A payer record request looks like paperwork. It is a claim decision waiting to happen. A Medicare contractor gives you 45 calendar days to send the chart behind a claim, and a request that sits in a queue becomes a denial that no clinician ever reviews. The clock starts on the date printed on the letter, not the day your front desk opens the envelope.
What this covers
- A claim-review request is a condition of payment. Ignore it and the claim denies without anyone reading the chart (42 CFR 405.930).
- Medicare allows 45 calendar days to answer a MAC, RAC, or SMRC request and 30 days for a UPIC request. Both clocks run from the date on the letter.
- Send the record that supports the billed service and nothing else. Psychotherapy notes and substance use disorder records are consent-gated.
- Copy fees follow the request type. A patient access request is capped by HIPAA. A third-party payer request follows state law and the provider contract.
- A record request does not pause timely filing. A Medicare claim that ages out at 12 months cannot be rebilled, whatever the reason it waited.
A record request is the payer asking you to prove the claim. The deadline decides the answer before the chart does.A non-response denial is settled on the calendar, not on the clinical record.
The denial management queue is where these requests usually land, and that is part of the problem. A record request gets worked like a records task when it is really a claim with a deadline attached. This article separates the two families of requests a practice sees, the windows that apply to each, what belongs in the response, when a copy fee is allowed, and what happens to the claim when the request waits too long.
Two kinds of record requests, two different rulebooks
Payers ask for records for two reasons, and the reason decides the rules. The first is claim review: the payer or its contractor is deciding whether to pay, keep paying, or take money back on a specific claim. The second is data collection: the plan wants charts for risk adjustment or a quality measure. The first has a hard deadline and a denial attached. The second usually does not.
| Request | Who sends it | What it decides | If you ignore it |
|---|---|---|---|
| Medicare ADR, prepayment | MAC | Whether the claim is payable | The claim denies under 42 CFR 405.930 |
| Medicare ADR, post-payment | MAC, RAC, or SMRC | Whether the payment stands | An overpayment demand and recoupment |
| Program integrity request | UPIC | Whether a billing pattern is investigated | Denial plus referral for further review |
| Risk adjustment chart chase | Medicare Advantage plan or its vendor | Whether a diagnosis is supported for the year | The plan risks an overpayment if CMS audits the diagnosis |
| Quality or HEDIS chart request | Plan or its vendor | Whether a measure is credited | No claim denial, but the measure cannot be credited |
The tell sits in the first paragraph. A claim-review request names the claim number, the date of service, and a response date. A data-collection request names a sample, a measure, or a diagnosis code, and usually arrives from a vendor rather than the plan itself. Read that paragraph before you route the letter.
A claim-review request belongs to the person who owns denials and appeals. A chart-retrieval request belongs to health information management. Send a claim-review request to the records desk and it can miss its deadline while it waits in a chart-pull queue.
The response window you actually own
For Medicare fee-for-service, the window comes from regulation rather than from the contractor’s preference. A provider or supplier gets 45 calendar days to respond to a MAC, a RAC, or the Supplemental Medical Review Contractor, and 30 calendar days for a UPIC request. Those numbers come from 42 CFR 405.903 for prepayment review and 42 CFR 405.929 for post-payment review.
| Requesting entity | Review type | Response window |
|---|---|---|
| MAC | Prepayment or post-payment review, including Targeted Probe and Educate | 45 calendar days |
| RAC | Post-payment review of paid claims | 45 calendar days |
| SMRC | CMS-directed project review | 45 calendar days |
| UPIC | Program integrity investigation | 30 calendar days |
The clock starts on the date printed on the letter. A letter dated the first that reaches the compliance officer on the twelfth has already spent a quarter of its window on mail transit and internal routing. Calendar the date on the page, not the date of receipt, and work backward from it.
A contractor may accept a late response for good cause, which CMS describes as a natural disaster, an interruption in business practices, or another extenuating circumstance the contractor accepts. Ask before the deadline passes, never after. Silence past the deadline is treated the same as no response at all.
A patient access request runs on its own clock. Under 45 CFR 164.524, a covered entity has 30 calendar days to act, with one 30-day extension if it tells the patient in writing within the first 30 days. That deadline belongs to the patient, but it lands on the same desk.
What to send, and what to leave out
Send the record that answers the question the payer asked. The minimum necessary standard at 45 CFR 164.502(b) applies to disclosures for payment, so a request for the notes behind one date of service does not authorize a copy of the whole chart.
- Attach the request letter as the first page so the reviewer can match the record to the claim.
- Send only the date range and the provider named in the request.
- Include the signed order, the plan of care, the progress note, and any prior authorization referenced on the claim.
- Redact or omit records of other patients that appear on the same page.
- Leave psychotherapy notes out unless the patient signed an authorization that specifically covers them (45 CFR 164.508(a)(2)).
- Treat substance use disorder records as consent-gated, even for a payer request.
- Log what you sent, who sent it, and the date it left the office.
Two record types trip practices that bill behavioral health. Psychotherapy notes, defined at 45 CFR 164.501 as the therapist’s private notes separated from the rest of the record, need a specific authorization for disclosure and are not covered by the treatment, payment, and operations permission at 45 CFR 164.506. Substance use disorder records under 42 CFR Part 2 are consent-gated. Since February 16, 2026, a Part 2 program may take a single patient consent that covers all future disclosures for treatment, payment, and health care operations, which makes the front-end consent the thing to check.
For an ABA claim, the record that supports 97153 is a session note with the date, the start and stop times, the technician who delivered the protocol, the targets worked, and the data collected. A payer that asked for the note behind four units of 97153 does not need the initial assessment report, and sending it invites a second look at the authorization.
A chart dump buries the one page that supports the claim, and it hands the reviewer a wider date range to question. It can also disclose information that was never needed for payment. Send the answer, not the file.
Can you bill for the copies?
Sometimes, and the answer depends on who is asking and why.
A request from the patient, or from someone the patient directs in writing, is a HIPAA right-of-access request. The fee there is capped at a reasonable, cost-based amount covering labor for copying, supplies, and postage only, per 45 CFR 164.524(c)(4). OCR does not consider per-page fees reasonable for protected health information maintained electronically, and a covered entity may instead charge a flat fee of no more than $6.50 for an electronic copy of information it maintains electronically.
A request from a health plan or its contractor for payment purposes is not a right-of-access request. Where the payer initiates the request on its own behalf, HHS says the access fee limits do not apply. The prohibition on selling protected health information at 45 CFR 164.502(a)(5)(ii) may still apply, and where it does, you may charge only a reasonable, cost-based fee to prepare and transmit the record, or a fee another law expressly permits.
| Who is asking | Fee rule | Where it comes from |
|---|---|---|
| Patient or their designee | Reasonable, cost-based fee for copying labor, supplies, and postage | 45 CFR 164.524(c)(4) |
| Health plan, for payment | Access fee caps do not apply; the sale-of-PHI limit may | HHS right-of-access guidance |
| Insurer validating a billed claim | Often no fee is owed; state law and the contract control | 42 Pa.C.S. 6152.1, as one example |
| Medicare or Medicaid contractor | Records are produced on request as a condition of participation | 42 CFR 424.516(f) and 42 CFR 431.107(b)(2) |
Pennsylvania shows how the third row works in practice. State law sets a per-page fee for medical records, then carves out insurers: an insurer is not required to pay for copies of records needed to validate services billed under an insurance contract, unless the request is a workers’ compensation or auto injury claim, or a contract between the insurer and the provider says otherwise.
A per-page invoice sent to a health plan is a contract question first. Read the provider agreement and the state fee statute before you bill, and do not treat a patient access fee schedule as a payer fee schedule.
What happens to the claim while the request waits
A record request does not stop any other clock. Two clocks keep running in the background, and either one can end the claim before anyone reads the chart.
The first is the response window itself. If the contractor receives nothing in time, 42 CFR 405.930 gives it authority to deny the claim. The reviewer never sees the documentation, so a claim that would have paid denies on the calendar. On a post-payment review, the same silence turns a paid claim into an overpayment.
The second is timely filing. Under 42 CFR 424.44, a Medicare claim must be filed no later than one calendar year after the date of service, with narrow exceptions that turn on a contractor error or a retroactive eligibility change. A claim that waits while a record request sits in a chart-pull queue does not get a filing extension. When that window closes, the claim is not late. It is gone.
A denial that one session note could have answered becomes unrecoverable when the practice’s own filing window closes first. Age every request against the date of service the day it arrives, not the day it is due.
The remedy after a non-response denial is an appeal, and the appeal runs on its own clock. A Medicare redetermination must be filed within 120 days of receipt of the initial determination. Every day the request spent unassigned eats into the time left to fight the denial it caused.
Run the request like a claim
A request has three parts: a date on the letter, the documents named, and a claim behind it. Track all three.
Record the date on the letter, the claim or sample number, the date of service, the documents named, and the calculated due date. Set the due date from the letter, not the mailroom.
Mark it claim review or data collection. The two go to different owners and carry different deadlines.
Give the request to a named person with the date range and the specific documents. Ask for the whole chart only when the letter asks for the whole chart.
Check the response against the request line by line. Confirm the letter is attached as the first page and that nothing beyond the request went out.
Send by a channel you can prove: the payer portal, esMD, or a trackable shipment. Keep the confirmation with the response.
Tie the response back to the claim record so the biller knows the claim is in review rather than lost, and knows when to expect a decision.
- The date on the letter is in the log, not the date of receipt.
- The request is classified as claim review or data collection.
- One named owner per request.
- The response contains only the documents the letter named.
- Psychotherapy notes and Part 2 records were checked before release.
- Proof of delivery is filed with the response.
- The claim record shows the review status and the expected decision date.
A chart audit that reads the same records your payer reads is the cheapest way to know whether a response would have held up. comprehensive chart auditing is where that check lives, and it belongs in the loop before a second request arrives on the same provider.
Payer record request questions
For Medicare fee-for-service it depends on the contractor. A MAC, a RAC, and the SMRC each allow 45 calendar days under 42 CFR 405.903 and 405.929. A UPIC allows 30 calendar days. The clock starts on the date printed on the letter, not the date your office receives it. Commercial and Medicaid plans set their own windows in the contract or the provider manual.
The contractor has authority to deny the claim under 42 CFR 405.930, and it will deny without reading the record. On a post-payment review the same silence produces an overpayment demand. A contractor may accept a late response for good cause, which CMS limits to events like a natural disaster or an interruption in business operations, and you have to ask before the deadline passes.
It depends on the state and the contract. HIPAA caps only patient access requests, where the fee may cover copying labor, supplies, and postage. Where a health plan initiates a request for payment purposes, the access fee limits do not apply, but the federal sale-of-PHI rule can limit what you charge. Pennsylvania, for example, says an insurer is not required to pay for records that validate a billed claim.
For payment, usually no. 45 CFR 164.506 permits a covered entity to disclose protected health information for payment activities without an authorization. Two exceptions matter. Psychotherapy notes need a specific authorization under 45 CFR 164.508(a)(2). Substance use disorder records under 42 CFR Part 2 are consent-gated, so confirm the patient consent covers the disclosure before the record leaves.
Only what the request names. The minimum necessary standard at 45 CFR 164.502(b) applies to payment disclosures, so a request for the notes behind one date of service does not justify a full chart copy. Attach the request letter as the first page, send the specific documents, and log the date you sent them.
CARC 252, an attachment or other documentation is required to adjudicate this claim, is the current code for a missing record, and it requires a remark code. RARC M127, missing patient medical record for this service, and N237, incomplete or invalid patient medical record, are both active. Do not use RARC N29, which was deactivated on March 1, 2016.
The bottom line
A record request is a claim with a deadline, and the deadline runs from the date on the letter. Classify the request, send only what was asked, and log it against the claim so nothing ages out in a queue. The practices that never lose a claim this way are the ones that gave the request an owner and a date.
How many record requests are sitting unanswered in your practice right now?
The MedFactor team works payer record requests inside the denial queue, from the date on the letter through the appeal if the claim denies anyway. We will review a month of your requests against your claims and show you which ones are running out of time.
Request a free records workflow auditThis article is general information about payer record requests and claim timelines, not legal advice, and the deadline on your own request letter or provider contract controls.
