CERT Audit Requests: Why Missing a Deadline Counts as an Improper Payment

Every year, CMS measures how accurately Medicare fee-for-service claims are paid through the Comprehensive Error Rate Testing program, known as CERT. CERT randomly selects tens of thousands of claims and asks the providers who billed them to submit medical records. Those records are reviewed to determine whether each claim was paid correctly. The results produce the national Medicare fee-for-service improper payment rate, which CMS reported at 6.55 percent, or $28.83 billion, for fiscal year 2025.

Because CERT uses random sampling, any provider can be selected, even one with excellent billing practices. And CERT has one rule that catches many providers by surprise: if the CERT contractor does not receive documentation within 75 days of its initial request, the claim is classified as a "no documentation" error and counted as an improper payment. The MAC will then recover the payment.

This article explains how CERT works, why missing the deadline counts as an improper payment, what happens to late documentation, how to respond to a CERT request, how CERT findings are recovered and appealed, and how to avoid common mistakes. It is educational and does not replace advice from qualified professionals.

What Is the CERT Program?

CMS describes CERT as the program it uses to estimate the Medicare fee-for-service improper payment rate. Each year, CERT reviews a statistically valid stratified random sample of Medicare fee-for-service claims to determine whether they were paid properly under Medicare coverage, coding, and payment rules. CERT is designed to comply with the Payment Integrity Information Act of 2019.

Key features include:

• CERT selects a stratified random sample of approximately 37,500 claims per reporting period, effective for reporting year 2025 and later, from claims submitted to Part A and Part B MACs and DME MACs.

• The sample includes claims that were paid or denied by the MAC.

• An independent CERT review contractor requests documentation and reviews the claims.

• Using statistical weighting, findings are projected to the total universe of Medicare fee-for-service claims.

• The improper payment rate is published annually in the HHS Agency Financial Report.

CMS emphasizes that the improper payment rate is not a fraud rate. It measures payments that did not meet Medicare requirements.

Recent Results

CMS reported the following for fiscal year 2025:

• An overall Medicare fee-for-service improper payment rate of 6.55 percent, or $28.83 billion, compared with 7.66 percent, or $31.70 billion, in fiscal year 2024.

• By claim type, 6.67 percent for Part A providers excluding hospital inpatient prospective payment system claims, 8.44 percent for Part B providers, and 3.15 percent for hospital inpatient prospective payment system claims.

• Most improper payments fell into two categories: insufficient documentation, and documentation that did not sufficiently demonstrate medical necessity.

How CERT Requests Documentation

According to CMS's Medicare Program Integrity Manual, Chapter 12, and CMS's CERT educational materials:

• The CERT review contractor sends an Additional Documentation Request (ADR) to the billing provider or supplier.

• If documentation is missing or insufficient, a subsequent ADR may be sent to the billing provider, the ordering or referring provider, or a third party, as appropriate.

• CERT uses CMS-approved ADR letters and sends ADRs in Spanish to providers in Puerto Rico and upon request elsewhere.

• CMS's historical CERT reports describe that if a provider failed to respond to the initial request after 30 days, the CERT contractor sent up to three subsequent letters in addition to follow-up phone calls.

• MACs are instructed not to contact providers selected for CERT review until 30 days after the first CERT ADR has been reported, and when they do, to remind providers to include the CERT cover sheet or claim identification number.

Why Missing the Deadline Counts as an Improper Payment

CMS's CERT educational materials state that if no documentation is received within 75 days of the initial request, the claim is classified as a "no documentation" claim and counted as an error.

This rule exists because CERT's purpose is to measure whether claims are supported. If a provider does not submit records, CERT cannot confirm that the service was provided, was medically necessary, or was billed correctly. CMS's CERT error categories define "no documentation" errors as situations in which the provider or supplier fails to respond to repeated requests for medical records, or responds that it does not have the requested documentation.

The consequences are real:

• The claim is counted as an improper payment in the national rate.

• The MAC is notified and recovers the payment.

• The provider receives an overpayment notice.

Other CERT Error Categories

CMS describes five CERT improper payment categories:

1. No documentation. The provider fails to respond to repeated requests or does not have the requested documentation.

2. Insufficient documentation. The documentation submitted is inadequate to support payment, or reviewers could not conclude that services were provided, were provided at the level billed, or were medically necessary.

3. Medical necessity. Reviewers had adequate documentation to determine that the services were not medically necessary under Medicare coverage and payment policies.

4. Incorrect coding. The documentation supports a different code than the one billed.

5. Other. Errors that do not fit the other categories, such as duplicate payments or non-covered services.

What Happens to Late Documentation?

CMS explains that if documentation is received after 75 days, CERT will still review it, as long as it is received before the end of the report period deadline. CMS's Program Integrity Manual also explains:

• MACs may submit additional documentation received from a provider to the CERT review contractor for consideration as late documentation.

• If the CERT contractor receives late documentation before the cutoff for the report, and the provider has not appealed the CERT-initiated denial, the contractor reviews the late documentation and scores the claim appropriately.

• If the provider has already appealed the CERT-initiated denial, the CERT contractor will not review the late documentation, and the appeal decision governs.

In other words, late documentation may still help, but providers should not rely on it. Responding within 75 days avoids the error altogether.

Who Is Responsible for Submitting Records?

CMS's Program Integrity Manual states that the billing provider or supplier is ultimately responsible for submitting requested documentation within established timelines, because it is the provider whose payment is at risk. CMS's historical CERT reports also explain that in some cases components of documentation are maintained by a third party, such as an ordering physician, and that if the billing provider fails to obtain the records or the third party fails to submit them, the claim may be counted as a full or partial insufficient documentation error. CMS has also stated that documentation produced by a supplier alone may be insufficient to support payment in certain circumstances.

This is particularly important for durable medical equipment suppliers, laboratories, and other providers whose claims depend on records from ordering practitioners.

How to Respond to a CERT Request: Step by Step

Step 1: Recognize the Request

CERT letters come from the CERT contractor, not your MAC. Make sure staff who open mail and manage portals recognize CERT requests and forward them immediately.

Step 2: Log and Calendar

Record the date of the request, the claim identification number, beneficiary, date of service, and documents requested. Calendar a target response date well before 75 days. Many organizations aim to respond within 30 days.

Step 3: Gather Complete Records

Collect all documentation supporting the claim, including:

• Orders, referrals, and certifications.

• Physician or practitioner notes supporting medical necessity.

• Test results and reports.

• Plans of care.

• Proof of delivery for DMEPOS.

• Signature logs or attestations.

• Records from ordering or referring providers.

Step 4: Obtain Third-Party Documentation

If records are maintained by others, request them immediately and follow up. Document your efforts.

Step 5: Review Before Submission

• Confirm the records match the beneficiary and date of service.

• Check that required elements are present and legible.

• Confirm signatures. CMS has emphasized that services must be authenticated by a legible identifier, and CERT will accept signature attestations, signature logs, and electronic signature protocols received before the deadline for the annual report.

Step 6: Include the Cover Sheet

Place the CERT cover sheet or claim identification number on top of the records, as instructed, so the documentation is matched to the correct claim.

Step 7: Submit Using an Accepted Method

CMS's Program Integrity Manual states that MACs, CERT, the SMRC, and RACs shall accept documents via paper, fax, CD or DVD, esMD, and contractor website portals. Follow the instructions in the CERT letter.

Step 8: Confirm Receipt

Keep proof of submission and, where possible, confirm that the CERT contractor received the documentation.

Step 9: Track the Outcome

Monitor for review results and any overpayment notice from your MAC.

How CERT Findings Are Recovered

CMS explains that the CERT program notifies MACs of improper payments identified through CERT, and MACs recoup overpayments and repay underpayments. CMS's Program Integrity Manual instructs MACs to adjust claims to reflect the corrected code and payment amount and to make the appropriate payment or collection.

Appealing CERT Determinations

CMS states that providers, suppliers, and beneficiaries have the right to appeal any improper payment determination made by the CERT program, and that final appeal decisions are reflected in the calculation of the improper payment rate. CMS's claim review booklet also notes that providers can appeal denials, including no documentation denials, through the normal appeals process by submitting documentation supporting their claims.

The Medicare fee-for-service appeals process includes:

• Redetermination by the MAC, generally requested within 120 days.

• Reconsideration by a Qualified Independent Contractor, generally within 180 days of the redetermination decision.

• Administrative Law Judge hearing, generally within 60 days of the reconsideration decision.

• Medicare Appeals Council review.

• Judicial review in federal district court.

Under 42 CFR 405.379, filing a redetermination within 30 days of the demand letter, and a reconsideration within 60 days of the redetermination decision, can limit recoupment during those appeals.

Appeal or Submit Late Documentation?

If a claim was denied for no documentation and the provider has the records, there are two possible paths: submitting late documentation to the CERT contractor before the report cutoff, or filing an appeal. CMS's manual indicates that if an appeal has been filed, the CERT contractor will not review late documentation. Providers should consider which path is most appropriate, considering deadlines and recoupment, and may want to discuss the situation with their MAC.

Why CERT Matters Beyond a Single Claim

Even though CERT reviews only a small sample, its results have broad effects:

• CERT findings shape MAC medical review priorities and improper payment reduction strategies.

• CERT results influence SMRC projects and other targeted reviews.

• Service types with high CERT error rates often become focus areas for Targeted Probe and Educate and other reviews.

CMS publishes detailed CERT data, including supplemental improper payment data by service type, which providers can use to understand risk areas.

Practical Scenarios

The following simplified, hypothetical scenarios show how CERT rules can play out. They are illustrations only.

Scenario 1: The Letter That Sat Unopened

A small physician practice receives a CERT letter addressed to its billing office. The office manager assumes it is a routine notice from the MAC and files it without reading it. No documentation is sent. After 75 days, the claim is scored as a no documentation error and the MAC issues an overpayment notice. The practice could have avoided the denial simply by recognizing the letter and responding with records it already had.

Scenario 2: The Missing Ordering Physician Notes

A durable medical equipment supplier responds to a CERT request on time, but only includes its own delivery records and the order. The CERT contractor determines that the documentation does not establish medical necessity, because the treating practitioner's notes were not included. The claim is scored as an insufficient documentation error. The supplier could have reduced this risk by requesting the treating practitioner's records as soon as the letter arrived.

Scenario 3: Late Documentation Before the Cutoff

A home health agency misses the 75-day deadline because of a staffing change. The claim is initially scored as a no documentation error. The agency submits the records shortly afterward, before the report cutoff, and has not filed an appeal. Under CMS's manual instructions, the CERT contractor reviews the late documentation and scores the claim based on its content. This shows why late documentation can still help, although meeting the deadline is always the better approach.

Scenario 4: An Illegible Signature

A hospital submits complete records, but the physician's signature on a key progress note is illegible and there is no signature log. Under CMS signature guidance, the hospital could submit a signature attestation or signature log to authenticate the entry. Including these with the original submission avoids an unnecessary error.

What CERT Reviewers Look For

CERT reviewers, who include clinicians and certified coders, evaluate whether documentation supports the claim as billed. In general, they look for:

• Evidence that the service was ordered, when an order is required.

• Documentation that the service was actually provided on the date billed.

• Clinical information supporting medical necessity under applicable coverage policies.

• Documentation supporting the specific code and level of service billed.

• Valid signatures and authentication.

• Required certifications, plans of care, or face-to-face documentation for services that require them.

Because CERT reviews claims across all service types, the applicable rules vary. Providers should check the national coverage determinations, local coverage determinations, and CMS manual provisions that apply to the service in question.

An Example Internal CERT Response Timeline

Because the 75-day period starts with the initial request, providers benefit from moving quickly. A sample internal timeline might look like this:

• Days 1 to 3: Recognize, log, and route the request to the responsible coordinator.

• Days 3 to 10: Gather internal records and request any third-party documentation.

• Days 10 to 20: Review documentation for completeness, legibility, and signatures.

• Days 20 to 30: Submit with the CERT cover sheet and confirm receipt.

• Days 30 to 75: Reserve as a buffer, and respond promptly to any follow-up request from the CERT contractor.

Responding within the first 30 days also reduces the chance of follow-up letters and calls, and gives time to respond to any subsequent request for missing information.

The Role of Your MAC

Although CERT is run by an independent contractor, your MAC plays a supporting role. CMS's manual instructions direct MACs to wait 30 days after the first CERT request has been reported before contacting providers, and then to remind them to include the CERT cover sheet or claim identification number. MACs also handle claim adjustments, overpayment recovery, and redetermination appeals for CERT findings. MACs often provide education based on CERT results in their jurisdictions, and providers can use that education to improve documentation.

Common Mistakes to Avoid

• Not recognizing a CERT letter because it does not come from the MAC.

• Sending CERT requests to the wrong department or letting them sit unopened.

• Assuming a single claim is not worth the effort.

• Waiting until close to 75 days to begin gathering records.

• Failing to obtain records from ordering providers.

• Omitting the CERT cover sheet or claim identification number.

• Submitting records for the wrong beneficiary or date of service.

• Missing signature attestations when signatures are illegible or missing.

• Ignoring the overpayment notice that follows a CERT error.

Building CERT Readiness Into Your Operations

• Train mailroom, front-desk, and billing staff to recognize CERT requests.

• Route all review contractor requests to a central ADR coordinator.

• Maintain current correspondence addresses with your MAC so letters reach you.

• Establish agreements or processes with referring providers for timely record sharing.

• Conduct periodic internal audits using CERT error categories.

• Review CMS's CERT supplemental data for your service types.

Frequently Asked Questions

How long do I have to respond to a CERT request?

CMS states that if no documentation is received within 75 days of the initial request, the claim is classified as a no documentation error. Respond as early as possible.

Why was I selected for CERT?

CERT uses a stratified random sample of claims. Selection does not mean you are suspected of wrongdoing.

Will CERT review documentation submitted after 75 days?

CERT will still review late documentation received before the end of the report period deadline, as long as the provider has not already appealed the CERT-initiated denial.

Can I appeal a CERT denial?

Yes. Providers can appeal any CERT improper payment determination through the Medicare appeals process.

Who recovers CERT overpayments?

CERT notifies the MAC, which adjusts the claim and recovers the overpayment.

Does a CERT error affect my organization beyond the single claim?

The direct effect is the recovery of that claim's payment. However, CERT results contribute to national and jurisdiction-level error rates that shape future reviews, and repeated documentation problems may draw attention from other contractors.

Is the improper payment rate a measure of fraud?

No. CMS states that the improper payment rate is not a measure of fraud. It measures payments that did not meet Medicare requirements, most often because of documentation issues.

Conclusion

CERT requests may involve only one claim, but they deserve prompt attention. Because no documentation within 75 days counts as an improper payment, missing a CERT deadline guarantees a denial and recovery. By recognizing CERT letters, logging and calendaring them, gathering complete records including third-party documentation, reviewing and submitting them with the cover sheet, confirming receipt, and appealing incorrect findings, providers can avoid unnecessary errors and protect their revenue.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare audit response and documentation improvement. We help providers set up processes to recognize and route CERT requests, gather and review documentation, obtain third-party records, prepare appeals, and use CERT data to strengthen internal audits. If you have received a CERT request or want to improve your response process, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Comprehensive Error Rate Testing (CERT). https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert

• Centers for Medicare & Medicaid Services. CERT Background. https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert/background

• Centers for Medicare & Medicaid Services. Improper Payment Measurement in the Medicare Fee-for-Service Program (January 2025). https://www.cms.gov/files/document/introduction-comprehensive-error-rate-testing-cert-program.pdf-0

• Centers for Medicare & Medicaid Services. Introduction to CERT (January 2016). https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/CERT/Downloads/IntroductiontoCERT_January2016.pdf

• Centers for Medicare & Medicaid Services. CERT 101. https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/CERT/Downloads/CERT-101-07-2013.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 12. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c12.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08, Transmittal 766. https://www.cms.gov/Regulations-and-Guidance/Guidance/Transmittals/2018Downloads/R766PI.pdf

• Centers for Medicare & Medicaid Services. Improper Medicare FFS Payments Report, November 2009. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/cert/downloads/cert_report.pdf

• Centers for Medicare & Medicaid Services. Fiscal Year 2025 Improper Payments Fact Sheet. https://www.cms.gov/newsroom/fact-sheets/fiscal-year-2025-improper-payments-fact-sheet

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Comprehensive Error Rate Testing Data. https://data.cms.gov/provider-compliance/fee-for-service-error-rate-improper-payment/medicare-fee-for-service-comprehensive-error-rate-testing

• Centers for Medicare & Medicaid Services. 2025 Medicare Fee-for-Service Supplemental Improper Payment Data. https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert/cert-reports/2025-medicare-fee-service-supplemental-improper-payment-data-2

• Centers for Medicare & Medicaid Services. Medicare Claim Review Programs (MLN Booklet). https://www.cms.gov/outreach-and-education/medicare-learning-network-mln/mlnproducts/downloads/mcrp-booklet-text-only.pdf

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for January 29, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-january-29-2026

• Centers for Medicare & Medicaid Services. Original Medicare (Fee-for-Service) Appeals. https://www.cms.gov/medicare/appeals-grievances/fee-for-service

• Electronic Code of Federal Regulations. 42 CFR 405.379, Limitation on Recoupment of Provider and Supplier Overpayments. https://www.ecfr.gov/current/title-42/section-405.379