CMS Medical Record Documentation Requirements and Standards

CMS medical record documentation requirements come down to a single principle: every entry that supports a Medicare or Medicaid claim must be legible, complete, dated, timed, and authenticated by the person who provided or evaluated the service, and it must contain enough detail to show the service was medically necessary and matches the code billed.¹ Miss any of those pieces and the claim is exposed, whether the reviewer is a contractor doing a routine sample or an investigator following up on a fraud referral.

The Baseline Every Entry Must Meet

Documentation should happen at the time the service is rendered or as close to it as possible.² If you add an entry later, label it as a late entry and sign and date it on the day you actually write it. Backdating a late entry to the original service date is a red flag in any audit.

For Medicare-participating hospitals, 42 CFR 482.24 makes these standards a Condition of Participation: every entry legible, complete, dated, timed, and authenticated, with all orders (including verbal orders) dated, timed, and promptly authenticated by the ordering practitioner. The requirements apply whether the record is handwritten, dictated and transcribed, typed, or computer-generated.¹

Signatures and Authentication

Authentication means the entry carries a signature, date, and time identifying who wrote it and when. Electronic signatures are acceptable when the system verifies the author’s identity and the entry’s integrity. Stamped signatures are not acceptable for Medicare purposes.³

If a signature is missing from a progress note, attestation, or similar documentation, the original author can file an attestation statement after the fact. It has to be associated with the specific record and be signed and dated. One exception matters a great deal: CMS does not accept attestation statements for missing signatures on orders. An unsigned order cannot be rescued this way. It must be signed by the ordering practitioner.³

Illegible signatures can sink an otherwise perfect claim. Keep a signature log: a typed list of providers and non-physician practitioners with their handwritten signatures alongside, so reviewers can match the scrawl to a name. Medicare Administrative Contractors accept logs regardless of when they were prepared. Alternatively, a printed name identifying the illegible signature can appear on the same page as the entry or on a separate document.³

EHR Cloning and Copy-Paste

The HHS Office of Inspector General has specifically flagged copy-paste and record cloning as features commonly misused to facilitate fraud, waste, and abuse.⁴ Pulling a previous note into today’s visit saves time, but it can produce entries that no longer reflect the patient’s condition, overstate encounter complexity, or carry forward outdated information. Macros and auto-fill templates carry the same risk. If every visit for a patient reads almost identically, the record works against you instead of for you.

Evaluation and Management Visits

E/M visits generate more claims than any other category, which makes them a constant audit target. Since 2021, you may select the level of service based on either total time on the encounter date or the complexity of Medical Decision Making. History and physical examination remain clinically important but no longer determine the billing level. Documentation must clearly support whichever element you use.⁵

When You Select by Time

Document total time spent on the encounter date and the specific activities performed. CMS counts these activities, whether or not they involve direct patient contact:

Preparing to see the patient (reviewing test results, prior records, referral notes)
Obtaining or reviewing history gathered separately
Performing the exam or evaluation
Counseling and educating the patient, family, or caregiver
Ordering medications, tests, or procedures
Communicating with other health care professionals about the patient’s care, when not separately reported
Documenting clinical information in the health record
Independently interpreting results not separately reported and communicating them to the patient
Coordinating care, when not separately reported

All counted activities must be medically reasonable and necessary. Time on unrelated administrative tasks, or on activities reported under a separate code, does not count.⁵

When You Select by Medical Decision Making

The note must reflect complexity across three elements: the number and complexity of problems addressed, the amount and complexity of data reviewed, and the risk of complications and morbidity from your management decisions. Auditors look for concrete descriptions of the problems considered, the data weighed, and why the treatment plan carries the level of risk claimed. “Complex visit” as a bare phrase does not hold up.

Split or Shared Visits

A split or shared visit occurs when both a physician and a non-physician practitioner in the same group perform parts of an E/M encounter in a facility setting. The practitioner who performs the substantive portion bills the service. As of January 1, 2024, “substantive portion” means more than half of the total time spent by both practitioners combined, or, for most visit types, performing a substantive part of the MDM.⁶

A few limits catch providers off guard. For critical care, the substantive portion can only be based on time (more than half), not MDM. Office visits and nursing facility visits cannot be billed as split or shared services at all. For prolonged services, the substantive portion is again more than half of the total combined time.⁶ The record must document each practitioner’s role and time clearly enough that a reviewer can verify who performed the substantive portion.

Scribes and Teaching Physicians

Scribes

Scribes are not providers. CMS does not require a scribe to sign or date any note they help prepare. What matters is the treating physician’s or NPP’s signature, because signing affirms the note accurately reflects the care provided. Claims cannot be denied because a scribe failed to sign.⁷ Review every note before signing. Your signature vouches for its accuracy.

Teaching Physicians

When residents provide care in teaching settings, Medicare pays based on the teaching physician’s involvement. The record must show that the teaching physician was present when the service was provided and participated in patient management. The teaching physician may sign and date notes written by residents, but the combined entries must together demonstrate medical necessity for the billed service.⁸

For E/M services, the teaching physician must document their presence during critical or key portions of the resident’s service. When total time is used to select the visit level, only the time the teaching physician spent performing qualifying activities counts. In residency training programs located outside a metropolitan statistical area, the teaching physician may be present through audio-video telehealth, but the record must identify which portion of the service involved virtual presence.⁸ A limited primary care exception exists, under which the teaching physician documents the extent of their participation, direction, and review rather than proving physical presence during the entire encounter.

Orders, Operative Reports, and Diagnostics

A signed and dated order from the treating practitioner is a condition of payment for procedures and diagnostic tests. The order confirms the practitioner intended the service. Without it, the claim is denied, and, as noted above, an attestation cannot substitute for a missing signature on an order.³

Every surgical procedure requires a comprehensive operative report completed and signed by the operating practitioner. Under the hospital Conditions of Participation, the record must contain enough information to justify the procedure, support the diagnosis, and describe the patient’s response.¹ In practice, that means the indication for surgery, pre-operative and post-operative diagnoses, description of the technique, findings during the operation, estimated blood loss, any implants or devices placed, and the patient’s condition at the end.

For imaging, laboratory work, and other diagnostic services, the record must include the ordering practitioner’s request and a formal interpretation report tying the results back to the clinical question that prompted the test. That link is what establishes medical necessity for the diagnostic service.

Telehealth

Telehealth visits carry the same documentation requirements as in-person encounters, plus some extras. Patient consent must be documented for all services, including non-face-to-face visits. Consent may be obtained when the initial service is provided, and auxiliary staff under the billing practitioner’s general supervision can collect it.⁹

Audio-only visits carry additional conditions. As of January 1, 2025, you may use two-way audio-only technology only if your site is technically capable of audio-video telehealth, the patient is in their home, and the patient either cannot use or does not consent to video technology. The record should reflect these conditions. For behavioral and mental health telehealth, audio-only communication is permitted as long as the patient is at home.⁹

For home health telehealth visits billed under HCPCS code G0321, the record must document how the telehealth encounter helps achieve the goals in the patient’s plan of care. A generic “telehealth visit completed” note is not enough. Documentation must connect the remote service to specific care plan objectives.

Proving Medical Necessity

The record behind every claim must prove the service was reasonable and necessary for the patient’s condition. Create a clear link between the diagnosis or symptoms and the specific procedure or service provided, justifying the CPT or HCPCS code selected.

NCDs and LCDs

Coverage rules come in two layers. National Coverage Determinations are evidence-based policies that apply across all of Medicare. Where no NCD exists, Medicare Administrative Contractors can issue Local Coverage Determinations that set region-specific requirements for particular services.¹⁰ LCDs often specify which ICD-10 diagnosis codes support coverage. If documentation does not align with the diagnosis codes in the applicable NCD or LCD, expect a denial. Checking the relevant LCD before billing an unfamiliar service is one of the simplest steps you can take to prevent problems.

Incident-To Services

When an NPP provides services “incident to” a physician’s professional service, the record must show that the physician performed the initial service, established the treatment plan, and remains actively involved. The patient record needs to include the care plan written by the supervising physician or NPP.¹¹ The physician need not be in the treatment room, but must be present in the office suite and available to assist.¹² A missing or illegible supervising signature, or the absence of a documented treatment plan, is a common reason incident-to claims get flagged.

Advance Beneficiary Notices

When you expect Medicare to deny a service as not medically necessary, issue an Advance Beneficiary Notice of Noncoverage using CMS Form R-131 before providing the service. The ABN shifts potential financial liability to the patient if they choose to proceed.¹³ The form must describe the service, explain why you believe Medicare will deny it, and estimate the cost. The patient selects an option, signs, and dates. Bill with modifier GA to indicate a valid, signed ABN is on file.

If the patient refuses to sign, document the refusal: date, who refused, services involved, and date of service. Have a witness sign when possible. Bill with modifier GA even after a refusal, as long as you properly presented the ABN and documented the refusal. Without an ABN on file, you absorb the cost of the denied service.

Audits, Overpayments, and Penalties

CMS uses several contractor programs to review documentation. Recovery Audit Contractors identify underpayments and overpayments after payment and flag improper payments for recoupment; a RAC that suspects fraud refers the case to a Unified Program Integrity Contractor, and a UPIC investigation is substantially more serious than a routine review. Medicare Administrative Contractors process claims and handle payment adjustments when RACs identify problems, and also conduct their own prepayment and post-payment reviews. The Comprehensive Error Rate Testing program samples claims to measure the overall Medicare improper payment rate. Claims already under review by one program are excluded from review by the others to prevent duplicative audits.¹⁴

The 60-Day Overpayment Rule

If you identify an overpayment through your own compliance activities or in response to credible information, you have 60 days from identification to report and return it. “Identification” includes the time spent investigating; once you receive credible information of a potential overpayment, you should complete your investigation within six months. The lookback period extends six years from when you received the overpayment.¹⁵

Sitting on an overpayment past the 60-day deadline turns it into an “obligation” under the False Claims Act. Overpayments can be reported and returned through claim adjustments, credit balances, or self-reported refunds submitted through your MAC.¹⁵

Penalties

Consequences scale with the nature of the problem. At the lowest level, insufficient documentation means denied claims and returned payments. Above that, CMS imposes civil monetary penalties adjusted annually for inflation. For 2025, effective for penalties assessed on or after January 28, 2026, the maximum penalty for knowingly presenting a false claim is $25,595 per violation, and the maximum for making or using a false record material to a fraudulent claim reaches $72,163.¹⁶

The heaviest exposure comes under the False Claims Act. Per-claim penalties currently range from roughly $14,300 to $28,600, and the statute imposes treble damages on top, allowing the government to recover three times the overpayment amount. An overpayment you knew about but failed to return within 60 days can trigger FCA liability. Providers who discover systematic documentation problems through internal audits can reduce exposure by using the OIG Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol, both of which pause the 60-day return clock while the disclosure is being processed.¹⁵

Retention and Corrections

How Long to Keep Records

Medicare Fee-For-Service providers must retain all required documentation for at least six years from the date of creation or the date it was last in effect, whichever is later. Providers that submit cost reports must keep patient records for at least five years after the cost report is closed. Medicare managed care participants must retain records for ten years.¹⁷

Hospitals subject to the Conditions of Participation must retain medical records in their original or legally reproduced form for at least five years.¹ State laws frequently impose their own retention periods, often longer than the federal minimums, and records for minors commonly must be kept until the patient reaches adulthood plus an additional period. The safest approach is to retain records for the longest period required by any applicable federal, state, or payer rule.

Fixing Errors the Right Way

When you find a mistake in a record, the original entry must stay readable. Never erase, white-out, or delete the incorrect text. In a paper record, draw a single line through the error so the original content remains visible, write “error,” sign or initial the correction, and add the current date and time. In an EHR, the system should preserve the original entry and log the correction with the author’s identity and a timestamp.

Addendums and late entries follow similar rules. Each must be clearly labeled, dated and signed on the day it is actually written, and linked to the original entry it supplements. A late entry backdated to look contemporaneous is the kind of thing that turns a documentation problem into a credibility problem during an audit.

1
eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services
2
Centers for Medicare & Medicaid Services. Documentation Matters Toolkit
3
Centers for Medicare & Medicaid Services. Complying with Medicare Signature Requirements
4
Centers for Medicare & Medicaid Services. Documentation Integrity in Electronic Health Records
5
Centers for Medicare & Medicaid Services. Evaluation and Management Services
6
Centers for Medicare & Medicaid Services. Updates for Split or Shared Evaluation and Management Visits
7
Centers for Medicare & Medicaid Services. Transmittal R713PI – Scribe Services Documentation
8
Centers for Medicare & Medicaid Services. Guidelines for Teaching Physicians, Interns, and Residents
9
Centers for Medicare & Medicaid Services. Telehealth and Remote Monitoring
10
Centers for Medicare & Medicaid Services. Medicare Coverage Determination Process
11
Centers for Medicare & Medicaid Services. Complying with Medical Record Documentation Requirements
12
Centers for Medicare & Medicaid Services. Incident To Services
13
Centers for Medicare & Medicaid Services. FFS ABN
14
Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual Chapter 9 – Recovery Audit Program
15
Federal Register. Medicare Program; Reporting and Returning of Overpayments
16
GovInfo. Annual Civil Monetary Penalties Inflation Adjustment
17
Centers for Medicare & Medicaid Services. Medical Record Retention and Media Format