10 Tips for Responding to a Records Request: Risk Adjustment Audits
By Barbara Griswold, LMFT (Updated October 17, 2023)
Many of us have practiced for decades without having a health plan ask that we send a copy of a client’s chart. But in the last few years, providers are having the new experience of receiving records requests from third party companies hired by health plans, including Blue Cross, HealthNet, MHN, Medicare, OPTUM/United, and Aetna.
You may have read my articles about 90837 CPT code provider profiles which sometimes included a threat of records review (if you missed those articles, click here). And there are many other reasons why your records might be requested by a health plan. However, this article focuses on requests are from third party companies including Inovalon, Ciox Health, Change Healthcare, Coativity, Datafied, Episource, Alliant and Reveleer. While these companies are hired by health plans to do a variety of projects, the latest project is carrying out “risk adjustment” audits under the Affordable Care Act (ACA).
What’s a risk adjustment audit? In a risk adjustment audit, information from health provider records is used by the plan to determine the severity of illnesses of plan members. After these assessments, health plans that have a greater number of “healthier” members are required to transfer funds to plans that have a greater number of “sicker” members. Think of this audit as a way for the health plan to get a snapshot of the health of their plan members so they can forecast future expenses for their members as a whole, and to recoup money from other health plans who may have spent less.
The good news for providers and clients? In my mind, these are the least threatening of all the types of records requests. Not a wink of sleep should be lost when thinking about them. Risk adjustment requests are not for the purpose of determining the medical necessity of treatment. The plan is not looking at whether or not to approve future sessions. They are not reviewing your care. It is not a documentation review aimed at critiquing the state of your notes (so don’t panic if you have lousy notes). It will not negatively affect the member’s coverage, premium, or your provider agreement. Best of all, the goal is not recouping money from the therapist or client. So while annoying, they shouldn’t be a cause for concern.
Note: While these requests may be intimidating, you may find the requesting agencies are quite disorganized. They may call for information (to verify your fax or address) several times, even if you already responded. They may call to say they never received records even when you already sent them. So just expect this.
So if you get a records request, what should you do? There is no correct answer here. But here are some tips when considering your response:
1) Confirm it is a Risk Adjustment Audit. Carefully search the letter you received for the words “risk adjustment.” It’s usually mentioned on the page from the health plan itself. If you don’t see this, the rest of the advice I give here may not apply.
2) Don’t panic about the deadline on the letter. Call the requesting agency and/or the health plan and ask for an extension, if you’d like more time. Most seem very willing to give more time.
3) Prepare to be shocked: Ask them what they REALLY need. In most cases, DESPITE WHAT IT SAYS ON THE REQUEST, you probably don’t need to send your notes at all! If you were to contact the requesting agency, chances are they would tell you a treatment summary would suffice. [One important exception to this may be Reveleer, who told one therapist they would not accept a treatment summary, but it’s still a good idea to call to be sure.] Remember to document your call, who you spoke to, and what they said. The summary generally should include a VERY BRIEF summary of client name, date of birth, diagnosis, dates of service during the time period on the request, general reason for treatment, basic description of client symptoms, treatment plan goals, session modality/frequency (average), length of sessions, progress, and prognosis. A few sentences for each of these areas is fine, and the treatment summary should be no more than one page. Better still, I have a sample Risk Adjustment Treatment summary you can purchase and use as a template to make it super-easy — it is available in my online store (click here).
4) Note carefully the time frame of sessions requested on the release. It is usually a one year time period. Any information you release should be restricted to service provided during that time period.
5) If you are a network provider, you shouldn’t need to notify your client, or get a client release. When your client started therapy with you, you likely had them sign a release authorizing the exchange of information with their health plan. And complying with administrative requests like these are part of what you agreed to when you joined the plan. Furthermore, HIPAA doesn’t require client notification. This might be a good time to beef up the release you have clients sign at the start of treatment.
6) If you are an out-of-network therapist, confirm with the requesting agency that the request was not sent to you in error. If you do release information, you will need to get a release from your client.
7) If you decide to talk to your client about it, explain the purpose of the records request to them in the most objective way possible. Document the conversation in their chart. If your client doesn’t want you to release records, you could inform the plan that you are reluctant or unwilling to go against your client’s wishes. However, I can tell you in the past I tried refusing, and I got a strongly worded letter from the health plan, reminding me complying was part of my contract.
8) The correspondence you receive may seem confusing, since it says not to release your psychotherapy notes. But remember, there are two types of notes — progress notes, which include session start and stop time, treatment type and frequency, diagnosis, treatment plan, symptoms, prognosis, and progress, and psychotherapy notes as defined by HIPAA (sometimes called process notes), which are optional to keep and may include your analysis, thoughts and feelings about the case. Psychotherapy notes are to be kept separately from the rest of the client chart, and are afforded greater privacy, so don’t release these.
9) Give the minimum information necessary to fulfill the request. Releasing more is a HIPAA Privacy violation.
10) No matter what you do, it’s probably a good idea to respond in some way to the request. They often keep calling if you don’t.
Do you cringe when you think of someone reading your notes? Vow to start keeping better records — now. Remember that well-written notes could serve as your best defense in a disciplinary or ethics complaint — or to help your client get much-needed treatment in treatment review. Check out my webinar “What Should be In Your Charts: Writing Great Progress Notes” (pre-recorded, so you can view at your leisure); visit www.theinsurancemaze.com/store for more information.