Responding to a Medicare Records Request: The First 30 Days That Determine Your Audit Outcome

A Day-by-Day Guide to Building a Complete, Defensible Response Package Before Findings Are Issued

Introduction: The Phase Most Practices Treat as Clerical

A Medicare contractor sends a request for medical records. Someone in the practice pulls the charts, prints what the letter asks for, and mails the package. The task feels administrative, so it gets assigned accordingly, often to whoever has capacity that week.

This is the most consequential misjudgment a practice makes in the entire audit lifecycle.

The documentation you submit in response to that request becomes the complete evidentiary record for every stage that follows. The contractor’s determination will be based on it. The redetermination will be based on it. The reconsideration will be based on it. By the time a matter reaches an Administrative Law Judge, the practice is arguing about the sufficiency of a package assembled months earlier by someone who did not know they were building a litigation record.

The asymmetry here is stark. A thorough, well-organized, internally audited response costs the practice a few dozen hours. A rushed or incomplete one produces denials that convert to overpayment demands, and those demands can be extrapolated across years of billing. The practices that fare best in Medicare audits are almost never the ones with perfect documentation. They are the ones that took the response phase seriously.

This guide covers the first thirty to forty-five days after a records request arrives: what to do, in what order, and which decisions carry consequences that persist through every subsequent appeal level.

What an Additional Documentation Request Actually Is

The additional documentation request, commonly called an ADR, is the instrument a Medicare contractor uses to pull the medical record behind a claim before deciding whether that claim survives review. Medicare Administrative Contractors, Recovery Audit Contractors, Unified Program Integrity Contractors, and the Supplemental Medical Review Contractor can all issue one.

Every ADR tests a single question: does the medical record support the claim as billed, including medical necessity under the applicable coverage determination? Everything about your response should be organized around answering that question affirmatively and making it easy for the reviewer to see the answer.

Why the Request Was Sent

MACs typically issue ADRs during prepayment or post-payment medical review when a claim trips a service-specific edit or the provider has been selected for a targeted probe. RACs and UPICs generally pull claims post-payment based on data analysis flagging billing patterns rather than any single claim. The distinction matters because it tells you whether the contractor is examining one service or a pattern across your billing.

What a Non-Response Produces

An unanswered ADR is not a neutral outcome. The claim is denied for insufficient documentation, the denial produces an overpayment, and the overpayment enters the demand and recoupment process. A late or incomplete response frequently becomes the opening move of a larger post-payment audit, because a documentation failure across a sample suggests a documentation problem across the population.

Day One: Calendar the Deadline Correctly

The response clock starts on the date printed on the ADR letter, not the date your practice opens the mail.

This single point costs practices more days than any other. Mail transit, internal routing, and the time a letter sits in an unopened stack all consume the response window. A letter dated the first of the month that reaches the compliance officer on the twelfth has already burned a quarter of the available time.

The Deadlines

• 45 calendar days: MAC, RAC, and SMRC requests
• 30 calendar days: UPIC requests

The regulatory basis is 42 CFR 405.903 for prepayment review and 42 CFR 405.929 for post-payment review. Note that these are calendar days, not business days.

Build the Schedule Backward

Set the internal submission target at least five business days before the actual deadline. That buffer absorbs the problems that reliably surface late in the process: a record that cannot be located, an imaging report held by an outside facility, a signature that was never captured, a provider who is on vacation the week the package needs review.

From the submission target, work backward to establish milestones for claim inventory completion, internal audit completion, and package assembly. A 45-day window is adequate. A 45-day window discovered on day 20 is not.

Days One to Three: Identify the Contractor and Assess Enforcement Risk

Before producing anything, determine who is asking and what category of matter this is. The contractor name appears on the letterhead. If it is not the MAC that processes your claims, identify the entity before proceeding.

The Threshold Question

Is this a payment review or an investigation?

Payment reviews, meaning most MAC, RAC, SMRC, and CERT activity, are about whether specific claims were properly paid. Investigations, meaning UPIC and OIG matters, are about whether the provider engaged in fraud, waste, or abuse. The records you produce in an investigation may become evidence in a subsequent enforcement proceeding.

When to Engage Counsel Before Responding

• The request comes from a UPIC or the OIG
• The letter references investigation, program integrity, or potential fraud rather than payment review
• The request is accompanied by a subpoena or civil investigative demand
• The response window is 30 days rather than 45
• The request references statistical sampling, a universe of claims, or an overpayment estimate
• Your internal review suggests the claims at issue have genuine documentation problems across a pattern

In these situations, decisions about scope, privilege, and supplemental documentation should be made with counsel before the package is assembled, not after findings are issued.

Days One to Three: Implement a Documentation Hold

Immediately upon receiving an audit notice, implement a hold covering the claims at issue and the surrounding period. The hold should prevent deletion, alteration, or reorganization of relevant records, including the electronic health record, billing system data, scheduling records, correspondence, and any related communications.

Why This Matters More Than It Appears To

Electronic health records maintain audit trails. Every access, every edit, and every addendum is timestamped. A reviewer examining a record can generally determine when each element was created and whether anything was added after the encounter.

A documentation entry created after the audit notice arrived, appearing in a record submitted in response to that notice, is among the most damaging findings possible. It converts a documentation deficiency, which is a payment issue, into an apparent falsification, which is an enforcement issue. Practices have turned recoverable audits into False Claims Act exposure through well-intentioned late edits.

What the Hold Should Cover

• Clinical documentation for the claims under review
• Clinical documentation for the same patients in the surrounding period, since context frequently matters to medical necessity
• Billing and claims data, including submission histories and remittance advices
• Scheduling and registration records
• Orders, referrals, and results from outside entities
• Internal correspondence regarding the claims or services at issue
• Prior audit findings and any related corrective action documentation

Days Three to Ten: Build the Claim Inventory

Create a working inventory of every claim in the request. For each, capture the beneficiary identifier, date of service, claim number, CPT and HCPCS codes billed, diagnosis codes, modifiers, rendering provider, place of service, and paid amount.

This inventory becomes the control document for the entire response. It tracks which records have been located, which are complete, which have identified problems, and which have been included in the package.

Locate Every Component

Clinical documentation for a single encounter frequently lives in more than one place. Depending on the service, a complete record may require:

• The encounter note, including history, examination, and medical decision making
• Physician orders and the documentation supporting medical necessity for those orders
• Diagnostic test results and interpretations, which may be held by an outside facility
• Operative or procedure notes
• Nursing and ancillary staff documentation
• Medication administration records
• Signed advance beneficiary notices where applicable
• Referral documentation and prior authorization records
• Physician signature and credentials, including signature attestations where a signature is illegible or missing

Start Outside Requests Immediately

Records held by outside entities, meaning hospital records, imaging center reports, reference laboratory results, and prior treating physician documentation, take time to obtain. Submit those requests in the first week. Waiting until the internal record review is complete is the most common cause of missed deadlines.

Days Five to Twenty: Audit Your Own Claims Before Submitting

This is the step that separates practices that manage audits from practices that are managed by them.

Before submitting anything, review each requested claim exactly as the contractor will. Evaluate whether the documentation supports the level of service billed, whether medical necessity is established under the applicable coverage determination, whether modifiers are supported, whether signatures and dates are present and legible, and whether every billed element appears in the record.

Why Do This

Three reasons, each independently sufficient.

First, it tells you what is coming. A practice that knows its own error rate before submission can plan for the findings, budget for the exposure, and prepare the appeal strategy in advance rather than reacting to a demand letter.

Second, it identifies documentation that exists but was not going to be included. Reviewers deny claims for missing elements that were actually documented elsewhere in the chart and simply never made it into the package. A pre-submission audit catches these.

Third, and most significantly, it reveals whether the problem is isolated or systemic. If the sample shows a pattern, the practice has an obligation to consider whether that pattern extends beyond the claims under review, and whether the sixty-day overpayment rule is implicated for claims the contractor has not yet examined. Discovering this after the audit concludes is substantially worse than discovering it during the response window.

Who Should Conduct It

Not the person who coded the claims. Self-review by the coder or provider responsible for the original documentation reliably produces optimistic assessments. Use a credentialed auditor without prior involvement in the claims at issue, whether internal to the practice or engaged externally.

What to Do With Bad News

If the internal audit reveals genuine deficiencies, that information is valuable rather than merely unwelcome. It informs whether to pursue the discussion period with a RAC, whether to prepare for appeal, whether to engage counsel, and whether a broader internal review or voluntary disclosure warrants consideration. What it does not justify is altering the records.

What a Complete Response Package Contains

Organize the submission so a reviewer can evaluate each claim without hunting for anything. The reviewer’s job is to determine whether documentation supports the claim. Anything that makes that determination harder works against you.

Package Structure

• Cover letter. Identify the practice, the contractor’s request by reference number, the claims included, the date of submission, and the contact person for questions. State plainly that the enclosed records are complete for each claim.
• Index or table of contents. List each claim by beneficiary, date of service, and claim number, with corresponding page numbers or tab identifiers.
• Claim-by-claim sections. Separate each claim clearly. Within each section, present documentation in a consistent order across all claims so the reviewer learns the structure once.
• Signature attestations where required. Where a signature is illegible or absent from an otherwise complete record, include a properly executed attestation statement.
• Supporting policy documentation where relevant. Where medical necessity turns on a coverage determination, including the applicable policy language can help the reviewer connect the documentation to the standard.

Practical Requirements

• Every page legible. Illegible documentation is treated as absent documentation
• Every page attributable to a specific patient and date of service
• Complete records rather than excerpts, unless the request specifies otherwise
• Submitted by the method the contractor specifies, whether electronic portal, fax, or mail
• A complete copy of everything submitted retained by the practice, exactly as sent
• Proof of timely submission retained, including transmission confirmations or certified mail receipts

Retain What You Sent

The retained copy is not a formality. If the matter proceeds to appeal, you will need to demonstrate precisely what the contractor received. Disputes about whether a document was included in the original submission are common and are resolved in favor of the party with the better record.

The Amendment Question: When Correcting the Record Helps and When It Destroys You

This question arises in nearly every audit and is answered incorrectly with alarming frequency.

The Rule

Medical records may be amended, corrected, or supplemented through legitimate documentation practices. A legitimate amendment is clearly identified as an amendment, is dated as of the date it was actually made, identifies the individual making it, and does not obscure the original entry. Electronic systems generally handle this automatically through addendum functionality.

What is never acceptable is altering a record to make it appear that documentation existed at the time of service when it did not. Backdating, overwriting original entries, or creating documentation after an audit notice and presenting it as contemporaneous crosses from documentation practice into falsification.

The Practical Standard

Ask whether the amendment adds a legitimate, clearly dated clarification, or whether it attempts to cure a deficiency by making the record look different than it did when the audit notice arrived. The first is defensible. The second is not, and the EHR audit trail will reveal it.

Timing Considerations

An amendment made after an audit notice, even a legitimate one, will draw scrutiny. Reviewers examine timestamps precisely because late documentation is a known indicator. Where a legitimate post-notice amendment is necessary, it should be clearly identified, properly dated, and ideally accompanied by an explanation in the cover letter rather than left for the reviewer to discover.

Signature Attestations

Missing or illegible signatures are a distinct and more forgiving category. Where the documentation is otherwise complete but the signature is illegible or was not captured, a signature attestation statement is an accepted remedy. The attestation confirms the identity of the author and that the author provided the documented service. It does not add clinical content, which is why it does not carry the risk that substantive amendment does.

Should You Include a Position Paper?

A position paper is a written explanation submitted alongside the records, framing why the claims meet coverage and medical necessity requirements. It is optional and it is not always advisable.

When It Helps

• The medical necessity rationale is clinically sound but not obvious from the face of the record
• The patient presentation was atypical in a way that justifies the service billed
• The applicable coverage determination contains ambiguity that the documentation resolves
• Documentation supporting the claim is distributed across multiple sources and the connections benefit from explanation
• The practice’s patient population differs from the norm in ways that explain apparent outlier billing

When It Hurts

• The documentation genuinely does not support the claim, in which case the paper draws attention to the gap and may constitute an admission
• The explanation relies on facts not present in the medical record
• The matter carries enforcement risk, where written statements may be used in a subsequent proceeding
• The argument is defensive in tone rather than clinical

If You Include One

Keep it clinical, factual, and grounded exclusively in what the record contains. Cite the specific coverage determination and connect its criteria to specific documented findings. Avoid characterizing the contractor’s motives, arguing about the fairness of the review, or making assertions that the record does not support. In matters with enforcement exposure, counsel should review any written submission before it goes out.

Days Twenty to Forty: Assemble, Verify, and Submit

Verification Before Submission

Work through the claim inventory a final time and confirm, for each claim:

• Every requested component is present
• Every page is legible
• Patient identifiers and dates of service are correct and consistent
• Signatures are present, or attestations are included
• Pages are in the intended order and nothing was lost during scanning or copying
• Nothing unrelated to the request was inadvertently included

Submission Mechanics

Use the method the contractor specifies. Many contractors now require or prefer electronic submission through a portal, which produces an immediate confirmation and eliminates mail transit risk. Where fax or mail is used, retain the transmission confirmation or certified mail receipt.

Submit ahead of the deadline. A package that arrives on day 44 leaves no room for a transmission failure, a portal outage, or a rejected upload.

Confirm Receipt

Follow up to confirm the contractor received the complete submission. Documentation that was sent but not received is functionally documentation that was never sent, and the burden of establishing otherwise falls on the practice.

Requesting an Extension

Contractors may grant good cause extensions for documented extenuating circumstances such as a natural disaster, a business closure, or another comparable disruption.

The critical requirement: the extension request must reach the contractor before the deadline passes. A request submitted after the deadline has expired does not restore a right that has already lapsed.

Extensions are not granted because the practice is busy, because staff turnover occurred, or because the request was routed slowly internally. Where a genuine qualifying circumstance exists, submit the request in writing, describe the circumstance specifically, propose a definite alternative date, and retain proof of timely submission.

The more reliable strategy is to build the internal schedule so that an extension is never necessary.

What Happens After You Submit

Review Timeline

Contractors generally complete review within 30 to 60 days of receiving a complete submission, though timelines vary by contractor and complexity. During this period, prepayment review claims remain held.

Possible Outcomes

• No errors identified. The review closes. For TPE, this may end the process entirely rather than proceeding to the next round.
• Partial denials. Some claims are denied and referred for recoupment while others are paid or upheld.
• Full denial with overpayment determination. The findings proceed to the demand and recoupment process.
• Education offered. Under TPE, the contractor offers one-on-one education and the correction window opens.
• Escalation. Findings suggesting a pattern rather than isolated errors may prompt expanded review, extrapolation, or referral to another contractor.

Use the Interval

The period between submission and findings is working time, not waiting time. If the internal audit identified deficiencies, begin remediation now: retrain the providers involved, correct the template or workflow that produced the problem, and document what was done. Corrective action initiated before findings are issued is materially more persuasive than corrective action initiated in response to them, and it is the mechanism that prevents escalation.

The Deadlines That Follow: Demand Letters, Interest, and Recoupment

If the review produces an overpayment determination, a new and considerably less forgiving set of deadlines begins. Practices that navigate the ADR well and then miss these deadlines lose money they did not need to lose.

The Key Dates From the Demand Letter

• Day 15: Deadline to submit a rebuttal to the proposed recoupment. A rebuttal is not an appeal and does not stop recoupment, but it provides an opportunity to present information before collection begins.
• Day 30: The pivotal date. Filing a valid request for redetermination by day 30 prevents recoupment from beginning. This is the single most important deadline in the post-determination phase.
• Day 31: Interest begins accruing on the outstanding balance if the overpayment has not been paid in full. Interest is charged on the outstanding principal for each 30-day period until the debt is satisfied.
• Day 41: Recoupment begins where the overpayment has not been paid and no valid redetermination request was filed by day 30.
• Day 120: The outer deadline to file a request for redetermination. Filing between day 31 and day 120 preserves appeal rights but does not undo recoupment that has already occurred, and amounts already recouped are generally not refunded unless the appeal succeeds.

Why the Thirty-Day Date Governs Practice

The 120-day appeal deadline is the one printed most prominently, and it is the one practices tend to calendar. But recoupment starting on day 41 means that a practice using the full 120 days will have money withheld for months while the appeal proceeds. For a practice with meaningful Medicare volume, that cash flow interruption can be more damaging than the overpayment itself.

The operative deadline is 30 days. Treat 120 as the absolute outer limit, not the target.

A Note on the RAC Discussion Period

Where a RAC issued the findings, a discussion period allows the provider to submit additional documentation directly to the RAC before recoupment is set up. The discussion period is not an appeal, does not stop interest, and does not extend the redetermination deadline. Once redetermination is requested from the MAC, the discussion option closes. Sequencing these two options is a strategic decision that should be made deliberately.

The Ten Most Costly Response Errors

• Calendaring from the receipt date rather than the letter date. Costs days that cannot be recovered.
• Assuming 45 days on a UPIC request. The window is 30, and the assumption forfeits a third of the available time on the most serious audit type.
• Submitting without an internal audit. Forfeits the opportunity to identify missing documentation that exists elsewhere in the chart and to prepare for known findings.
• Altering records after receiving notice. Converts a payment dispute into a potential enforcement matter. The audit trail is visible.
• Submitting incomplete records. Missing signatures, absent orders, and unattached test results generate denials on documentation that frequently existed but was never sent.
• Sending illegible copies. Illegible is treated as absent. Poor scans and faint faxes produce denials on adequate documentation.
• Failing to retain a complete copy of the submission. Makes it impossible to establish what the contractor actually received when that becomes disputed on appeal.
• Waiting on outside records. Hospital, imaging, and laboratory records take weeks. Requests submitted late are the leading cause of missed deadlines.
• Missing the 30-day redetermination date. Triggers recoupment on day 41 and withholds cash flow for the duration of an appeal that might have been filed in time.
• Treating findings as a cost rather than a correction mandate. Unremediated findings are the mechanism by which a routine audit becomes a larger one, and by which billing errors become False Claims Act exposure.

How DoctorsManagement Supports Audit Response

DoctorsManagement has guided practices through documentation requests from every Medicare contractor as well as commercial payer special investigations units. Our involvement during the response window, before findings are issued, consistently produces better outcomes than engagement after a demand letter arrives.

Our auditors hold both the Certified Professional Coder and Certified Professional Medical Auditor credentials and receive ongoing training through NAMAS, our education division. Every auditor brings substantial experience in the specialties they review.

Our audit response services include:

• Request Analysis: Identification of the contractor, confirmation of the operative deadline, assessment of enforcement risk, and determination of what the request actually requires
• Pre-Submission Internal Audit: Independent review of each requested claim against the documentation, conducted as a contractor would conduct it, so the practice knows its exposure before submitting
• Response Package Preparation: Assembly, organization, and verification of a complete, legible, well-indexed submission, including position paper development where appropriate
• Appeal Representation: Preparation and prosecution of redetermination, reconsideration, and ALJ-level appeals, with clinical and statistical expert support
• Extrapolation Defense: Statistical analysis of sampling methodology where an overpayment estimate has been applied
• Post-Audit Remediation: Corrective action planning, provider and coder training, and workflow correction to prevent recurrence and escalation

If your practice has received a documentation request, contact DoctorsManagement at www.doctorsmanagement.com/audit-appeal-defense or call (800) 635-4040.

Frequently Asked Questions

How many days do I have to respond to a Medicare records request?

45 calendar days for MAC, RAC, and SMRC requests, and 30 calendar days for UPIC requests. The clock runs from the date printed on the letter rather than the date of receipt, so internal routing delays consume the response window. The regulatory basis is 42 CFR 405.903 for prepayment review and 42 CFR 405.929 for post-payment review.

What happens if I miss the deadline?

The claims are denied for insufficient documentation, the denials produce an overpayment, and the overpayment enters the demand and recoupment process. A missed deadline also signals a documentation problem to the contractor and can prompt an expanded review. Missing the deadline is generally worse than submitting an imperfect but timely response.

Can I get an extension?

Contractors may grant good cause extensions for documented extenuating circumstances such as a natural disaster or business closure. The request must reach the contractor before the deadline expires. Being busy or short-staffed does not generally qualify, and a request submitted after expiration does not restore a lapsed right.

Can I correct or add to the medical record before submitting?

Legitimate amendments are permitted when clearly identified as amendments, dated as of the date actually made, attributed to the individual making them, and not obscuring the original entry. What is never acceptable is creating documentation after the audit notice and presenting it as contemporaneous. EHR audit trails reveal timing, and apparent falsification converts a payment dispute into an enforcement matter.

What do I do about missing or illegible signatures?

Where documentation is otherwise complete but a signature is missing or illegible, a signature attestation statement is an accepted remedy. The attestation confirms the author’s identity and that the author provided the documented service. It does not add clinical content, which distinguishes it from substantive amendment and makes it considerably less risky.

Should I have an attorney review my response?

For UPIC and OIG matters, matters referencing investigation rather than payment review, matters involving extrapolation with significant exposure, and matters where internal review revealed a pattern of deficiencies, yes, and before the package is assembled. For routine MAC probes, TPE Round 1, and CERT requests, experienced audit defense consultants are typically sufficient.

Should I include a letter explaining the claims?

A position paper helps when medical necessity is clinically sound but not obvious from the record, when the presentation was atypical, or when supporting documentation is distributed across sources. It hurts when the documentation genuinely does not support the claim, when the explanation relies on facts absent from the record, or when the matter carries enforcement risk. Keep any position paper clinical, factual, and grounded strictly in the record.

What is the most important deadline after I receive findings?

Day 30 from the demand letter. Filing a valid redetermination request by day 30 prevents recoupment from beginning on day 41. The 120-day outer deadline preserves appeal rights but not cash flow, and amounts already recouped are generally not refunded unless the appeal succeeds. Treat 30 days as the target and 120 as the absolute limit.

Should I audit my own claims before submitting them?

Yes, and the review should be conducted by someone other than the coder or provider responsible for the original documentation. A pre-submission audit identifies documentation that exists but was not going to be included, tells you what findings to expect, and reveals whether a deficiency is isolated or systemic. That last determination may carry sixty-day overpayment obligations extending beyond the claims under review.

How can DoctorsManagement help with an audit response?

DoctorsManagement provides request analysis, pre-submission internal auditing by credentialed auditors, response package preparation, appeal representation, extrapolation defense, and post-audit remediation. Engagement during the response window produces better outcomes than engagement after findings. Contact us at www.doctorsmanagement.com/contact-us or call (800) 635-4040.

External Resources and References

• CMS Medicare Overpayments Fact Sheet (MLN006379)
• CMS Medicare Financial Management Manual, Chapter 4: Debt Collection
• Federal Register: Medicare Program, Limitation on Recoupment of Provider and Supplier Overpayments
• CMS Regulations and Guidance
• ACEP Recovery Audit Contractor (RAC) FAQ
• OIG Work Plan
• OIG Self-Disclosure Information
• DoctorsManagement Audit Appeal and Defense
• DoctorsManagement Coding and Documentation Review
• DoctorsManagement Healthcare Compliance Audit
• DoctorsManagement Total Compliance Solution

Contact Us

This article is provided for informational and educational purposes only and does not constitute legal advice. Audit procedures, deadlines, and documentation requirements are subject to change, and the appropriate response to any specific request depends on its particular facts. Practices facing a documentation request should consult qualified legal and compliance professionals. DoctorsManagement is available to provide audit response and defense consulting at any stage of the process.