Documentation Requirements for Therapists: What Auditors Look For

Overview

Documentation Requirements for Therapists: What Auditors Look For

Your clinical documentation serves multiple purposes: guiding treatment, communicating with other providers, protecting you legally, and supporting reimbursement. When documentation falls short, the consequences range from denied claims to fraud allegations.

Key takeaways

• Documentation Requirements for Therapists: What Auditors Look For Your clinical documentation serves multiple purposes: guiding treatment, communicating with other providers, protecting you legally, and supporting reimbursement.
• When documentation falls short, the consequences range from denied claims to fraud allegations.
• Understanding what auditors look for helps you document efficiently while protecting your practice and your patients.
• This guide covers documentation requirements, common audit triggers, medical necessity standards, and best practices for creating defensible clinical records.
• Why Documentation Matters Clinical Purpose Good documentation: Supports continuity of care Guides treatment planning Facilitates communication between providers Tracks patient progress Supports clinical decision-making Legal Protection Your notes may be: Subpoenaed in malpractice cases Requested in custody disputes Used in disability determinations Reviewed by licensing boards Examined in criminal proceedings The rule: If it isn't documented, it didn't happen (at least for legal and billing purposes).

Details

Understanding what auditors look for helps you document efficiently while protecting your practice and your patients.

This guide covers documentation requirements, common audit triggers, medical necessity standards, and best practices for creating defensible clinical records.

Why Documentation Matters

Clinical Purpose

Good documentation:Supports continuity of careGuides treatment planningFacilitates communication between providersTracks patient progressSupports clinical decision-making

Legal Protection

Your notes may be:Subpoenaed in malpractice casesRequested in custody disputesUsed in disability determinationsReviewed by licensing boardsExamined in criminal proceedings

The rule: If it isn't documented, it didn't happen (at least for legal and billing purposes).

Billing and Reimbursement

Documentation must support:Services billedMedical necessityLevel of service (CPT code)Time spent (for time-based codes)DiagnosisTreatment plan goals

For CPT code requirements, see our complete CPT codes guide.

What Auditors Examine

Types of Audits

Pre-payment Review: Payer reviews documentation before paying claims. Common for:New providersHigh-cost servicesPrior authorization requirements

Post-payment Review: Payer reviews after payment to verify appropriateness. Triggers include:Unusual billing patternsHigh utilization ratesComplaint investigationsRandom sampling

Recovery Audit Contractors (RACs): For Medicare, RACs conduct post-payment audits seeking overpayments. They work on contingency, keeping a percentage of recovered funds.

Zone Program Integrity Contractors (ZPICs): CMS contractors investigating Medicare fraud, waste, and abuse. More serious than RAC audits.

OIG Audits: Office of Inspector General conducts audits targeting specific issues or geographic areas.

State Medicaid Audits: State agencies audit Medicaid claims. Requirements vary by state.

Key Documentation Elements Auditors ReviewMedical NecessityDoes documentation support the diagnosis?Is the level of care appropriate?Is treatment frequency justified?Is continued treatment necessary?Service VerificationWas the service provided as billed?Does time documentation match the code?Was the rendering provider qualified?Was the service covered?Coding AccuracyDoes the documentation support the CPT code?Is the diagnosis supported by clinical findings?Are modifiers used appropriately?Is the place of service correct?ComplianceAre required elements present?Is the documentation timely?Are signatures present and legible?Are credentials documented?

Medical Necessity: The Foundation

What Is Medical Necessity?

Medical necessity means services are:Appropriate for the diagnosisConsistent with accepted standards of careNot primarily for convenienceThe most appropriate level of serviceExpected to produce meaningful improvement

The American Medical Association and Centers for Medicare & Medicaid Services (CMS) provide guidance on medical necessity standards.

Documenting Medical Necessity

Your documentation should clearly establish:Diagnosis with Supporting EvidenceSymptoms meeting diagnostic criteriaDuration of symptomsFunctional impairmentDifferential diagnosis consideredFunctional ImpairmentHow symptoms affect daily functioningImpact on work, relationships, self-careSpecific examples, not just global statementsMeasurable impairment (GAF scores, standardized measures)Treatment AppropriatenessWhy psychotherapy (vs. medication, hospitalization, etc.)Why this modality (individual, group, family)Why this frequencyEvidence-based approach for diagnosisProgress or Justification for Continued TreatmentMovement toward goalsIf no progress, why continued treatment is warrantedBarriers to progress being addressedRealistic prognosis

Medical Necessity Red Flags

Auditors look for patterns suggesting services aren't medically necessary:Chronic, unchanging diagnoses without documented symptomsNo functional impairment documentedNo measurable treatment goalsIdentical progress notes session after sessionExtended treatment duration without documented progressHigh-frequency treatment without justification"Maintenance" therapy without acute symptoms

Documentation Requirements by Service Type

Initial Psychiatric Evaluation (90791/90792)

Required elements:[ ] Identifying information[ ] Chief complaint/reason for evaluation[ ] History of present illness (onset, duration, symptoms, severity)[ ] Psychiatric history (prior treatment, hospitalizations, medications)[ ] Medical history (relevant conditions, current medications)[ ] Family psychiatric history[ ] Social history (relationships, occupation, substance use, trauma)[ ] Developmental history (when relevant)[ ] Mental status examination[ ] Risk assessment (suicide, violence, self-harm)[ ] Diagnosis with supporting criteria[ ] Treatment recommendations[ ] Disposition/plan

For 90792 (with medical services), additionally document:Physical examination elementsReview of systemsMedical decision-making complexityMedication management

For detailed coding guidance, see our CPT codes guide.

Psychotherapy Progress Notes (90832/90834/90837)

Required elements:[ ] Date of service[ ] Session duration (actual time for time-based codes)[ ] Session type (individual, family, group)[ ] Modality (in-person, telehealth)[ ] Presenting concerns/session focus[ ] Mental status observations[ ] Interventions provided[ ] Patient response to interventions[ ] Progress toward treatment goals[ ] Risk assessment (when clinically indicated)[ ] Plan for next session[ ] Clinician signature and credentials

Time documentation is critical for psychotherapy codes. Document:Actual face-to-face timeStart and stop times (recommended)Statement of total psychotherapy minutes

Example: "Provided 52 minutes of individual psychotherapy (session 1:00 PM - 1:55 PM, 3 minutes scheduling next appointment)."

See our SOAP notes guide for documentation templates.

Treatment Plan Requirements

Most payers require a treatment plan documenting:[ ] Diagnosis (ICD-10)[ ] Presenting problems[ ] Treatment goals (measurable, time-limited)[ ] Objectives for each goal[ ] Interventions planned[ ] Modality and frequency[ ] Estimated duration[ ] Criteria for discharge[ ] Patient participation/signature[ ] Review/update dates

Treatment plan review frequency:Medicare: Every 30 days (for psychiatric services)Medicaid: Varies by state (typically 90-180 days)Commercial: Per payer policy (often 90 days)

Crisis Documentation (90839/90840)

Crisis codes require documentation of:[ ] Nature of crisis (life-threatening or complex emergency)[ ] Symptoms precipitating crisis[ ] Time devoted to crisis intervention[ ] Interventions provided[ ] Resolution or stabilization achieved[ ] Safety plan developed[ ] Disposition (ER, hospitalization, follow-up)

Warning: Crisis codes are frequently audited. "Urgent" is not the same as "crisis." Document why the situation met crisis criteria.

Telehealth Documentation

For telehealth services, additionally document:[ ] Modality (audio-video vs. audio-only)[ ] Platform used[ ] Patient location (home, office, etc.)[ ] Provider location[ ] Verification of patient identity[ ] Technical quality adequate for service

For telehealth regulations, see our California telehealth guide.

Common Audit Triggers

Billing Patterns That Trigger ScrutinyHigh Utilization of 90837

If you bill 90837 (53+ minute sessions) for most or all sessions, expect questions. Auditors may ask:Why do most patients need extended sessions?Is there clinical variation in your practice?Are you billing 90837 for 45-50 minute sessions?

Best practice: Vary codes based on actual clinical need. Document why extended sessions are medically necessary when they occur.Billing Every Patient Weekly for Extended Periods

Long-term weekly therapy isn't inherently inappropriate, but:Document why weekly frequency is neededShow progress or explain barriersConsider step-down as patients improveUpdate treatment plans reflecting current statusUnusual Code Combinations

Auditors flag unusual patterns like:Multiple E/M codes same day without explanationAdd-on codes without appropriate primary codesHigh rates of crisis codesFamily therapy billed for individual issuesHigh Denial Rates Followed by Appeals

If you frequently bill, get denied, and successfully appeal, auditors may investigate whether initial claims are coded correctly.Out-of-Network Provider High Charges

Unusually high charges compared to market rates attract attention, especially with high-volume out-of-network billing.

Clinical Patterns That Raise ConcernsCopy-Paste Documentation

Identical or near-identical notes across sessions suggest:Notes don't reflect actual servicesTemplate overuse without customizationPossible fraudNo Documented Progress

Years of treatment without documented improvement raises questions:Is treatment effective?Are goals appropriate?Is the diagnosis correct?Is this medically necessary?Missing Risk Assessments

For high-risk patients, missing risk documentation is a liability issue and audit flag.Inconsistent Diagnoses

Diagnosis that changes frequently without explanation, or doesn't match symptom descriptions, suggests coding problems.Documentation Timing Issues

Notes signed weeks after service, backdated entries, or clustered documentation suggests poor practices or falsification.

Audit Response: What to Do

If You Receive an Audit RequestDon't PanicMost audits are routine. Respond professionally and timely.Understand the RequestWhat records are requested?What time period?What is the deadline?What format is required?Gather RecordsCollect all requested documentation:Progress notesTreatment plansIntake assessmentsDischarge summariesBilling recordsReview Before SubmittingCheck records for completeness. You may submit additional documentation clarifying services, but don't fabricate records.Respond TimelyMissing deadlines can result in automatic denials or adverse findings.Consider Legal CounselFor significant audits (especially RAC, ZPIC, or OIG), consult a healthcare attorney before responding.

Audit Defense Strategies

Document contemporaneously: Records created at time of service are most credible.

Respond specifically: Address each audit finding with specific documentation.

Provide context: Explain clinical reasoning auditors may not understand.

Know your codes: Be prepared to defend why the code billed was appropriate.

Demonstrate medical necessity: Connect symptoms, impairment, treatment, and progress.

Appealing Adverse Findings

If audit results are unfavorable:Understand appeal rights and deadlinesReview findings carefully - identify specific errorsGather supporting documentationWrite clear appeal narrative addressing each findingCite relevant regulations and payer policiesConsider expert support (billing consultants, attorneys)Track deadlines - appeals have strict timelines

For claim denial appeals generally, see our claim denials guide.

Best Practices for Audit-Proof Documentation

Write for the Skeptical Reader

Imagine an auditor who:Doesn't know your patientQuestions whether services were necessaryIs looking for reasons to deny payment

Your notes should answer their questions before they ask.

Be Specific, Not Generic

Weak: "Patient discussed anxiety."Strong: "Patient reported three panic attacks this week, including one at work that caused her to leave early. Identified cognitive distortions (catastrophizing) and practiced challenging automatic thoughts. Patient able to identify more realistic assessment of situation by end of session."

Document Functional Impairment

Weak: "Depressed mood interfering with functioning."Strong: "Patient reports depressed mood (6/10) resulting in missing 3 days of work this week, not cooking meals (eating fast food exclusively), and declining social invitations from friends. Sleeping 12+ hours daily."

Show Progress (or Explain Lack Thereof)

Document progress:"PHQ-9 decreased from 18 to 12 over past 6 weeks""Patient now able to attend work consistently (0 missed days this month vs. 5 last month)""Successfully used coping skills during panic attack without leaving situation"

When progress is slow, explain:"Limited progress toward Goal 1 due to recent job loss and housing instability creating acute stressors""Patient inconsistent with homework; session focused on barriers to engagement and problem-solving"

Use Measurable LanguageSpecific frequencies (3 times this week, daily, etc.)Rating scales (0-10 distress rating, standardized measures)Behavioral observations (eye contact appropriate, speech rate rapid)Functional measures (days missed work, hours sleep)

Document Time Accurately

For time-based codes, record actual time:Start and stop timesTotal face-to-face minutesServices that aren't face-to-face separately

Do not: Bill 90837 for 45-minute sessions. This is fraud.

Include Clinical Reasoning

Explain why you're doing what you're doing:Why this intervention for this patientWhy this frequency of treatmentWhy extended session was neededWhy continuing treatment despite slow progress

Sign and Date PromptlySign within 24-48 hours of serviceNever backdate entriesUse late addendums (clearly marked) if neededEnsure electronic signatures comply with regulations

Documentation Tools and Technology

EHR Features That Support Compliance

Look for EHR systems offering:Customizable templatesRequired field enforcementTime trackingAudit trail loggingSignature trackingTreatment plan remindersOutcome measure integration

Template Best Practices

Templates can improve efficiency and compliance, but:Customize for each sessionAvoid copy-paste without modificationInclude prompts for required elementsBuild in specificity requirementsReview templates periodically

Outcome Measures

Integrate standardized measures:PHQ-9 (depression)GAD-7 (anxiety)PCL-5 (PTSD)AUDIT/DAST (substance use)Columbia Suicide Severity Rating Scale

These provide objective progress documentation that strengthens medical necessity arguments.

Retention Requirements

Federal Requirements

HIPAA: Doesn't specify retention period, but requires policies be retained 6 years.

Medicare: Records must be retained 5 years from claim date.

Medicaid: Varies by state; typically 6-10 years.

State Requirements

Most states require:Adult records: 7-10 years from last serviceMinor records: Until age of majority plus statute of limitations (often 18-21 + 3-7 years)

Check your state requirements. Many licensing boards publish specific guidance.

For comprehensive retention guidance, see our record retention guide.

Retention Best PracticesRetain longer than minimum requirementsConsider malpractice statute of limitationsMaintain records for minors until well into adulthoodDocument destruction dates and methodsUse HIPAA-compliant destruction (shredding, secure electronic deletion)

Frequently Asked Questions

How detailed do my notes need to be?

Detailed enough that another clinician could understand the patient's status and treatment. Detailed enough to support the code billed and demonstrate medical necessity. Not so detailed that you're documenting irrelevant information or spending excessive time.

Can I use the same template every session?

You can use a template structure, but content must be individualized. Identical notes across sessions are a major audit red flag and may constitute fraud.

What if I forget to document something important?

Add a late entry with the current date, clearly marked as an addendum. Never backdate or alter existing documentation.

How do I document a session where "nothing happened"?

Every session should have clinical content. Document:What was discussedPatient's current statusInterventions attemptedWhy progress is slowPlan adjustments

If sessions routinely feel like "nothing happened," consider whether treatment is still medically necessary.

Do I need to document every phone call?

Document clinically significant phone contacts:Crisis callsCoordination with other providersSignificant clinical updatesCalls affecting treatment decisions

Brief scheduling calls don't require clinical documentation.

What's the best way to document telehealth sessions?

Include all standard progress note elements plus telehealth-specific requirements (modality, platform, patient/provider locations, technology adequacy). The clinical documentation should be equivalent to in-person services.

How long should documentation take?

With good templates and efficient practices, a standard progress note should take 5-10 minutes. Initial evaluations take longer (15-25 minutes). If documentation consistently takes longer, review your process.

Ease Health's EHR includes customizable templates, required field enforcement, outcome measure integration, and time tracking to support compliant documentation. Schedule a demo to see how we help practices document efficiently and defensibly.

Next steps

• Review the key takeaways and adapt them to your practice workflow.
• Use the details section as a checklist when you implement or troubleshoot.
• Share this with your billing or admin team to align on process and terminology.