Your provider agreement decides what a payer can audit. Most physicians have never actually read the clause that says so.
Yet it sets the notice period, the deadline, which records the payer can ask for, and what happens to your money once the review’s over. We’ll walk through those rights here, along with the inspections that come with them.
Key Takeaways
- 1Your audit rights come from the provider agreement, usually the records and compliance section.
- 2Lots of offices start counting from the day the letter hit the mailbox, which is wrong, because the clock on a records request has usually been running since before it ever reached your front desk, and honestly we see that one hurt practices more than anything else they do to themselves.
- 3Nothing at the federal level limits how many records a commercial payer can ask for. Whatever lookback limits you’ve got come from state law or your contract, and neither one holds up much once fraud is suspected or the plan turns out to be self-funded.
- 4Once that notice is in the building, hands off the chart. An addendum with a date on it, sitting on top of the original, we can defend all day long, but tuck a quiet change into the original entry and a payment dispute starts to smell like enforcement.
- 5Credentialing files get audited as well. The payer holds your licenses, NPDB reports, exclusion list status and any work-history gaps up against what you attested when you enrolled.
- 6Post-payment findings turn into recoupments quickly. You don’t get long to appeal, and the money starts coming back out whether you appeal or not.
What payer credentialing audits actually examine
There are basically two kinds of audit that hit a physician practice, and they don’t act alike at all.
We’ve seen a practice pass one and fail the other in the same quarter. So any physician guide to payer credentialing audits has to cover both.
Payers run credentialing audits on their own timetable, often at recredentialing every two or three years.
More and more, they do it by pulling data instead of sending someone out. A lapsed DEA registration shows up in minutes that way. So does an NPDB report you never knew had been filed.
Where the audit right comes from
It’s a contract term. A broad one, too. Commercial agreements make records inspection a condition of being in network.
The provider manual then handles the nuts and bolts: how a request gets sent, what a complete response looks like, and how you’d go about disputing anything.
Commercial insurance medical audit compliance is mostly paperwork discipline, honestly.
When a payer has a treatment relationship with the patient, it’s entitled to the records its request lists. Sending them over isn’t a HIPAA violation, as long as you send them securely. The limits that do exist come from two places:
Payers overreach. Not every time, but often enough that it’s worth knowing your contract well.
Watch for a request that wanders outside the scope its own letter laid out, or a reviewer who skips a step the payer’s manual says is mandatory.
The payer audit record request timeline physicians face
On the payer audit record request timeline physician offices deal with, there are really three different clocks. Only one of them gives you much breathing room.
Commercial requests usually give somewhere from ten to thirty days, and for a small sample it can be less. Medicare contractors give you forty-five calendar days on additional documentation requests from MACs, RACs and the SMRC, and Targeted Probe and Educate rounds run on forty-five days too.
UPIC requests, the most serious kind of review, only get thirty.
| Audit or request | Response window | Clock starts |
|---|---|---|
| Commercial records request | 10 to 30 days, contract-set | Letter date unless the contract says otherwise |
| Medicare ADR (MAC, RAC, SMRC) | 45 calendar days | Date printed on the letter |
| Medicare UPIC request | 30 calendar days | Date printed on the letter |
| TPE round | 45 days | Letter date |
| Redetermination appeal | 120 days from the remittance | Remittance date |
| Reconsideration appeal | 180 days | Redetermination decision date |
Read the letter slowly. Your response has to cover all four things it names, or auditors will call it incomplete:
Records requests and the rules around them
Most of the damage we see in audits, practices do to themselves at the records stage. There aren’t many rules here, but they’re strict:
If the form wants a certification, certify. A lot of commercial payers ask for a signed statement that what you produced is the whole record for each patient listed.
Handing over a partial file under that signature is exactly the sort of finding that makes an audit bigger.
Leave the requested record alone. Not even a typo.
If you spot a mistake while you’re pulling the file, it stays put. The correction goes in an addendum dated the day you actually wrote it, attached next to the original entry, so anybody reading can still see what was there first.
Older records are their own headache. Hospital records, imaging reports, reference lab results, notes from whoever saw the patient before you: none of that is sitting in your office.
Getting it back almost always takes longer than the window you were given (sometimes a lot longer).
Post payment audit protection for doctors
Post payment audit protection for doctors gets built long before any notice shows up. The audit is just when you learn whether you built it.
Findings usually come as an overpayment letter or an adjustment on your remittance, and the money moves quickly from there.
Medicare starts recouping on day forty-one after the demand, unless a valid redetermination request went in by day thirty.
Commercial contracts mostly let the payer offset against your pending claims instead. You never get a bill at all; the clawback just shows up one week as a remittance that’s lighter than it should be.
Appeals are where a practice gets money back. You have to file a Medicare redetermination within one hundred twenty days of the remittance, and reconsideration within one hundred eighty days of the redetermination decision.
Commercial contracts have their own dispute language with windows the contract sets, and those are shorter.
So if an audit turns up a pattern, you now owe that duty on all the similar claims the auditor never even looked at. Disclosing it yourself goes a lot better than having it found.
Credentialing file compliance audit checklist
Credentialing files fail because things go stale. It’s rarely that something was wrong when it went in.
Any credentialing file compliance audit checklist really boils down to making sure every document in the file is current, verifiable, and still lines up with what the provider put on the original application. Credentialing reviewers and payer auditors usually go for these items first.
| Item | What the reviewer checks | Typical cycle |
|---|---|---|
| Medical license | Active status, primary source verification, expiration | At recredentialing, 2 to 3 years |
| DEA registration | Valid dates, matching practice address | Every renewal, 1 to 3 years |
| Board certification | Current status through the board | At recredentialing |
| Malpractice coverage | Certificate of insurance, limits, claims history | Annually |
| NPDB report | Continuous query or cycle query within lookback | Every 2 years |
| OIG/SAM exclusion check | Monthly or continuous screening | Monthly |
| Work history | Five-year history, explained gaps | At recredentialing |
| Peer references | Current, completed, matching panel requirements | At recredentialing |
Gaps draw questions. A three-month hole in a five-year work history is a normal thing for a reviewer to ask about.
Left unexplained, though, it turns into a red flag pretty fast, because work history and exclusion screening are exactly where payers dig for whatever the application didn’t mention.
Exclusion screening needs its own protection. Practices that run well check the OIG exclusion list every month, and the ones that run even better check it continuously.
If the payer finds a match before you do, you lose referrals in the meantime. And the screening log, dated and signed, goes in the file too.
Building an audit-ready practice before anyone asks
It’s a calendar more than a binder. Here’s the rhythm we keep:
The practices that handle audits well had their files organized long before anyone asked. The ones that get run over by audits started pulling records together the week the letter came.
Don’t wait for the audit letter.
We’ll review your provider agreements and credentialing files so you’re ready when a payer calls.
Talk to a credentialing specialist before the notice arrivesConclusion
An audit is mostly a records job.
The contract sets what the payer can look at, and the request letter sets your deadline. After that, it comes down to what’s actually in your file, and whether the appeal goes in early enough for you to ever see the money again.
Practices that keep credentialing files current tend to come through payer inspections without much damage. Answering on time through the channel the payer named matters a lot too, and so does leaving records alone while an audit’s open.
The Audit Protection team sets that up for practices, starting with contract review and going all the way through response packages. Treat audit rights as part of enrollment. Practices that do usually keep their panel status and the revenue that comes with it.
