What Rehab Therapists Need to Know About the Rise in CMS and Commercial Audits

By John Wallace, PT, MS, FAPTA, chief compliance officer, WebPT.

Federal audits targeting Centers for Medicare & Medicaid Services (CMS) reimbursements are intensifying, and rehab therapists are already feeling the impact. In the wake of public announcements about increased efforts to eliminate fraud, waste, and abuse in federal healthcare programs, both Medicare and commercial payers have significantly ramped up their auditing activities.

Historically, audits of this kind disproportionately affected large practices. Today, however, even small and mid-sized clinics are receiving record requests from both CMS and commercial insurers. For providers billing Medicare or Medicaid—even those with a long history of compliance—this shift signals the need for heightened awareness, tighter documentation, and proactive internal oversight.

The Changing Landscape of Rehab Audits

The rise in CMS audits is not occurring in isolation. As Medicare strengthens its oversight through contractors like Medicare Administrative Contractors (MACs) and program integrity auditors, commercial payers are quickly following suit. 

While CMS is transparent in publishing documentation expectations and typically approaches audits as educational, commercial payers often take a more punitive stance. Some conduct takeback audits based on small samples, then extrapolate error rates across years of claims to justify large recoupment demands.

This dynamic poses an especially difficult challenge for smaller practices. Commercial insurers, despite often paying significantly less than Medicare (e.g., sometimes 10% to 40% lower), are applying similar levels of scrutiny. And they’re not offering education. They’re demanding repayment.

Where Rehab Providers Are Most Vulnerable

The most frequent audit failures do not stem from fraud, but from insufficient or inconsistent documentation. Many rehab therapists rely heavily on electronic medical records (EMRs) to generate compliant records, but EMR systems alone cannot ensure accuracy. While structured fields and templates are helpful, providers must still input the correct clinical details to meet payer requirements.

One of the biggest vulnerabilities is the lack of regular internal compliance review. Large organizations may employ dedicated compliance staff, but small and medium-sized practices often operate without any formal chart review process. Unfortunately, this reactive model leaves providers exposed. Audits arrive without warning, and without a clear understanding of where documentation falls short, even well-meaning clinics may struggle to defend their claims.

What to Do When You’re Audited

Audit requests typically ask for documentation from 10 to 30 dates of service across multiple patient records. The first step is not to panic. Practices should immediately pull and review all relevant documentation, not just for the requested date, but for the entire episode of care that supports the medical necessity of the services provided.

For example, if an audit targets a therapeutic exercise billed on May 10, submitting only that date’s note is insufficient. Reviewers expect to see the full clinical context, including the physician-signed plan of care, progress notes, and any other documents that justify the service. Omitting these materials can result in an automatic denial, even when the treatment itself was appropriate.

If errors or omissions are discovered, practices can add an addendum to the EMR. The current date will be reflected, but referencing the original visit and clarifying missing elements is both permissible and advisable. However, these updates must be completed before the record is submitted. Post-denial amendments rarely yield favorable outcomes in appeals.

Proactive Strategies for Staying Ahead

Rehab practices don’t need expensive consultants or complex software to improve compliance. Simple strategies can go a long way in reducing audit risk. One of the most effective is peer review: asking each therapist to print a completed episode of care and exchange it with a colleague for feedback. This exercise improves documentation quality almost immediately, as it forces therapists to see their notes through another clinician’s eyes and often reveals gaps that would be obvious to an auditor.

Another overlooked but critical step is reviewing payer-specific documentation guidelines. Most clinics are heavily concentrated among a core group of eight to 12 payers. These insurers often publish medical policies that outline what they expect to see for each CPT code. These documents are not long and are readily available, but many therapists have never read them. Building awareness around these expectations, especially for high-volume codes, can significantly reduce denials.

When Additional Support Is Necessary

If more than half of an audited sample is denied, practices should strongly consider seeking professional help. While EMR vendors may offer compliance tools, large takeback demands or legal actions require support from experienced healthcare attorneys and compliance consultants. These specialists can guide providers through the appeals process, help contextualize documentation failures, and, in many cases, reduce or eliminate financial penalties.

Five years ago, these high-stakes cases were rare. Now they are becoming far more common. Technology has made it easier for payers to flag discrepancies, and the widespread use of EMRs means every clinical note is now legible, traceable, and fully reviewable.

Documentation Is Critical

Rehab therapists are often focused on what happens in the clinic. However, what is recorded is also of utmost importance. Inadequate or incomplete notes—even for care that was medically necessary and effective—can cost a practice thousands, if not millions, of dollars.

Documentation should not be treated as a burden or afterthought. It is a vital form of protection, ensuring both continuity of patient care and financial stability. With audits on the rise and payers demanding ever-higher standards of proof, proactive compliance is no longer optional. It’s essential.