Commercial Payer Audits: Why Private Insurance Recoupments Are Rising and How to Fight Them

The Contract Is the Rulebook: How Private Payer Audits Differ From Medicare, the State Law Protections Most Practices Never Invoke, and the Defense Playbook That Preserves Leverage

Table of Contents

1. Introduction: The Audit Letter That Looks Like Medicare and Is Not
2. The Numbers: Why Commercial Recoupments Are Rising
3. The Fundamental Difference: Your Contract Is the Rulebook
4. The Three Rulebooks: Contract, State Law, and ERISA
5. Who Is Actually Auditing You
6. The Contract Provisions That Decide Everything
7. State Lookback and Notice Protections
8. Offsets: How Commercial Payers Actually Take the Money
9. Extrapolation Without the Statutory Guardrails
10. The Response Playbook: The First 30 Days
11. Fighting Back: The Dispute and Appeal Path
12. When the Letter Comes From the Special Investigations Unit
13. Prevention: Winning the Audit Before It Starts
14. How DoctorsManagement Defends Commercial Payer Audits
15. Frequently Asked Questions
16. External Resources and References

Introduction: The Audit Letter That Looks Like Medicare and Is Not

A records request arrives from a commercial payer. The letter looks familiar: a list of claims, a demand for documentation, a deadline, references to audit findings and potential recoupment. A practice that has been through a Medicare review reaches for the Medicare playbook, assumes the familiar deadlines, assumes the familiar appeal levels, assumes the familiar limits on how far back the payer can reach and how aggressively it can project an error rate.

Every one of those assumptions is wrong, and each one costs leverage.

Medicare audits operate inside a dense statutory and regulatory framework: fixed response windows, five defined appeal levels, a statutory limitation on when extrapolation may be used, a limitation on recoupment that timely appeals can invoke, and a body of published manuals the contractor must follow. Commercial payer audits operate inside a contract. The participation agreement your practice signed, often years ago and possibly never read since, defines the payer’s audit rights, the lookback period, the deadline to respond, the dispute process, and the payer’s right to simply deduct the money from your next remittance. Where the contract is silent, state insurance law may fill the gap for some plans, and federal ERISA law governs others. There is no Program Integrity Manual, no Administrative Law Judge, and no Section 1893(f)(3).

That difference cuts both ways. Commercial payers have freedoms Medicare contractors do not, including offset rights that let them collect without your consent and extrapolation unconstrained by federal statute. But providers also have leverage against commercial payers that does not exist against Medicare: the payer needs the network, state law imposes real limits on many plans, the contract binds the payer as much as the practice, and everything is ultimately negotiable in a way a Medicare demand is not.

This guide covers why commercial audit activity is rising, which of three distinct legal frameworks governs any given audit, the contract provisions that determine your position before the first letter arrives, the state law protections most practices never invoke, how offsets and commercial extrapolation actually work, and the response and dispute playbook that preserves leverage instead of surrendering it.

The Numbers: Why Commercial Recoupments Are Rising

The rise in commercial audit activity is not an impression. It is measurable, and the 2025 data is stark.

Benchmark data drawn from a network of more than 1.2 million providers, published by the billing compliance platform MDaudit covering the first three quarters of 2025, found that external payer audit activity rose 30 percent year over year measured by total dollars at risk per organization, with the average at-risk amount per audited claim up 18 percent. Commercial payers accounted for 45 percent of the at-risk dollars, substantially more than Medicare and Medicaid combined at 28 percent. In the professional setting, the average audited claim carried $1,172 at risk, with missing information, coding errors, and billing errors as the leading triggers. Telehealth-related denials rose 84 percent, and Medicare Advantage denial amounts rose more than 22 percent, a reminder that MA plans are commercial payers wearing a federal program’s name.

What Is Driving It

• Payment integrity has become an industry. Payers increasingly outsource post-payment review to third-party payment integrity vendors, many compensated on contingency. Like Recovery Audit Contractors in the Medicare program, these vendors are paid to find overpayments, and the volume of review scales with the size of the industry built to perform it.
• Data mining selects the targets. Claims analytics flag providers whose coding distribution, modifier usage, visit frequency, or billing growth deviates from specialty norms. Audits that once required manual selection now begin with an algorithm scoring every claim a practice submits, and medical margin pressure gives payers every reason to run those models harder.
• The Medicare playbook migrated. Techniques refined in federal program integrity work, including statistical sampling and extrapolation, prepayment review flags, and high-dollar claim targeting, are now standard commercial practice.
• Virtual care created new review categories. Telehealth, remote monitoring, and the documentation conventions around them are young enough that payers and providers routinely disagree about what supports a claim, and the 84 percent rise in telehealth denials shows where that disagreement lands.

The practical conclusion for a physician practice: the probability of facing a commercial audit in any given year is rising, the average dollars at stake per audit are rising, and the payer side of the table is increasingly professionalized. The provider side should be too.

The Fundamental Difference: Your Contract Is the Rulebook

Everything in this guide follows from one structural fact: a commercial audit is a contract dispute, not an administrative proceeding. The contrasts with Medicare are worth stating plainly, because each one changes the correct response.

• Response deadlines. Medicare documentation requests carry regulatory deadlines of 30 or 45 days. A commercial records request carries whatever deadline the contract or the letter states, which may be shorter, longer, or negotiable. Read the letter and the contract rather than assuming.
• Appeal structure. Medicare provides five statutory appeal levels with defined deadlines and an independent judge at the third. Commercial contracts typically provide one or two internal appeal levels, sometimes followed by arbitration or litigation, all defined by the agreement.
• Extrapolation limits. Medicare Parts A and B extrapolation is restricted by Section 1893(f)(3) of the Social Security Act to sustained or high error rates or failed educational intervention. No comparable statute restrains a commercial payer. Whether extrapolation is permitted at all is a question of what the contract says and what state law allows.
• Recoupment protection. Timely Medicare appeals stop recoupment through the second level under the Section 935 limitation. Commercial contracts typically authorize the payer to offset the alleged overpayment against future remittances, sometimes after a short notice period, whether or not a dispute is pending, unless the contract or state law says otherwise.
• Lookback periods. Medicare’s framework sets defined look-back windows by contractor type. Commercial lookbacks are set by contract and, for state-regulated plans, capped by state statutes that vary enormously, from months to years.
• Leverage. A practice cannot negotiate with CMS about whether to be audited. A practice absolutely can negotiate with a commercial payer, because the relationship is mutual: the payer markets its network, needs its directory full, and faces state regulators and contract law on its own conduct. Providers hold more cards in commercial disputes than most ever play.

The Three Rulebooks: Contract, State Law, and ERISA

The first analytical question in any commercial audit is which legal framework governs, because the answer determines which protections exist. Three overlap.

Rulebook One: The Participation Agreement

The contract governs every audit regardless of plan type. Its audit, records, overpayment, offset, and dispute provisions are the baseline rules, and they are examined in detail in the next section. Where the contract and state law conflict, state law generally prevails for the plans it regulates, which is why the second rulebook matters.

Rulebook Two: State Insurance Law, for Fully Insured Plans

Fully insured employer plans, individual and small group policies, and HMOs are regulated by the state insurance department. Many states have enacted provider protections that override contrary contract terms for these plans: limits on how far back a payer may recoup, written notice requirements before recoupment or offset, a defined window to dispute before the money moves, and prompt payment rules. These protections are real, they are frequently stronger than the contract, and practices routinely fail to invoke them because nobody on staff knows they exist.

Rulebook Three: ERISA, for Self-Funded Plans

Self-funded employer plans, which cover roughly 63 percent of workers with employer coverage, are governed by federal ERISA law, and state insurance protections generally do not apply to them. For these plans, the plan document and the provider contract set the rules, and disputes travel through the plan’s claims and appeals procedures under federal regulations rather than through the state insurance department. Providers typically pursue ERISA remedies through an assignment of benefits from the patient, and many plans now include anti-assignment clauses intended to block exactly that, which is a question for counsel when the stakes justify it.

The First Question in Every Audit

Is this plan fully insured or self-funded? The answer determines whether your state’s lookback cap and notice requirements protect you, whether the state insurance department is an escalation venue, and what the dispute path looks like. The member ID card sometimes indicates it, the payer must tell you if asked, and the analysis of any multi-claim audit should sort the claims by funding type before anything else, because the same payer letter frequently mixes both.

Who Is Actually Auditing You

Commercial audit letters come from three different kinds of entities, and the sender changes the stakes.

Payment Integrity and Recovery Units

The payer’s internal post-payment review operation, focused on coding accuracy, bundling, medical necessity under the payer’s policies, coordination of benefits, and duplicate payments. These reviews are about money. They are the commercial analogue of a MAC or RAC review, and they resolve through documentation, argument, and negotiation.

Third-Party Payment Integrity Vendors

Outside firms engaged by the payer to conduct post-payment review, data mining, itemized bill review, or specialty-specific audits, frequently compensated on a contingency percentage of recoveries. The contingency structure matters for the same reason it matters with RACs: the entity reviewing your claims is paid to find errors. Vendor findings deserve independent verification as a matter of course, including recalculating the math, because vendor demand letters containing duplicated claims, already-adjusted claims, and arithmetic errors are a recurring phenomenon.

The Special Investigations Unit

Every major payer maintains an SIU with a mandate that is not payment accuracy but fraud, waste, and abuse. SIU involvement changes the character of the matter: SIUs can place providers on prepayment review, refer matters to state insurance fraud bureaus and law enforcement, share information with other payers through industry anti-fraud organizations, and initiate network termination. An SIU letter is the commercial counterpart of a UPIC letter, and it calls for the same posture, which is addressed in its own section below.

Reading the Letterhead

Identify the sender before responding: internal recovery unit, named outside vendor, or SIU. The letter’s own language usually tells you. References to payment accuracy, coding review, or overpayment identification indicate a financial review. References to investigation, fraud, waste and abuse, or an interview request indicate the SIU. The response strategy, and the decision about involving counsel, follows from that identification.

The Contract Provisions That Decide Everything

Your position in a commercial audit was largely fixed on the day the participation agreement was signed. These are the provisions that matter, and they should be located and read now, not after a letter arrives.

• Audit rights. What the payer may review, how often, with how much notice, and whether on-site access is permitted. Some contracts limit audit frequency or scope; most practices never check.
• Lookback period. How far back the payer may reach to recoup. Contracts commonly specify 12 to 36 months, state law may cap it shorter for fully insured plans, and fraud allegations typically remove the cap entirely.
• Records deadlines. How long the practice has to produce documentation, and what happens on non-response. As with Medicare, an unanswered request converts to a denial and then to a demand.
• Overpayment notice and dispute window. What notice the payer must give before recovering, and how many days the practice has to dispute before recoupment or offset begins. This window is the commercial equivalent of Medicare’s day 30, and missing it has the same consequence: the money moves while you argue.
• Offset rights. Whether the payer may deduct alleged overpayments from future remittances, and on what notice. This clause is how commercial payers collect without your consent, and its terms are negotiable at contracting time.
• Dispute resolution. The internal appeal levels, their deadlines, whether binding arbitration applies, which state’s law governs, and where disputes must be brought. Arbitration clauses in particular shape the endgame and are routinely discovered only when the endgame arrives.
• Amendment by notice. Most agreements let the payer amend terms, including audit and recoupment provisions, by notice with continued participation deemed acceptance. The contract you signed is not necessarily the contract in force. Request the current agreement with all amendments and policy manuals incorporated by reference, because incorporated manuals frequently contain the actual audit procedures.

A practice that maintains a current, indexed file of every participation agreement, amendment, and incorporated manual, with the audit-relevant terms summarized on one page per payer, enters every audit knowing its rights. A practice that has to request its own contract from the payer after the demand arrives starts the dispute already behind.

State Lookback and Notice Protections

For fully insured plans, state law frequently gives providers protections stronger than anything in the contract, and they operate whether or not the contract mentions them.

Lookback Caps

Most states limit how far back a state-regulated payer may recoup a paid claim, with caps commonly falling in the range of 12 to 24 months from the payment date. The variation is wide: published compilations show examples running from 6 months in Maryland, through 12 months in Alaska, 15 months in Tennessee, and 18 months in Hawaii and South Carolina, up to 30 months in Florida. A recoupment demand reaching claims older than your state’s cap is, for fully insured plans, demanding money the payer may have no right to recover, and identifying those claims is one of the fastest ways to cut a demand down.

Notice and Dispute Requirements

Many states also require written notice before recoupment or offset, commonly 15 to 30 days, with the notice identifying the specific claims and the basis for the overpayment determination, and some states guarantee a dispute window during which the payer may not take the money. A payer that offsets first and explains later may be violating these requirements, which is both a defense and an escalation lever with the state insurance department.

The Exceptions and the Caveats

• Fraud exceptions are nearly universal. Allegations of fraud typically extend or eliminate the lookback cap, which is one reason payers sometimes characterize ordinary coding disputes in fraud language, and one reason that characterization should be contested rather than accepted.
• Self-funded plans are outside all of it. These protections bind state-regulated plans only. For the roughly 63 percent of covered workers in self-funded arrangements, the contract and ERISA govern.
• Verify your own state. Compilations of these laws vary in currency and some flag entries as unverified. Before building a defense on a lookback cap or notice statute, confirm the current provision, which is a task for your consultant or counsel at the start of the engagement, not an assumption.

Offsets: How Commercial Payers Actually Take the Money

Medicare recoups through a defined demand and collection process. Commercial payers mostly use something blunter: the offset, meaning the payer deducts the alleged overpayment from what it owes you on current and future claims, for different patients and different services, until the balance is satisfied.

Why Offsets Are Operationally Dangerous

• They scramble the books. Remittances arrive short, with the reductions spread across unrelated claims. Practices without disciplined payment posting lose track of what was taken, for which alleged overpayments, and whether the deductions match the demand. Reconciling offsets to the claim level is tedious and absolutely necessary, because duplicate and erroneous offsets are common and invisible without it.
• They reverse the burden. In a demand process, the payer must pursue the money while the practice holds it. An offset means the payer holds the money while the practice pursues it. Every dynamic of the dispute changes when the funds have already moved.
• They can precede the dispute. Unless the contract or state law requires notice and a dispute window, the offset can begin before the practice has meaningfully contested anything. This is why the notice protections in the prior section, and the dispute-window deadline in the contract, are the commercial equivalents of Medicare’s day 30 filing.

Cross-Plan Offsetting

Some payers have gone further, offsetting an alleged overpayment from one plan against payments owed on claims under entirely different plans the payer administers. Federal courts examining the practice under ERISA have treated it with notable skepticism, and a practice seeing deductions that cross plan lines should flag the issue for counsel rather than absorbing it as ordinary accounting noise.

The Standing Defenses

• Demand a claim-level accounting. For every offset, the payer should identify the original claim, the alleged overpayment, the amount taken, and the remittance it was taken from. Refuse to reconcile against lump sums.
• Match offsets against the demand. Confirm that nothing is being taken twice, that disputed claims are not being offset during a contractual dispute window, and that amounts match the payer’s own findings.
• Invoke the notice requirements. Where state law or the contract requires pre-offset notice and a dispute period, a payer that skipped them has handed you both a defense and a regulator-ready complaint.

Extrapolation Without the Statutory Guardrails

Commercial payers and their vendors use statistical sampling and extrapolation exactly as Medicare contractors do: review a sample, compute an error rate, and project it across the universe of comparable claims to produce a demand many multiples of the actual findings.

The critical difference is that none of the Medicare limits apply. Section 1893(f)(3) restricts extrapolation in Medicare Parts A and B to sustained or high error rates or failed educational intervention. No such statute constrains a commercial payer. Whether extrapolation is permitted at all, against claims under a given contract, is a question with three possible sources of an answer: the contract, state law, and the defensibility of the methodology itself.

Ground One: The Contract

Many participation agreements say nothing about extrapolation. A payer projecting a sample error rate across thousands of unexamined claims, under a contract that authorizes review of claims and recovery of overpayments but never mentions statistical estimation, is asserting a right the agreement does not clearly grant. Silence is an argument, and demands have been reduced to the actual sampled findings on exactly that ground.

Ground Two: State Law

Some states regulate or restrict extrapolated recoupment against providers for state-regulated plans, and the lookback caps discussed earlier bound the universe a projection may lawfully cover regardless of what the sample shows.

Ground Three: The Methodology

Every methodological defect catalogued in the companion article in this series on statistical extrapolation applies with equal force to a commercial projection: a contaminated universe, an unreproducible sample, inadequate precision, variable methods applied to binary determinations, systematic bias, and a one-directional review that counted no underpayments. Commercial vendor methodologies are frequently less rigorous than contractor methodologies built under the Program Integrity Manual, which makes them more vulnerable, not less. The forum differs, since the challenge is pressed through the contract’s dispute process rather than before an ALJ, but the statistics are the statistics, and an expert analysis that would win at OMHA is equally potent in a payer negotiation.

The practical rule: never accept a commercial extrapolated demand at face value. Demand the complete methodology, the universe definition, the sampling frame, and the claim-level findings, and have both the sampled denials and the statistics independently reviewed before any number is discussed.

The Response Playbook: The First 30 Days

• Identify the sender and the plan types. Internal recovery unit, contingency vendor, or SIU, and for each claim, fully insured or self-funded. These two determinations set the risk level and the applicable rulebook.
• Calendar the deadline from the letter and the contract, not from Medicare habit. Commercial windows vary, extensions are frequently available on request, and a documented extension request is itself evidence of good faith.
• Pull the current contract, every amendment, and the incorporated manuals. Locate the audit, lookback, overpayment, offset, and dispute provisions before producing anything. If the practice does not hold the current version, request it in writing immediately.
• Check the state law overlay. For the fully insured claims, confirm the lookback cap and notice requirements and identify every claim in the demand that falls outside them.
• Demand specificity. A compliant response requires knowing exactly what is alleged: claim-level findings, the policy basis for each, the review criteria applied, and the complete sampling methodology if anything is extrapolated. A demand that cannot be tied to specific claims and policies is not yet a demand you can evaluate, and saying so in writing is a legitimate first response.
• Audit your own claims before producing. The same discipline the companion article on Medicare records requests prescribes applies here: an independent pre-submission review by credentialed auditors tells you your actual exposure, surfaces documentation that exists but was not going to be included, and reveals whether the problem is isolated or systemic.
• Implement a documentation hold and produce a complete, organized response. Legible, indexed, claim by claim, with signature attestations where needed, retained in full with proof of delivery. Commercial reviewers deny on incomplete submissions exactly as Medicare reviewers do.
• Verify the math on any findings. Recalculate the payer’s numbers against the contracted fee schedule and your remittance data. Vendor demands containing duplicated claims, previously adjusted claims, and incorrect contracted rates are common enough that the recalculation routinely pays for itself.
• Do not sign anything reflexively. Settlement offers, repayment agreements, and education attestations presented with the findings can waive dispute rights, admit error characterizations, and establish knowledge relevant to future matters. Every such document gets reviewed before signature, by counsel where the stakes or the language warrant it.

Fighting Back: The Dispute and Appeal Path

The Internal Appeal

The contract defines the appeal levels, their deadlines, and the required contents, and the deadlines are enforced. The appeal itself should be built like a reconsideration filing in the Medicare process: claim-by-claim argument tied to the documentation and the payer’s own published policies, the state law defenses asserted expressly, the extrapolation methodology challenged with expert support where one exists, and every ground stated, because arguments omitted early are harder to introduce late in commercial disputes too.

The Escalation Venues

• The state insurance department, for fully insured plans. A complaint documenting lookback violations, skipped notice requirements, or prompt pay failures invokes a regulator the payer answers to, and the prospect of one changes negotiating behavior.
• The ERISA claims process, for self-funded plans, pursued through the plan’s required appeal procedures, typically on an assignment of benefits and with counsel’s involvement where anti-assignment clauses or litigation are in play.
• Arbitration or litigation, as the contract’s dispute resolution clause directs, for matters that do not resolve below. This is legal territory and belongs to counsel, supported by the audit, coding, and statistical record built earlier.

The Negotiation, Which Is Where Most of These End

Unlike Medicare demands, commercial disputes overwhelmingly resolve by negotiation, and the practice’s leverage is real: the quality of the findings once independently audited, the state law defenses, the methodology defects in any projection, the payer’s need for the network and its exposure to its own regulator, and the relationship’s ongoing value. Practices that arrive with an independent audit showing the payer’s error rate is overstated, a list of claims outside the lawful lookback, and an expert report dismantling the extrapolation routinely settle for a fraction of the demand. Practices that arrive with an apology settle for the demand.

Negotiate the Future, Not Just the Number

A settlement is also the moment to address the terms that produced the dispute: prospective clarification of the documentation standard at issue, removal from prepayment review, and where the relationship justifies it, amendment of the audit and offset provisions themselves. Money resolves the past. Terms prevent the sequel.

When the Letter Comes From the Special Investigations Unit

An SIU matter is categorically different from a payment integrity review, and it calls for the posture a UPIC letter calls for on the Medicare side.

• Engage healthcare counsel before responding. SIU productions can become evidence in insurance fraud referrals, law enforcement matters, and network terminations. Scope, privilege, and strategy decisions belong with counsel from the first letter, with DoctorsManagement supplying the coding, documentation, and statistical analysis under counsel’s direction.
• Expect information sharing. SIUs participate in industry anti-fraud organizations and share findings across payers, which is how one payer’s investigation becomes several payers’ audits.
• Watch for the fraud framing. Characterizing a coding disagreement as fraud conveniently removes lookback caps and escalates leverage. The characterization itself should be contested where the facts are a documentation or interpretation dispute, which they usually are.
• Remember the federal spillover. Where the claims involve Medicare Advantage or other federally funded plans, the matter can carry False Claims Act exposure, and findings of systemic error raise the identification and repayment obligations covered in the companion article on the 60-day overpayment rule.
• Protect the network relationship deliberately. Prepayment flags and termination threats are SIU tools. Both are negotiable, and both are far easier to resolve before they take effect than after.

Prevention: Winning the Audit Before It Starts

• Review audit terms at contracting, when you have leverage. Lookback length, audit frequency, offset notice, extrapolation rights, and dispute procedures are all negotiable before signature and nearly impossible to change during a dispute. Every new agreement and every amendment deserves that review.
• Maintain the contract file. Current agreements, all amendments, incorporated manuals, and a one-page summary of audit-relevant terms per payer.
• Hold documentation to one standard. Practices that document to the Medicare standard across all payers rarely face commercial findings they cannot defend, because the commercial policies largely track the same medical necessity and documentation logic.
• Watch your own data the way the payer does. The analytics that flag outliers are not secret in principle: coding distribution, modifier rates, and utilization against specialty norms. Internal monitoring finds the outliers first and either corrects them or documents why they are legitimate.
• Audit the payers back. Recoupment flows one direction only if the practice lets it. Systematic underpayment against contracted rates is at least as common as overpayment, and a practice that reconciles remittances to its fee schedules enters every audit negotiation holding its own demand. DoctorsManagement’s published work on recovering payer underpayments covers that discipline, and it belongs in the same operational rhythm as audit defense.

How DoctorsManagement Defends Commercial Payer Audits

DoctorsManagement defends practices in commercial payer audits with the same combination that drives our Medicare audit work: credentialed coding and documentation expertise, statistical and economic analysis for anything extrapolated, and managed care experience on the contract and negotiation side. Our auditors hold both the Certified Professional Coder and Certified Professional Medical Auditor credentials and train continuously through NAMAS, our education division.

Our commercial audit services include:

• Audit Response Management: Sender and plan-type analysis, deadline management, demand-for-specificity correspondence, pre-submission internal audit of the requested claims, and preparation of a complete, defensible production
• Findings Verification: Independent review of every denied claim, recalculation of the payer’s math against contracted rates and remittance data, and identification of duplicated, previously adjusted, and out-of-lookback claims
• Extrapolation Defense: Statistical analysis of the vendor’s sampling methodology and recalculation of the demand under corrected assumptions, by the same statisticians and economists who challenge Medicare projections
• Dispute and Negotiation Support: Appeal preparation under the contract’s dispute process, settlement analysis, and negotiation support grounded in the independently verified findings
• Managed Care Contract Review: Business-terms review of audit, lookback, offset, and dispute provisions at contracting and renewal, and underpayment recovery analysis against contracted fee schedules
• SIU Matter Support: Coding, documentation, and statistical analysis performed under the direction of your healthcare counsel

DoctorsManagement is a healthcare consulting, accounting, and auditing firm, not a law firm. We do not provide legal advice, interpret contracts as a legal matter, litigate, or represent practices in arbitration or before regulators; for SIU matters, ERISA disputes, and contract enforcement, we work alongside your healthcare counsel and supply the analytical record the legal strategy depends on.

If your practice has received a commercial payer audit letter or is watching offsets erode its remittances, contact DoctorsManagement at www.doctorsmanagement.com/audit-appeal-defense or call (800) 635-4040.

Frequently Asked Questions

How is a commercial payer audit different from a Medicare audit?

A Medicare audit operates inside a statutory framework: fixed response deadlines, five defined appeal levels, statutory limits on extrapolation, and a limitation on recoupment during early appeals. A commercial audit is governed by your participation agreement, supplemented by state insurance law for fully insured plans and by ERISA for self-funded plans. Deadlines, appeal rights, lookbacks, extrapolation, and offset rights are all contract and state law questions, which means the first document to read is your contract, not a CMS manual.

Why are commercial payer audits increasing?

Benchmark data covering the first three quarters of 2025 showed external payer audit activity up 30 percent year over year in dollars at risk, with commercial payers accounting for 45 percent of at-risk amounts versus 28 percent for Medicare and Medicaid combined. The drivers are a growing payment integrity vendor industry, often paid on contingency, data mining that scores every submitted claim, migration of Medicare-style techniques including extrapolation into commercial review, and new dispute categories such as telehealth, where denials rose 84 percent.

How far back can a commercial payer recoup?

For fully insured, state-regulated plans, most states cap recoupment lookbacks, commonly in the 12 to 24 month range, with published examples running from 6 months in Maryland to 30 months in Florida, and fraud allegations typically extending or removing the cap. For self-funded ERISA plans, which cover roughly 63 percent of workers with employer coverage, state caps generally do not apply and the contract governs. Always confirm your state’s current statute before relying on a specific figure.

Can a commercial payer just deduct the money from my future payments?

Usually, yes, through offset rights in the participation agreement, subject to any state notice and dispute-window requirements for fully insured plans. Offsets reverse the leverage of the dispute because the payer holds the money while you contest it. The defenses are claim-level accounting of every deduction, reconciliation against the demand to catch duplicates and errors, and enforcement of any required pre-offset notice. Deductions that cross plan lines raise additional issues under ERISA and belong with counsel.

Can commercial payers use extrapolation?

There is no commercial equivalent of the Medicare statute that restricts extrapolation, so the answer depends on the contract, state law, and the methodology. Many contracts never mention extrapolation, which supports an argument that the payer is asserting a right the agreement does not grant. Where a projection is used, every methodological challenge available against a Medicare extrapolation applies: universe defects, unreproducible samples, inadequate precision, bias, and one-directional review. Demand the full methodology and have it independently analyzed before negotiating any number.

What is a Special Investigations Unit and why does it matter who sent the letter?

The SIU is the payer’s fraud, waste, and abuse arm, distinct from its payment accuracy and recovery operations. SIUs can impose prepayment review, refer matters to state fraud bureaus and law enforcement, share findings with other payers through industry anti-fraud organizations, and initiate network termination. A payment integrity letter is a financial dispute; an SIU letter is a potential enforcement matter and calls for healthcare counsel before any response.

Does it matter whether the patient’s plan is fully insured or self-funded?

It is the single most important classification in the audit. State lookback caps, notice requirements, prompt pay rules, and the state insurance department as an escalation venue apply to fully insured plans. Self-funded ERISA plans sit outside those protections, governed by the plan document, the contract, and federal claims procedures. A single audit frequently mixes both, so sort the claims by funding type before building the defense.

Should I just repay to protect the network relationship?

Not before verifying the findings. Vendor demands routinely contain duplicated claims, previously adjusted claims, out-of-lookback claims, and inflated projections, and commercial disputes overwhelmingly resolve by negotiation, where an independent audit of the findings is the leverage. Repaying unverified findings also concedes an error characterization that feeds future targeting. The relationship argument runs the other way: payers respect practices that dispute professionally and document thoroughly.

What should I negotiate in my payer contracts to protect against audits?

Lookback length, audit frequency and scope, advance notice before recoupment or offset, a defined dispute window during which no offset may occur, limits or clarity on extrapolation, reasonable records deadlines, and a workable dispute resolution process. These terms are negotiable at contracting and renewal and essentially fixed once a dispute begins, which is why contract review belongs in the compliance calendar rather than the crisis response.

How can DoctorsManagement help with a commercial payer audit?

We manage the response end to end: sender and plan-type analysis, pre-submission internal audit by credentialed auditors, findings verification and recalculation against contracted rates, statistical analysis of any extrapolation, appeal preparation under the contract’s process, negotiation support, and managed care contract review on the business terms. We are a consulting, accounting, and auditing firm rather than a law firm, and for SIU, ERISA, and litigation matters we work alongside your counsel. Contact us at www.doctorsmanagement.com/contact-us or call (800) 635-4040.

External Resources and References

• Fierce Healthcare: Payer Audits, Denial Amounts Rise Again in 2025, Vendor Data Show
• American Medical Association: Payor Audits on the Rise, How Private Practices Can Get Ready
• CareCost Estimate: Recoupment Limits by State, Lookback Windows, Notice and Offset
• Department of Justice: The False Claims Act
• OIG Fraud and Abuse Laws for Physicians
• OIG Work Plan
• CMS Regulations and Guidance
• DoctorsManagement Audit Appeal and Defense
• DoctorsManagement Coding and Documentation Review
• DoctorsManagement Healthcare Compliance Audit
• DoctorsManagement Blog: The Silent Revenue Leak, Payer Underpayments
• DoctorsManagement Blog: 10 Pitfalls to Avoid in Managed Care Contract Negotiations
• DoctorsManagement Blog: The 7 Types of Medicare Audits Explained
• DoctorsManagement Total Compliance Solution

This article is provided for informational and educational purposes only and does not constitute legal advice. DoctorsManagement is a healthcare consulting, accounting, and auditing firm. It is not a law firm, does not practice law, and does not interpret contracts as a legal matter, litigate, arbitrate, or represent providers before regulators.

Commercial payer audit rights, state recoupment and notice statutes, and ERISA requirements vary by state, by plan, and by contract, and the figures and state examples cited reflect published compilations that should be independently verified before being relied upon. Practices facing a commercial audit, and particularly any matter involving a Special Investigations Unit, should consult qualified healthcare counsel. DoctorsManagement is available to provide the audit, coding, statistical, and negotiation support components of the defense alongside counsel.