How to Prepare for a Payer Audit: The 9 Documents to Pull First, the 45-Day Clock, and the 3 Gaps That Cost Therapists the Most (2026)
To prepare for a payer audit, pull five things for every claim under review: the signed treatment plan, the progress note showing psychotherapy start and stop times, documented medical necessity, the eligibility and authorization record, and a dated signature with your credentials. Send only what the payer requested. Read every page before it leaves your office.
That is the answer. Here's what it leaves out: most therapists don't lose audits because their care was bad.
They lose because a note that reads perfectly well clinically is missing one billing element, and that single gap turns a paid claim into a refund demand, sometimes across hundreds of sessions at once.
This guide walks you through what triggers an audit, what the payer actually reads, how to respond inside the deadline, and the self-audit you can run on ten charts this week to find your gaps before someone else does.
What triggers an insurance audit of a therapy practice?
Payers don't pick you out of a hat. They run your claims against everyone else billing the same codes in your region, and they flag the outliers.
Here's what puts a behavioral health practice on the list:
Billing 90837 almost exclusively: The 53-minute code pays more than 90834, and payers watch the ratio. If 95% of your sessions are 90837 and your peers sit at 40%, expect questions.
If you're unsure which code fits which session length, the difference between 90837 and 90834 and the modifiers that sink claims is worth ten minutes of your time.
High session volume per day: Billing 12 to 14 units of therapy on a single date raises a time-math question the payer will ask you to answer with documentation.
Telehealth patterns: Place-of-service and modifier choices are a live audit target. Getting telehealth place-of-service and modifier decisions right matters more now than it did three years ago.
A pattern of denials and appeals: Repeated denials tell a payer your documentation may not support what you bill.
A complaint or a tip: Sometimes a former employee, a client, or a competing practice starts the process.
Random sampling: Some audits carry no signal at all. You were simply selected.
The Office of Inspector General (OIG) at the U.S. Department of Health and Human Services gave payers a very specific reason to look at our field.
In a nationwide audit covering March 2020 through February 2021, Medicare Part B paid roughly $1 billion for psychotherapy services, and the OIG estimated that $580 million of that was improper, with $348 million tied to telehealth and $232 million to in-person care.
Providers either failed to document psychotherapy time or omitted other required information, and in 54 of the sampled enrollee days, providers did not sign their claims. You can read the full report on the OIG's site.
Read that again. More than half the money was flagged, and almost none of it was fraud. It was paperwork.
What documentation do payers request in a therapy audit?
An audit request names specific dates of service. For each one, the reviewer wants a complete, self-contained record. Here are the nine documents to pull first.
The signed, dated treatment plan covering that date of service, with diagnosis, measurable goals, planned interventions, and the frequency and duration of treatment.
The progress note for the session, including start time, stop time, and total minutes.
The intake or diagnostic evaluation that established the diagnosis you're billing.
Documented medical necessity - the clinical reasoning that explains why this client needs this service at this frequency right now.
Your signature block with full name, credential (LCSW, LPC, LMFT, PsyD), and the date you signed.
The eligibility and benefit verification you ran before the session.
The prior authorization and its approved unit count, where the plan required one.
The claim and the remittance advice showing what you billed and what the payer paid.
Supervision documentation, if a pre-licensed clinician delivered the service under your supervision.
One rule governs all nine: send what was requested and nothing more.
Payers routinely ask for "the complete record," and a complete record does not mean psychotherapy notes, which HIPAA protects separately.
Before you release anything, check the rules governing what a valid records authorization must contain and the five requests you should never fulfill as written. Overdisclosure creates a second problem while you're trying to solve the first.
How do I respond to an Additional Documentation Request (ADR)?
An Additional Documentation Request, or ADR, is the letter that starts the clock. For Medicare reviews, the standard response window runs 45 calendar days from the date on the letter. Commercial payers set their own windows, and some run as short as 15 or 30 days.
Missing the deadline counts as an error. The claim gets denied on non-response alone, no matter how good the note was.
Step 1: Log the deadline the day the letter arrives
Put the due date on the calendar and backdate a target of 30 days so mail or portal problems don't sink you.
Step 2: Confirm what kind of review this is
Call the payer and ask directly: prepayment or postpayment, targeted or random, and which issue triggered it. The answer shapes everything you do next.
Step 3: Build one packet per claim
Keep claims separate, each with its own cover sheet and a copy of the corresponding ADR. Reviewers process by claim, not by box.
Step 4: Read every page before you send it
This is the step practices skip, and it is the most expensive one. Someone prints the notes, seals the envelope, and mails documentation that was never reviewed against the payer's own requirements.
Step 5: Fix what is fixable and disclose what is not
You may add a signature attestation for an unsigned note. You may not rewrite a note after the fact and present it as contemporaneous. That crosses from correction into falsification.
Step 6: Submit through the payer's preferred channel and confirm receipt
Electronic portals are faster, but confirm every document uploaded and that you received an acceptance notice.
Step 7: Keep a complete copy of exactly what you sent
If findings come back, you need to know precisely what the reviewer saw.
Across the practices HireGaynell supports, the practices that assign one person to own the ADR return complete packets in about 9 days. Solo owners handling it alone between sessions average closer to 40, and roughly one in six misses the deadline entirely.
Not sure your notes would survive a review?
Most owners find out the hard way. You don't have to. Book a free consultation, and we'll walk through your last ten charts against payer requirements and tell you plainly where the gaps are.
What does a Medicare TPE audit look like for a behavioral health practice?
Targeted Probe and Educate, or TPE, is Medicare's structured review process, run by your Medicare Administrative Contractor (MAC). It is the audit most small practices meet first, and it works in rounds.
A single round typically covers 20 to 40 claims, and a provider faces up to three rounds, with individualized education offered after each one.
The MAC then allows at least 45 days before starting the next round, specifically so you have time to improve, and a provider found compliant at the end of any round exits the process and generally isn't reviewed again for at least twelve months.
If the errors persist through all three rounds, the tone changes.
CMS states that problems that fail to improve after three rounds of education get referred for next steps, which may include 100 percent prepayment review, extrapolation, or referral to a Recovery Auditor. You can read CMS's own explanation on the TPE program page.
Extrapolation is the word to watch. It means the payer applies your error rate from a small sample across your entire claim history for the period. A 40% error rate on 25 claims can become a five-figure refund demand.
How far back can a payer audit therapy claims?
Different auditors, different windows.
Medicare Recovery Audit Contractors are limited to a three-year look-back period, measured from the date a claim was paid.
But that limit protects you less than it sounds.
CMS has been explicit that a provider who receives an unfavorable RAC finding must review claims across the full six-year look-back period tied to the overpayment rule, and cannot hide behind the RAC's three-year limit.
Commercial payers set their own look-back in your contract. Two to three years is common, and some Medicaid programs reach further.
Note: pull your executed payer contracts and read the audit and recoupment clauses; these vary by plan and by state.
This is exactly why retention rules matter operationally, not just legally. If your audit window is six years and your record-keeping practice is five, you cannot defend a claim you no longer hold.
The record retention timelines and the destruction mistakes that trigger board complaints are worth aligning to your longest payer window, not your shortest.
What are the most common documentation gaps in behavioral health audits?
Three gaps account for most of what we find, and all three are cheap to fix before an audit and expensive to fix after.
Gap 1: Missing or vague time documentation
Psychotherapy codes are time-based. A note that says "50-minute session" without start and stop times invites a reviewer to disallow it. Across the behavioral health practices HireGaynell supports, missing start and stop times show up in roughly one in three charts during a first-pass self-audit, and it is the single most common finding we report back.
Gap 2: Stale or incomplete treatment plans
A treatment plan needs a diagnosis, measurable goals, planned interventions, frequency, duration, and a current signature. The OIG audits kept finding plans that were unsigned or silent on frequency and duration. In our own records reviews, about one in five active treatment plans has drifted past its stated review date.
Gap 3: Signature problems
Unsigned notes, undated signatures, missing credentials, and image-stamped signatures that don't reflect a real signing event. This one is pure administration, and it is entirely preventable inside your electronic health record (EHR).
A fourth pattern deserves a mention because owners rarely connect it to audit risk: routinely waiving copays.
Payers treat consistent waivers as a contract issue, and the paper trail lives in the same charts a reviewer is already reading. The six-step system for collecting copays and past-due balances covers the waiver language that can void a payer contract.
How do I run a self-audit on my therapy notes?
Do this before a payer does it for you. It takes about two hours.
Step 1: Pull ten charts at random from the last six months, weighted toward your highest-volume code.
Step 2: Score each one against the nine documents above. Present, missing, or incomplete. No partial credit.
Step 3: Check the time math. Do the documented start and stop times support the code you billed? Do the total minutes across a single day match a schedule a human being could actually keep?
Step 4: Check every signature for name, credential, and date.
Step 5: Verify each treatment plan is current and names frequency and duration in plain language.
Step 6: Calculate your error rate. Any chart with a missing required element counts as an error. If more than two of ten fail, treat that as a system problem, not a memory problem - fix your note template inside SimplePractice, TheraNest, or TherapyNotes so the field cannot be left blank.
Step 7: Repeat quarterly and keep the results. A documented internal review program is itself evidence of good faith if a payer ever questions your intent.
What happens if a payer says I owe money back?
You get a demand letter with an amount and a deadline. You have three real options: pay it, appeal it, or negotiate the extrapolation methodology.
Appeal deadlines are short and unforgiving, and the same evidence-first approach that wins claim appeals wins audit appeals. The process for appealing a denied insurance claim and deciding which denials are worth fighting applies almost directly here.
One rule you cannot negotiate: under federal law, providers must report and return an identified overpayment within 60 days of identifying it. Once you know, the clock runs.
Note: confirm current application with your compliance counsel; the reporting mechanics differ between Medicare, Medicaid, and commercial plans.
Also watch your cash flow. Recoupment usually means the payer withholds future payments until the balance clears, which hits your accounts receivable while you're still delivering care.
If your aging AR follow-up system is already loose, a recoupment turns a paperwork problem into a payroll problem.
How HireGaynell keeps audit risk off your desk
We run administrative operations for solo and small-group behavioral health practices that bill insurance and have no front desk. Audit readiness is not a separate product for us. It is a byproduct of doing the daily work correctly.
That means we verify benefits and prior authorization before the session, so the eligibility record exists when a reviewer asks for it. We keep credentialing and CAQH ProView re-attestation current, so a lapse never becomes a documentation finding. We scrub claims against the note before submission, catching code and modifier mismatches while they're still fixable. We build EHR templates in SimplePractice, TheraNest, and TherapyNotes that make time fields and signature blocks required rather than optional. And we run quarterly chart reviews so you learn about your error rate from us instead of from a MAC.
If an audit letter has already landed, we assemble the packet, track the deadline, and hand you a reviewed submission instead of a stack of printouts.
If your documentation is the thing keeping you up at night, that is exactly what HireGaynell's practice administration and billing support handles, at $58/hour on packages.
Conclusion
In my experience running billing and credentialing operations for behavioral health practices, the single thing that decides an audit outcome is not clinical quality - it is whether your note template forces the required fields before anyone can sign it.
Practices that build the requirement into the system pass. Practices that rely on remembering, between 3 p.m. and 4 p.m., do not. Fix the template this week, run ten charts against it, and you will have done more for your audit position than any policy document ever will.
Ready to stop guessing whether your documentation would hold up?
Book a free consultation, and we'll review your last ten charts, name the gaps, and give you the fix list.
