The Quiet Audit: What a Behavioral Health Payer Actually Looks At When They Pull Your Records

This is a working clinician's guide to what a behavioral health payer or state auditor actually looks at, written from the perspective of the small practice that does not have a dedicated compliance officer. The same logic applies to a solo LPC, a 4-clinician group, or a 30-bed residential program — the standards differ in scope, not in nature.

What an audit is — and isn't

In 2026, the most common audit types Oregon practices face are:

• Payer record reviews. A commercial insurer or Medicare Advantage plan requests 10–25 charts to verify medical necessity, documentation adequacy, and billing accuracy. Most are routine. A subset are targeted because something in your billing pattern flagged.
• OHA program audits. The Oregon Health Authority site-visits licensed programs every 12–24 months and may pull records as part of corrective action follow-up. These are licensure audits, not billing audits — but the documentation requirements substantially overlap.
• RAC and Medicare/OHP recovery audits. Recovery Audit Contractors and CCO-led recovery audits target overpayment recoupment. These have the highest financial stakes and the narrowest documentation tolerance.
• Internal quality audits. The audits you should be running on yourself, every quarter, sampling 10% of charts against your own standard.

The single most important thing to internalize: auditors are reading for what is absent, not what is present. A 90-minute progress note with rich clinical narrative will fail an audit if it does not contain the eight to ten specific data points the auditor was instructed to find. A two-paragraph SOAP note that hits every required element will pass.

The seven documentation patterns that decide audit outcomes

1. Medical necessity, every session

Every billed encounter needs documentation answering: why does this client meet criteria for the diagnosis being billed, why is this level of care appropriate today, and what is the active treatment goal being worked. Auditors do not infer medical necessity from a generic problem list. They look for a sentence — sometimes literally one sentence — that ties today's intervention to today's symptom presentation.

The fail pattern: copy-pasted "client continues to work on managing depression and anxiety" sessions, three months in a row, with no symptom severity, functional impact, or progress reference. Three of those in a 15-chart pull is almost always a recoupment event.

2. Time documentation that supports the CPT code

CPT 90834 (38–52 minutes), 90837 (53+ minutes), and 90847 (family/couples therapy) each have time floors that must be documented. "55-minute session" is not enough — most payers now expect start and end times. The current CMS guidance for time-based codes is explicit: the documented time must support the code billed.

The fail pattern: notes that say "1 hour" with no start/end, billed at 90837. Audited at 90834 rates, the recoupment per session ranges from $18–$45 depending on the contracted rate. Across two years of weekly sessions, that's $1,800–$4,500 per client.

3. Treatment plans current and signed

Treatment plans need to be current (typically reviewed every 90 days, formally updated every 6 months, signed by both clinician and client). An audit pull will check whether the dates of service fall within a valid, signed treatment plan window. If the treatment plan expired three months ago and was never updated, every session billed in that gap is at risk.

The fix is mechanical: a treatment plan review reminder in the EMR, triggered 14 days before expiration, with a hard block on session billing if the plan is more than 30 days expired. Most modern EMRs support this; few practices have it enabled.

4. Risk and safety assessment trail

Every initial evaluation needs a documented risk assessment. Subsequent sessions need a documented re-assessment when clinical indicators change — and a documented "no acute concerns this session" when they don't. Oregon-specific suicide assessment standards (SB 48 training and documentation) raise the bar further.

The fail pattern most auditors target: an intake that documents passive suicidal ideation, followed by 12 weekly sessions of "client doing better" with no re-assessment, no safety plan reference, and no documented reason the clinician concluded risk had resolved.

5. Coordination of care documentation

For clients on psychiatric medication, in active medical treatment, or with significant comorbidities, payers expect documentation of coordination — releases of information signed, communications with prescribers and PCPs noted, and rationale when coordination is not pursued. CCOs are particularly attentive here.

6. Authorization and benefits match billing

This is the most preventable category: claims billed past authorization end dates, claims billed at frequencies higher than auth allowed, or claims billed for services the auth did not cover. A clean front-end (verification of benefits, prior auth tracking, denial workflow) eliminates ~80% of this category before it reaches the back-end.

7. Supervision documentation for pre-licensed work

If any of the audited charts were authored by a pre-licensed associate, the audit will check supervision documentation: supervisor identity, supervision hour logs, signed supervision agreements, and supervisor credentialing with the payer (or appropriate "incident to" billing structure for Medicare). Gaps here can void entire blocks of billed services.

The recoupment math, conservatively

A small Oregon practice with $400,000 in annual commercial behavioral health revenue, audited on a routine 15-chart pull, can lose:

• $8,000–$15,000 in single-encounter recoupments
• $25,000–$75,000 if the audit extrapolates findings across a 12-month look-back
• $50,000+ in suspended payments while corrective action is pending

None of those numbers are theoretical. They are the routine outputs of routine audits applied to documentation that was good enough for clinical care but not built for review.

The four-piece compliance floor every practice should have

You do not need a full compliance program to clear audits. You need four things, maintained:

1. A documentation standard. One page. The specific data points every session note must contain, and the EMR template that enforces them. Reviewed annually.
2. A quarterly internal chart review. 10% of active charts pulled randomly, scored against your standard. Findings tracked. Recurring issues fed back into clinical training.
3. A renewal and credentialing calendar. Treated as operational infrastructure, not a clinician's nights-and-weekends task.
4. A response binder. When the audit email arrives, the practice knows in 10 minutes who is pulling the charts, who is reviewing them, who is responding, and where the templates and prior responses are stored.

This is the minimum. For practices running IOP, residential, SUD, or any program-licensed service line, the standard rises to a documented QAPI program with quarterly committee meetings, performance improvement projects, and corrective action tracking. Saint Health Group's compliance practice typically builds these layers in stages over 60–120 days, with a primary goal of getting the practice from "would fail a 15-chart pull" to "would pass without preparation" before formal accreditation work begins.

The clinician's read

If you are a solo or small-group practice clinician, the temptation is to read all of this and conclude that the work is too large to start. The reality is the opposite: an unprepared practice owes between 3 and 8 percent of revenue to documentation drift. The first quarter of cleanup typically returns more than its cost in reduced denials alone, well before any audit hits.

Start with chart sampling. Pull ten charts, score them honestly against the seven patterns above, and use the gaps to write your standard. That single afternoon, repeated quarterly, is the spine of every working behavioral health compliance program. Everything else extends it.

For Oregon-licensed clinicians evaluating the broader operational picture, the orcounselors match quiz brings new clients in while the back office is being built; the Saint Health Group partner profile outlines what a comprehensive compliance-and-risk engagement covers for practices ready to bring in outside structure.