SMRC Audit Letters Explained: How to Respond to a Supplemental Medical Review Contractor Request

Many providers have never heard of the Supplemental Medical Review Contractor until a letter arrives asking for medical records. The Supplemental Medical Review Contractor, or SMRC, is a CMS contractor that conducts nationwide medical reviews focused on specific vulnerabilities identified by CMS. An SMRC letter usually means that one or more of your claims has been selected as part of a national review project, not that your organization is suspected of fraud. But an SMRC review can still result in claim denials and overpayment recoveries, and failing to respond can lead to automatic denials.

This article explains what the SMRC is, how SMRC projects are selected, what an SMRC letter typically includes, how to respond, what happens after the review, and how to appeal. It is educational and does not replace advice from qualified professionals.

What Is the Supplemental Medical Review Contractor?

CMS states that it contracts with a Supplemental Medical Review Contractor to help lower improper payment rates and protect the Medicare Trust Fund. According to CMS:

• The SMRC conducts nationwide medical reviews of Medicaid, Medicare Part A and Part B, and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) claims to determine whether claims follow coverage, coding, payment, and billing requirements.

• The focus of the medical reviews may include vulnerabilities identified by CMS data analysis, the Comprehensive Error Rate Testing (CERT) program, professional organizations, and federal oversight agencies.

• At CMS's request, the SMRC may also carry out other special projects to protect the Medicare Trust Fund.

CMS identifies Noridian Healthcare Solutions as the current SMRC. CMS's Review Contractor Directory lists the SMRC as covering the entire United States and notes that it accepts submissions through the Electronic Submission of Medical Documentation (esMD) system.

How the SMRC Differs From Other Contractors

• Medicare Administrative Contractors (MACs) process claims and conduct routine medical review in their jurisdictions, including Targeted Probe and Educate.

• Recovery Audit Contractors (RACs) identify and recover improper payments in defined regions, are paid on a contingency fee basis, and review CMS-approved topics.

• Unified Program Integrity Contractors (UPICs) investigate potential fraud, waste, and abuse.

• The CERT program measures the national improper payment rate using random sampling.

• The SMRC conducts nationwide, project-based medical reviews directed by CMS, often focused on specific services or provider types with identified vulnerabilities.

Why Providers Receive SMRC Letters

SMRC reviews are generally organized as projects. CMS directs the SMRC to review a particular service, item, code set, or provider type based on identified vulnerabilities. Within a project, the SMRC selects claims and requests documentation from the providers that billed them.

Common reasons a project may be initiated include:

• High improper payment rates identified by the CERT program.

• CMS data analysis showing unusual billing patterns or growth in a service.

• Findings or recommendations by the HHS Office of Inspector General or other oversight agencies.

• Concerns raised by professional organizations.

• Special projects requested by CMS.

Being selected for an SMRC project does not necessarily mean your organization is an outlier. Your claim may simply fall within the population being reviewed. However, providers should still treat SMRC requests seriously because denied claims will be recovered.

What an SMRC Letter Typically Includes

CMS has standardized the format of postpayment Additional Documentation Request (ADR) letters used by the SMRC, DME MACs, RACs, and the CERT contractor, so that letters are more recognizable and understandable. An SMRC ADR letter typically includes:

• An explanation that CMS has retained the SMRC to conduct medical review.

• The reason for selection, often describing the project or service under review.

• The claims, beneficiaries, and dates of service selected.

• The documentation requested.

• The deadline for submitting records.

• The consequences of not responding.

• Instructions for submitting records, including accepted submission methods.

• Contact information for questions.

Older CMS examples of SMRC letters show how projects are described. For example, one CMS template described an SMRC postpayment review project focused on power mobility devices, identified specific HCPCS codes under review, and explained that the high incidence of improper payment for those items constituted good cause for reopening claims under 42 CFR 405.980(b).

The Response Deadline

Under CMS's Medicare Program Integrity Manual, providers and suppliers generally have 45 calendar days to submit documentation in response to a MAC, RAC, or SMRC request, consistent with 42 CFR 405.929 for postpayment reviews. CMS instructs reviewers to notify providers when documentation is expected. Contractors may accept documentation received after the deadline for good cause, but providers should not rely on this.

If no response is received within the expected timeframe, CMS manual instructions direct the SMRC, along with MACs, RACs, and UPICs, to deny the claim.

Accepted Submission Methods

CMS's Program Integrity Manual states that MACs, CERT, the SMRC, and RACs shall accept documents via paper, fax, CD or DVD, electronic submission of medical documentation (esMD), and the contractor's website portal. The SMRC is listed by CMS as an esMD-accepting review contractor. Providers should follow the specific instructions in the ADR letter.

Who Is Responsible for Submitting Records

CMS's Program Integrity Manual explains that, unless otherwise specified, review contractors request information from the billing provider or supplier, and that because the billing provider or supplier is the one whose payment is at risk, it is ultimately responsible for submitting the requested documentation within the established timelines. The treating physician or other clinicians should provide any requested or relevant documentation, but the billing provider must make sure it is submitted.

This is especially important for providers whose claims depend on records maintained by others, such as durable medical equipment suppliers that rely on ordering physician documentation, or laboratories that rely on ordering provider records.

How to Respond to an SMRC Request: Step by Step

Step 1: Log the Request

Record the date received, the date on the letter, the project or reason for selection, the claims and beneficiaries, the documents requested, and the deadline.

Step 2: Calendar the Deadline

Set the 45-day deadline, or the deadline stated in the letter, with reminders well in advance.

Step 3: Verify the Request

Confirm the SMRC's identity using CMS's SMRC webpage and Review Contractor Directory. Make sure the contact information and submission instructions match official sources.

Step 4: Understand the Project

Read the reason for selection carefully. Identify the service under review and the applicable coverage, coding, and documentation requirements, such as national coverage determinations, local coverage determinations, policy articles, and CMS manual provisions. The SMRC's website may provide additional project information.

Step 5: Gather Complete Records

Collect all documentation that supports each claim, which may include:

• Orders and referrals.

• Physician or practitioner notes documenting medical necessity.

• Certifications and plans of care.

• Test results.

• Proof of delivery for DMEPOS.

• Records from ordering or referring providers.

• Signature logs or attestations.

CMS manual instructions allow reviewers to consider documentation related to the beneficiary's condition before and after the service to get a more complete clinical picture, so include relevant records beyond the date of service when helpful.

Step 6: Obtain Third-Party Records Early

If records are held by ordering physicians, hospitals, or other providers, request them immediately. Delays in obtaining third-party documentation are a common cause of incomplete submissions.

Step 7: Review the Records Before Submission

• Confirm that each required element is present.

• Check signatures, dates, and legibility.

• Confirm that the records belong to the correct beneficiary and date of service.

• Make sure late entries and addenda follow Medicare documentation rules. Never create or alter records after the fact.

Step 8: Organize the Submission

Include a cover sheet or the barcode cover page provided with the request, list enclosed documents, and organize records by claim.

Step 9: Submit and Keep Proof

Submit using an accepted method before the deadline, and keep proof of submission and a complete copy of everything sent.

Step 10: Track the Outcome

Monitor for review results and any overpayment notices from your MAC.

What Happens After the SMRC Review

CMS explains that the SMRC notifies CMS of any identified improper payments and noncompliance with documentation requests, and that the MAC may initiate claim adjustments and overpayment recoupment actions through the standard recovery process.

In practice, this means:

• If the SMRC finds that a claim was paid correctly, no action is needed.

• If the SMRC finds an improper payment, the MAC adjusts the claim and issues an overpayment demand or makes a payment correction.

• Providers may also receive review results letters explaining the findings.

Appealing SMRC Findings

Overpayments resulting from SMRC reviews are recovered through the MAC and can be appealed through the Medicare fee-for-service appeals process:

• Redetermination by the MAC, generally requested within 120 days of receiving the initial determination or demand letter.

• Reconsideration by a Qualified Independent Contractor, generally within 180 days of the redetermination decision.

• Administrative Law Judge hearing, generally within 60 days of the reconsideration decision.

• Medicare Appeals Council review.

• Judicial review in federal district court.

Under Section 1893(f)(2) of the Social Security Act and 42 CFR 405.379, filing a redetermination request within 30 days of the demand letter, and a reconsideration request within 60 days of the redetermination decision, can limit recoupment while those appeals are pending.

When appealing, include a clear explanation of how the documentation meets the applicable requirements and any relevant records that existed at the time of service.

Common Reasons SMRC Claims Are Denied

Based on CMS's description of improper payment categories, common reasons include:

• No response to the ADR.

• Missing documentation, such as orders, certifications, or proof of delivery.

• Documentation that does not support medical necessity.

• Missing or invalid signatures.

• Coding that does not match the documentation.

• Failure to meet specific coverage criteria for the item or service under review.

Using SMRC Findings to Improve

SMRC projects highlight areas where CMS has identified vulnerabilities. Even if only a few of your claims are reviewed, the project topic can signal broader risks. Providers can use SMRC findings to:

• Review other claims for the same service and identify similar issues.

• Update documentation templates and checklists.

• Train clinicians and staff on specific requirements.

• Strengthen processes for obtaining third-party documentation.

• Evaluate whether overpayment obligations exist under the 60-day rule at 42 CFR 401.305 if internal review identifies additional errors.

Building SMRC Readiness Into Your Compliance Program

• Monitor CMS and SMRC communications for project topics affecting your services.

• Maintain a central ADR log for all contractors, including the SMRC.

• Establish a standard ADR response workflow with clear responsibilities.

• Conduct internal audits of services frequently targeted by national reviews.

• Build relationships with referring providers to support timely record sharing.

• Keep contact information current so letters reach the right people.

Special Considerations by Provider Type

Because the SMRC reviews Medicaid, Part A, Part B, and DMEPOS claims nationwide, the documentation challenges differ by provider type. The following considerations are general, and providers should always check the coverage and documentation requirements that apply to the specific service under review.

DMEPOS Suppliers

Suppliers often depend on records created by the ordering practitioner. Reviewers generally expect documentation that supports the order, the beneficiary's medical need for the item, and proof that the item was delivered to the beneficiary. Supplier-created forms alone may not be enough to establish medical necessity. Suppliers should:

• Request the treating practitioner's notes as soon as the letter arrives.

• Confirm that orders contain the required elements for the item.

• Include proof of delivery that matches the date of service and the item billed.

• Include any required face-to-face encounter documentation for items that require it.

Hospitals and Facilities

Hospital reviews may focus on admissions, outpatient services, or specific procedures. Facilities should include physician orders, admission documentation, progress notes, operative or procedure reports, and discharge summaries as relevant. Coordinating between health information management, case management, and billing helps make sure that the full clinical picture is submitted.

Physicians and Other Practitioners

Practitioner reviews often focus on evaluation and management levels, procedures, or services with high error rates. Practitioners should make sure progress notes clearly support the level and type of service billed, are signed and dated, and include any required elements for time-based or split or shared services.

Laboratories and Diagnostic Suppliers

Laboratories and diagnostic suppliers typically need documentation from the ordering practitioner showing that the test was ordered and medically necessary. Because the laboratory is the billing provider, it is responsible for obtaining that documentation, so relationships with ordering practices matter.

Medicaid Providers

When the SMRC reviews Medicaid claims, state Medicaid requirements may also apply. Providers should review the applicable state rules and any instructions in the request letter.

A Sample SMRC Response Timeline

A structured timeline helps organizations meet the 45-day deadline without last-minute pressure. The following is an example internal timeline that providers can adapt:

• Days 1 to 3: Log the request, verify the contractor, calendar deadlines, and assign an owner.

• Days 3 to 7: Identify the project topic and applicable requirements, and request any third-party records.

• Days 7 to 20: Gather internal records and follow up on third-party requests.

• Days 20 to 30: Conduct a quality review of each claim's documentation against the applicable requirements.

• Days 30 to 35: Assemble, paginate, and finalize the submission.

• Days 35 to 40: Submit using an accepted method and confirm receipt.

• Days 40 to 45: Reserve as a buffer for unexpected delays.

Organizations that receive many review requests may want to assign a dedicated coordinator who manages SMRC, MAC, RAC, CERT, and UPIC requests in one tracking system.

Understanding the Documentation Standard

Reviewers evaluate whether the medical record supports the claim as billed. In general, CMS guidance expects records to be complete, legible, signed, and dated, and to support that the service was reasonable and necessary under applicable coverage requirements. Providers should keep in mind several practical points:

• The record should stand on its own. Reviewers generally cannot infer missing information.

• Signatures matter. If a signature is missing or illegible, providers may be able to submit a signature log or signature attestation consistent with CMS rules.

• Amendments and late entries must be clearly identified with the date they were made and the author. Records should never be altered to appear as if they were created at the time of service.

• Templates and checkbox forms can help, but they should still capture patient-specific clinical information that supports medical necessity.

• Coverage policies such as local coverage determinations often list specific documentation elements. Use those lists as a checklist.

What to Do If You Missed the Deadline

If an SMRC deadline was missed, providers should act quickly. Contact the SMRC to ask whether documentation can still be accepted, and document the reason for the delay in case good cause can be shown. If the claim has already been denied and an overpayment has been issued, the provider can generally submit the documentation with a redetermination request to the MAC. Providers should also review their internal processes to determine why the deadline was missed and correct the cause, such as outdated mailing addresses, misrouted mail, or unclear responsibility.

Frequently Asked Questions

Who is the current SMRC?

CMS identifies Noridian Healthcare Solutions as the current SMRC, covering the entire United States.

How long do I have to respond to an SMRC request?

Generally 45 calendar days for postpayment review requests. Always follow the deadline in the letter.

Does an SMRC letter mean I am suspected of fraud?

Not necessarily. The SMRC conducts project-based medical reviews focused on vulnerabilities identified by CMS. However, denied claims will be recovered, and patterns of serious problems may be referred elsewhere.

Who recovers SMRC overpayments?

CMS explains that the MAC may initiate claim adjustments and overpayment recoupment through the standard recovery process.

Can I appeal SMRC findings?

Yes. SMRC-related overpayments can be appealed through the standard Medicare fee-for-service appeals process, beginning with a redetermination request to the MAC.

Can the SMRC review Medicaid claims?

Yes. CMS states that the SMRC conducts nationwide medical reviews that can include Medicaid claims, as well as Medicare Part A, Part B, and DMEPOS claims.

Can I submit records electronically?

Yes. CMS lists the SMRC as a review contractor that accepts submissions through esMD, and CMS manual instructions require review contractors to accept several submission methods, including fax, paper, CD or DVD, and portals.

What if the records I need are held by another provider?

The billing provider remains responsible for submitting the documentation. Request third-party records immediately, follow up regularly, and keep a record of your efforts.

Will an SMRC review lead to other audits?

An SMRC review is focused on a specific project, and many providers will see no further action beyond the reviewed claims. However, CMS states that the SMRC notifies CMS of improper payments and noncompliance with documentation requests. Significant or repeated problems could lead to additional review by other contractors, so providers should correct identified issues promptly and document their corrective actions.

Should I review other claims if the SMRC finds errors?

Yes, it is generally a good practice. If SMRC findings suggest a broader issue, providers should evaluate whether similar claims outside the sample were also paid in error and consider their obligations under the 60-day overpayment rule.

Conclusion

An SMRC letter is a request to participate in a national medical review project, and it deserves prompt, careful attention. By logging the request, understanding the project topic, gathering complete records including third-party documentation, reviewing records before submission, submitting on time, tracking results, and appealing incorrect findings, providers can minimize denials and protect their revenue. SMRC findings also provide useful insight into areas where CMS sees risk, which providers can use to strengthen their compliance programs.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare audit response and documentation improvement. We help providers manage SMRC and other contractor requests, review records before submission, obtain and organize third-party documentation, analyze findings, prepare appeals, and conduct internal audits on services targeted by national review projects. If you have received an SMRC letter, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Supplemental Medical Review Contractor. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education/supplemental-medical-review-contractor-smrc

• Centers for Medicare & Medicaid Services. Review Contractor Directory, Interactive Map. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/review-contractor-directory-interactive-map

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08, Transmittal 884 (Postpayment ADR Letter Format). https://www.cms.gov/regulations-and-guidance/guidance/transmittals/2019downloads/r884pi.pdf

• Centers for Medicare & Medicaid Services. SMRC Additional Documentation Request Template (Power Mobility Devices). https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medical-review/downloads/pmd-adr-template.pdf

• Centers for Medicare & Medicaid Services. Introducing esMD to Providers, Review Contractors, and Health Information Handlers (March 2026). https://edit.cms.gov/files/document/introducing-esmd-providers-review-contractors-health-information-handlers.pdf

• Centers for Medicare & Medicaid Services. Review Contractor OID Table (Updated May 21, 2026). https://www.cms.gov/files/document/rc-oid-table.pdf

• Centers for Medicare & Medicaid Services. Recovery Auditing in Medicare Fee-for-Service for Fiscal Year 2016, Report to Congress. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/downloads/fy-2016-medicare-ffs-report-congress.pdf

• Centers for Medicare & Medicaid Services. Medicare Claim Review Programs (MLN Booklet). https://www.cms.gov/outreach-and-education/medicare-learning-network-mln/mlnproducts/downloads/mcrp-booklet-text-only.pdf

• Centers for Medicare & Medicaid Services. Original Medicare (Fee-for-Service) Appeals. https://www.cms.gov/medicare/appeals-grievances/fee-for-service

• U.S. Social Security Administration. Social Security Act, Section 1893, Medicare Integrity Program. https://www.ssa.gov/OP_Home/ssact/title18/1893.htm

• Electronic Code of Federal Regulations. 42 CFR 405.929, Post-Payment Review. https://www.ecfr.gov/current/title-42/section-405.929

• Electronic Code of Federal Regulations. 42 CFR 405.980, Reopening of Initial Determinations, Redeterminations, Reconsiderations, Hearings, and Reviews. https://www.ecfr.gov/current/title-42/section-405.980

• Electronic Code of Federal Regulations. 42 CFR 405.379, Limitation on Recoupment of Provider and Supplier Overpayments. https://www.ecfr.gov/current/title-42/section-405.379

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/