A family practice we work with received a records request from the CERT contractor, the Comprehensive Error Rate Testing program that samples paid Medicare claims to measure the national error rate. Twelve claims, all routine office visits. The notes were thorough and the coding was right. Four of the twelve came back as errors anyway. Two notes had been left unsigned in the EHR for six weeks, one had a typed name with no indication it had been electronically authenticated, and one order for a lab panel carried only the medical assistant's initials.
None of that changed what the physician did for the patient. All of it made the documentation unusable as evidence, and Medicare pays on evidence. The practice repaid four visits, but the bigger cost was the extended review that followed, because a one-third error rate on a small sample invites a larger one.
This piece lays out the medical record signature requirements that Medicare reviewers apply, which come mostly from Chapter 3 of the Medicare Program Integrity Manual, and how to set up a practice so signatures are never the reason a claim fails.
Key takeaways
- Every service billed to Medicare must be documented in a record authenticated by the author with a legible handwritten or electronic signature; stamped signatures are not accepted except for authors with a documented physical disability.
- Illegible or missing signatures on progress notes can be cured with a signature log or a signed attestation statement, but a missing signature on an order cannot: reviewers disregard the order.
- Acceptable electronic signatures carry the author's name, credentials and an authentication phrase such as "electronically signed by" with the date; a typed name alone or "signature on file" does not qualify.
- Unsigned notes sitting in an EHR queue are the most common failure in small practices, and the fix is a daily unsigned-encounter report with a 48-hour standard.
What Medicare means by a signature
The Program Integrity Manual says services provided or ordered must be authenticated by the author. Authentication means the person who performed or ordered the service confirms the entry is theirs, and the accepted methods are a handwritten signature or an electronic signature. A handwritten signature can be a full signature or initials, and it must be legible, or at least traceable to a specific person through a signature log. A rubber stamp is not acceptable unless the author has a physical disability that prevents signing, documented under the Rehabilitation Act of 1973.
The reviewer's job is to establish who wrote the note and whether that person had the credentials to bill the service. When the reviewer cannot tell who signed, the note is treated as if nobody did. That is why a scrawl with no printed name or credentials is a problem even though the physician knows exactly who wrote it.
Dates matter too. A signature should be dated, and the date should be close to the date of service. CMS does not set a national deadline for signing office notes, but the expectation is that signing happens as part of completing the record, and several Medicare Administrative Contractors have published guidance suggesting 24 to 72 hours as reasonable. A note signed weeks later is not automatically rejected, but it invites questions, and a note signed after the records request arrived is treated with open suspicion.
Acceptable and unacceptable formats
Electronic signatures are the norm in every EHR, and most of them pass. The requirement is that the signature shows the author's name and credentials plus wording that makes clear the entry was authenticated, not just typed. Reviewers accept phrases such as "electronically signed by," "authenticated by," "approved by," "completed by," "finalized by," "validated by" and "signed by," each followed by the name and date. Your EHR should also keep an audit trail showing who signed and when, and you should know how to print it, because a reviewer who doubts a signature will ask for it.
| What appears on the record | Reviewer treatment | What fixes it |
|---|---|---|
| Legible handwritten signature with credentials | Accepted | Nothing needed |
| Illegible handwritten signature or initials | Accepted only if traceable | Signature log listing the typed name, credentials and specimen signature |
| "Electronically signed by J. Patel, MD, 07/14/2026 16:02" | Accepted | Nothing needed; keep the audit trail available |
| Typed name with no authentication phrase | Questioned | Attestation statement, and correct the EHR signature block going forward |
| "Signature on file" or "dictated but not read" | Not accepted | Attestation statement for the specific entry |
| Rubber stamp | Not accepted | Attestation, unless a disability exception is documented |
| Unsigned progress note | Not accepted as written | Attestation statement signed by the author |
| Unsigned order for a test or DME item | Order disregarded | Cannot be attested; only a signed note documenting intent to order can support a lab test |
Two things in that table surprise people. First, the signature log. If a physician's handwritten signature looks like a wave, a one-page document listing the typed name, credentials and a sample signature makes every past and future entry traceable, and the manual says the log can be created at any time, including after the records request. Every practice with anyone still signing on paper should have one on file. Second, the asymmetry between notes and orders. A note can be rescued by attestation because the service was documented and only the authentication was missing. An order without a signature is not an order.
Signature logs and attestation statements
An attestation statement is a short signed declaration by the author confirming that a specific entry is theirs. The manual gives suggested wording that identifies the practitioner, the date of service, the beneficiary, and states that the entry accurately reflects the practitioner's work and that the practitioner understands the liability for falsification. It must be signed and dated by the author of the entry, not by an office manager or another physician in the group. A practice can prepare a template, but each statement is specific to one entry.
Attestations have limits. They cannot be used for orders. They should not be a routine tool; a practice that submits attestations for a third of its sampled claims is telling the reviewer that its signing process is broken. And a note that was never written cannot be attested into existence; attestation confirms authorship of documentation that exists, nothing more.
In the CERT example we opened with, the two unsigned notes and the typed-name note could all have been supported with attestation statements had the practice responded that way. The unsigned lab order could not.
Orders: the rules are stricter
Orders for diagnostic tests, durable medical equipment, home health and referrals carry their own requirements, and they are the place where reviewers are least forgiving.
For clinical laboratory tests, the regulation at 42 CFR 410.32 allows the order to be given verbally or in writing, and a signature is not required on the requisition itself. What must exist is a signed note by the treating practitioner showing the intent to order that specific test, for example "ordered CBC and BMP to evaluate fatigue." If the requisition is unsigned and the note does not mention the test, the reviewer treats the test as not ordered and denies it. Medical assistants entering orders under a standing protocol should be sure the practitioner's signed note names the tests.
For durable medical equipment, prosthetics, orthotics and supplies, CMS requires a standard written order that includes the beneficiary's name or Medicare number, the order date, a description of the item, the quantity if applicable, the treating practitioner's name or NPI, and the practitioner's signature. Suppliers cannot bill without it, so an unsigned DME order comes back to your fax machine within days. Home health certifications and plans of care must be signed and dated by the certifying practitioner before the agency bills.
Scribes deserve a note. CMS clarified in 2018 that reviewers should not deny a claim because a scribe did not sign or the note lacks a scribe attestation. The billing practitioner's signature is what authenticates the note, and it carries responsibility for everything in it. Medical students are different: a teaching physician may verify a student's documentation rather than rewrite it, but the teaching physician must sign.
The unsigned-encounter problem and how to end it
In our audit work, the most common signature failure by a wide margin is the note that was written, never finalized, and then billed anyway because the charge dropped from the encounter independently of the signature. Most EHRs allow that. Many practices do not know how many unsigned encounters they have until someone runs the report.
Here is a worked example of what that looks like. A three-physician practice bills about 180 encounters a week. One physician habitually leaves notes in draft, and on any given Friday 40 encounters from the past month are unsigned. The billing system has already sent all 40 claims. If any of those claims are sampled, the record as it exists at the time of the request is an unsigned note, and the practice is choosing between an attestation and a refund. Multiply 40 encounters by an average allowed amount of $110 and the exposure on one physician's backlog is about $4,400 at any moment, before anyone looks at the pattern.
The fix is administrative, not clinical. Run the unsigned-encounter report daily. Set a practice standard of 48 hours from the date of service to final signature and publish each provider's count at the weekly meeting. Configure the billing system to hold claims until the encounter is signed where the system allows it; the delay of a day or two costs far less than a refund. And check the EHR signature block once: print a signed note and confirm it shows the authentication phrase, name, credentials and date, because we have seen systems configured to print only the typed name.
Questions we hear
Our physician signs notes weeks late. Is that a compliance problem or just untidy?
Both. Late signatures are not automatically rejected, but a note signed after the payer asked for records is treated as unreliable, and a pattern of late signing is exactly what turns a small sample into a large review. Sign within 48 hours and the question disappears.
Can we go back and sign old notes before sending records to a reviewer?
Do not add a signature dated today to a note from months ago and present it as an ordinary signature. Use the attestation statement, which is the sanctioned way to authenticate an entry after the fact, and let the EHR audit trail show the real dates. Backdating a signature is a falsification problem, which is far worse than an unsigned note.
Do commercial payers apply the same rules?
Most commercial and Medicare Advantage medical record policies borrow the Medicare signature standards nearly word for word, and state licensing boards have their own record-keeping rules. Treat the Medicare standard as the floor for every payer; you will not be wrong.
What to do this week
- Run the unsigned-encounter report for the past 90 days and count how many billed encounters have no final signature.
- Print one signed note per provider and confirm the signature block shows an authentication phrase, name, credentials and date.
- Create a signature log for every clinician who signs anything on paper, including orders and paper superbills.
- Save an attestation statement template that follows the Program Integrity Manual wording and store it with your records-request procedure.
- Set the 48-hour signature standard in writing and add signature status to the pre-billing checklist, or ask your billing team to hold claims on unsigned encounters.
