What Insurance Auditors Look for in Therapy Notes

Understanding the Audit Process

Insurance audits are not random acts of bureaucratic cruelty. They are systematic reviews designed to verify that the services you billed were actually provided, were medically necessary, and were documented to the standards required by the payer. Understanding what auditors look for — and why — is the best defense against an adverse audit outcome.

There are three types of audits you may encounter:

Prepayment review: The insurer requires documentation before paying the claim. This is common when a provider has been flagged for unusual billing patterns or has previously failed an audit.

Post-payment audit (desk review): The insurer requests records after claims have been paid. A reviewer evaluates whether the documentation supports the services billed. If not, the insurer demands repayment (recoupment).

On-site audit: An auditor visits your practice to review records, billing practices, and compliance procedures. This is less common for solo practitioners but standard for group practices and agencies billing Medicaid.

What Triggers an Audit

Auditors are not reading your notes in real time. Audits are triggered by patterns in your claims data:

• Consistent use of the highest CPT code. If 90 percent of your sessions are billed as 90837 (53+ minutes), you are an outlier. Most therapists bill a mix of 90834 and 90837. Exclusively billing the higher code flags your claims for review.
• High session frequency without clinical justification. Seeing a client three times per week for an extended period without documented crisis or acute clinical need draws scrutiny.
• Long treatment duration without progress. Clients in treatment for two or more years without documented treatment plan updates, progress reviews, or outcome measurement.
• Billing multiple codes per session. Combining psychotherapy with E/M codes, add-on codes, or crisis codes at higher-than-expected rates.
• High no-show/cancellation billing. Billing for sessions that clients reportedly attended when the ratio of billed sessions to appointment slots seems implausible.
• Client complaints. A client who contacts their insurance company questioning a charge or reporting that services were not as described.

The 8 Things Auditors Evaluate

1. Medical Necessity

This is the central question of every audit: was the treatment medically necessary? Auditors evaluate this through documentation, not by second-guessing your clinical judgment. They look for:

• A diagnosed condition (ICD-10 code) supported by the clinical assessment
• Documented functional impairment that warrants treatment
• A treatment plan with goals that address the diagnosed condition
• Progress notes showing that each session's interventions target the treatment plan goals
• Evidence that the client is making progress — or a documented clinical rationale for why treatment should continue despite limited progress

If your notes do not connect the session to a diagnosis and treatment goal, the auditor cannot verify medical necessity regardless of how clinically appropriate the treatment was.

2. The Golden Thread

Auditors trace the logical connection from assessment to diagnosis to treatment plan to session notes. They ask:

• Does the diagnosis match the documented symptoms and impairment?
• Do the treatment plan goals address the diagnosed condition?
• Do the progress notes describe interventions that target the treatment plan goals?
• Is there documented progress toward measurable goals?

A broken golden thread is the most common finding in failed audits. See the full guide on the golden thread for detailed guidance.

3. CPT Code Accuracy

Auditors verify that the CPT code billed matches the service documented:

• 90791 (Diagnostic evaluation): Was a comprehensive diagnostic assessment documented?
• 90834 (Individual therapy, 38-52 min): Does the note document 38 to 52 minutes of face-to-face psychotherapy?
• 90837 (Individual therapy, 53+ min): Does the note document 53 or more minutes of face-to-face psychotherapy?
• 90847 (Family/couples therapy with client present): Does the note document family or couples intervention with the identified client present?
• 90846 (Family therapy without client present): Was the session conducted without the identified client?

The most common CPT-related audit finding: billing 90837 for sessions that ran 45 to 52 minutes. The fix is simple — document start and stop times, and bill the code that matches the actual session duration.

4. Session Duration and Timeliness

Auditors look for:

• Documented session duration matching the billed CPT code (start/stop time or total minutes)
• Date of service matching the billed date
• Timely completion — notes written within a reasonable period after the session (24 to 72 hours is the general standard)
• Signature and credentials of the treating clinician

5. Risk Assessment

Auditors look for documented risk assessment, particularly for clients with diagnoses associated with self-harm risk (Major Depressive Disorder, PTSD, Borderline Personality Disorder, Substance Use Disorders). A complete risk assessment includes documentation of: suicidal ideation (present or absent), intent, plan, access to means, risk factors, protective factors, and clinical determination of risk level.

6. Treatment Plan Currency

Auditors check whether the treatment plan has been reviewed and updated at regular intervals — typically every 90 days. Stale treatment plans that have not been updated in six months or more suggest either that treatment is drifting without clinical direction or that the clinician is not maintaining the record.

7. Client Participation

Documentation should reflect that the client is an active participant in treatment, not a passive recipient. Auditors look for evidence that:

• The client participated in treatment planning
• Treatment goals reflect the client's stated concerns
• The client's response to interventions is documented
• Homework, between-session activities, or the client's own efforts are noted

8. Consistency Across the Record

Auditors compare documents against each other. They flag:

• Diagnoses in progress notes that differ from the treatment plan
• Session content that has no relationship to treatment plan goals
• Identical or near-identical notes across multiple sessions (copy-paste documentation)
• Progress notes that describe improvement while the treatment plan shows no goals met

Audit-Ready vs. Audit-Risky Documentation

The following comparison illustrates the difference between documentation that would pass an audit and documentation that would draw scrutiny.

Your Audit-Proof Documentation Checklist

Use this checklist for every progress note:

• Date of service clearly documented
• Session duration documented (start/stop time or total minutes) matching the billed CPT code
• Diagnosis listed with ICD-10 code
• Treatment plan goal referenced by number or description
• Specific intervention described (not just "processed" or "discussed")
• Client response to the intervention documented (behavioral observations, self-report)
• Measurable progress indicator included (symptom measure score, behavioral frequency, functioning level)
• Risk assessment documented (at minimum: SI/HI denied, risk level assessed)
• Plan for next session with clinical rationale
• Medical necessity statement — why continued treatment is warranted
• Clinician signature with credentials and date signed
• Note completed within 24-72 hours of the session

No single missing element will necessarily fail an audit. But consistently missing three or more of these elements across multiple notes creates a pattern that auditors interpret as systemic documentation deficiency — and that is when recoupment demands follow.

Proactive Audit Preparation

Do not wait for an audit notification to evaluate your documentation. Conduct a self-audit every quarter:

1. Pull 5 to 10 records at random
2. Evaluate each note against the checklist above
3. Trace the golden thread from the most recent note back to the treatment plan and diagnosis
4. Verify that CPT codes match documented session durations
5. Check that treatment plans have been updated within the last 90 days

AI documentation tools can serve as a built-in compliance layer by structuring notes to include all required elements automatically. When you use a tool like myclinicalwriter.ai, the output is already organized to satisfy audit requirements — risk assessment, treatment goal linkage, intervention specificity, and measurable progress are built into the note structure. This does not replace your clinical judgment, but it ensures you do not accidentally omit the compliance elements that auditors evaluate.

The best time to prepare for an audit is before you know one is coming. Every note you write today is a note that could be reviewed two years from now.