Medical Necessity Documentation: What Payers Look for in Notes and Records Requests

Updated November 5, 2026, based on CMS, HHS and the Code of Federal Regulations as of that date.

Payers look for a record that shows why the service was needed, what was done, who did it, and whether the patient is getting better. Medicare's rules, in its Program Integrity Manual and Benefit Policy Manual, are a detailed public baseline. Medicaid and commercial plans set their own requirements in their provider manuals, so check each payer's manual as well.

When a payer asks for records, the deadline matters too. Medicare review contractors give you 45 calendar days to respond, or 30 for a Unified Program Integrity Contractor (UPIC), and they can deny the claim if the records don't arrive in time. This guide covers what reviewers look for in notes, what therapy, behavioral health and home health records need, and how to handle payer, patient and attorney requests.

Reviewers read the whole record

Medicare's Program Integrity Manual, chapter 3, tells review contractors to consider all medical record entries made by physicians and other licensed or certified professionals. What you submit has to show that coverage and coding requirements were met. The chapter also covers how notes are written and corrected:

• CMS allows templates but discourages ones with limited options, such as check boxes and predefined answers. In its claim review experience, they often miss the clinical detail needed to show that coverage and coding requirements are met.
• Certificates of medical necessity, supplier statements and physician attestations do not establish medical necessity on their own, even when signed by the ordering physician.
• When a scribe or an AI transcription tool drafts a note, the treating practitioner's signature affirms that the note documents the care.
• Amendments, corrections and delayed entries are allowed. The date and author of each should be identifiable, and the change should be clearly and permanently marked.

The Medicare Benefit Policy Manual, chapter 15, section 220.3 adds that contractors should consider the entire record, so one missing item doesn't negate medical necessity when the record as a whole supports it. The reviewer can only weigh what you send, so send the complete set.

Therapy records need four kinds of documents

For outpatient physical, occupational and speech therapy, section 220.3 of the Benefit Policy Manual lists what Medicare expects in response to a records request:

1. The evaluation and plan of care, including any re-evaluations for the episode under review.
2. The certification, meaning physician or other practitioner approval of the plan, and any recertifications.
3. Progress reports, including a discharge note if there is one.
4. Treatment notes for each treatment day.

Treatment notes don't have to justify medical necessity. They record the date, each intervention billed, total timed code minutes and total treatment time, and the signature and credentials of the person who furnished or supervised the service. The billing and the total timed code minutes must be consistent.

Progress reports carry the medical necessity argument. They're due at least once every 10 treatment days, and the clinician's report must assess progress toward each goal and describe plans for continuing treatment. The justification should include objective evidence, or a clinically supportable expectation, that the patient's condition can improve or is improving, in a reasonable and generally predictable period.

Certification timing is where the manual and the regulation diverge. Section 220.1.3 of the manual says certification is timely when the practitioner certifies the plan, by signature or verbal order, dated within 30 days of the first day of treatment, including the evaluation. A verbal order must be followed by a signature within 14 days, and the manual also accepts delayed certifications that give a reason for the delay. The regulation, 42 CFR 424.24(c), includes an exception: if a therapist established the plan, the record holds a written order or referral from the patient's physician or other practitioner, and the therapist has documented that the plan was delivered to that practitioner within 30 days of the initial evaluation, the certification doesn't need their signature. Recertification is still required at least every 90 days. If you rely on the exception, confirm how your Medicare Administrative Contractor (MAC) applies it.

Behavioral health: show progress in the record, keep psychotherapy notes separate

Practices that want to defend mental health treatment in an audit need the progress in the part of the record a reviewer can see. HIPAA's definition of psychotherapy notes in 45 CFR 164.501 covers a mental health professional's notes on the contents of a counseling session, kept separate from the rest of the record. It excludes session start and stop times, the modalities and frequencies of treatment, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.

Section 3.3.2.6 of the Program Integrity Manual builds on that definition. Medicare reviewers may not ask for psychotherapy notes, and declining to send them doesn't automatically deny a claim. The provider is responsible for pulling out the information that shows the services were reasonable and necessary. If what you send doesn't show that, the claim is denied.

So the items on that excluded list, such as session times, the treatment plan, symptoms, functional status and progress to date, belong in the regular record, where they can support the claim. Outside Medicare review, HIPAA generally requires a patient's authorization to disclose psychotherapy notes, under 45 CFR 164.508(a)(2), with narrow exceptions.

Home health: the certifying practitioner's record carries the claim

Medicare pays for home health only when a physician or allowed practitioner certifies the patient's eligibility, so missing practitioner documents can stop a claim. Under 42 CFR 424.22, the certification must state that the patient needs intermittent skilled nursing, physical therapy or speech-language pathology, is confined to the home, has a plan of care, and is under their care. The certification must also document the date of a face-to-face encounter related to the main reason for home health. That encounter must fall no more than 90 days before the start of care or within 30 days after. Recertification is required at least every 60 days when care continues.

The same section says the basis for certification must come from the certifying practitioner's medical record, the acute or post-acute facility's record if the patient came straight from there, or both. The agency's own documentation can support it only if other entries in those records corroborate it and the certifying practitioner signs and dates it. An agency's notes alone won't hold the claim up on review.

How to respond to a payer records request

1. Log the dates. For Medicare, 42 CFR 405.929 gives 45 calendar days to respond to a post-payment request, or 30 for a UPIC, and the manual applies the same windows to prepayment review. Under 42 CFR 405.930, the contractor can deny the claim if the records are late. Contractors may accept late records for good cause, such as a natural disaster. Medicaid and commercial deadlines vary, so read the date on the letter.
2. Send what the request asks for. Medicare's additional documentation request letters spell out the action to take, the due date and how to submit. For therapy, the manual expects the four documents above unless the contractor asks otherwise. HIPAA's minimum necessary standard applies to disclosures for payment, but under 45 CFR 164.514(d)(3)(iii) you may reasonably rely on another covered entity's request, such as a health plan's, as the minimum necessary.
3. Get records from other providers early. Section 3.2.3.3 of the Program Integrity Manual makes the billing provider ultimately responsible for submitting the records, even when another clinician holds them, such as an ordering physician's notes.
4. Submit through a channel that records receipt. MACs, Recovery Audit Contractors and the Supplemental Medical Review Contractor accept records through esMD, and the esMD receipt date counts as the date received. Depending on the payer, other channels include portal uploads, fax and mail. Keep proof of the submission date.
5. Track the request to a decision. A records request that goes unanswered past its deadline can become a denial. If a claim is denied after review, it moves to your appeals process. Our guide to denial management covers that workflow.

Patient and attorney requests follow different rules

A request from a patient falls under HIPAA's right of access. Under 45 CFR 164.524, you must act within 30 days and may take one extension of up to 30 more days, with a written explanation sent within the first 30. The regulation says a patient can direct you to send a copy to another person, such as their attorney, if the request is in writing, signed, and says who gets the copy and where. A 2020 federal court decision, described in HHS's 2021 proposed HIPAA rule, limited that right to an electronic copy of records in an electronic health record. For anything else going to a third party, ask whoever handles privacy at your organization whether you need a signed HIPAA authorization.

An attorney request without the patient's authorization is different. Under 45 CFR 164.512(e), you can disclose in response to a court order, limited to what the order authorizes. A subpoena without a court order requires satisfactory assurance that the patient was notified or that a qualified protective order was sought. Response deadlines come from the subpoena and state law. Route these requests to whoever handles legal requests at your organization.

Frequently asked questions

How long do we have to respond to a Medicare additional documentation request?

45 calendar days for requests from a MAC, a Recovery Audit Contractor, the Comprehensive Error Rate Testing (CERT) contractor or the Supplemental Medical Review Contractor, and 30 days for a UPIC. The contractor can deny the claim if records arrive late, though it may accept them for good cause.

Does every therapy treatment note need to justify medical necessity?

No. Section 220.3 of the Benefit Policy Manual says treatment notes record what was done and for how long. The progress report, due at least every 10 treatment days, carries the medical necessity justification.

Can a payer ask for psychotherapy notes?

Medicare reviewers may not request them. Other disclosures of psychotherapy notes generally need the patient's authorization under HIPAA. Put the information that supports the claim, such as session times, the treatment plan and progress, in the regular record.

Can we add to a note after the visit?

Yes. Medicare accepts amendments, corrections and delayed entries if each one shows its date and author and is clearly and permanently marked. Don't change the original entry without that trail.

Do check-box templates fail audits?

CMS allows templates but discourages limited-option ones, because in its review experience they often leave out the detail needed to show that coverage and coding requirements are met. CMS encourages templates that allow a full and complete collection of information.

For records needed before a claim goes out, see our guide to medical claims submission.

Keeping up with records requests across payer portals?

Champ automates portal and document work, like checking payer portals for records requests and uploading the documents they ask for. We set it up and run it, so your staff sees only the finished results. If records requests are piling up into denials, learn more here.

This post is general information, not legal, compliance or billing advice. Rules vary by payer and state and change often, so confirm with your Medicare Administrative Contractor, the payer or your privacy or legal counsel before acting. Champ is not affiliated with or endorsed by CMS, HHS or the other agencies and plans mentioned here.