How to Document Therapy for Insurance Audits

What Is an Insurance Audit?

An insurance audit is a retrospective review of your clinical documentation and billing records by an insurance company, government payer, or their contracted audit firm. The purpose is to verify that the services you billed for were actually provided, were medically necessary, were documented appropriately, and were billed using the correct CPT and ICD-10 codes.

Unlike utilization review, which happens during treatment to evaluate whether ongoing services should be authorized, an audit looks backward at services already delivered and claims already paid. The auditor's question is straightforward: does the documentation in the clinical record support the claims that were submitted and paid?

Insurance audits in mental health have increased significantly over the past decade. Several factors drive this trend: rising mental health service utilization, the growth of telehealth (which introduced new billing patterns and compliance considerations), increased scrutiny of high-cost claims, and parity enforcement reviews. For mental health professionals in private practice, an audit is not a matter of if but when.

The consequences of audit findings range from repayment of specific claims to recoupment of large sums, corrective action plans, network termination, referral to licensing boards, and in cases of fraud, criminal prosecution. The best protection is not audit preparation — it is documentation practices that produce audit-ready records as a matter of routine.

When You Need It

Audit-ready documentation is not something you create when an audit is announced. It is a daily practice standard. However, there are specific situations where audit awareness is particularly important:

• When you receive an audit notification letter — Insurers provide written notice identifying the records they want to review, typically giving you 30-45 days to compile and submit them
• When your billing patterns differ from your peers — If you bill 90837 for 85% of sessions while the national average is 40%, expect scrutiny
• When you treat clients for extended periods — Long-term treatment (52+ sessions) is more likely to be reviewed than short-term treatment
• When you bill higher-reimbursement codes frequently — High rates of 90837, crisis codes (90839/90840), or testing codes attract attention
• When joining or credentialing with a new insurance panel — Some insurers conduct pre-participation record reviews
• When you receive a recoupment notice — If an insurer claws back payments, review your documentation practices immediately
• As a routine practice standard — Every note you write should be written as if it will be read by an auditor, because eventually one might be

Key Components

The Golden Thread

The golden thread is the single most important concept in audit-proof mental health documentation. It refers to the logical, traceable connection that runs from the client's presenting problem and diagnosis through the treatment plan to each progress note and ultimately to the discharge summary. Every element of the clinical record should connect to every other element in a coherent clinical narrative.

Here is what the golden thread looks like in practice:

• The intake assessment identifies the client's presenting problems, symptoms, and functional impairments, and results in a clinical diagnosis (ICD-10 code)
• The treatment plan lists goals and objectives that directly address the symptoms and impairments identified in the assessment, using interventions appropriate for the diagnosis
• Each progress note documents interventions from the treatment plan that were delivered in the session, the client's response, and progress toward treatment plan goals
• The CPT code billed matches the service described in the progress note
• The ICD-10 code on the claim matches the diagnosis in the treatment plan and is supported by the assessment findings

When an auditor reads your records, they should be able to follow this thread from assessment to treatment plan to progress notes without any gaps or contradictions. If the treatment plan targets panic attacks but the progress notes describe processing childhood memories with no reference to panic, the thread is broken. If the ICD-10 code is F33.1 (Major depressive disorder) but the progress notes describe no depressive symptoms, the thread is broken.

Documentation Timing

Auditors check when notes were written relative to the date of service. Best practice is to complete notes within 24 hours of the session. Notes written days or weeks later are less reliable as clinical records and raise questions about accuracy. Most EHR systems timestamp note creation and signing, and auditors can access this information.

Session Time Documentation

For time-based CPT codes, your note must document the actual time spent on psychotherapy. This can be stated directly ("45 minutes of individual psychotherapy were provided") or calculated from documented start and end times. If you bill 90837 (53+ minutes), the note must support a psychotherapy duration of at least 53 minutes.

Medical Necessity

Every session note must demonstrate why the service was medically necessary on that specific date. This means documenting current symptoms, functional impairment, and the clinical rationale for the intervention provided. A note that reads "Client discussed their week; processed feelings about work stress" does not establish medical necessity. A note that reads "Client reported increased frequency of panic attacks (4 this week vs. 2 last week), with new avoidance of grocery stores. Session focused on interoceptive exposure to physical sensations of panic per treatment plan goal 2" does.

Signature and Credentials

Every clinical document must be signed with your full name and credentials. Electronic signatures are acceptable but must be compliant with your state's laws and your EHR's authentication protocols. Unsigned notes are treated as if they do not exist for audit purposes.

How to Document for Insurance Audits Step by Step

Step 1: Build the Golden Thread from Day One

Start every client relationship with a thorough intake assessment that clearly identifies presenting problems, symptoms, functional impairments, and a supported diagnosis. Create a treatment plan within the first 1-3 sessions that directly addresses the assessment findings. From that point forward, every progress note should reference the treatment plan and document progress toward its goals.

Step 2: Write Notes That Demonstrate Medical Necessity

Each progress note should answer three questions: (1) What symptoms or functional impairments did the client present with today? (2) What clinical interventions did you deliver to address them? (3) How did the client respond, and what is the plan going forward? Notes that answer these three questions demonstrate medical necessity on every date of service.

Step 3: Document Time Accurately

Record the actual start time, end time, and psychotherapy duration for every session. If a 50-minute appointment slot included 5 minutes of non-therapy activity (scheduling, paperwork, brief check-in), your psychotherapy time is 45 minutes and the appropriate code is 90834. Auditors look for patterns — if every session is documented at exactly 53 minutes (the minimum for 90837), they will scrutinize your records closely.

Step 4: Individualize Every Note

Copy-paste notes are one of the most common audit red flags. If five consecutive notes contain identical language, the auditor will question whether the notes reflect actual session content or are templates filled in without clinical thought. Each note should reflect what specifically happened in that session — the particular thoughts, behaviors, or concerns addressed, the specific interventions used, and the unique client responses observed.

Step 5: Update the Treatment Plan Regularly

Treatment plans should be reviewed and updated at least every 90 days (or more frequently if required by the insurer). Updates should reflect changes in diagnosis, achieved goals, new goals, modified interventions, and revised timelines. A treatment plan that has not been updated in 8 months while the client has been seen weekly suggests that treatment may not be goal-directed.

Step 6: Use Standardized Outcome Measures

Administer and document standardized measures (PHQ-9, GAD-7, PCL-5, ORS) at regular intervals. These provide objective evidence of symptom severity and treatment response. Auditors view outcome measurement as an indicator of quality clinical practice. The absence of any objective measurement over a long course of treatment weakens your case for medical necessity.

Step 7: Conduct and Document Risk Assessments

Document risk assessments at intake, at regular intervals during treatment, whenever the client reports suicidal ideation or self-harm, and whenever clinical circumstances change. Risk assessment documentation demonstrates clinical diligence and justifies the level of care provided.

Step 8: Maintain a Consistent Fee Schedule

Keep a written fee schedule that documents your standard rates for each CPT code. If you offer sliding scale fees, maintain a written sliding scale policy. Auditors compare the fees on your claims to your fee schedule — inconsistencies without a documented policy can be interpreted as billing irregularities.

Common Mistakes

Writing vague, non-specific progress notes. "Client discussed relationship issues. Provided supportive interventions. Client appeared to benefit from session." This note would fail an audit. It does not describe what was discussed, what interventions were provided, what the client's response was, or how the session relates to treatment plan goals. It does not establish medical necessity, and it does not justify the CPT code billed.

Billing 90837 when documentation does not support it. This is the number one audit finding in mental health. If you consistently bill 90837 (53+ minutes), every note must document a psychotherapy duration of at least 53 minutes. If your documentation shows 45-50 minute sessions but you billed 90837, the auditor will require you to refund the difference between 90837 and 90834 reimbursement for every affected session. Over dozens or hundreds of sessions, this can amount to thousands of dollars.

Copy-paste notes with no individualization. If your Tuesday 10:00 AM client's note looks identical to your Tuesday 11:00 AM client's note, the auditor will flag both. Notes must reflect the unique content of each session. Using a structured template is fine — using identical content is not.

No treatment plan or an outdated treatment plan. A treatment plan is required by virtually every insurance company. If there is no treatment plan in the chart, the auditor will question the medical necessity of every session. If the treatment plan was created at intake and never updated despite 40 sessions of treatment, it demonstrates a lack of clinical planning.

Missing notes for billed dates of service. If your billing records show that you billed for a session on February 12 but there is no progress note dated February 12, the claim is unsupported and subject to recoupment. Every billed date must have a corresponding signed clinical note.

Altering notes after receiving an audit notification. This cannot be emphasized enough: do not modify clinical notes after receiving an audit notice. EHR systems log every edit with timestamps. Altering notes after an audit begins transforms a documentation deficiency (a billing issue) into evidence of fraud (a criminal issue). If you realize a note is incomplete, add a clearly labeled addendum dated with the current date.

Not tracking your own billing patterns. Run reports on your own billing data regularly. What percentage of your sessions are billed as 90837 vs. 90834? How many clients have been in treatment for over a year? Do you bill crisis codes? How does your pattern compare to national benchmarks? Self-auditing allows you to identify and correct issues before an external auditor does.

Failing to respond to audit requests within the specified timeframe. If an insurer requests records and you miss the deadline, they may deny all claims under review and begin recoupment automatically. Treat audit notification letters as urgent — block time in your schedule to compile records, make copies, and submit them before the deadline. If you need an extension, request it in writing immediately.