Records requests & recoupment
Medical records requests from payer vendors: can you fight the audit and the takeback?
The letter comes from a company like Datavant or Cotiviti, gives you days to comply, and warns of a takeback if you’re late. Providers ask us the same four questions: who is this, can I refuse, is that deadline even legal, and what happens if I miss it. Here are the answers.
The records demand
What actually happens when the letter arrives.
These are claims you were already paid on, for care you already delivered. A plan (or a vendor working for it) asks for a bulk pull of chart notes across many patients, a reviewer second-guesses the documentation months later, and if the notes don’t satisfy the plan’s medical-necessity policy, the money is taken back by offsetting your future checks. It is a defined, repeatable process, which means there are defined places to push back. Here is the path, start to finish.
The demand
A retrieval vendor (Datavant, MRO, Verisma) requests a year of notes across dozens of patients on a short deadline.
You produce charts
Your team pulls and sends the notes: complete, legible, and on time, or the claim fails by default.
The review
A payment-integrity reviewer (Cotiviti, Optum) judges the notes against the plan’s medical-necessity policy.
Overpayment
Visits the notes don’t support are tallied into an overpayment demand you’re asked to repay.
Recoupment
If it isn’t repaid, the plan takes it out of your next checks, across other patients, under your TIN.
Who is asking
Who is actually asking, and by what authority.
The letterhead is usually a company you’ve never contracted with, and that unnerves providers. Here is the key fact: none of these vendors act on their own authority. Each is the health plan’s HIPAA business associate, working under the plan’s permission to review already-paid claims for “payment” and “health care operations” (45 CFR 164.506, 164.502(e)). They come in two types.
They pull the charts
Release-of-information / retrieval vendors that physically request and collect your records:
Datavant (which absorbed Ciox Health and ChartSwap), MRO, Sharecare Health Data Services, Verisma (which absorbed ScanSTAT), Ontellus, Inovalon, Episource, Reveleer.
They run the review
Payment-integrity vendors that judge the notes and drive the takeback:
Cotiviti, Optum / Optum Insight (which owns Change Healthcare and Episource), EXL, Machinify (which absorbed Performant), Lyric (formerly ClaimsXten), Zelis.
It’s often the same company under a new name. Ciox and ChartSwap are now Datavant. ScanSTAT is now Verisma. Change Healthcare and Episource are now Optum. Performant is now Machinify. ClaimsXten is now Lyric. A stack of different letterheads can trace back to just a few parents, so identify the plan behind the letter, not just the vendor on it.
Can you refuse?
Can you refuse? Mostly no. But you have real leverage.
The honest answer: if you participate with the plan, your network contract requires you to cooperate with a legitimate payment audit. HIPAA only permits the disclosure; the contract compels it. Aetna’s national provider manual is blunt that providers “are required to send” requested records and that “failure to respond may impact your future participation status.” A flat refusal is a breach that triggers denial or recoupment on its own. So you rarely get to say no. What you can do is narrow it, verify it, and slow it down.
Verify who’s really asking
Make the vendor show it is the named plan’s business associate acting for a payment or operations purpose (45 CFR 164.514(h)). A disguised attorney, subrogation, or marketing request is different, and would need the patient’s written authorization (164.508).
Narrow the request
HIPAA’s minimum-necessary rule (45 CFR 164.514(d)) says a requester “may not request an entire medical record” unless that is specifically justified. An overbroad “send everything” demand can be narrowed to the dates and elements actually at issue. It is a negotiation with a strong basis, not an automatic veto.
Push on the timeline
The deadline is contract language, not law (see below). Ask for an extension in writing, cite the volume, and hold the plan to the turnaround in its own manual.
Out of network? More room
With no participation contract there’s no cooperation clause to breach, so a refusal isn’t a breach. The plan can still deny or recoup the patient’s claim, so the leverage is real but limited.
When a refusal is actually defensible: the requester can’t prove it’s acting for the plan; the request is outside treatment, payment or operations and has no patient authorization; or it reaches specially protected data such as psychotherapy notes (164.508(a)(2)) or substance-use records under 42 CFR Part 2. One thing to avoid: don’t assume you can bill the plan for audit copies. You generally can’t for a plan’s own audit, even though a patient’s right-of-access copy (164.524) and an attorney’s request follow separate fee rules.
The 8-day clock
Is an 8-day deadline legal? No, and it’s usually shorter than the plan’s own rule.
No law sets how fast you must answer a commercial payer’s records request. HIPAA governs how records are shared, not how quickly. The clock in the letter is whatever the plan or its vendor chose to write, which means it is negotiable, and it is often far shorter than what the plan itself allows elsewhere.
Medicare gives you to answer the same kind of request (the ADR window, 42 CFR 405.903 / 405.929). A claim only auto-denies on day 46, and late records can still be accepted for good cause.
what commercial plans’ own provider manuals commonly allow: Optum’s payment-integrity letters give 30, Cotiviti runs 30 to 60, UnitedHealthcare ties it to a 45-day window.
what a vendor’s letter may demand for a year of charts. When that’s shorter than the plan’s own published turnaround, that gap is your opening.
To push back: request an extension in writing before the clock runs, cite the volume and the minimum-necessary standard, and escalate from the vendor to the plan, holding it to the turnaround in its own provider manual. A short, documented extension request is also part of the record if the takeback is later appealed.
If you missed it
Missed the deadline and got a takeback? It’s almost never the end.
When records are late or fail the review, the claim is treated as unsupported and recouped by offset. But that recoupment is an appealable decision, and the documentation defense can still be made after the fact. The job just changes from “prevent” to “appeal,” and the money is usually won or lost there. Four live options:
Submit the records late
A missed deadline rarely closes the door. Medicare can accept late records for good cause (42 CFR 405.929), and commercial plans take them on reconsideration or first-level appeal (Cigna allows 180 days). The chart still gets its hearing.
Appeal the recoupment
On a fully-insured plan, a medical-necessity denial goes to internal appeal, then binding external review. On a self-funded plan it’s the federal ERISA appeal (29 CFR 2560.503-1). On Medicare, recoupment must pause while a timely appeal is pending (42 CFR 405.379).
Invoke your state’s cap
If the takeback reaches past your state’s lookback window, or skips a required notice, it may be barred outright (the matrix below). This reaches fully-insured plans only, and a fraud allegation removes the cap.
Make them prove the number
Demand the specific claims and notes at issue and, for an extrapolated bulk demand, the sampling methodology. Send a complete records package with the appeal by certified delivery, and complain to your state insurance regulator for an out-of-window or no-notice offset.
The one genuine dead end: a self-funded ERISA plan where the notes fail on the merits and the plan document authorizes the offset. There, state protections are preempted and the ERISA appeal is the only route, which is exactly why plan type is the first thing to check.
Why chiropractic
Why chiropractic draws more of these than almost any specialty.
If you feel singled out, the data explains it. The whole audit turns on one line the record has to draw every visit: active, corrective care that is improving the patient is covered. Maintenance, holding a stable patient steady, is not. Most recoupments come from that line being blurry in the notes.
improper-payment rate of any Medicare Part B service. Chiropractic’s rate rose from about 44% to 54% between 2010 and 2014 (HHS-OIG CERT data).
of paid chiropractic claims OIG reviewed were for maintenance therapy the plan doesn’t cover. The error climbs with the number of visits per patient.
in unallowable chiropractic payments OIG has cited, which is why chiropractic keeps returning to auditors’ work plans, public and commercial alike.
Those figures are Medicare and OIG data, the backdrop for why you’re a target. The standard that decides a commercial takeback is each plan’s own medical-necessity policy, and that is what your notes have to satisfy.
Notes that survive
The same visit, two charts. One holds up, one gets clawed back.
The care can be identical. What decides the audit is whether the note proves it, against the current commercial policies (Cigna CPG 278, UnitedHealthcare 2026T0541X, Aetna CPB 0107). The hard truth: good care with bad notes still loses. This is the checklist to self-audit against.
Survives the review
- An individualized, contemporaneous note, written for this patient, this visit.
- A plan with a set number of visits over a set timeframe, and the outcome you expect.
- PART documented (at least two of asymmetry, range of motion, tissue tone, tenderness) with how the subluxation drives the symptom.
- Objective outcome measures re-scored at intervals, with measurable improvement between them.
- When the patient plateaus, maintenance called what it is, and handed off with an ABN where required.
Gets recouped
- Cloned or templated notes that read identically visit after visit (Cigna bans this outright).
- “Pain 6/10, feels better,” a subjective score with no objective measure behind it.
- A frequency of care the notes never justify, like three visits a week, indefinitely.
- No re-examination: goals set once and never re-measured.
- A stable patient still billed as active care: maintenance in everything but the label.
Insured or ERISA?
One question decides which protections you have: who bears the risk?
Before you cite a single deadline or lookback, find out whether the plan is fully-insured or self-funded. It decides whether the state rules in the next section reach the plan at all, and the same national logo sits on both kinds.
Fully-insured (state law applies)
The carrier bears the risk, so the state regulates it. The lookback caps, the notice-before-offset rules and the external-review rights below are all available to you.
Self-funded, or ASO (state law is preempted)
The employer bears the risk and the carrier only administers. Under ERISA (29 U.S.C. § 1144), states can’t regulate these plans as insurers, so the state rules below don’t reach them. Your floor is the federal ERISA appeal (29 CFR 2560.503-1).
How to tell: the member ID card and EOB (“insured by” vs. “administered by,” a third-party administrator), the summary plan description, or simply ask at eligibility. It’s always step one.
Your state’s limit
How far back a fully-insured plan can reach, and whether it can offset before you’re heard.
For fully-insured plans, state law caps the recoupment lookback and, in several states, forbids offsetting before you’ve had a chance to contest. A takeback reaching past your state’s window, absent a fraud allegation that removes the cap, is barred. A verified snapshot, current as of July 2026:
Read once, applies to every row: these reach fully-insured, state-regulated plans only. Self-funded and ASO plans and their audit vendors are not bound by any lookback or offset limit below (29 U.S.C. § 1144).
| State | Recoupment lookback (fully-insured) | Can they offset before you’re heard? | Prompt-pay + interest |
|---|---|---|---|
| California | 365 days from payment | Offset only if you don’t repay within 30 working days and the contract authorizes it; 30 wd to contest | 30 days; 15%/yr |
| Texas | 180 days from your receipt of payment | Strong; no recovery until your appeal rights are exhausted | 30/45 days; 18%/yr |
| Florida | Chiropractors: 12 months (30 mo general) | No offset without your written agreement or an untimely response; 35 days to contest | 20/90 days; 12% |
| Washington | 24 months | Written request; 30 days to contest; a contested refund can’t be offset for 6 months | 30/60 days; 1%/mo |
| Illinois | 12 months | Itemized remittance required first; 60-day appeal window | 30 days; 9%/yr |
| Georgia | 12-mo notice / 18 mo to complete | Written notice of intent required before any audit or takeback | 15/30 days; 12%/yr |
| Colorado | 12 months (its separate 6-month rule covers only risk-sharing reconciliation, not ordinary claims) | Written notice with a specific explanation and the dispute process | 30/45 days; 10%/yr (+20% at day 91) |
| Pennsylvania | 24 months | Written statement of the basis; the clock pauses while you gather records | 45 days; 10%/yr |
| New Jersey | 18 months | Written notice under the prompt-pay rule | 30/40 days; 12%/yr |
| New York | 24 months (self-funded expressly carved out; a pending bill to cut this to 12 months has not been enacted) | Written notice of recovery, plus a chance to challenge | 30/45 days; 12%/yr |
| North Carolina | 2 years | 30 days’ advance written notice before offset | 30 days; 18%/yr |
| Ohio | 2 years (payment final after) | Notice plus 30-day appeal; offset paused pending appeal | 30/45 days; 18%/yr |
| Arizona | 1 year (shortest) | Adjustment request within a year; no bright-line pre-offset stay | 30 days; ~10%/yr |
Operative sections: CA 28 CCR §1300.71; TX Ins. Code §843.350 / §1301.132; FL §627.6131 & §641.3155 (ch. 460 in the 12-month tier); WA RCW 48.43.600; IL 215 ILCS 5/368d; GA O.C.G.A. §33-20A-62; CO C.R.S. §10-16-704(4.5); PA 40 Pa.C.S. §3803; NJ N.J.A.C. 11:22-1.8; NY Ins. Law §3224-b; NC N.C.G.S. §58-3-225; OH R.C. §3901.388; AZ A.R.S. §20-3102. Verified against primary text, July 2026. Not your state? We track the current rule for every state we bill.
What to do now
The short version, in the order it matters.
Most of these audits are won or lost on procedure, not the merits. Here is the sequence that keeps a records demand from becoming a silent takeback.
This is the day-to-day work ACB does for chiropractic practices: fielding the demand, hitting the clocks, coaching audit-ready documentation, and running the appeal to the finish, inside the EHR you already use. It pairs with our active vs. maintenance and denials guides.
Common questions
Records requests and takebacks, answered.
Datavant is a medical-records retrieval company (it absorbed Ciox Health and ChartSwap) that pulls charts on behalf of health plans. It doesn’t act on its own authority; it’s the plan’s HIPAA business associate, and the plan’s right to review already-paid claims without patient authorization comes from HIPAA’s payment and operations rules (45 CFR 164.506). Others do the same job (MRO, Verisma, Sharecare), and separate firms like Cotiviti and Optum run the review. So yes, a legitimate request tied to a plan you participate with is one you generally have to answer, but you can make them prove who they represent first.
Rarely. If you participate with the plan, your contract requires you to cooperate with a legitimate payment audit, and a flat refusal is a breach that triggers denial or recoupment by itself. HIPAA permits the disclosure; your contract compels it. What you can do is narrow an overbroad request under the minimum-necessary rule (45 CFR 164.514(d)), make the vendor prove it’s the plan’s business associate, and push on the deadline. A true refusal is defensible only in narrow cases, such as a request with no proof of authority, or one reaching psychotherapy notes or Part 2 substance-use records.
No law sets a minimum response time for a commercial payer’s records request, so an 8-day deadline is contract language, not a legal requirement, and it’s negotiable. For comparison, Medicare gives 45 days for the same task, and most commercial plans’ own manuals allow 30 to 45. A vendor’s 8-day letter is often shorter than the plan’s published policy, which is your opening: request an extension in writing, cite the volume, and hold the plan to its own turnaround.
Almost always. A missed deadline shifts you from preventing the takeback to appealing it, but the documentation defense still lives. You can usually submit the records late on reconsideration or first-level appeal (Cigna gives 180 days; Medicare accepts them for good cause), appeal the recoupment to external review or the ERISA process, and invoke your state’s lookback cap to bar a stale takeback on a fully-insured plan. Appeal with a complete records package rather than paying the offset.
You have a real basis to. HIPAA’s minimum-necessary standard says a requester “may not request an entire medical record” unless that is specifically justified (45 CFR 164.514(d)), so you can ask them to limit the pull to the dates of service and elements actually under review. It’s a negotiation, not an automatic veto, since the rule lets the requester rely on its own judgment of what it needs, but a documented push to narrow the scope is both reasonable and useful if the audit is later appealed.
Official sources
Where these answers come from
Every legal figure, deadline and policy quotation on this page is drawn from primary federal and state law and from insurers’ own current materials. Rules and plan policies change, and several below were amended or take effect in 2025 or 2026, so confirm the current rule for a specific member, plan and state before relying on it.
- 45 CFR § 164.506: HIPAA payment & operations disclosures (the records basis)
- 45 CFR § 164.502(e) & 164.504(e): business-associate relationship (the vendor’s authority)
- 45 CFR § 164.514(d) & (h): minimum necessary & verification of the requester
- HHS OCR: treatment, payment & operations disclosures are permitted, not required
- 42 CFR § 405.903 / 405.929: Medicare 45-day records window & good-cause late records
- 42 CFR § 405.379: Medicare recoupment pauses during a timely appeal
- 29 U.S.C. § 1144: ERISA preemption (self-funded plans)
- 29 CFR § 2560.503-1: ERISA claims & appeals procedure
- HHS-OIG: chiropractic improper-payment findings (maintenance care; $350M+)
- Cal. Code Regs. tit. 28, § 1300.71: overpayment recovery (California)
- Tex. Ins. Code § 843.350: recovery of overpayment (Texas)
- Fla. Stat. § 641.3155: overpayment recovery; ch. 460 in the 12-month tier (Florida)
- RCW 48.43.600: overpayment recovery time limits (Washington)
- N.Y. Ins. Law § 3224-b: overpayment recovery; self-insured carve-out (New York)
- Cigna Coverage Policy CPG 278: Chiropractic Care (eff. 12/15/2025)
- Aetna Clinical Policy Bulletin 0107: Chiropractic Services
This guide is part of our chiropractic billing guides. For the documentation that keeps these claims audit-proof, see active vs. maintenance care, the Medicare billing rules, and the denials playbook.
This guide is general information for chiropractic and multi-specialty practices, not legal advice. Whether you can push back on a request, and what you can do about a takeback, turns on plan-specific facts: your participation contract, the plan’s funding type, the member’s benefit, and your state’s current statute. Verify the current rule for each situation and consult counsel for a specific dispute above a material dollar amount. American Chiropractic Billing helps clients respond to records audits, meet the deadlines and pursue appeals as part of its billing service; we are a billing company, not a law firm.
Got a records demand or a takeback?
Let us help you.
Book a free 30-minute appointment. We’ll read the demand, check who’s behind it, the plan type and your state’s lookback, and map the response before the offset hits. Chiropractic-first, month-to-month, no contract.
HIPAA-regulated · BAA available · Any-EHR compatible · Serving all 50 states · Since 2020