The letter is two pages long and arrives by regular mail addressed to the practice, not the physician. It lists 20 claims by beneficiary, date of service and procedure code, all of them 99214 and 99215, and asks for the complete medical record for each within 45 calendar days. The letterhead is the Medicare Administrative Contractor. The subject line says Targeted Probe and Educate. The office manager reads it on a Thursday afternoon, puts it in the physician's inbox, and the physician sees it the following Wednesday. Six of the 45 days are gone.
We have handled versions of this letter for years, from Medicare contractors, from Medicaid program integrity units and from commercial plans' special investigations units. The practices that come through well are not the ones with perfect documentation. They are the ones that treat the request as a project with a deadline, an owner and a checklist, starting the day it arrives. This article is that checklist, with the differences between the Medicare and commercial versions called out where they matter.
Key takeaways
- A payer audit records request is not an accusation, but it is a deadline: Medicare additional documentation requests under Targeted Probe and Educate (TPE) allow 45 calendar days from the date on the letter, and a claim with no records submitted is denied in full.
- TPE reviews 20 to 40 claims per round, allows up to three rounds with one-on-one education after each, and refers providers who fail all three to CMS for stronger action.
- Commercial special investigations unit (SIU) requests run on the contract's terms, usually 30 to 45 days, and can end in extrapolated recoupment across a lookback period that state law often limits.
- Send the complete record for each date of service, organized and indexed, with a signature attestation where a signature is missing or illegible. Send what supports the claim, not the whole chart.
- Read every chart before it goes out. The review you do in week one tells you whether you are heading for education or for an appeal, and it is the only chance to find the pattern before the auditor does.
Who sends payer audit records requests and what each one means
Medicare has several reviewers and their letters look alike, so read the letterhead. The Medicare Administrative Contractor (MAC) runs TPE, a program in place since October 2017 that selects providers whose billing patterns look unusual against their peers or whose service is on a high-error list, and reviews a small sample with education between rounds. The Supplemental Medical Review Contractor (SMRC) conducts national reviews on topics CMS assigns. Recovery Audit Contractors (RACs) review paid claims for overpayments and are paid a contingency fee. Unified Program Integrity Contractors (UPICs) investigate suspected fraud, and a UPIC letter is the one that should send you to counsel the same day.
Commercial plans use a special investigations unit or a payment integrity department. Medicare Advantage plans run both their own audits and the risk adjustment data validation audits CMS requires. Medicaid has state program integrity units, Medicaid RACs and, for suspected fraud, the Medicaid Fraud Control Unit, which is law enforcement. The rights and deadlines differ across all of these, which is why the first task is to identify exactly who is asking and under what authority.
| Reviewer | Typical sample | Response window | What a bad result leads to |
|---|---|---|---|
| MAC, Targeted Probe and Educate | 20 to 40 claims per round, up to 3 rounds | 45 calendar days | Denials of sampled claims, education, referral to CMS after round 3 |
| SMRC | Varies by project, often 20 to 40 | 45 days | Overpayment demand on sampled claims |
| RAC | Limited by CMS-set additional documentation request caps | 45 days | Overpayment demand, recoupment, appeal rights |
| UPIC | Any size | As stated in the letter | Payment suspension, extrapolation, referral to law enforcement |
| Commercial SIU | Often 20 to 50 claims | Per contract, commonly 30 to 45 days | Recoupment by offset, extrapolation, network action |
Day one: the clock, the owner and the log
The response window in a TPE letter runs from the date printed on the letter, not the date you opened it. Calendar the due date immediately and set an internal deadline seven days earlier. Name one person as the owner; in a small practice that is usually the practice manager or the lead biller, with the physician responsible for reviewing the charts. If the practice uses an outside billing company, tell them the same day, because they hold the claim data you will need to match records to the list.
Open a log with one row per claim: beneficiary, date of service, codes billed, amount paid, records pulled (yes or no), physician review complete, issues found, date sent, tracking number. This log is your evidence that you responded on time and completely, and it becomes the appeal file if you need one. If any claim on the list is not yours, for example a beneficiary you have never seen, note that and say so in the response rather than ignoring it.
If the deadline cannot be met, ask for an extension in writing before it passes. MACs commonly grant a short one when asked early with a reason.
What to send for each of the 20 charts
Send the records that support the claim as billed, for the date of service in question, plus anything the note references. For an office visit that means the signed progress note; the medication list and problem list if the note relies on them; any orders, results or images referred to in the medical decision making; the prior note if the current note says "see previous"; and, for time-based codes, the statement of time. If the billing practitioner's signature is electronic, include the EHR's signature log or audit trail showing who signed and when. If a signature is missing or illegible, include a signature attestation statement, which Medicare accepts for medical review when it is signed by the author and identifies the record.
Do not send the whole chart; unrelated pages raise new questions. Do not alter, add to or "complete" a note after the request arrives. A clearly labeled late entry is legitimate in ordinary practice; a note that appears to have been edited to fit the code after the audit letter is the fastest way to turn an education round into a fraud referral. Involve counsel before any addendum is considered in this context.
Organize the package with a cover letter listing each claim and the pages that answer it, number every page, and keep a copy identical to what you sent. Medicare contractors accept submissions through esMD (Electronic Submission of Medical Documentation), through the MAC's portal, by fax or by mail; electronic submission gives you a receipt with a timestamp, which is what you want.
Review before you send: the part everyone skips
Before anything goes out, someone who knows coding reads every chart against the claim and writes down what they find. The point is not to change the response; the point is to know your position. For 20 E/M visits we look at five things: whether the note is signed by the billing practitioner; whether the medical decision making or the total time supports the level billed under the 2021 office visit guidelines; whether the diagnosis codes on the claim appear in the assessment; whether any incident-to or split/shared rules apply and are documented; and whether the note is cloned from a prior visit in a way that a reviewer will notice.
Say the review finds that 14 of 20 notes support the level billed, 4 support one level lower and 2 are unsigned. You now know roughly what the results letter will say, you know which findings to concede and which to appeal, and you know what to fix in the practice before round two, if there is one. Practices that skip this step get the results letter as a surprise and have 120 days to organize an appeal they could have prepared in advance. Our RCM audit work often starts because a practice received one of these letters and wanted the same review done on the claims that were not sampled.
What happens after: results, education, rounds and appeals
Under TPE, the MAC reviews the records and sends a results letter with the error rate and the reason for each denial. If the error rate is acceptable to the MAC, the review closes and the practice is generally not reviewed on that topic for at least a year. If not, the MAC schedules a one-on-one education session, usually by phone or video, walking through the denials. The practice then has at least 45 days to make changes before the MAC can pull claims for round two. Three rounds with unacceptable error rates lead to referral to CMS, which can mean 100 percent prepayment review, extrapolation of the error rate across a larger universe of claims, referral to a UPIC or revocation of billing privileges. In our experience most practices that take the first-round education seriously do not see round three.
Denied claims carry standard Medicare appeal rights: redetermination by the MAC within 120 days of the initial determination, reconsideration by the Qualified Independent Contractor within 180 days of the redetermination, then the Administrative Law Judge level within 60 days of the reconsideration, subject to an amount-in-controversy threshold. Appeal the denials you believe are wrong, with the specific documentation element the reviewer missed marked in the record. Do not appeal the ones your own review conceded; it wastes credibility.
Commercial SIU reviews end differently. The plan issues findings and, often, an overpayment demand that it will recoup by offsetting future payments unless you dispute it within the contract's window. If the plan extrapolated, ask for the sampling methodology and the universe definition, because a flawed sample is the most common successful challenge. Many states limit how far back a plan can recoup, often 12 to 24 months absent fraud, and some require notice before offset. This is where counsel and the contract earn their keep.
Questions we hear
Do we need patient authorization to release these records?
No. HIPAA permits disclosure of protected health information to a health plan or its contractor for payment and health care operations, including audits, without patient authorization. Send only what the request covers and log the disclosure as you would any other. If the request comes from a law enforcement agency rather than a payer, stop and call counsel before responding.
Should we call a lawyer for a TPE letter?
For a routine TPE or SMRC letter about E/M levels, most practices handle the response internally or with their billing partner and involve counsel only if the results are bad. For a UPIC letter, a letter that mentions fraud, a payment suspension, or a commercial SIU that has already extrapolated, involve counsel before you send anything. The cost of a consultation is small next to the cost of a mishandled response.
The letter asks for records we do not have, like a hospital discharge summary. What then?
Send what you have and state in the cover letter what you do not have and why. Request the outside record and forward it if it arrives before the deadline. A gap explained is treated very differently from a gap ignored.
What to do this week
- Write down who opens mail addressed to the practice and make sure any letter mentioning records, audit, review or overpayment goes to the practice manager the same day.
- Build the response log template now, before you need it, with the columns listed above.
- Confirm the practice can produce an EHR signature log or audit trail for any note, and test it on one visit.
- Run your own 20-chart sample of 99214 and 99215 visits against the 2021 E/M guidelines. If the practice would fail its own review, fix the documentation before a contractor picks the same sample.
- Register for esMD or your MAC's portal for record submission, so the first submission is not also the first login.
- Read the audit and recoupment clauses in your three largest commercial contracts and note the response windows and lookback limits; our medical billing team keeps these on the payer grid for every practice we support.
