Insurance Audits and Clawbacks: What Actually Triggers Them (and How to Survive One)

The envelope has the payer's logo, but it isn't a remittance. It's too thick for that, or too formal, and your stomach knows before your brain finishes the first paragraph. Records request. Ten charts. Thirty days. Somewhere between "Dear Provider" and the signature block, a voice in your head starts listing every note you wrote at 9 p.m., every session you coded from memory, every chart you meant to tighten up later.

Here's the thing about that voice: it's describing a monster it has never seen. Most therapists have never been through an audit, so the fear runs on rumor — a colleague's colleague who got audited and quit insurance forever, a Facebook thread about clawbacks with a lot of capital letters. Fear of open water is mostly fear of not having a chart. So let's chart it. What audits actually are, what actually triggers them, exactly what to do when the letter comes, and how the money side — clawbacks, extrapolation, appeals — really works. The monster gets a lot smaller once it has a name.

What an audit actually is

"Audit" is one word covering several different processes, and knowing which one you're in changes everything about how worried to be.

• Prepayment review. The payer holds specific claims and asks for records before paying them. Annoying — your cash flow stalls — but structurally the gentlest form: nothing has been paid, so nothing can be clawed back. Send supporting notes, get paid, and the review typically lifts once your documentation checks out.
• Post-payment review. The payer re-examines claims it already paid — this is the clawback engine. A reviewer reads your notes against the codes you billed and, where the note can't support the code, the payer demands the money back.
• SIU investigations. Commercial payers run special investigations units for cases they suspect involve more than sloppy paperwork. A letter from an SIU is a different animal from a routine review — more on that below.
• Medicare programs. If you take Medicare, the review landscape includes TPE — targeted probe and educate, which is genuinely what it sounds like: small samples of claims reviewed with feedback and a chance to correct course — and RAC contractors, private auditors paid a contingency on the overpayments they find.
• Medicaid program integrity. Medicaid has its own machinery — federal Medicaid integrity contractors and state program-integrity units — and the details vary by state. If you bill Medicaid, it's worth learning your state's version before you ever need to.

Now the reframe that matters more than any of the taxonomy: most audits are routine. Payers review records constantly, the way harbors run safety inspections — it's weather, not judgment. An audit is a question: do your records support what you billed?It is not a verdict, and it is not an accusation. Your notes are the answer to the question, and if you've been documenting honestly, the overwhelming likelihood is that the answer is yes.

What actually triggers one

Payers don't publish their selection algorithms, but the commonly cited triggers are consistent across compliance literature, and none of them are secret knowledge. They're mostly arithmetic:

• Utilization outliers. Software compares your billing to your peers'. A clinician billing 90837 for literally every client stands out against colleagues who bill a mix; so does a calendar showing twelve billed hours in a day, or sessions seven days a week, every week. Outlier doesn't mean wrong — some practices genuinely run long sessions — but outliers get looked at, and the look is a records request.
• Coding patterns. Upcoding (billing longer or higher-paying codes than the work supports), unbundling, and add-on code overuse — 90785 (interactive complexity) appended to everything is a frequently cited example — all read as patterns to a computer long before any human looks at a chart.
• High-volume telehealth patterns. Since telehealth became the norm, payers watch it closely. All-telehealth practices with heavy volume draw more review attention than the median — not because telehealth is suspect, but because the post-2020 fraud cases made payers cautious about the pattern.
• Beneficiary complaints. A client disputes a charge, questions an EOB for a session they don't remember, or complains to the plan — complaints route to review queues.
• Random selection. It happens. Some audits are pure sampling, which is exactly why an audit letter is not an accusation.

A word about the 90837 folklore, because it's the trigger therapists fear most and understand least: 90837 is not inherently an audit trigger. It's a standard code payers reimburse every day. What draws review is the pattern — every client, every session, with notes that don't record session times — not the code itself. We've traced the whole mythology, including where the infamous letters actually came from, in our 90837 vs. 90834 guide. Bill the code that matches the clock and document the time, and the longer code is as safe as any other.

The response playbook

The letter is here. What you do in the next thirty days matters far more than whatever is already in your charts. Steady hands on the wheel:

1. Read the entire letter, twice. Not the first paragraph followed by an anxiety spiral — the whole thing. Which claims, which clients, which date range, what exactly is requested (progress notes only? treatment plans? intake paperwork? billing records?), where it goes, and by when. Auditors write these letters precisely, and half the unforced errors in audit responses come from answering a question the letter didn't ask.

2. Calendar the deadline the day the letter arrives. Deadlines are commonly 30–45 days, but use the date in your letter. Missing it is the one guaranteed way to lose: payers can treat non-response as grounds to deny or recoup every claim under review by default. A mediocre on-time response beats a perfect late one, every time.

3. Send exactly what's requested — complete and organized. Every record listed, nothing extra. Legible, ordered by client and date, with a cover letter inventorying what's enclosed. Keep a complete copy of everything you send and proof of delivery. Remember who your reader is: a reviewer with a stack of files who decides, chart by chart, whether the note supports the code. Make their job easy. An organized production quietly says this practice keeps a tight ship, and that impression is worth more than any argument you could attach.

4. Never alter or backfill a record after a records request. This is the single most important sentence in this post: altering records after an audit request converts a documentation problem into a fraud problem. A missing note might cost you the payment for that session. A note edited after the request — dates changed, content added, a chart quietly "completed" — is potential evidence of fraud, and it puts your license and worse on the table. The gap between those two outcomes is the entire ballgame. If a note is genuinely missing or incomplete, there is a legitimate tool: a late entry, written now, explicitly labeled as a late entry, with today's date alongside the date of service. That's standard, accepted practice. The difference between a labeled late entry and a backdated note is the difference between honesty and forgery, and reviewers know exactly how to tell them apart.

5. Know when to call for help. A routine ten-chart records request is usually manageable on your own. But loop in a healthcare attorney — or start with your malpractice carrier — before responding if: the letter comes from a special investigations unit; the lookback is large (dozens of charts, multiple years); or the letter uses words like fraud, misrepresentation, or referral to authorities. Many malpractice policies include audit or regulatory-defense coverage riders that pay for exactly this — check your policy; you may already own the lifeboat you're afraid you can't afford. One phone call before you respond is cheap. Un-saying something you put in writing to an SIU is not.

Clawbacks: how a small sample becomes a big number

If the review finds errors, the payer issues an overpayment determination — a demand to return money for claims the records didn't support. Here's the part that shocks people: the demand usually isn't limited to the charts they read. Payers commonly extrapolate — they treat the sample's error rate as representative of all your claims and scale it up.

A worked example, with round numbers. The payer pulls 10 charts. In 2 of them, the reviewer decides the note doesn't support the billed code — a 20% error rate, maybe $300 in actual overpayment across those two sessions. But you've submitted roughly 1,500 claims to this payer over three years at about $130 each. Twenty percent of that universe is 300 claims, and the demand letter reads something like $39,000. Two thin notes, five figures. That's why the self-audit habit in the next section is not busywork.

Three things to know about that number. First, appeal rights exist, at multiple levels — typically an internal reconsideration, then higher stages that vary by payer and program — and each level has its own deadline, which is as unforgiving as the records deadline was. Overpayment findings are frequently reduced on appeal: coding determinations get overturned chart by chart, and the statistical validity of the extrapolation itself can be challenged, often with an attorney or a billing consultant. Second, lookback periods are bounded — commonly one to three years for commercial payers by contract, longer for government programs — so check your actual contracts rather than assuming the worst. Third, the mechanics of repayment usually run through offset: rather than waiting for a check, the payer deducts the overpayment from your future remittances until it's recovered, which is why a clawback can feel like your income springing a slow leak. Repayment plans and negotiated settlements exist too — payers generally prefer an agreed number over a fight — though terms vary widely and this is exactly where professional help earns its fee.

Prevention is a habit, not a panic

Everything above is damage control. The actual protection is boring and continuous, like maintaining a hull — you do it in dry dock, not in the storm.

• Write notes that support every code, every time. Session start and stop times, medical necessity, interventions, response, plan. The full recipe is in our insurance-ready documentation guide — if you read one companion piece to this post, make it that one. For the coding side, keep the CPT code cheat sheet close, and get the telehealth details right — place-of-service codes are a quiet audit finding, covered in POS 02 vs. 10.
• Run your own audit before anyone else does. Once a quarter, pull five charts at random and read them as a reviewer would: does each note, standing alone, support the code on the claim? Could a stranger reconstruct why this session was medically necessary and how long it ran? Twenty minutes, four times a year, and you'll find your own weak spots while they're still cheap to fix.
• The one-sentence standard: never bill what the note can't carry. If the note says 45 minutes, the claim doesn't say 60. If the note doesn't show interactive complexity, 90785 stays off the claim. Every audit outcome, good or bad, reduces to that sentence.

Tooling matters here more than it first appears, because most audit findings are consistency failures: the note says one thing, the claim says another, and nobody noticed for two years. When your notes, codes, and claims come from the same source — the way Practice Harbor generates claims directly from the documented session, with the time and code carried through — they can't drift apart, and consistency is the whole defense.

One necessary caveat: this article is education, not legal advice. Audit and overpayment rules vary by payer, contract, program, and state — for a real letter with real stakes, especially anything involving an SIU or a large demand, talk to a healthcare attorney or your malpractice carrier about your specific situation.

The envelope may still make your stomach drop — you're human. But now you have the map: read it all, calendar the deadline, send exactly what's asked, never touch the records, call for help when the letter warrants it, and appeal on time. Audits are weather. Practices with honest notes and steady habits sail through them all the time — they just don't post about it.