Responding to insurance audits of patient records when you are out-of-network

Psychologists will likely see patients who opt to use their out-of-network (OON) insurance benefits to pay for services, so it’s important to prepare for an audit request from the patient’s insurance company.

According to the 2019 Milliman Report, OON utilization was much higher for mental health services than for medical/surgical services. And relaxed telehealth policies during the pandemic have offered more access to OON providers. Since the auditing of patient records has been increasing for in-network providers, it’s no surprise that insurance companies are scrutinizing OON claims more frequently as well.

Even if you do not have a contract with your patient’s insurer or do not accept insurance at all, you could still receive a request from an OON patient’s insurance company to review their records. If the patient (or the psychologist on the patient’s behalf) submits a claim to the insurance company, then the company may verify that the services are being provided and that they are medically necessary.

While you may not have a contract with the insurer, your patient does. Denying access to records may have serious ramifications for both your patient and you, so it’s important for you and your patient to understand potential consequences. When navigating these sometimes-thorny situations, APA recommend that you:

Your informed consent form should have language that allows you to provide information to insurance companies when requested. You should tell your patients that by using their OON (or in-network) benefits, they may be required to provide access to information in the records to support the claim or otherwise respond to reasonable insurer requests. Failure to comply with insurance company audit requests may result in the patient and/or you having the claim denied, future reimbursement being denied, and demands for repayment of claims already paid by the insurer.

There may be times when patients object to you responding to an audit. This is why this issue should be thoroughly discussed during the informed consent process. If they refuse at the beginning, you may want to refer them to another provider. Or you can discuss the level of detail to record and/or keep psychotherapy notes, which may alleviate their concerns about overly sensitive information being shared with insurers. Another option would be to suggest that the patient self-pay and not submit claims for reimbursement.

Familiarize yourself with the policies of the patient’s insurance company (especially if you see several patients with the same insurer) as the company/auditor may determine medical necessity through the lens of the insurer’s documentation standards. They typically require documentation to support medical necessity, such as:

• patient name and date of birth
• dates of service
• start and stop times for face-to-face interaction (for therapy)
• diagnosis, symptoms, and status
• treatment plan
• goals and response to treatment

Policies may be accessible through the insurance company’s website.

Under HIPAA, insurance companies are only entitled to the minimum necessary information to support the reason for the audit. Insurers don’t have the right to psychotherapy notes (that are kept in a separate record). You may also want to adjust your record keeping practice in anticipation of a future request. (Read Detailed or lean therapy notes? for guidance.)

Insurance companies may contact you under the Risk Adjustment Audit process. They may want to conduct a review for medical necessity or proper coding. An inquiry into issues of fraud, waste, and abuse is often signaled by an audit letter from the company’s Special Investigations Unit (SIU). But recently, some companies have sent more mundane audit requests, like medical necessity audits, from the SIU department. If the nature of the request is not clear in the letter, contact the company for guidance. (APA members can contact Legal and State Advocacy if they can’t get a clear answer from the company.)

A patient may have a change of heart after you have already been paid and direct you to refuse to provide records to the insurance company, even after you have reminded them of the potential consequences. In that scenario, APA recommends that you honor the patient’s request, or contact your malpractice carrier for a consultation. APA members can reach out to APA’s Legal and State Advocacy team for additional assistance.