What Should I Do When a Commercial Insurance Carrier Wants to Audit My Patient Charts.

An insurance audit is not a routine administrative interaction when it focuses on controlled substance prescribing. It is an adversarial proceeding with legal consequences, and it should be treated as one from the moment the request arrives.

Commercial insurance carriers, Medicare Administrative Contractors, and Medicaid managed care organizations have contractual and regulatory authority to audit the records of providers who participate in their networks or programs. That authority is real. The audit is not optional. But the practitioner's obligation to comply with an audit does not require compliance without preparation, without counsel, or without a clear understanding of what the audit's scope and purpose actually are.

Understanding the Audit's Character

Not all audits are equivalent. A routine audit of a random sample of claims for documentation sufficiency is a different proceeding from a focused audit of a specific category of prescriptions, a specific time period, or a specific patient population. The character of the audit request, including which claims are selected, which documentation is sought, and which unit of the carrier is conducting the review, provides information about whether the audit is routine or investigative.

An audit conducted by the carrier's Special Investigations Unit, or that focuses specifically on Schedule II or III controlled substance prescriptions, or that requests records for the same time period that a DEA inquiry has identified, is an audit that may have been initiated in coordination with a government investigation or that may generate a government referral when its findings are complete. The carrier is not required to disclose whether its audit is connected to a government investigation. The practitioner is not required to ask before retaining counsel.

Retain Counsel Before Responding

The audit response deadline in the carrier's request is typically thirty to sixty days from the date of the request. That interval is sufficient to retain counsel, conduct a privileged review of the records at issue, identify any records that raise compliance concerns, and develop a response strategy that complies with the audit's requirements while protecting the practitioner's legal position.

Counsel experienced in healthcare compliance and government investigations should review the audit request before any records are produced. That review addresses several questions: whether the audit is within the scope of the carrier's contractual audit authority; whether the records requested are subject to any privilege or other protection; whether the records, when reviewed, reveal compliance issues that should be addressed before or alongside the audit response; and whether the audit's scope suggests a government investigation that warrants independent legal attention.

Reviewing the Records Before Producing Them

Every record produced in an audit should be reviewed before it is produced. The practitioner who produces records without reviewing them has produced a set of documents whose contents they have not assessed for accuracy, completeness, or consistency with the billing that was submitted. Records that are inconsistent with the billed services, that are underdeveloped relative to the complexity of the encounter they document, or that reflect documentation practices that do not meet the carrier's requirements are records that will be identified in the audit and that may generate a demand for repayment or a referral to the government.

The review of records before production is not an opportunity to alter or supplement those records in a manner that makes them more favorable. Adding documentation to patient records after the audit has been initiated, or modifying records to reflect clinical activity that did not occur as documented, constitutes record falsification and creates obstruction and fraud exposure that is far more severe than any adverse audit finding the original records would have generated.

The review is an assessment of what the records show, what the audit is likely to find, and what the practice's legal position is with respect to each finding the audit may produce. That assessment informs the response strategy.

Responding to Adverse Findings

If the audit produces findings that the carrier characterizes as documentation deficiencies, billing irregularities, or inappropriate prescribing, the practitioner has the right to appeal those findings through the carrier's administrative appeal process. The appeal is not a formality. It is an adversarial proceeding in which the practitioner has the opportunity to present clinical and legal arguments challenging the audit's methodology, the standards it applied, and the conclusions it reached.

Carrier audit findings that result in repayment demands may also trigger exclusion proceedings under the Medicare and Medicaid exclusion statutes if the audit findings are referred to the Office of Inspector General. Exclusion from Medicare and Medicaid participation effectively ends a healthcare practice that depends on federal program reimbursement, and the exclusion proceeding is separate from any criminal investigation that may arise from the same underlying conduct.

The carrier audit that arrives without warning is the one for which preparation is hardest. The carrier audit that arrives after the practitioner has been monitoring their billing patterns, maintaining thorough documentation, and conducting internal compliance reviews is the one for which the response is most straightforward. The difference between those two situations is entirely a function of what happened in the months before the audit request arrived.

When the Audit Reveals Government Involvement

Some audits reveal government involvement explicitly: the carrier notifies the practitioner that it has referred its findings to the OIG, the DOJ, or a state agency. Others reveal it implicitly through the timing and focus of the audit relative to other indicators of investigation. Either way, the moment at which a carrier audit intersects with a government investigation is the moment at which the practitioner's response strategy must account for both proceedings simultaneously.

The insurance carrier and the government are not the same entity, but they share information, refer matters to each other, and may be pursuing related investigations based on the same underlying prescribing data. Managing the audit response in a way that does not inadvertently worsen the practitioner's position in the government investigation requires counsel who understands both dimensions of the exposure and can coordinate the response to each.