Audit and lookback clauses: the years you are agreeing to

How far back can a payer audit under your contract?

There is no single national number — the answer is set by two things that both vary. Your contract's audit and lookback clause names how far back the payer may review claims and recover overpayments, and your state's recoupment or prompt-pay law caps that window, with the limit differing from state to state. Payers publish these audit and recovery rules in their own policies, and your contract controls 1Ref 1Anthem (2026).Anthem Provider Policies.Named example that Anthem publishes its reimbursement and recovery policies on its provider portal, used to show the audit and overpayment rules live in the payer's own policy and 'your contract controls' — not a national rule.2Ref 2UnitedHealthcare (2026).UnitedHealthcare Policies and Protocols.Named example that UnitedHealthcare publishes its policies and protocols online, used alongside the other example for the 'audit rules are published by the payer, your contract controls' framing.. So read the clause, then read your state's insurance code.

That two-layer answer matters because a solo practice often assumes the contract is the ceiling. It is not: the contract may allow a longer lookback than your state permits, or your state may not cap it at all for a given plan. Government payers add a third layer with their own rules. Knowing which layer governs a specific claim is what tells you how many years of records you actually have to defend.

What the audit clause in your contract sets

The contract's audit clause is where most of the concrete terms live. It typically sets the lookback period, the records you must produce and the deadline to produce them, the payer's right to use sampling and extrapolation, and how it will recover an overpayment — usually by offset against future payments. Read each of these, because a short production deadline or a broad extrapolation right can hurt more than the raw number of lookback years.

• Lookback window. How many years of paid claims the payer can reopen.
• Production deadline. How long you have to send records once an audit letter lands — often short.
• Sampling and extrapolation. Whether the payer can review a sample and project the error rate across all claims, which multiplies a small finding.
• Recovery method. Whether repayment is invoiced or taken by offset against your future remittances, and on what notice.

This is exactly why reading a payer contract before signing pays off: the audit clause is negotiable at the front end and immovable once you are mid-audit.

The layers on top of your contract

Two other bodies of rules sit above the contract. State recoupment and prompt-pay statutes limit how far back and how fast a payer can claw money back, and those limits vary by state — some are tight, some barely exist, and self-funded ERISA plans may sit outside them entirely. Medicare and Medicaid run their own audit and overpayment programs on their own timelines, and Medicaid enrollment and oversight are state-administered under federal rules 3Ref 3Centers for Medicare & Medicaid Services (2026).Provider Enrollment.That Medicaid is state-administered under federal rules, so its audit and overpayment oversight runs through the state agency and adds a program-specific lookback layer on top of the commercial contract..

The practical upshot is that the same date of service can carry three different lookback answers depending on the plan: the commercial contract's window, your state's statutory cap where it applies, and the federal program's rule for Medicare or Medicaid. Do not read one state's recoupment limit as the national rule, and do not assume your contract's number is the binding one — check which layer actually governs the claim in front of you.

What audits check — and how documentation decides them

Most audits turn on documentation, not clinical judgment. The recurring findings are records that do not support the code billed, missing or illegible signatures, and services billed under rules the note does not meet. Medicare requires each service to be authenticated by a handwritten or electronic signature, and a missing one can sometimes be cured by an attestation during review 4Ref 4Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires services to be authenticated by a handwritten or electronic signature and that an attestation can cure a missing signature in review — a common audit finding and how it is remedied.. If you bill staff services incident-to, the supervision and initiating-service conditions are exactly what an auditor tests 5Ref 5Office of the Federal Register (2026).42 CFR 410.26 — Services and supplies incident to a physician's professional services.The incident-to conditions — direct supervision and the initiating-service requirement — that an auditor tests when a practice bills staff services incident-to a supervising clinician..

The defense is built long before the letter: contemporaneous notes that stand on their own, signatures on every entry, and the ability to show which fee schedule and which policy were in effect on the date of service. Keep the version of the payer's reimbursement policy that applied then, not just the current one — an audit is judged against the rules that existed at the time, and those rules may have changed since.

If an audit finds a real problem

Not every audit finding is wrong, and how you respond matters as much as the finding. If the records genuinely do not support what was billed, you generally have an obligation to return the identified overpayment, and ignoring the takeback letter only adds interest and offsets. If the conduct implicates federal health-program fraud laws, the OIG maintains a self-disclosure protocol that lets you report and resolve it deliberately rather than waiting to be found 6Ref 6HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG maintains a self-disclosure protocol for conduct implicating federal health-program fraud laws — the deliberate escalation path when an audit reveals more than a simple overpayment..

But do not concede a finding you can rebut. The contract's dispute resolution process — and your right to appeal the audit through the payer's stated steps — is how you contest an extrapolation or a wrongly denied service. Know the payer's offset rights before money starts disappearing from remittances, so a recovery does not surprise your cash flow. And if a finding coincides with leaving a network, the exit accounting matters — a negative balance can follow you into termination.

Reduce your exposure before the letter comes

You cannot prevent an audit, but you can shorten the years it can reach and strengthen what it finds. Start by reading each contract's audit and lookback clause so you know the window you agreed to, then keep your documentation and your contract file for at least that long — and for your state's medical-record retention period, whichever is longer. Good records shrink both the odds of a finding and the size of one.

• Snapshot the fee schedule and policies on the day each takes effect, so you can prove which rules applied to a past date of service.
• Know your state's recoupment limit and whether a given plan is self-funded and outside it.
• Sign and date every note — an authentication gap is the most avoidable audit finding there is.
• Calendar the response deadline the day any audit or takeback letter arrives, and answer through the contract's dispute steps.
• Escalate a real problem deliberately rather than hoping it is missed; the self-disclosure path exists for exactly that.