Prepayment Review in Behavioral Health: How Medicaid and Commercial Payers Run It, and How to Get Off It

Prepayment review means a payer holds each of your claims until a reviewer has read the medical records behind it. Medicare runs it through its contractors, often as Targeted Probe and Educate (TPE), and state Medicaid agencies, Medicaid managed care plans and commercial insurers run their own versions. To get off it, you hit the payer's accuracy target for a set period, usually three consecutive months in the programs that publish one, while keeping claim volume close to normal.

This guide covers who runs prepayment review and what triggers it. It then lays out records deadlines and exit rules by program, the cash impact, a week-by-week plan to pass, and the escalation if accuracy stays low. For the wider map of audit programs, see our guide to Medicare and Medicaid audits in behavioral health. It is general information, not legal advice.

What prepayment review is, and why it hurts more than an audit

In a post-payment audit, you've already been paid and the payer comes back later. In prepayment review, the money stays with the payer until the record satisfies a reviewer. Each claim goes in with records attached or triggers a records request, and the reviewer pays it, pays part of it or denies it.

Missing records mean a denied claim. Under Medicare, a claim with no response to the records request is denied as CO-50 with remark code M127, "Missing patient medical record for this service" (Medicare Program Integrity Manual, or PIM, Chapter 3, §3.2.3.8). It's the same CARC our CO-50 denial guide covers, arriving for a paperwork reason rather than a clinical one.

Payers describe the program mildly. Indiana Medicaid calls it an educational tool and says placement is not a sanction. That's accurate in a legal sense. In practice, every documentation gap becomes a denied claim the day it's found, and every denial counts against the score that decides when you get out.

Who runs prepayment review

Medicare: TPE, MAC edits and UPICs

Start with TPE. Under PIM §3.2.5, a MAC picks providers through data analysis, reviews a probe of typically 20 to 40 claims for one service, and offers one-on-one education at the end of the round. It then waits at least 45 days before pulling new claims. CMS also runs a Low Biller version with fewer than 20 claims a round.

Meet the MAC's error rate goal and you're released for one year, though the MAC can look again sooner if your billing changes. The PIM leaves the goal to each MAC, so read your results letter for yours. If error rates stay high after three rounds, the MAC refers you to CMS, which can order more rounds, 100% prepayment review, extrapolation, a Recovery Auditor referral or referral for revocation.

MACs can also place edits outside TPE, but only when there is a likelihood of a sustained or high level of improper payment. The PIM reserves 100% prepayment review for a prolonged period of non-compliance, and the MAC must tell CMS in advance how long it will last and what the removal criteria are.

UPICs work the fraud, waste and abuse side. They use limited prepayment reviews to test a lead and give you only 30 days to answer. A 100% review needs CMS approval. Our UPIC audit response guide covers that track.

State Medicaid programs: three written rules

Federal rules require every state to run basic prepayment checks on all claims, such as eligibility, duplicates and rate limits (42 CFR 447.45(f)). Records-based prepayment review is a separate program integrity tool, and each state writes its own rules. They differ a lot.

• North Carolina, G.S. 108C-7. Grounds include credible allegations of fraud, aberrant billing found through investigation or data analysis, and failure to answer a records request on time. The notice must state the reason, the claims under review, the documents required and the standard for removal. Clean claims must be processed within 20 calendar days of documentation reaching the review vendor. For prior-authorized services, the review can't question the medical necessity of what was approved.
• Indiana, 405 IAC 1-1.4-7. Per provider bulletin BT202360 (June 2023), review runs six months and every claim must carry its documentation. Placement can't be appealed, but denied claims can.
• Florida, Fla. Stat. 409.913(3). The agency may run prepayment review for up to one year without any suspicion of fraud, abuse or neglect. Claims must be decided within 90 days of complete documentation, or 180 days when the agency has reliable evidence of fraud.

Medicaid managed care plans

MCOs run their own reviews. Each plan's state contract must provide for suspending payments to a network provider when the state finds a credible allegation of fraud (42 CFR 438.608(a)(8)). North Carolina lets its plans start prepayment review without state approval if they send the state a copy of the notice. CareSource's Ohio Medicaid policy, effective July 1, 2026, shows one design: selected claims are "soft denied" with remark code M127, and uploading the records releases them for review.

Commercial plans

Commercial insurers rely on plan policy and the audit clauses in your provider agreement. CareSource's Marketplace policy (effective June 1, 2026) allows immediate placement in state-directed or suspected-fraud cases, with notice afterward. It denies a claim if the record fails minimum standards, such as the member's name and date of service on each page and a valid provider signature. Read your contract's audit, records and recoupment sections the day the letter arrives.

What puts a provider on prepayment review

For Medicare, placement starts with data analysis. The PIM lets MACs target services for high volume, high cost, a dramatic change in frequency of use, high-risk problem areas, or findings from RAC, CERT, OIG or GAO reviews. For TPE, MACs look for high claim error rates or billing that differs from peers.

• Billing spikes. A new site, a new level of care or a jump in units per patient can look like the dramatic change the PIM describes.
• Outlier codes and units. Long psychotherapy codes on most visits, high daily units of 15-minute H codes, or PHP and IOP days well above peers.
• Prior findings. High denial rates, a failed TPE round, or a referral from a RAC, CERT, UPIC or OIG.
• Unanswered records requests. North Carolina names this as a ground on its own, and TPE letters warn that non-response can lead to a RAC or UPIC referral.
• Complaints. Beneficiary complaints and law enforcement leads feed UPIC work, per PIM Chapter 4.

Records deadlines and exit criteria by program

Two details catch providers. First, volume. North Carolina scores a month with no claims as 0% and bars providers from holding claims back, and Indiana and CareSource compare volume with the months before placement. Second, the score counts every denial. Indiana's formula includes system denials, so an eligibility or authorization error costs you as much as a weak note.

What prepayment review does to cash

The cost comes in three layers: slower payment, more denials and staff time. The numbers below are hypothetical, chosen to show the math, not a benchmark.

In this example, about $233,000 of working capital is tied up for as long as the review lasts, before counting a single denial. Some denials come back through reopening or appeal, slowly. And 75% accuracy fails both the North Carolina and Indiana tests, so the review runs longer and the cost repeats. Our guide to days in AR for behavioral health shows how a hold like this moves your aging buckets.

The response playbook: a week-by-week plan

Week 1: read the notice and set up

• Log the date received, the program, the codes or claim types under review, the start date and the exit standard.
• Name one owner. Billing, clinical leadership and compliance report to that person on this project.
• Confirm the submission channel. For Medicare that may be esMD or the MAC portal. A UPIC may use Kiteworks, with mail as the fallback.
• Tell billing not to hold claims back. Volume tests punish it, and North Carolina prohibits it.
• Flag claims with prior authorization. In North Carolina, that limits the medical necessity review.

Week 2: build the packet and the quality check

• Write a packet checklist for each service: assessment, treatment plan in effect on the date of service, the signed note with start and stop times, PHP or IOP certification, attendance or group logs, the authorization record, and a signature log if any signature is illegible.
• Put the patient's name and date of service on every page.
• Add a second-person check before anything goes out. Score each packet as supported, supported with explanation, or not supported.
• Run the claims already in the queue through the check first.

Weeks 3 to 6: submit, track and cure

• Track every claim: date billed, records sent, decision date, outcome and denial reason. Count accuracy weekly with the payer's formula.
• Answer deficiency notices the same week. North Carolina must send one within 15 days after the documentation due date.
• If Medicare denies a claim because records arrived late, send them anyway. A MAC may reopen when records arrive within about 15 calendar days of the denial (PIM §3.2.3.9).
• Expect calls during a TPE probe. MACs are told to let you cure easy errors, such as a missing signature fixed with an attestation.

After each round or month: education and root causes

• Take the education session. Bring the denial list and ask for the rule behind each error. Get the error categories in writing.
• Give every error a root cause and a fix at the source: a template field, a signature workflow, a time-documentation habit or a plan update schedule.
• Retrain the clinicians whose notes failed, using their own examples.
• When you meet the exit test, ask for release in writing and keep monitoring. TPE follow-up can come within a year.

Appeals, and what happens if accuracy stays low

Appeal the denials that are wrong. Under Medicare, each denied claim can go to redetermination within 120 days. It matters beyond the dollars, because a TPE referral to CMS includes the results of appealed denials, to the extent they're available. In Medicaid, the placement itself usually can't be challenged: North Carolina says it is not a contested case, and Indiana says it is not appealable. Claim denials still follow normal appeal rules.

If accuracy stays low, expect escalation. The paths are written down.

• Medicare. More TPE rounds, 100% prepayment review, extrapolation, a Recovery Auditor referral, or revocation for a pattern or practice of non-compliant claims under 42 CFR 424.535(a)(8)(ii). PIM Chapter 4 lists providers on prepayment review for more than six months who haven't corrected their pattern after warning letters as an example of a case suitable for exclusion.
• Medicare payment suspension. Generally limited to 180 days, with a one-time extension of up to 180 more (42 CFR 405.372).
• Medicaid payment suspension. Under 42 CFR 455.23, a state must suspend payments once it finds a credible allegation of fraud, unless it finds good cause not to. It can act without advance notice, must send notice within five days (up to 90 if law enforcement asks for a delay), and must refer the case to the Medicaid Fraud Control Unit.
• Termination. North Carolina can terminate a participation agreement after six months below 80%, and its plans can drop the provider from their networks with state approval. Indiana and CareSource allow termination after 12 months.

How to stay off prepayment review

The cheapest prepayment review is the one that never starts. I'd focus on four habits.

• Review documentation before billing, on every claim. A sample tells you the error rate. A full sweep fixes the claims. Our post on full chart sweeps versus sampling explains the difference.
• Watch your own data before the payer does. Before you open a site or add a level of care, model how units per patient and code mix will shift. Medicare PHPs can download their PEPPER report, which compares their billing patterns with state and national peers, from the PEPPER Portal.
• Answer every records request on time, even when you think the payer is wrong. Late answers are denials and, in some states, grounds for review.
• Close the loop on denials. A cluster of CO-50 denials with M127, or of medical necessity denials on one service, is the same signal a MAC's data analysis finds. The standards are in our medical necessity documentation guide.

How Adentris helps

Prepayment review rewards programs whose records already hold up. Adentris reviews every active chart, not a sample, against payer and regulatory rules before claims go out, including medical necessity, ASAM level of care, 42 CFR Part 2, Medicaid and payer documentation rules, and treatment plan and signature timing. Each finding cites the rule that fired and comes with a drafted correction for staff to approve, so the gaps that fail a probe get fixed before a payer sees them.

Our payer audit readiness service adds a mock audit, chart defensibility scoring, extrapolation exposure and an ADR playbook. Adentris runs on top of any EHR, usually with no IT project on your side. To see it on your own charts, book a 30-minute call with our team.

Related reading

• Medicare and Medicaid Audits in Behavioral Health: RAC, UPIC, TPE, SMRC and MFCU Explained
• UPIC Audit Response for Behavioral Health and SUD Providers: The First 30 Days
• CO-50 Denials in Behavioral Health: Why Medical Necessity Gets Denied and How to Appeal (Template Included)

Sources

• CMS, Medicare Program Integrity Manual, Chapter 3 (Rev. 13821, June 2026)
• CMS, Medicare Program Integrity Manual, Chapter 4 (Rev. 13879, July 2026)
• CMS, Targeted Probe and Educate
• eCFR: 42 CFR 405.929, 405.930, 405.372, 424.535
• eCFR, 42 CFR 455.23 (Medicaid payment suspension)
• eCFR: 42 CFR 438.608 and 447.45
• North Carolina General Statutes, G.S. 108C-7
• Indiana Health Coverage Programs, Bulletin BT202360 (June 2023)
• Florida Statutes 2026, section 409.913
• CareSource, Provider Prepayment Review, Ohio Medicaid (July 2026)
• CareSource, Provider Prepayment Review, Marketplace (June 2026)
• Noridian, PEPPER for Partial Hospitalization Programs

Frequently asked questions

What is prepayment review?

It is a payer program that holds a provider's claims until a reviewer has read the supporting medical records. Each claim is paid, partly paid or denied after review, and claims without records by the deadline are denied. Medicare, state Medicaid agencies, Medicaid managed care plans and commercial insurers all run versions of it.

How do I get off prepayment review?

Meet the payer's exit test. Where it is written down, it is usually an accuracy rate held for three consecutive months with normal claim volume, such as 80% clean claims in North Carolina or an 85% approval rate in Indiana. Medicare TPE releases you for a year once you meet the MAC's error rate goal after any round.

How many claims does a TPE audit review?

A TPE round typically reviews 20 to 40 claims per provider, per service, followed by a one-on-one education session. The process repeats for up to three rounds, with at least 45 days between the education session and the next round. CMS's Low Biller program reviews fewer than 20 claims per round.

How long do I have to send records during Medicare prepayment review?

45 calendar days for a MAC, RAC or SMRC request, and 30 days for a UPIC. Contractors may accept late records for good cause, but otherwise the claim is denied. For prepayment review, a MAC must decide within 30 days of receiving the records, and a UPIC within 60 days.

Can I appeal being placed on prepayment review?

Usually not. North Carolina says placement is not a contested case, and Indiana says it is not appealable. Individual claim denials can be appealed, and under Medicare each denied claim can go to redetermination within 120 days.

What happens if we fail prepayment review?

The payer escalates. Medicare can order more TPE rounds, 100% prepayment review, extrapolation, a Recovery Auditor referral or revocation. State Medicaid programs and MCOs can extend the review, require a corrective action plan or terminate the provider agreement, and a credible allegation of fraud requires a Medicaid payment suspension unless the state finds good cause not to.