A CMS audit process begins when a Medicare contractor sends a written request for medical records, moves through a documentation review, and ends either with the claim confirmed or with a demand for repayment that carries tight deadlines. Interest on any overpayment starts accruing on Day 31 after the demand letter, and the contractor can begin withholding money from your current Medicare payments on Day 41.1eCFR. 42 CFR 405.379 – Limitation on Recoupment of Provider and Supplier Overpayments A timely appeal at the first two levels stops that recoupment while the dispute is pending, but the window to file and preserve that protection is only 30 days from the demand letter, not the 120 days many providers assume.
How the Audit Begins
Almost every audit opens with an Additional Documentation Request, or ADR. The letter names the patient, the date of service, the specific claim under review, and the deadline for producing records. Response time depends on which contractor sent it: Medicare Administrative Contractors, Recovery Audit Contractors, and the Supplemental Medical Review Contractor allow 45 calendar days, while Unified Program Integrity Contractors allow only 30.2Centers for Medicare & Medicaid Services. Additional Documentation Request Miss the deadline and the claim is denied automatically, regardless of whether the care was appropriate.
What you send matters as much as when you send it. Auditors want physician orders, operative reports, encounter notes, billing data, and any required certifications. They also want signatures. Missing physician signatures and illegible signatures without a corresponding signature log are among the most common reasons claims fail review. Documentation problems can sink an otherwise defensible claim.
CMS operates an Electronic Submission of Medical Documentation system (esMD) that lets you respond to ADRs electronically and creates a clean audit trail of what you sent and when.3Centers for Medicare and Medicaid Services. Electronic Submission of Medical Documentation (esMD) If a dispute later turns on whether you met a deadline, that transmission record is the evidence you’ll need.
Who Sent the Letter and Why It Matters
The contractor name on the ADR tells you a lot about what you’re facing. A MAC typically handles routine post-payment review; MACs process claims, issue payments, and also decide the first level of appeal.4Centers for Medicare & Medicaid Services. Medicare Claim Review Programs A RAC works on contingency, earning a percentage of the improper payments it recovers, so its incentive is to find errors.5Centers for Medicare & Medicaid Services. Medicare Fee for Service Recovery Audit Program CMS caps the number of records a RAC can pull from any single provider within a 45-day cycle, so the demand is bounded.
A UPIC is the most serious of the three. UPICs investigate potential fraud, waste, and abuse across both Medicare and Medicaid, can refer matters to law enforcement, and can initiate payment suspensions that stop your current Medicare payments while the investigation runs.6Office of Inspector General. UPICs Hold Promise To Enhance Program Integrity Across Medicare and Medicaid, But Challenges Remain Those suspensions require CMS Central Office approval and are grounded in either credible allegations of fraud or reliable evidence that payments may be incorrect.7Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual – UPIC Payment Suspensions A UPIC letter warrants involving counsel immediately.
One boundary worth knowing: the Comprehensive Error Rate Testing program samples claims to measure the national improper payment rate, and its reviews don’t produce individual recoupment demands. If your involvement is limited to a CERT sample, you’re not in the same procedural posture as a MAC, RAC, or UPIC audit.8Centers for Medicare & Medicaid Services. Comprehensive Error Rate Testing (CERT)
When Statistical Extrapolation Enlarges the Demand
Some audits don’t stop at the claims sampled. When a contractor finds a sustained or high level of payment errors relative to peer providers, it can pull a statistical sample, calculate an error rate, and project that rate across the entire universe of claims for a period. The contractor must consult with CMS before creating the sample.9Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual Transmittal 11797
This is what turns an inconvenient audit into a threat to the practice. A 15% error rate found in 30 sampled claims, projected across thousands of claims over multiple years, can generate demands running into the hundreds of thousands of dollars. Extrapolated overpayments are appealable on two fronts at once: the individual claim denials, and the statistical methodology itself. Providers commonly challenge whether the sample was truly random, whether the universe of claims was correctly defined, and whether the projection was properly applied. Overturning individual denials in the sample drives the error rate down, and the extrapolated total falls with it. Engaging a statistician alongside legal counsel early in the appeal is often worth the cost.
The Overpayment Demand and the Rebuttal Trap
After reviewing your records, the contractor sends a determination letter. If the review went against you, the letter identifies which claims were denied, the reason for each denial, and the total amount owed. The most common grounds are lack of medical necessity and failure to meet technical documentation requirements.
You have 15 calendar days from the demand letter to submit a rebuttal explaining why the findings are wrong. The MAC will evaluate it promptly. But a rebuttal is not an appeal, and it does not stop or delay recoupment.10Centers for Medicare & Medicaid Services. Medicare Overpayments Providers who file a rebuttal and assume they’ve bought time often discover on Day 41 that the MAC is withholding their current payments. Only a timely formal appeal produces that protection.
Interest, Recoupment, and Extended Repayment
The financial clock runs on its own schedule regardless of whether you plan to appeal. If the full overpayment isn’t paid within 30 days of the demand letter, simple interest begins accruing on Day 31 and continues in 30-day increments until the debt is paid in full. As of January 2026, the applicable rate is 11.625%.11Centers for Medicare & Medicaid Services. Notice of New Interest Rate for Medicare Overpayments Payments are applied to accrued interest first and to principal second, so partial payments don’t reduce the principal balance until all interest is covered.10Centers for Medicare & Medicaid Services. Medicare Overpayments
Recoupment through withholding of current payments starts on Day 41 if you haven’t paid and haven’t filed a qualifying appeal.1eCFR. 42 CFR 405.379 – Limitation on Recoupment of Provider and Supplier Overpayments
If paying within 30 days would create financial hardship, you can request an Extended Repayment Schedule (ERS). CMS defines hardship as the total outstanding overpayment equaling 10% or more of your total Medicare payments for the most recent cost-reporting period or calendar year. Qualifying providers can get up to 36 months, with extreme cases extending to 60 months.12Centers for Medicare & Medicaid Services. Medicare Financial Management Manual – Extended Repayment Schedules The request has to include financial documentation, a proposed installment schedule, and the first payment. CMS will not approve an ERS if there’s reason to believe the provider may file for bankruptcy, may stop participating in Medicare, or if fraud is suspected.
The Five-Level Appeals Process
Medicare provides five successive levels of appeal. Each has its own filing deadline, and missing a deadline generally forfeits that level of review. The two most consequential features to understand up front: filing at Levels 1 and 2 within the recoupment window stops CMS from withholding your payments, and each level after Level 2 has its own separate deadline running from the previous decision.
Level 1: Redetermination by the MAC
You have 120 calendar days from receiving the initial determination to request a redetermination from the MAC, with receipt presumed five days after the notice date. A different MAC reviewer looks at the claim along with any new evidence you submit, and the MAC generally decides within 60 days.13Centers for Medicare & Medicaid Services. First Level of Appeal: Redetermination by a Medicare Contractor
The trap: the 120-day appeal deadline is not the same as the 30-day recoupment-stay deadline. To stop the MAC from withholding your current Medicare payments, you have to file the redetermination within 30 days of the demand letter. File it on Day 31, and your appeal rights are preserved, but recoupment can begin on Day 41.14Centers for Medicare & Medicaid Services. Limitation on Recoupment (935) for Providers, Physicians, and Suppliers Overpayments
Level 2: Reconsideration by a Qualified Independent Contractor
If the redetermination goes against you, you have 180 days from receiving that decision to request reconsideration by a Qualified Independent Contractor. The QIC conducts an independent review of the full administrative record and considers new evidence.15Centers for Medicare & Medicaid Services. Second Level of Appeal: Reconsideration by a Qualified Independent Contractor
The recoupment stay continues at Level 2. A timely QIC filing keeps the contractor from withholding until the QIC issues its decision. Once the QIC decides, the contractor can resume recoupment after sending a 30-day notice, whether or not you appeal further.14Centers for Medicare & Medicaid Services. Limitation on Recoupment (935) for Providers, Physicians, and Suppliers Overpayments
Level 3: Hearing Before an Administrative Law Judge
If the QIC upholds the denial, you have 60 days from receiving that decision to request a hearing before an Administrative Law Judge at the Office of Medicare Hearings and Appeals.16Centers for Medicare & Medicaid Services. Third Level of Appeal: Decision by Office of Medicare Hearings and Appeals (OMHA) The amount remaining in controversy has to meet a minimum threshold recalculated annually. For 2026, the threshold is $200.
The ALJ hearing is de novo, meaning the judge considers the case fresh and isn’t bound by the lower decisions. You can present testimony, cross-examine witnesses, and make legal arguments in ways the paper-record levels below don’t allow. OMHA’s average processing time is currently about 69 days per case.17U.S. Department of Health and Human Services. Medicare Hearings and Appeals Average Processing Time By Fiscal Year
Filing an ALJ appeal does not stop recoupment. The mandatory stay applies only at Levels 1 and 2.14Centers for Medicare & Medicaid Services. Limitation on Recoupment (935) for Providers, Physicians, and Suppliers Overpayments
Level 4: Medicare Appeals Council Review
If you’re dissatisfied with the ALJ decision, you have 60 days from receipt to request review by the Medicare Appeals Council, a component of the HHS Departmental Appeals Board. There’s no amount-in-controversy requirement at this level. The Council reviews whether the ALJ decision was supported by substantial evidence and applied the law correctly, and it can also decline review, which lets the ALJ decision stand.18Centers for Medicare & Medicaid Services. Fourth Level of Appeal: Review by the Medicare Appeals Council
Level 5: Federal District Court
The final level is a civil action in federal district court, filed within 60 days of the Council’s decision. For 2026, the amount remaining in controversy has to be at least $1,960.19Centers for Medicare & Medicaid Services. Fifth Level of Appeal: Judicial Review in Federal District Court If the Council fails to issue a timely decision, you may be able to escalate to federal court without waiting.
Reopenings for Clerical Errors
Not every dispute belongs in the appeals process. A contractor can reopen an initial determination within one year for any reason, within four years for good cause, or at any time if there’s reliable evidence of fraud. Clerical errors, including data entry mistakes, math errors, and duplicate claim denials, must be handled as reopenings rather than appeals.20eCFR. 42 CFR 405.980 – Reopening of Initial Determinations, Redeterminations, Reconsiderations, Decisions, and Reviews
The catch is that the contractor’s decision on whether to reopen is discretionary and cannot itself be appealed. If the reopening request is denied, your only recourse is the formal appeals process, assuming the deadline hasn’t passed. For substantive disputes about medical necessity or coding, appeal directly. Reopenings work best for clear administrative errors where the fix is obvious.
What to Do When an ADR Arrives
How you handle the first 45 days shapes everything that follows.
- Calendar every deadline the day the ADR arrives. Response is due in 30 days from a UPIC and 45 days from a MAC, RAC, or SMRC.
- Send the complete record the first time: orders, encounter notes, operative reports, billing data, certifications, and a signature log for any illegible signatures. Auditors deny for missing documents as often as wrong ones.
- Keep proof of what you sent and when. esMD creates a clean trail; if you fax or mail, retain the transmission or delivery record.
- Track the 30-day recoupment clock separately from the 120-day appeal clock. A Level 1 redetermination filed within 30 days of the demand letter is what stops withholding; a filing on Day 31 preserves the appeal but not the stay.
- If the demand is extrapolated, get a statistician involved before filing the Level 1 appeal. Methodology challenges preserved at the first level carry through the rest of the process.
Legal representation for Medicare appeals typically runs between roughly $180 and $565 per hour, and complex extrapolated cases can generate tens of thousands in professional fees. For small demands the math may not favor a full defense. For large ones, and especially extrapolated ones, qualified representation usually pays for itself.