. Counsel decides how to handle this.
  </Step>

  <Step title="Document the remediation">
    A demonstrated corrective action is what reduces exposure on the next audit.
  </Step>
</Steps>

## Verify it worked

* [ ] Audit logged with owner and deadline on arrival
* [ ] Correspondence addresses monitored
* [ ] Counsel engaged where the type warrants it
* [ ] Exactly the records requested, nothing more
* [ ] No records altered or created after the request
* [ ] Internal review completed before submission
* [ ] Indexed cover letter; complete copy retained; delivery confirmed
* [ ] Findings reviewed claim by claim
* [ ] Extrapolation challenged with expert support where applicable
* [ ] Root causes fixed and documented


## Related topics

- [Handle recoupments and takebacks](/guides/compliance/handle-recoupments.md)
- [Report and return overpayments (the 60-day rule)](/guides/compliance/report-and-return-overpayments.md)
- [File appeals](/guides/billing/file-appeals.md)
- [Billing compliance: the lines you never cross](/concepts/compliance/billing-compliance-basics.md)
- [When to call a lawyer (a triage map)](/concepts/compliance/when-to-call-a-lawyer.md)
- [Denial code playbook](/reference/edi/denial-code-playbook.md)