The discovery began with a staircase, not a golden mask. On November 4, 1922, Howard Carter’s excavation team uncovered the first step leading toward what became the tomb of Tutankhamun. The sealed doorway appeared afterward; Carter’s first glimpse of the treasures inside did not come until November 26. The University of Oxford’s Griffith Institute archive preserves that chronology through Carter’s contemporary records. It is a useful reminder that evidence often becomes comprehensible only after painstaking reconstruction of its source, date, and relationships.
A modern Medicare review can feel much the same. The billed claim is visible, but the support may be scattered across an old electronic health record, a hospital portal, an outside laboratory, a physician’s paper file, and a vendor that no longer answers emails. The clinical service may have been rendered. Whether a provider can prove that the service met the applicable coverage and documentation requirements is a separate matter. In many audits, reconstruction—not abstract argument—is the decisive work.
The claim is an index, not the underlying evidence
A claim line usually identifies a service, a date, a diagnosis, a billing entity, and a provider. It does not establish every necessary fact about medical necessity, clinical supervision, physician certification, time, or proof of delivery. The CMS Additional Documentation Request overview explains why contractors seek supporting records: to determine whether billed items and services satisfy applicable coverage, coding, payment, and billing requirements. MACs, UPICs, RACs, SMRCs, and other reviewers perform different functions within this architecture.
The provider’s first task should be to translate each requested claim into an evidence map. For a hospice stay, that may involve the election statement, initial and subsequent certifications, required encounters, assessments, care plans, nursing observations, visit schedules, and relevant orders. For a laboratory, it may involve a dated test order, medical-necessity support, specimen tracking, results, and evidence of the referring professional. For home health, it may include certification, the physician’s underlying records, homebound evidence where required, plans of care, and visit notes. The exact list depends on the benefit category and the service date.
Records should not be evaluated one document at a time. An order may establish who requested a service; a physician visit may explain why; a treatment note may establish what occurred; a laboratory accession record may connect a specimen to a specific patient and date. A technically complete packet that fails to demonstrate those connections is often weaker than a smaller, coherent submission.
Record retention is not governed by a single HIPAA rule
One of the most persistent healthcare-law myths is that HIPAA requires every provider to keep every medical record for six years. HHS expressly states that the HIPAA Privacy Rule itself does not impose a general medical-record retention period. State law and other federal program rules can determine how long patient records must be kept. HIPAA separately requires retention of certain HIPAA compliance documentation for six years, as reflected in 45 C.F.R. § 164.530(j).
Specific Medicare rules can impose different minimums. A hospice generally must keep patient clinical records six years after death or discharge, or longer if state law requires, under 42 C.F.R. § 418.104(d). A Medicare-certified home health agency generally must retain clinical records five years after discharge, unless a longer state rule applies, under 42 C.F.R. § 484.110(c). Hospitals are subject to a federal five-year minimum under 42 C.F.R. § 482.24(b)(1), again without negating longer applicable requirements.
There is also a seven-year documentation-and-access requirement in 42 C.F.R. § 424.516(f) for specified Medicare ordering, certifying, referring, prescribing, and furnishing activity. CMS’s Medical Record Maintenance & Access Requirements fact sheet stresses that an individual professional may remain responsible for furnishing records even when an employer or another entity operates the system where the records are stored. That obligation matters for locum tenens physicians, hospitalists, telehealth clinicians, and clinicians working with outside suppliers.
These provisions are not contradictory; they operate on different entities, documents, and triggering dates. A retention matrix should identify which rules attach to each record category, when the clock starts, whether a litigation hold applies, and which organization can actually retrieve the material. A simple label marked “six-year policy” is not a sufficient legal analysis.
The EHR migration problem
The day after a successful EHR conversion, management may focus on whether the front desk can schedule appointments and submit claims. The more consequential test may arrive years later, when a UPIC asks for a physician order or a hospice recertification from the retired system. An archive that saves PDF renderings but loses signature history, original timestamps, document relationships, scanned attachments, or audit logs may compromise a defense.
A healthcare organization changing EHRs should conduct a record-access test before terminating the old vendor. Select representative files from high-risk services, reconstruct the patient record, and verify that exported artifacts preserve authentication data and meaningful clinical context. Confirm whether reports remain searchable by patient and service date. Confirm that original signed documentation is distinguishable from a later correction. The organization should document the test rather than rely on the vendor’s statement that the migration is “complete.”
Contract terms matter here. Who owns the data? In what format must the vendor provide it at termination? Does access continue during a dispute? Is an export fee permitted? Will the vendor preserve audit logs and patient identifiers? Can clinicians retrieve records after leaving the practice? The CMS fact sheet on record access specifically recommends considering contract language that preserves an individual professional’s access to necessary Medicare documentation. Related technology-vendor questions are addressed in BOLO’s discussion of AI clinical scribes, patient records, and contract safeguards.
Late entries are not permission to manufacture history
Discovery of a missing note does not justify backdating a new one. Medicare reviewers may scrutinize amendments, corrections, delayed entries, and signatures. The Medicare Program Integrity Manual, Chapter 3, discusses documentation review standards and relevant record-authentication issues. An appropriate correction should preserve what was originally documented, identify the person and actual date of the change, and follow the applicable record and institutional policies.
A physician may be able to clarify a clinical fact using a properly dated addendum, but an addendum is not necessarily equivalent to contemporaneous evidence for every coverage requirement. Some programs require specified certifications or encounters at particular times. A record made after an audit begins cannot simply be represented as though it existed when the claim was filed. Counsel should also distinguish a legally protected internal quality review from the underlying facts and clinical records that must be produced.
Constructing the audit packet like an evidence file
For each sampled claim, build a chronology with a document index, record origin, clinical event, and legal issue supported. The legal team can then identify missing evidence, contradictory dates, unsigned entries, and documentation held by third parties. That method makes it easier to separate a true non-covered service from a correctable packaging problem and from a valid service whose original evidence cannot be located.
A strong submission avoids two extremes. It does not dump every page of an EHR into a contractor’s portal without explanation, and it does not over-curate records in a way that removes material context. Use accurate filenames, Bates or page references, consistent patient identifiers, and a claim-specific narrative where helpful. Respond within the actual request’s deadline; the right timing may differ by review type. CMS’s ADR guidance and the relevant contractor letter control more than an old office checklist.
When multiple claims share a defect, counsel should evaluate the population of potentially affected claims, not just the sample. That may raise a separate Medicare overpayment question under 42 C.F.R. § 401.305. Audit defense and voluntary refund review require coordination, but neither should be confused with the other.
Five questions for the next compliance meeting
Can the organization retrieve a complete claim-specific file from five years ago? Can it identify the responsible signatory and verify the signature process? Do written contracts guarantee access when the physician, practice, or vendor relationship ends? Does the archive preserve historical edits and timestamps? Finally, is there an enforceable litigation-hold or investigation-preservation process that overrides routine destruction when necessary?
An archaeological team protects an object’s location because its original context supplies meaning. Healthcare providers should treat clinical evidence similarly. A claim’s supporting record is not merely a stack of forms; it is a time-specific account of what happened and why Medicare could pay for it. The work of preserving that account begins before the audit letter arrives.
Primary sources and further reading
- Griffith Institute, University of Oxford — Tutankhamun first excavation season
- CMS — Additional Documentation Requests
- CMS — Medical Record Maintenance & Access Requirements
- HHS — HIPAA medical record retention FAQ
- 42 C.F.R. § 418.104 — Hospice Records
- 42 C.F.R. § 484.110 — Home Health Records
- 42 C.F.R. § 482.24 — Hospital Records
- 42 C.F.R. § 424.516 — Medicare Documentation and Access
- 42 C.F.R. § 401.305 — Medicare Overpayments