The moment a postpayment audit notice or overpayment demand letter arrives, three actions matter most: date-stamp and log the letter, preserve every medical record and EHR audit trail tied to the listed claims, and route the letter to compliance and counsel before anyone replies. Skipping any one of these steps can cost you appeal rights you cannot get back later.
TL;DR:
- Most overpayment demands involve claim-by-claim calculations, specific dates of service, and payer details that must be matched against your records before responding.
- Preserving detailed evidence, including complete EHR records and audit trails, within the first ten days is critical to protecting your appeal rights and procedural position.
- Responding options vary, with early appeals and timely redeterminations helping to preserve limits on recoupment, even if payment is made immediately.
- Challenging extrapolation requires examining sampling errors, bias, and methodology, as an invalid sample can significantly reduce liability.
- Conducting internal audits and implementing corrective action plans can prevent future overpayment issues and improve documentation accuracy.
Table of Contents
- What a demand letter contains and who sent it
- Immediate first steps: secure evidence and control communications
- How to respond to a MAC overpayment demand
- Defending against extrapolation: challenge the sample
- Preparing and submitting records the right way
- When to bring in counsel, a statistician, or a HIM vendor
- Corrective action and preventing the next audit
- What I've learned defending small practices
- How HIMShield supports your audit response
- FAQ
- Sources
What a demand letter contains and who sent it
Every demand letter maps specific claims to a dollar figure, so your first job is matching that list against your own records before you respond to anything. The letter tells you who sent it: a Medicare Administrative Contractor (MAC), a Recovery Audit Contractor (RAC), a Unified Program Integrity Contractor, or a private payer, and that identity changes your deadlines and remedies.
Look for these elements first:
- Claim-level calculation: how the overpayment amount was derived, claim by claim
- Patient identifiers and dates of service: the Medicare Beneficiary Identifier and the exact dates tied to each flagged claim
- Interest language: whether and when interest starts accruing
- Repayment instructions: including Extended Repayment Schedule (ERS) options
- Appeal and rebuttal contacts: the office and address for disputing the finding
Commercial payer letters rarely follow the same statutory clock as Medicare, so confirm the sender before you assume any CMS timeline applies.
Immediate first steps: secure evidence and control communications
The first ten days set the tone for everything that follows. Treat this window as evidence preservation, not negotiation.
- Log and date-stamp the letter the day it arrives, noting the postmark or delivery method.
- Open an internal case file that tracks every claim number, deadline, and communication.
- Export the complete EHR record for each claim listed, including audit trails, without redacting or annotating anything.
- Preserve originals of progress notes, orders, consents, and billing worksheets exactly as they exist in the system.
- Assign one point of contact for all auditor communication and notify compliance and legal counsel immediately.
- Avoid free-text admissions in emails or portal messages, even casual ones that seem harmless.
- Request clarification or a limited extension in writing if the claim list or calculation method is unclear.
Pro Tip: Never let a Miller or front-desk staffer respond informally to an auditor's phone call; route every question through your single designated contact.
This discipline protects you if the matter escalates toward extrapolation or appeal, where procedural missteps are hard to undo. Our guide on preparing for a payer audit walks through the same groundwork in more detail.
How to respond to a MAC overpayment demand
Medicare's process gives you several response paths, each with different effects on recoupment and appeal rights. A rebuttal is typically due within 15 calendar days of the demand letter, but filing one usually does not stop recoupment from starting. A redetermination, the first level of formal appeal, must be requested in writing and can preserve certain limits on recoupment if you file it on time.
The statutory clock matters: interest begins accruing on Day 31 if the balance is not paid in full by Day 30, and recoupment limitations tied to timely appeals are spelled out in CMS transmittal guidance under section 1893(f)(2).
Your repayment options include:
- Immediate payment: stops interest accrual but does not waive appeal rights
- Immediate recoupment request: offsets future payments faster but ends the standard timeline
- Standard recoupment: Medicare withholds future payments automatically
- Extended Repayment Schedule (ERS): spreads repayment over time for practices facing hardship
Attach your supporting documentation, a claim-by-claim rebuttal narrative, and any corrected billing worksheets to strengthen a redetermination request.
Defending against extrapolation: challenge the sample
Extrapolation takes a small sample, often 30 to 50 claims, and projects the error rate across a much larger universe of claims, turning a modest finding into a six- or seven-figure demand. This is where a well-prepared practice can materially change the outcome.
Challenge these points directly:
- Sampling frame errors: did the auditor define the universe of claims correctly?
- Selection bias: was the sample truly random, or skewed toward certain providers or codes?
- Insufficient sample size: is the sample statistically defensible for the projection claimed?
- Reviewer inconsistency: do multiple reviewers agree on the same claims?
- Misapplied formulas: was the extrapolation math itself correct?
Request the auditor's sample list, universe definition, selection methodology, and reviewer qualifications in writing. When the stakes are high, commission an independent statistical review of the sampling approach.
Pro Tip: A successful methodological challenge can reduce liability from the extrapolated total back down to only the sampled claims, which is often a fraction of the original demand.
Preparing and submitting records the right way
A technically incomplete submission can get denied on procedural grounds alone, so treat formatting and labeling as seriously as the content itself.
- Write a cover letter that mirrors the auditor's claim list line by line.
- Assemble the full chart: progress notes, consults, orders, signed consents, medication administration records, and EHR audit logs.
- Include corrected claims and billing worksheets where applicable.
- Label every document with the auditor's claim identifier so nothing requires guesswork on their end.
- Keep a submission log noting what was sent, when, and through which secure channel.
- Request an extension in writing with good cause if records take longer to compile than the deadline allows.
Secure upload portals or encrypted transmission protect protected health information in transit, a point reinforced in the HIPAA audit checklist from MyLTC Apps. Our own audit response letter template walks through this structure claim by claim.
When to bring in counsel, a statistician, or a HIM vendor
Not every demand letter needs outside help, but certain triggers should move you to escalate fast: an extrapolated demand running into the millions, any hint of False Claims Act exposure, a threatened provider termination, or recoupment hitting multiple payers at once.
Ask any specialist you engage the same core questions:
- What are the actual deadlines, and have any already started running?
- What defenses are realistic given the sampling method and documentation on hand?
- What evidence is still missing, and how fast can it be gathered?
- What will this cost, and what is the realistic timeline to resolution?
Counsel drafts appeals, negotiates Extended Repayment Schedules, and preserves procedural arguments that are hard to raise once recoupment is underway. Statisticians dissect sampling methodology. HIM vendors assemble response-ready records and root-cause reports that make the whole process faster for everyone involved.
Corrective action and preventing the next audit
An audit finding, even a small one, is a signal worth acting on. Start with a focused internal chart audit covering the same date range and code set the payer flagged, and quantify the actual error rate rather than guessing at it.
Build a corrective action plan with:
- A named owner responsible for each fix
- A timeline for coding corrections, provider education, and EHR template updates
- Measurable KPIs that track error rates over the following quarters
- Documentation of staff training completed as part of remediation
SCAI's best-practice guidance recommends treating audit findings as a trigger for organization-wide review rather than a one-off repayment. If you identify an overpayment through your own review, self-reporting and returning the funds promptly is part of acting in good faith and avoiding escalated scrutiny. Our coding correction process outlines the same four-step remediation structure.
What I've learned defending small practices
The practices that come out of a postpayment audit intact are the ones that treat the first week as evidence preservation, not damage control. Bring in counsel before you reply to anything substantive, and never let the auditor's sampling claims go unchallenged. Most extrapolated demands assume the underlying math is beyond question. It almost never is.
The checklist above reflects patterns we see across independent practices navigating these demands, and it's worth running through methodically rather than reactively.
— Elena
How HIMShield supports your audit response
We built our Free 30-day Revenue Leakage Audit for practices that need documentation gaps identified before a payer finds them first. It delivers a quantified view of coding and charge-capture risk across your providers and payers, with prioritized fixes you can act on immediately.
When you're already facing a demand letter, this same platform helps assemble response-ready records and documentation trails that complement, not replace, your counsel's work on appeals and recoupment strategy.
- Quantified revenue leakage across providers and payers in 30 days
- Automated compliance alerts that flag risk before claims submission
- Response-ready evidence when a payer audit does arrive
Start with our HIM compliance engagement to see where your practice stands today.
FAQ
What does it mean to audit money?
Auditing money, in this context, means a payer or government contractor reviews paid claims against medical records to confirm the billed services were documented, coded, and reimbursed correctly. A postpayment audit specifically looks at claims already paid, unlike a prepayment review, which holds claims before payment.
Does the IRS send audit letters by regular mail?
This article addresses Medicare and payer postpayment audits, not IRS tax audits, so we can't speak to IRS mail practices here. Medicare demand letters, by contrast, arrive through the Medicare Administrative Contractor and detail the claim calculation, repayment options, and appeal rights.
Who audits the United States government?
Federal agencies like Medicare are overseen through contractors such as Medicare Administrative Contractors, Recovery Audit Contractors, and Qualified Independent Contractors, each handling a different stage of claims review and appeals. These contractors operate under CMS program integrity rules rather than auditing the government itself.
What does postpayment audit mean for my practice?
A postpayment audit reviews claims your practice already billed and got paid for, checking that documentation supports the coding and medical necessity. If the auditor finds errors, you'll receive a demand letter with a repayment amount, deadlines, and your appeal options.
How does HIMShield help during an active audit?
A platform can scan EHR data to quantify documentation and coding gaps and assemble the records and evidence trail needed for a response, which can speed up preparation when facing a tight deadline. We recommend pairing this with counsel for any appeal strategy or extrapolation challenge.
Sources
- MLN006379_Medicare Overpayments Fact Sheet
- Best Practices for Responding to Documentation Requests/Audits | SCAI