If you’ve been in practice long enough, you’ve probably heard the phrase “audit letter” and felt your stomach drop a little, even if you’ve never gotten one. Insurance audits aren’t rare anymore. Payers are pulling more behavioral health records than they used to, and multi-provider agencies are seeing them more often simply because they’re billing more claims across more clinicians. The good news: a payer audit is almost never about catching bad clinical work. It’s about whether your documentation can prove, on paper, that the work you did actually happened the way you billed it. That’s a solvable problem, and it starts long before the letter ever arrives.

This post walks through what triggers a therapy insurance audit, what auditors request and look for, the documentation mistakes that turn a routine review into a clawback, and how to build a note-taking process that holds up under scrutiny.

What Actually Triggers an Audit

Here’s the part that’s easy to get backwards: payers can’t see your notes before they decide to audit you. All they have going in is claims data, codes, units, frequency, billed amounts. Nobody at the payer has read a single progress note until an audit is already underway and records get requested. So whatever triggers the review has to be visible in the billing pattern itself, not in the clinical narrative behind it.

Most therapy audits start with a pattern in your billing data that looks different from everyone else’s. Payers and Medicare contractors run claims through analytics that flag statistical outliers, and the practices that get pulled for review are usually the ones whose numbers stand out from their peers on paper, before a reviewer ever opens a chart.

A few of the most common claims-level triggers for behavioral health practices:

• Heavy reliance on one code. Billing CPT 90837 (the 60-minute psychotherapy code) for nearly every session, regardless of what a session actually required, is one of the clearest patterns auditors watch for. A practice billing 90837 at 95%+ when the regional norm is closer to 60% stands out immediately in the data.
• Session frequency or duration outliers. Seeing a client more often, or for longer, than what’s typical for the diagnosis and level of care can flag a claim for review even before anyone looks at why.
• High per-provider or per-day volume. Claims analytics catch implausible patterns, like a single clinician billing more session-hours in a day than is realistically possible.
• Sudden volume spikes. A sharp jump in claims from a provider or practice, especially without a corresponding change in caseload size, tends to draw attention.
• Peer comparison outliers. Payers often benchmark a provider’s billing against others in the same specialty and region; falling well outside that range, in either direction, is a common trigger regardless of what’s actually happening clinically.
• Random and targeted sampling. Some audits aren’t pattern-driven at all, they’re routine post-payment reviews, credentialing-related pulls, or random samples that have nothing to do with your billing looking unusual.

None of this means something fraudulent happened. It just means the numbers pulled you into the pool of claims a payer decided to look at more closely. What happens next, whether that review turns into a clean pass or a clawback, comes down entirely to what’s actually written in the chart once they ask to see it. That’s where documentation quality takes over.

What Auditors Request

When an audit letter arrives, it typically asks for a defined window of records, sometimes a full year, occasionally longer. What gets requested is fairly consistent across payers:

• Diagnostic assessment (also called an intake summary or biopsychosocial assessment)
• Treatment plan, including the therapeutic goals the plan is meant to address
• Progress notes for each session in the requested window, showing what was addressed and any change in the client’s condition
• Supervision records, for associate-level or unlicensed staff billing under a supervisor

One protection worth knowing: under HIPAA, insurers are only entitled to the minimum information necessary to support the reason for the audit, and they don’t have a right to psychotherapy notes kept in a separate, personal record (the process notes many clinicians keep for their own use, distinct from the official clinical record). Knowing where that line sits matters both for compliance and for not handing over more than you’re required to.

What Auditors Are Actually Looking For

Once the records are in hand, reviewers are checking for a few specific things:

Medical necessity. Does the documentation show why this level and frequency of care was clinically warranted, not just that sessions occurred? CMS guidance on behavioral health services requires that psychotherapy be rendered by an appropriately licensed practitioner and supported by evidence that it was clinically indicated.

Session time documentation. This is where the 90837-heavy billing pattern that triggered the review in the first place either gets justified or falls apart. In a widely cited pandemic-era OIG review of psychotherapy claims, investigators found that for a large share of sampled sessions, clinicians hadn’t properly documented session start and end times or other required details. Without that documentation, a payer can downcode a 90837 to a 90834 and claw back the difference, even if the clinician genuinely spent the full hour. This is almost always a documentation gap, not a clinical one, and it’s entirely preventable.

Measurable goals and objective findings. Vague notes (“client processed feelings, session went well”) don’t hold up. Auditors are trained to look for the same elements physical therapy and ABA auditors check for: initial presentation, specific and measurable goals, objective clinical observations, and evidence of progress or lack of progress over time.

Alignment between the treatment plan and the notes. If the treatment plan says the client is working on panic-attack frequency, and six months of notes never mention panic symptoms, that’s a mismatch a reviewer will flag immediately.

Consistency of format. This isn’t about robotic sameness in wording (more on that in a second) — it’s about every note reliably including the elements a payer expects: date, time in/time out, intervention type, clinical content specific to that session, and a plan for the next session. Consistent structure is what actually makes documentation defensible, and it’s also what makes it fast for a reviewer to confirm compliance rather than dig for it.

The Documentation Mistake That Sinks the Most Audits Once They’re Underway: Cloned Notes

Cloned notes don’t get anyone audited. Nobody sees them until records are already requested. But once a reviewer is actually reading the chart, cloned documentation, notes that read identically or near-identically from session to session, or boilerplate language reused across different clients, is one of the most consistently flagged issues that turns a routine review into a clawback. It doesn’t matter whether the clinical work was legitimate. To a reviewer, a note that could have been written about any client on any date is a note that doesn’t prove anything happened on that specific date, and that’s exactly what medical necessity review is designed to catch.

The OIG has been explicit about this going back over a decade: copy-paste documentation, even when well-intentioned, damages the integrity of the record and creates real reimbursement exposure because it lacks the patient-specific detail needed to support medical necessity. More recent state Medicaid audits have traced tens of millions of dollars in improper payments directly back to documentation failures like this: missing session details, generic language, and cloned entries that didn’t connect to the client’s actual authorized services.

This is exactly where the growing use of AI-generated therapy notes creates a problem many practices haven’t fully reckoned with. AI note generators work by pattern-matching language from a session or a prompt into a plausible-sounding clinical note, and plausible-sounding is not the same as individualized. When an AI tool is generating notes at scale across a caseload, the underlying language patterns tend to converge, producing exactly the kind of generic, repetitive phrasing that auditors are trained to flag as a cloning red flag. Layer on top of that the HIPAA exposure of running protected health information through a third-party AI model, and you have two compounding risks stacking on top of each other in the same document: an audit clawback risk and a HIPAA breach risk, both traceable to the same shortcut.

Documentation software that’s built on structured, conditional logic rather than generative AI avoids this failure mode by design. It standardizes the format every note follows, so nothing required gets missed, without generating the clinical content on the clinician’s behalf. The note still has to reflect what actually happened in that specific session, because a person is still the one writing it. That distinction, standardized structure versus generated language, is the difference between documentation that holds up in an audit and documentation that becomes the audit’s first exhibit.

A Practical Pre-Audit Checklist

Whether or not a letter has ever landed in your inbox, these are the habits that keep a practice audit-ready year-round:

1. Record session duration every session note. This single habit closes one of the most common audit gaps.
2. Tie every note back to a goal in the treatment plan. If a note doesn’t connect to something on the plan, either the note or the plan needs updating.
3. Avoid reusing sentences or paragraphs across clients or sessions. If you catch yourself pasting last week’s note as a starting point, that’s the moment to stop and write fresh. Even small changes in those paragraphs make a big difference.
4. Review your own coding patterns periodically. If 90837 is nearly 100% of your billed codes, know why, and be ready to justify it.
5. Keep psychotherapy notes and the official clinical record separate, and know what you are and aren’t obligated to disclose under HIPAA’s minimum-necessary standard.
6. Standardize your note template, so every note reliably includes identifying information, date of service, diagnosis, intervention, and a forward-looking plan, without depending on any one clinician’s memory to include everything.
7. Self-audit a sample of your own charts the way a payer would, ideally on a recurring schedule rather than only after a scare.

Building the Habit, Not Just Passing the Test

The practices that come through an insurance audit cleanly are almost never the ones scrambling to reconstruct documentation after the letter arrives. They’re the ones where consistent, individualized, standards-based documentation was already the default, because the system they use makes that the path of least resistance rather than an extra step.

That’s the problem NoteNest was built to solve. It’s a behavioral health documentation platform built on structured conditional logic, not AI, so every note follows a consistent, audit-ready format while staying genuinely clinician-authored and session-specific. For group practices managing documentation across a dozen or more providers, that consistency isn’t just a compliance nice-to-have, it’s what turns “we hope our notes hold up” into “we know they will.”

If your agency is thinking through how to tighten up documentation before it becomes an audit problem, NoteNest is worth a look.