# Internal review protocol

## Common vulnerability categories

- Template default or copy-forward text inconsistent with the visit
- Internally inconsistent measurements, location, laterality, wound count, or product amount
- Missing or unclear signatures, dates, credentials, orders, or plan links
- Standard-care history that is absent, vague, or not tied to the episode
- Clinical rationale stated later but not documented contemporaneously
- Product, invoice-match status, lot/serial-match status, application, units, wastage, or claim-line mismatch; never place actual invoice, lot, serial, UDI, claim, or tracking numbers in the public plugin
- Diagnosis pointer or anatomical-site inconsistency
- Submission gaps, missing proof of delivery, or incomplete decision set
- Appeal argument that answers an earlier theory but not the current one
- Provider declaration that goes beyond firsthand knowledge

## Severity frame

- `Critical`: may materially undermine claim validity, testimony, or the integrity of the response; escalate before drafting.
- `High`: directly affects a stated denial issue or multiple claims.
- `Moderate`: creates ambiguity or avoidable reviewer concern but may be addressable with existing evidence.
- `Low`: quality-improvement issue not material to the stated determination.

## Corrective-action rules

A sound corrective action is prospective, documented, assigned, and testable. Examples include template revision, disabling unsafe defaults, staff training, pre-bill checks, claim-to-record reconciliation, signature workflows, sampling, and follow-up audits.

Do not use “corrective action” as a euphemism for rewriting the past. Preserve original records. A correction, amendment, addendum, or delayed entry is appropriate only when the author has firsthand knowledge or actual recollection; it must use the actual current date, identify the author, link to and preserve the original, and remain clearly and permanently identifiable. It must not reconstruct a rationale merely to meet coverage requirements after the fact. Treat it as retrospective evidence whose weight is determined by the reviewer. If an audit request has arrived, the gap is systemic, or legal/reporting risk may exist, route the decision through compliance or qualified healthcare counsel.

## Overpayment implications

For every material finding, ask whether it indicates that a paid claim inside or outside the audit sample may lack support or otherwise have been overpaid. A `yes` or `uncertain` answer is not a legal conclusion and does not automatically require a refund, but it cannot be classified as merely unrelated. Preserve the evidence, identify the potential claim population, and route the matter to compliance and qualified healthcare counsel for a prompt, documented, good-faith investigation, quantification, and any required report and return. Verify current 42 CFR 401.305, including the investigation rule, lookback period, and applicable deadlines.

For Original Medicare Part A/B, the current rule generally measures 60 days from identification, subject to its cost-report and suspension provisions. Identification uses the rule's knowing-receipt-or-retention standard; do not tell a practice that a clock can start only after perfect quantification. The related-overpayment investigation provision can suspend the deadline when its conditions are met, ending at the earlier of investigation completion with aggregate calculation or 180 days after initial identification. This is not an automatic extra 180 days for every documentation concern. The rule also specifies a six-year lookback. Verify the applicable version and promptly route the dates and decisions to compliance/counsel; do not make a case-specific legal identification finding here. Prospective template correction or an addendum does not extinguish a separate reporting duty.

## External-treatment decision

1. Is the finding expressly raised by the notice or necessary to answer it truthfully? If yes, address it accurately.
2. Would omission make an affirmative statement misleading? If yes, revise or disclose enough to avoid misleading the reviewer.
3. Is it an unrelated imperfection with no bearing on the issue? Keep it in the internal plan.
4. Could the finding implicate paid claims outside the sample, a report-and-return duty, privilege, or material legal risk? Send to compliance and qualified healthcare counsel for decision.

## Sources

- CMS Program Integrity Manual, Chapter 3: https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/Internet-Only-Manuals-IOMs-Items/CMS019033
- 42 CFR 401.305, requirements for reporting and returning overpayments: https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305
- Arclight rationale-drift analysis: https://www.arclightaction.com/insights/rationale-drift-medicare-audit-appeals