Payer Records Request Response: Behavioral Health Guide
Answer a payer records request on time: deadlines, minimum necessary, psychotherapy notes, look-back limits, a per-claim packet index, and a cover letter.
On this page: Direct answer
Direct answer
Payer records request response: what operators need to know
Answer a payer records request on time: deadlines, minimum necessary, psychotherapy notes, look-back limits, a per-claim packet index, and a cover letter. Log the request as a case the day it arrives: issuer, program, claims, look-back, deadline, and channel. Medicare contractors generally allow 45 days (30 for a program-integrity contractor); commercial deadlines come from the letter and your contract.
A records request is how most payer reviews begin: a letter from a health plan, a Medicare contractor, or a vendor working for either, listing claims and asking for the documentation behind them by a date. What you send, and when, largely decides what follows. Medicare's Program Integrity Manual tells contractors to deny claims when requested documentation does not arrive in time, and UnitedHealthcare's 2026 administrative guide says a failure to provide requested records may result in an audit failure denial that creates an overpayment.
Behavioral-health organizations also face privacy questions that many medical practices never see. Psychotherapy notes, substance use disorder records covered by 42 CFR Part 2, and the HIPAA minimum-necessary standard all shape what may leave the building, and a request for all records does not tell you which documents the reviewer actually needs.
This guide covers the operational response: triage, what the payer can and cannot require, how far back it can reach, how to build the packet, and what to ask in writing. It is not legal advice. Involve counsel when the request comes from a special investigations unit or a program-integrity contractor, or when it mentions sampling or extrapolation.
Key takeaways
The short version
- Log the request as a case the day it arrives: issuer, program, claims, look-back, deadline, and channel.
- Medicare contractors generally allow 45 days (30 for a program-integrity contractor); commercial deadlines come from the letter and your contract.
- Payment disclosures do not need patient authorization under HIPAA, but minimum necessary applies, and psychotherapy notes and Part 2 records have their own rules.
- Send an indexed packet: one cover letter, one index row per claim, every requested element mapped to a page.
- Ask the payer in writing for its basis, look-back, and sampling method before findings arrive.
Take the template with you
Free to copy · no email required
A cover letter that lists what is enclosed and withheld, states the minimum-necessary basis, and puts the payer's basis, look-back, and sampling method in writing. Every [BRACKET] is a decision for your team.
One row per claim: documents enclosed, page range, documented time, treatment plan, signature, Part 2 and psychotherapy-note flags, and reviewer. Use claim references only; keep patient identifiers out of the index you share internally.
claim_ref,date_of_service,code_billed,modifiers,paid_amount,rendering_clinician_id,documents_enclosed,page_range,start_time_documented,stop_time_documented,total_minutes,treatment_plan_page,signature_present,telehealth_modality_documented,authorization_ref,part2_record,psychotherapy_notes_withheld,missing_item_explanation,reviewer_initials EXAMPLE-01,YYYY-MM-DD,90837,,,CLIN-A,Progress note; treatment plan,pp. 1-4,yes,yes,55,3,yes,n/a,AUTH-REF,no,yes,,XX ,,,,,,,,,,,,,,,,,,
1. Identify who is asking, and under what program
Log the request as a case the day it arrives, with the received date, issuing entity, program, claims and dates of service listed, documents requested, deadline, submission channel, and contact. The issuing entity and the program the claims were paid under decide the deadline, the review rules, and the appeal route, even when two letters look alike.
| Requester | What usually arrives | Deadline | Watch for |
|---|---|---|---|
| Medicare Administrative Contractor (MAC) | Additional documentation request (ADR), often inside Targeted Probe and Educate | 45 calendar days | Claims are denied when documentation is not received in time |
| Recovery Audit Contractor or SMRC | Post-payment ADR | 45 calendar days | RACs must post approved review topics on their websites before sending ADRs |
| Unified Program Integrity Contractor (UPIC) | Records request in a program-integrity review | 30 calendar days | Higher stakes; involve counsel before responding |
| Medicaid RAC | Post-payment records request under a state contract | Set by the state program | No claims older than three years without state approval |
| Commercial plan or its audit vendor | Intent-to-audit letter or clinical records review | The letter and your provider agreement | Missing records can become an audit failure denial |
| Special investigations unit | Investigation-driven request | The letter and your agreement | Treat it as a legal matter first and a records task second |
3. Pin down the look-back period
Recovery windows limit how far back a review can turn into a repayment; they do not necessarily limit what a payer may ask to see. Ask the payer to state the look-back period it is applying and the authority for it, then compare the dates of service in the letter against the rule for that program, state, and contract.
| Program or rule | Look-back | Source |
|---|---|---|
| Medicare contractor reopening | 1 year for any reason; 4 years for good cause; any time for fraud or similar fault | 42 CFR 405.980(b) |
| Medicaid RAC | Claims no older than 3 years from the claim date unless the state approves | 42 CFR 455.508(f) |
| New York health plans | No overpayment recovery initiated more than 24 months after payment, with exceptions for fraud or abusive billing, self-insured plans, and government programs | N.Y. Insurance Law 3224-b |
| Texas preferred provider plans | Overpayment notice within 180 days after the provider receives payment | Tex. Insurance Code 1301.132 |
| Commercial contracts | As written in the agreement and applicable law; UnitedHealthcare's Oxford section cites the applicable statute of limitations, usually six years, for certain recoveries | Provider agreement and payer manual |
| Your own Medicare obligation | Overpayments you identify within 6 years of receipt must be reported and returned | 42 CFR 401.305(f) |
4. Build the response packet
- 01
Turn the letter into a checklist
List every claim, date of service, and document type requested, plus the deadline, channel, and contact. Every line gets a document, a page reference, or a written explanation of why the item does not exist.
- 02
Pull the record as it existed
Submit the documentation of record. Medicare expects services to be documented when rendered and requires any amendment, correction, or delayed entry to show its date and author and to be clearly and permanently marked. Never create or complete documentation because a request arrived.
- 03
Separate what is requested from what is protected
Remove psychotherapy notes, confirm the Part 2 written agreement where it applies, and check group-session notes for other patients' information before copying.
- 04
Index every claim
Build one index row per claim: claim reference, date of service, code billed, documents enclosed, page range, documented time for time-based codes, treatment plan in effect, signature, and authorization reference. A reviewer who cannot find a document will treat it as missing.
- 05
Close signature gaps the allowed way
For Medicare, a missing or illegible signature can be supported with a signature log or an attestation signed and dated by the author of the entry. An attestation cannot backdate something that had to be signed before a given date.
- 06
Write the cover letter
State what is enclosed, what is not enclosed and why, the minimum-necessary basis for the scope, and the questions in section 5. Keep it factual; do not argue the merits before findings exist.
- 07
Approve, submit, and keep proof
A named reviewer approves the packet before release. Use the channel in the letter, keep an exact copy, and log the submission date and delivery proof. For Medicare submissions through esMD, the esMD receipt date is treated as the date received.
5. Put the payer's basis in writing
Ask early, alongside or before the packet, and keep the answers on the case. Do not hold the response hostage to the answers unless counsel advises it; a missed deadline costs more than an unanswered question.
- Which entity is conducting the review, on whose behalf, and under which plan, program, or contract?
- Why were these claims or this provider selected? In Medicare provider-specific reviews, contractors must state the specific reason and, when selection rests on comparative data, show how you differ from others in the same specialty or locality. Ask commercial payers for the same.
- Is this prepayment or post-payment review, and is payment on any other claims being withheld?
- What look-back period applies, and what is its contractual or legal basis?
- How were the claims chosen? If they are a sample, will results be projected to claims not reviewed, and what universe and sampling method will be used?
- Which specific documents are needed? Medicare instructs its contractors to request only the individual pieces of documentation needed to make a determination.
- What criteria and policy versions will reviewers apply, and how will findings, dispute rights, and appeal deadlines be communicated?
6. After you submit
- Calendar the expected findings date and follow up if it passes; Medicaid RACs, for example, must notify providers of overpayment findings within 60 days
- Reconcile findings claim by claim against your index; a finding that a document was missing when your index shows it enclosed is a reviewer error to contest
- When Medicare denies for no response, contractors use CARC 50 with RARC M127, and the contractor's reopening process applies to documents that arrive late
- Route any overpayment demand into its own workflow; the dispute, offset, and appeal clocks start with that letter
- Feed findings into documentation templates and training, and date the changes
Common questions
Answers before you build.
Do we need patient authorization to send records to an insurer for an audit?+
Generally not under HIPAA, which permits disclosures for the plan's payment activities, including retrospective review. The exceptions are psychotherapy notes, substance use disorder records under 42 CFR Part 2 (audit disclosures without patient consent require the auditor's written agreement under 2.53), any state-law requirements, and contracts that assign authorization duties to you.
Can a payer require psychotherapy notes?+
Not without the patient's authorization, and a covered entity may not condition payment on the patient signing one. Medicare bars its contractors from requesting them. The information excluded from the definition, including start and stop times and treatment-plan and progress summaries, must still be provided if it supports the claim.
How long do we have to respond to a records request?+
Medicare gives 45 calendar days for MAC, RAC, SMRC, and CERT requests and 30 days for UPIC requests. Commercial deadlines come from the letter and your provider agreement. If you need more time, ask in writing before the deadline.
What if the request covers dates beyond the allowed look-back?+
Put it to the payer in writing, cite the rule you believe applies, and ask it to confirm or narrow the request. Decide with counsel whether to produce those records, since a payer may rely on a fraud exception or a contract term.
Should we send the entire chart?+
Not unless the entire record is specifically justified. Send what supports each billed service, indexed by claim, and explain in the cover letter what was excluded and why.
Practical closeout
Use this operator checklist.
- Log the request as a case the day it arrives: issuer, program, claims, look-back, deadline, and channel.
- Medicare contractors generally allow 45 days (30 for a program-integrity contractor); commercial deadlines come from the letter and your contract.
- Payment disclosures do not need patient authorization under HIPAA, but minimum necessary applies, and psychotherapy notes and Part 2 records have their own rules.
- Send an indexed packet: one cover letter, one index row per claim, every requested element mapped to a page.
- Ask the payer in writing for its basis, look-back, and sampling method before findings arrive.
Continue through the cluster
Verified customer case studies are added only with customer permission and supporting evidence; none is implied by these operational examples.
Sources & methodology
Trace the operational claims.
Marsa Health Editorial reviewed the primary and research sources below on September 21, 2026. We translate them into workflow controls, distinguish proposals from final rules, and flag where plan, program, state, contract, or clinical requirements vary.
- 0145 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations Electronic Code of Federal RegulationsPermits a covered entity to disclose protected health information to another covered entity for the payment activities of the entity that receives it.Accessed or rechecked September 21, 2026
- 0245 CFR 164.501: Definitions Electronic Code of Federal RegulationsHIPAA Privacy Rule definitions of psychotherapy notes, which exclude session start and stop times and treatment summaries, and of payment, which includes medical-necessity and retrospective review.Accessed or rechecked September 21, 2026
- 0345 CFR 164.502: Uses and disclosures of protected health information Electronic Code of Federal RegulationsThe minimum-necessary standard at 164.502(b), which applies to disclosures for payment and to requests between covered entities, and its listed exceptions.Accessed or rechecked September 21, 2026
- 0445 CFR 164.514(d): Minimum necessary requirements Electronic Code of Federal RegulationsMinimum-necessary implementation rules: reasonable reliance on another covered entity's request, limits on a plan's own requests, and the bar on requesting or disclosing an entire record unless specifically justified.Accessed or rechecked September 21, 2026
- 0545 CFR 164.508: Uses and disclosures for which an authorization is required Electronic Code of Federal RegulationsRequires patient authorization for nearly all disclosures of psychotherapy notes and bars covered entities from conditioning payment on an authorization.Accessed or rechecked September 21, 2026
- 0642 CFR 2.53: Management audits, financial audits, and program evaluation Electronic Code of Federal RegulationsConditions under which a Part 2 program may let a third-party payer or its contractor review, copy, or remove substance use disorder records for an audit, including a written agreement on use and redisclosure.Accessed or rechecked September 21, 2026
- 07Medicare Program Integrity Manual, Chapter 3: Verifying Potential Errors and Taking Corrective Actions Centers for Medicare & Medicaid ServicesRev. 13821 (June 2026): review targeting, provider notice, additional documentation request time frames, Targeted Probe and Educate, 100 percent prepayment review, signature attestation, amendments, and the bar on requesting psychotherapy notes.Accessed or rechecked September 21, 2026
- 0842 CFR 405.980: Reopening of initial determinations, redeterminations, reconsiderations, hearings, and reviews Electronic Code of Federal RegulationsMedicare contractors may reopen within 1 year for any reason, within 4 years for good cause, and at any time for fraud or similar fault.Accessed or rechecked September 21, 2026
Organizational author. Editorial review covers source accuracy, search intent, workflow boundaries, and human-oversight requirements. This material is educational and does not provide clinical, legal, coding, or coverage advice.
No named clinical or legal expert reviewer is attributed to this version. Marsa Health does not invent reviewer credentials.
Read our editorial methodRevision history
What changed and when
September 21, 2026
Initial publication, source review, and operational editing.