Guide

The records request: complete, organized, on time, copied

Summary

A post-payment audit records request is answered by sending a complete, organized, on-time, copied packet: every document that supports the billed service, indexed and page-numbered, delivered by a trackable method before the stated deadline, with an exact copy kept for your own file. Calendar the deadline the day the letter arrives, never alter the chart to improve it, and preserve your appeal rights by responding fully rather than repaying reflexively.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

First: read the request and calendar the deadline

Start with the letter, not the chart. A post-payment records request means a payer or its contractor has already paid the claims and now wants the documentation to decide whether it should have. Read who sent it — your Medicare Administrative Contractor, a Recovery Audit Contractor, or a commercial payer's audit unit — exactly which claims and dates it names, the format it wants, where it goes, and the response deadline. Calendar that deadline the day the letter arrives 1Ref 1Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.That Recovery Audit Contractors conduct post-payment review and that the provider's appeal rights run through the five-level Medicare appeals process..

Note who is asking. A request from your MAC or a Recovery Audit Contractor is usually routine documentation review. A request from a Unified Program Integrity Contractor or a commercial special-investigations unit is fraud-focused — how serious a UPIC investigation is depends on scope, but treat it as one from the first letter.
Note why. These requests follow outlier patterns: a high-level distribution that sits above your peers — your E/M bell curve — a frequently appended modifier 25, or a single code billed at volume. Knowing the trigger tells you what the reviewer is really testing.

Complete: what belongs in the packet

Complete means everything that supports the service, not just the note. Include the dated progress note, the signed treatment plan, the intake and consents, orders and results you referenced, and any authorization on file — the full record behind each billed claim. The single most common technical failure is an unsigned or illegibly signed note; Medicare requires services to be authenticated, and a signature attestation can cure a missing or illegible signature during review 2Ref 2Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires services to be authenticated by signature and that a signature attestation can cure a missing or illegible signature during review..

Match each document to a claim. For every date of service under review, assemble the note plus everything it relies on, so a reviewer can trace the code to the record without gaps.
Do not pad. Sending unrelated encounters does not strengthen the packet and can expose more than the request covers. Send what supports the claims named, completely.
Confirm the signature. If any note lacks a valid signature, prepare the attestation statement now rather than discovering the gap after the demand letter.

Organized, on time, copied: the mechanics

How you assemble and send the packet is half the defense. Organize it so a reviewer never has to hunt: a cover sheet listing each claim, documents grouped and labeled by date of service, and every page numbered. Send by a trackable method and keep the proof of delivery. On time means by the stated deadline, or with a written extension requested before it — a late or missing response is scored as no documentation and becomes an automatic overpayment.

Copied — keep an exact duplicate of what you sent, page-for-page. You will build every appeal from that copy, and you cannot defend a packet you cannot reproduce.
Logged — record the send date, the method, the tracking number, and the deadline in one place.
Extensions — if the volume is large, ask in writing before the deadline; many reviewers grant a short extension, but only if you request it in time.

Never fix the chart — addendum vs alteration

Editing the record to help the audit is the mistake that ends careers. If you find a genuine omission, you may add a late entry, but only as a clearly labeled addendum dated the day you actually write it and referencing the original entry — never by changing, overwriting, or backdating what is already there. Auditors compare metadata and versions, and an alteration allegation converts a payment dispute into a fraud and record-integrity problem.

Addendum — permitted, transparent, dated when written; it adds without hiding.
Alteration — changing the substance of an existing entry to match the bill; this is what destroys credibility and invites referral.
The rule — send the record as it truthfully stood at the time of service. A weak note defended honestly beats a strong note that cannot survive a metadata review.

Do you need the patient's authorization? No

You may release the records without separate patient authorization. Disclosing a chart to a payer to substantiate a claim is a payment operation permitted by the HIPAA Privacy Rule, subject to the minimum-necessary standard — send what the request covers, not the chart of unrelated encounters 3Ref 3HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That disclosure to a payer for payment purposes is a permitted use under the Privacy Rule, subject to the minimum-necessary standard.. A payer audit request is a routine, contract-authorized payment disclosure, and treating it as one keeps you from over-releasing.

This is a different animal from legal process. A subpoena without a court order requires satisfactory assurances of notice or a protective order before you disclose, and a court order limits you to exactly what it authorizes 4Ref 4HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a subpoena without a court order requires satisfactory assurances before disclosure and a court order limits disclosure to what it authorizes — distinguishing legal process from a routine payment-operations audit request.. If a records request arrives with a subpoena or court order attached, stop and handle the legal-process rules first — do not fold it into the routine audit response.

What happens after you send it

Sending the packet starts a clock, not the end of the matter. The reviewer decides whether each claim was supported and issues a demand or takeback letter if it finds an overpayment. From there your appeal rights begin, and for Medicare they run through the five-level appeals process; calendar every appeal deadline the day each letter arrives. Know which program you are in: a Targeted Probe and Educate round is educational and correctable between rounds 5Ref 5Centers for Medicare & Medicaid Services (2026).Targeted Probe and Educate (TPE).That TPE is an education-focused review conducted in rounds, correctable between rounds, contrasted here with a straight recovery demand., while a straight recovery demand is not.

Appeal, do not repay reflexively. Use the appeal levels for claims you can defend; conceding the finding can forfeit rights you would otherwise keep.
When it is more than an audit. Extrapolation across a sample, a large dollar demand, or a program-integrity origin is the counsel threshold — the point where a healthcare attorney should see the file before you respond further.

Common questions

The letter sets the deadline, and it is the one date that matters. Miss it and the unproduced claims are typically denied as unsupported, creating an automatic overpayment. Medicare additional-documentation requests and commercial audits state their own timeframes, so calendar the exact date the letter arrives, and if you need more time, request an extension in writing before the deadline passes.

No. Releasing records to substantiate a claim is a payment operation permitted under HIPAA, limited by the minimum-necessary standard, so send the documentation the request covers rather than the entire chart. This differs from a subpoena or court order, which carry their own notice and protective-order rules that you must satisfy before disclosing anything.

Use a signature attestation rather than signing the old note late. Medicare permits an attestation statement to authenticate a service when the signature is missing or illegible, but it must be a proper attestation, not an edit of the original entry. Never backdate or overwrite the chart to add a signature — that reframes a documentation gap as record tampering.

Usually not. Most requests are routine documentation review by a MAC or Recovery Audit Contractor confirming that claims were supported. The tone changes when the request comes from a program-integrity unit, spans a large sample, or signals extrapolation. Respond completely to every request, and bring in counsel when the scope suggests a fraud investigation rather than a coding review.

Not reflexively. Repaying concedes the finding and can forfeit appeal rights you would otherwise keep, and it does not stop the reviewer from expanding the sample. Respond with the complete record first, then use the appeal levels for the claims you can defend. Repay only what a review you agree with, or your own audit, actually shows was overpaid.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Centers for Medicare & Medicaid Services (2026). Medicare Fee for Service Recovery Audit Program. Centers for Medicare & Medicaid Services (CMS). link ✓That Recovery Audit Contractors conduct post-payment review and that the provider's appeal rights run through the five-level Medicare appeals process.
2.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓That Medicare requires services to be authenticated by signature and that a signature attestation can cure a missing or illegible signature during review.
3.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat disclosure to a payer for payment purposes is a permitted use under the Privacy Rule, subject to the minimum-necessary standard.
4.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThat a subpoena without a court order requires satisfactory assurances before disclosure and a court order limits disclosure to what it authorizes — distinguishing legal process from a routine payment-operations audit request.
5.Centers for Medicare & Medicaid Services (2026). Targeted Probe and Educate (TPE). Centers for Medicare & Medicaid Services (CMS). link ✓That TPE is an education-focused review conducted in rounds, correctable between rounds, contrasted here with a straight recovery demand.

https://www.gale.care/for-providers/eca-postpayment-records-request · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers