Sign and lock: payer expectations and your own policy

No universal deadline — three separate clocks

Nobody sets one single number that governs every note you write. Medicare requires services to be authenticated within a reasonable time relative to when they were furnished, without a fixed hour count written into the manual itself; some payers publish their own signature-timeliness expectations as part of their provider policies, on top of Medicare's baseline; and your own EHR lock setting is the deadline you actually control day to day, regardless of what any payer requires.

The honest answer to "how fast" is: fast enough that your memory of the visit is still accurate, and consistent enough that you have one habit rather than three. Most of the risk in this area comes from inconsistency — some notes locked same-day, others drifting a week or more — rather than from any single note missing a specific external deadline.

What Medicare actually requires

Medicare's signature guidance is built around authentication, not a stopwatch: a service needs a handwritten or electronic signature that authenticates the record, and where a signature is missing or illegible, an attestation statement can cure it during review 1Ref 1Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.Establishes that Medicare requires authentication within a reasonable time without a fixed hour count in the manual, and that attestation cures a missing signature.. What the guidance does not do is name a specific number of hours or days within which every note must be locked — that specificity, where it exists at all, tends to live in individual Medicare Administrative Contractor guidance or payer manuals, not in the core signature requirement itself.

Treat "reasonable time" as exactly that: a standard, not a countdown clock. A note signed the same week, consistently, satisfies the spirit of the requirement far better than a note signed within an arbitrary 24-hour window one time and three weeks late the next.

Payer-specific policies: named examples, your contract controls

Several major payers maintain their own clinical and reimbursement policy portals separate from Medicare's framework, and where one of them sets a specific documentation-timeliness expectation, it applies to that payer's contract with you, not to your practice universally or to patients covered by anyone else. Checking each payer's own published policy is the only reliable way to know whether a stricter number applies to a given claim:

• Anthem publishes its medical and reimbursement policies on its own provider portal 2Ref 2Anthem (2026).Anthem Provider Policies.Cited as a named example of a payer publishing its own clinical/reimbursement policy portal; used only as that payer's example, not as a universal rule..
• Aetna maintains its Clinical Policy Bulletins covering its own coverage and documentation expectations 3Ref 3Aetna (2026).Aetna Clinical Policy Bulletins.Cited as a named example of a payer publishing its own clinical/reimbursement policy portal; used only as that payer's example, not as a universal rule..
• UnitedHealthcare publishes its policies and protocols for network providers 4Ref 4UnitedHealthcare (2026).UnitedHealthcare Policies and Protocols.Cited as a named example of a payer publishing its own clinical/reimbursement policy portal; used only as that payer's example, not as a universal rule..
• Cigna maintains its own coverage and claims policy library 5Ref 5Cigna (2026).Cigna Coverage and Claims Policies.Cited as a named example of a payer publishing its own clinical/reimbursement policy portal; used only as that payer's example, not as a universal rule..

None of these substitute for reading your own contract or provider manual with each payer you're credentialed with — a specific turnaround number, where one exists, is a term of that specific agreement. "Your contract controls" isn't a dodge here; it's the accurate answer, since no single payer's policy binds a practice that isn't in-network with them.

Setting your own internal lock window

Pick a specific, short window — a small number of business days is typical — and apply it to every note regardless of how the visit went, rather than locking straightforward notes same-day and letting complicated ones drift for weeks. A consistent internal policy is what actually protects you: it demonstrates a habit a reviewer can rely on, rather than a best-case example next to a pile of stale drafts.

If your EHR supports an automatic lock after a set number of days, turn it on. An automatic lock forces the discipline even on your busiest weeks, and it converts "I'll finish that note later" from an open-ended intention into a deadline the software itself enforces.

Why delay erodes accuracy, not just timeliness

Since 2021, an office visit can be coded by total time as well as medical decision making, and an accurate time-based code depends on your own memory of how long the visit actually took — memory that degrades fast once a note sits unsigned for days 6Ref 6American Medical Association (2023).CPT evaluation and management (E/M) revisions.Establishes that total time is a valid basis for office-visit coding, supporting why prompt signing protects the accuracy of a time-based code.. CMS's E/M guide expects documentation to support the level billed with content that reflects what was actually done 7Ref 7Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.Supports that documentation must reflect what was actually done to support the level billed, reinforcing why a delayed note risks accuracy.; a note reconstructed from a calendar entry a week later supports that far less reliably than one written the same day.

Delay also raises the odds you'll lean on whatever the template pre-populated rather than what you specifically remember — copy-forward with guardrails matters most exactly when your own memory is thin, because that's when a stale default is easiest to leave unedited. A note drafted by a scribe or AI tool needs the same discipline: the attestation line still requires your own timely read, and a delayed review of an AI draft has the same accuracy risk as a delayed self-written note.

After lock: addenda, not edits

Locking a note doesn't mean it's frozen forever — it means further changes go through a dated addendum or late entry rather than an edit to the original text. If you remember a detail after lock, or a med rec conversation you forgot to capture, add it with today's date and a note explaining why it's being added now; that's a normal, expected part of the process, not a workaround.

What a good lock policy prevents is quiet editing: going back into a note weeks later and changing the original text without a trace. That's a different and much riskier thing than an honest, dated addendum, and it's exactly the distinction a reviewer is trained to look for.

Auditing your own turnaround

Add sign-to-lock turnaround to whatever periodic self-check you already run — if you keep something like the quarterly ten as a running self-audit, this is a natural tenth or eleventh item: pull a sample of recent notes and check how many days elapsed between the visit and the lock. A pattern of consistent same-week signing is the goal; a pattern that drifts wider every quarter is worth catching before a payer or reviewer notices it first.

The target isn't speed for its own sake. It's the same discipline that runs through the defensible note generally: written close enough to the event that it's still accurate, signed promptly enough that the record and your memory of the visit are still the same thing.