The envelope is from the Medicare Administrative Contractor and the subject line says "Targeted Probe and Educate: Additional Documentation Request". The practice manager reads "audit", assumes it is the Recovery Audit Contractor she has heard about at conferences, and puts it on the provider's desk, where it sits for nine days. The same week a commercial payer's special investigations unit asks for thirty charts supporting 99215 visits within fifteen business days, and a company nobody has heard of requests records on behalf of a Medicare Advantage plan. Three requests, three sets of rules, and the practice treats them all the same way: slowly, without reading the letterhead.
The first mistake is almost always the same one. The practice does not identify who is asking and under what authority, so it does not know the deadline, whether the request can be discussed or only appealed, whether recoupment can be paused, or whether the first call should go to the billing team or to a lawyer. Everything else in an audit response flows from that identification.
Payer audits fall into a small number of types, and your rights depend on which one you are in. Medicare fee-for-service reviews come from the MAC (Targeted Probe and Educate), the Supplemental Medical Review Contractor, the Comprehensive Error Rate Testing contractor and the Recovery Audit Contractors; program integrity investigations come from the Unified Program Integrity Contractors, the HHS Office of Inspector General and state Medicaid Fraud Control Units; Medicare Advantage and commercial reviews come from the plan under the contract and state insurance law; Medicaid reviews come from the state agency and its contractors. The response plan is the same four moves every time: identify the auditor and the authority, calendar the exact deadline, assemble a complete and indexed record set, and route the outcome to the right appeal or education path. The rest of this guide is a set of "if this, then that" rules for each type.
Who is asking, and under what authority?
Read the letterhead, the signature block and the first paragraph, then match them to the table below. If the sender is a Medicare contractor you do not recognize, confirm it on CMS's Review Contractor Directory, which lists the MAC, RAC and UPIC for each state, before you send a single page. A legitimate contractor will not object to being verified.
| The letter comes from | Audit type | What they are looking for | Typical response window | Discussion or appeal path |
|---|---|---|---|---|
| Your Medicare Administrative Contractor, citing Targeted Probe and Educate | MAC medical review (TPE) | Documentation supporting a specific service or code pattern where the MAC's data shows a high error rate | Stated in the ADR, commonly 45 calendar days | Education session after each round; denials appealed through the standard five Medicare levels |
| Performant or Cotiviti (or whoever holds the region), citing the Recovery Audit Program | RAC post-payment review | Overpayments and underpayments on paid claims, automated (data only) or complex (records), within the approved review topics | Stated in the ADR, commonly 45 days; discussion request within 30 days of the review results letter | Discussion period with the RAC, then the five Medicare appeal levels once the MAC issues a demand |
| Noridian as Supplemental Medical Review Contractor | SMRC project review | Nationwide review of a topic CMS selected from CERT, OIG or data findings | Stated in the letter, commonly 45 days | Discussion and education with the SMRC; MAC issues any demand; standard appeals |
| The CERT Documentation Center | CERT error-rate sample | A random sample of paid claims used to compute the national improper payment rate | 45 calendar days, with extensions available | Non-response is scored as an error and becomes an overpayment; standard appeals through the MAC |
| A UPIC, the HHS OIG, the Department of Justice or a state MFCU | Program integrity or fraud investigation | Patterns suggesting fraud, waste or abuse; may include interviews, unannounced visits and payment suspension | Varies; may be short | Counsel first; administrative appeals exist but the stakes and the rules are different |
| A Medicare Advantage plan, a commercial payer's SIU or medical review unit, or a vendor acting for them | Contractual review (pre-payment, post-payment, SIU) | Coding levels, medical necessity, modifier use, unbundling, risk adjustment documentation (RADV) | Set by the contract or the letter, often 10 to 30 days | Plan's internal appeal, then the contract's dispute process and state insurance law; MA coverage disputes follow Medicare rules |
| Your state Medicaid agency, its RAC or program integrity unit | Medicaid review | Payment accuracy, enrollment and screening compliance, managed care encounter accuracy | Set by state rule, often 30 days | State administrative appeal process; MFCU referral for suspected fraud |
If the letter is a Targeted Probe and Educate request, then treat it as a teaching audit with teeth
TPE is the MAC's medical review program and it is the audit most practices will actually meet. The MAC selects a provider because data analysis shows a high denial rate or unusual billing on a specific topic, requests records for a probe of 20 to 40 claims, reviews them, and sends the results with an invitation to a one-on-one education session. If the error rate is high, the practice gets at least 45 days to make changes before a second round of 20 to 40 claims, and then a third. Providers who become compliant are not reviewed again on that topic for at least a year. Providers who fail three rounds are referred to CMS for further action, which the program page says may include 100 percent prepayment review, extrapolation or referral to a Recovery Auditor.
Then: respond to every claim on the ADR by the date in the letter, never partially, because a missing record is scored as a denial. Attend the education session with the rendering provider in the room, not only the billing manager, and write down exactly which documentation elements the reviewer found missing. Use the improvement window to fix templates and retrain, and run your own probe of the same topic before round two. Appeal individual denials you believe are wrong; an overturned denial improves the round's error rate.
If the letter comes from a Recovery Audit Contractor, then watch two clocks
RACs are paid a contingency fee on what they recover, work from a list of CMS-approved review topics, and can look back three years from the date a claim was paid. An automated review needs no records and arrives as a review results letter; a complex review starts with an ADR. The number of records a RAC may request is capped in proportion to the practice's paid claim volume, so an outsized request is worth checking against the published limits.
Then: the first clock is the ADR deadline, which is a records deadline. The second is the discussion period, which opens when the review results letter arrives and runs 30 days. The discussion period is your chance to send additional documentation or argue the finding directly with the RAC before the claim goes to the MAC for adjustment, and it does not use up any appeal rights. Once the MAC issues a demand letter, the Medicare overpayment rules take over: interest starts accruing on day 31, recoupment starts on day 41, and a redetermination request filed within 30 days of the demand pauses recoupment under the limitation on recoupment provisions of Section 935 of the Medicare Modernization Act. A rebuttal statement can be filed within 15 days, but it does not stop recoupment and is not an appeal.
If the letter comes from the SMRC or CERT, then respond completely even though it feels random
The Supplemental Medical Review Contractor runs nationwide projects on topics CMS assigns, often drawn from CERT findings or OIG reports. The Comprehensive Error Rate Testing program pulls a random sample of paid claims to compute the national improper payment rate; being selected says nothing about your practice. Both send ADRs with a 45-day window, and in both a non-response becomes an overpayment that the MAC will collect.
Then: treat these the way you treat TPE. Send everything that supports the claim, indexed. If an overpayment is found and you agree, repay it; if you disagree, appeal through the MAC. SMRC findings come with a discussion and education period before referral to the MAC, and that discussion is worth having.
If the letter comes from a UPIC, OIG or a Medicaid Fraud Control Unit, then call counsel before you call anyone else
The Unified Program Integrity Contractors investigate suspected fraud, waste and abuse across Medicare and Medicaid in five geographic jurisdictions. They can request records, interview staff, visit unannounced, refer cases to law enforcement and recommend payment suspension. The HHS Office of Inspector General and state MFCUs sit further along the same path. The letter may look like any other records request; the stakes are not.
Then: contact healthcare counsel the same day and route all communication through them. Preserve every record exactly as it exists, including EHR audit logs, and tell staff in writing that nothing may be edited, added or deleted; late additions to a record under investigation are the fastest way to turn a billing dispute into something worse. Respond on time and completely, but let counsel manage the response and any interviews, and do not let a staff member answer investigator questions in the hallway. This is operational guidance, not legal advice; the point is that in this category the lawyer's judgment, not the biller's, drives the plan.
If the letter comes from a Medicare Advantage plan or a commercial payer, then read the contract
Commercial and Medicare Advantage audits run on different rails from Medicare fee-for-service. The plan's rights to request records, review before or after payment, recoup and extrapolate are set by your participation agreement, by state insurance law and, for MA plans, by Medicare Advantage rules. Many states limit how far back a commercial plan may recoup absent fraud and set notice and appeal requirements; these vary and change, so the contract and current state law are the sources, not memory. Special investigations units look for patterns: a high share of level 4 and 5 visits, modifier 25 on most procedure days, unbundled code pairs, or risk adjustment diagnoses that do not appear in the note.
Then: pull the contract's audit, records and recoupment clauses before responding and calendar the contract deadline, which is often shorter than Medicare's. Ask the plan in writing for the sample methodology and for the specific policy each finding relies on. Use the plan's appeal process first, because skipping it usually forfeits the contractual dispute path. For Medicare Advantage, the plan must apply Medicare coverage rules; for risk adjustment data validation, the question is whether each submitted diagnosis is supported in a face-to-face encounter note signed by an acceptable provider. Pre-payment review is the outcome to fear most here: it stops cash flow on every claim for the topic until the plan releases it, and the way out is a run of clean documentation that the coding team audits weekly while the review is in place.
What rights do you have in an audit?
Rights differ by audit type, but a core set appears in most of them. You have the right to know which claims are under review and the basis for the topic, to a specific deadline and (in most Medicare programs) an extension for cause requested before it passes, and to a written explanation of each finding and the policy it relies on. In the RAC program you have a discussion period before the finding becomes a demand; in TPE and SMRC you have education and discussion. You have the right to appeal: in Medicare fee-for-service through redetermination by the MAC within 120 days of the initial determination (decided within 60 days), reconsideration by the Qualified Independent Contractor, a hearing before an administrative law judge subject to an amount-in-controversy threshold that changes each year, review by the Medicare Appeals Council, and judicial review. The current thresholds and deadlines are on the CMS Original Medicare appeals page and in 42 CFR Part 405, Subpart I.
You have the right to pause recoupment while the first two Medicare appeal levels are pending, by filing on time. Extrapolation may be used only under the conditions in the Medicare Program Integrity Manual, Chapter 8 (a sustained or high level of payment error, or a documented educational intervention that failed), and you may see and challenge the sampling methodology. You have the right to counsel at every stage. What you do not have is the right to ignore a letter; non-response is treated as an unsupported claim everywhere.
| Right | Medicare fee-for-service | Medicare Advantage | Commercial | Medicaid |
|---|---|---|---|---|
| Written notice of claims and basis | Yes, in the ADR and results letter | Yes, per plan procedures and MA rules | Per contract and state law | Per state rule and plan contract |
| Formal appeal | Five levels; 120 days to request redetermination | Plan appeal; enrollee coverage appeals follow Medicare rules | Plan appeal, then contractual dispute process | State administrative appeal |
| Pause on recoupment during appeal | Yes at the first two levels if filed within 30 and 60 days respectively (Section 935) | Per plan and contract | Per contract and state law | Per state rule |
The response plan for the first 48 hours and after
- Log the letter the day it arrives. Date received, sender, audit type, number of claims, deadline. One person owns the log and every audit goes in it; the nine days on the provider's desk are the most expensive days in the whole process.
- Verify the sender. Medicare contractors through the CMS Review Contractor Directory; commercial and MA requests through the plan's provider relations line using a number from the contract, not the letter.
- Classify and decide who leads. TPE, RAC, SMRC, CERT, Medicaid and commercial reviews: billing or compliance lead with provider involvement. UPIC, OIG, DOJ, MFCU or any mention of fraud: counsel leads from the first call.
- Calendar the deadline and a 10-day-early internal deadline. Request an extension in writing before the date if the volume is unmanageable; none are granted after it.
- Pull the complete record for each claim. The signed note, the order, the results, procedure notes, consent, the authorization, the claim as submitted and the remittance, plus a signature log or attestation if signatures are illegible.
- Review before you send. A coder who did not code the original claim reads each record against the code billed and marks it supported, partially supported or not supported, so you know what to expect, what to appeal and whether any claim should simply be refunded.
- Index and send trackably. A cover letter listing each claim, date of service and the documents enclosed with page numbers; a copy kept exactly as sent; delivery through the contractor's portal or a tracked carrier, with the confirmation in the audit log.
- Work the results by path. RAC: open a discussion within 30 days for every disputed finding. TPE and SMRC: attend education and start fixes. Demand letter: redetermination within 30 days to pause recoupment, and no later than 120 days regardless. Commercial: plan appeal within the contract window.
- Fix the cause, not just the sample. Templates, superbill, training, a pre-bill review for the service in question, and an internal audit of the same topic across other payers, because the pattern is rarely limited to one.
- Handle any overpayment you find yourself. Medicare's 60-day rule requires reporting and returning an identified overpayment within 60 days, with a six-year lookback; voluntary refund versus the OIG Self-Disclosure Protocol is a decision for counsel.
The edge cases
The provider has left the practice: the records and the audit are still the practice's; pull from the EHR with the audit trail showing when the note was signed, and do not seek a new attestation from a departed clinician. The auditor wants to extrapolate from a small sample: ask for the sampling frame, the method and the error rate calculation, confirm the PIM Chapter 8 preconditions were met, and consider a statistician if the dollars justify it. You find a different error the auditor did not ask about: stop, document it and bring it to counsel, because the 60-day rule may already be running. The letter asks for records to go to an unfamiliar address: verify before sending anything, because this is how records requests are impersonated.
Questions we hear
Is a TPE letter the same as being accused of fraud?
No. TPE is a medical review program aimed at error rates, and the MAC's own description frames it as education. Selection means data analysis flagged a billing pattern that is unusual for your specialty or has a high denial rate nationally. Treat it seriously, respond completely and fix what the education session identifies, but do not treat it as an investigation. A UPIC letter is different, which is why the first step is always to identify the sender.
Can we just refund the money and make the audit go away?
Sometimes a refund is the right answer: when the record genuinely does not support the claim, repaying is both the compliant and the cheaper course. It does not end a TPE round, change a RAC's approved topic or lift a commercial pre-payment review. If you are refunding because you found a pattern, the 60-day rule and how far back to look are legal questions, not billing ones. Our view is that practices refund too reluctantly on single unsupported claims and too casually on patterns, when it should be the other way round.
How long do we have to appeal a Medicare overpayment?
You have 120 days from receipt of the initial determination to request a redetermination, and the MAC generally decides within 60 days. If you want recoupment paused, the redetermination request must be received within 30 days of the demand letter, and the reconsideration request within 60 days of the redetermination decision. The amount-in-controversy thresholds for the administrative law judge and judicial review levels change every year; check the current figure on the CMS appeals page before deciding whether a claim can go to a hearing alone or must be aggregated with others.
Should we send the whole chart or only what was asked for?
Send everything that supports the claims under review, organized and indexed, and nothing unrelated. A reviewer who has to hunt for the order or the signature will often score the claim as unsupported rather than keep looking, so include the supporting pieces even if the letter did not name them. Do not send other patients' records or unrelated encounters. The cover index that says "claim 3: progress note pages 14 to 17, order page 18, lab result page 19, attestation page 20" is the most valuable page in the package.
Sources and references
- Targeted Probe and Educate (TPE), CMS: how the MAC medical review program works, the 20 to 40 claim rounds, the education sessions, the improvement period and what happens after three rounds.
- Medicare Fee for Service Recovery Audit Program, CMS: the RAC program page with the current contractors by region, automated versus complex review, and links to approved review topics and provider resources.
- Supplemental Medical Review Contractor (SMRC), CMS: what the SMRC reviews, who the current contractor is and how findings are referred to the MAC.
- Review Contractor Directory - Interactive Map, CMS: the state-by-state directory of MACs, RACs and UPICs, useful for verifying that a records request is genuine.
- Original Medicare (Fee-for-service) Appeals, CMS: the five levels of appeal, with the current filing deadlines and amount-in-controversy thresholds on the linked pages for each level.
- Medicare Program Integrity Manual (Pub. 100-08), CMS: the manual chapters on medical review (Chapter 3), administrative actions and statistical sampling for overpayment estimates (Chapter 8) and enrollment (Chapter 15).
- General Compliance Program Guidance, HHS Office of Inspector General: the voluntary guidance on compliance program elements, the federal fraud and abuse laws, and OIG resources including self-disclosure.
