Prepayment Review Versus Postpayment Audit: Comparing Provider Risks, Documentation Expectations, Response Deadlines, and Escalation Paths
On Sept. 23, the HHS Office of Inspector General released an analysis of UnitedHealthcare of Texas's Medicare Advantage ICD-10-CM code submissions and estimated that the plan was overpaid by at least $24.4 million from 2020 through 2021. This is not just a payer story. As MedLearn reported, the same analysis reaches providers because Medicare Advantage, Medicaid, and Affordable Care Act plan funding can be heavily influenced by the quantity and quality of ICD-10-CM codes that move from provider claims to funding sources. If your team still treats documentation review as a back-end coding exercise, that is the mistake.
Prepayment review and postpayment audit are different operational problems. One chokes cash before it arrives. The other follows paid claims and tries to take money back, often by challenging the medical record, the code support, or both. The underlying exposure is shared, though: when the record does not support what was billed, the risk does not disappear because the claim has already been paid.
Prepayment review blocks cash now, while postpayment audit threatens cash already booked
Prepayment review is the payer saying, in effect, “show it to us before we finalize payment.” Postpayment audit is the payer, plan, or oversight body saying, “we already paid this, now prove we should have.” Same chart. Different pressure point.
From an RCM standpoint, that distinction matters more than many teams admit. Prepayment review creates immediate accounts receivable drag. Staff chase records, hold claims, track pending requests, and deal with avoidable aging. Postpayment audit is more dangerous in another way. It can trigger refund activity, appeal work, and a broader internal review when the issue appears systemic rather than isolated.
The MedLearn articles do not provide a payer-by-payer workflow chart, so there is no reason to overread them. They do establish the risk environment. The OIG's review of UnitedHealthcare of Texas focused on ICD-10-CM submissions tied to CMS-HCC-based capitated funding. The reporting also says the analysis affects hospitals, physicians, IPAs, ACOs, and entities whose quality and cost-efficiency metrics rely on ICD-10-CM-applicable clinical documentation integrity. Whether the review occurs before payment or after it, the dispute usually turns on the same questions: what did the provider document, and was the submitted diagnosis code supported under the governing coding rules?
Documentation expectations decide where these cases go
Teams often respond to review activity by sending more pages instead of better support. That is not strong revenue cycle management.
The strongest source point in the packet is this: UnitedHealthcare argued that many diagnoses the OIG found invalid were supported by the submitted medical records because the ICD-10-CM Official Guidelines for Coding and Reporting state that code assignment is based on the provider's diagnostic statement that the condition exists. The guideline language quoted in the packet is even more direct: “The provider's statement that the patient has a particular condition is sufficient. Code assignment is not based on clinical criteria used by the provider to establish the diagnosis.”
That applies in both prepayment and postpayment settings. When a payer reviewer substitutes external clinical criteria for the provider's documented diagnostic statement, the appeal or rebuttal should be organized around the coding rule, not only around a narrative that the patient was “really sick.” The packet supports that approach. It does not support turning every audit dispute into a medical necessity argument when the actual issue is diagnosis code validity under ICD-10-CM reporting rules.
For diagnosis-driven review activity, the audit packet should keep three questions separate:
- Was the diagnosis documented by the provider?
- Was the ICD-10-CM code assigned from that provider statement?
- Is the reviewer challenging code assignment rules, or the underlying clinical basis for the diagnosis?
That is not a free pass. The same MedLearn reporting reminds providers that DOJ and OIG apply a fraud definition that includes actual knowledge, deliberate ignorance, or reckless disregard for truth or falsity, and that no proof of specific intent to defraud is required. The provider diagnostic statement matters. It does not mean that anything documented goes. Carrying diagnoses forward without current record support, copying problem lists into claims-facing workflows, or allowing unsupported ICD-10-CM capture to flow untouched into risk-bearing arrangements creates the kind of sloppiness that makes both prepayment review and postpayment audit more dangerous.
Response deadlines are operational, even when the packet gives no day count
The packet does not provide a universal deadline table for Medicare, UnitedHealthcare, or other payers. Do not invent one internally or assume that every record request runs on the same clock. That is how teams miss due dates and then blame “bad payer behavior” afterward.
The sources do support disciplined intake and triage because the stakes attach quickly. In prepayment review, a missed or incomplete response can delay payment. In postpayment audit, it can solidify an adverse finding and move the team from documentation production into appeal or repayment mode.
The operational standard is straightforward. When a request arrives, staff should classify it correctly as prepayment review, postpayment audit, coding validation, risk-adjustment validation, or another form of medical record review. That classification determines who owns the response, what documentation standard applies, and whether coding, CDI, compliance, contracting, or legal needs to be involved early.
This is where organizations often trip. Everything gets routed through one generic correspondence pool. Later, the team realizes that a postpayment audit tied to diagnosis validity was handled like a routine attachment request. By then, the response is fragmented, the chart has not been checked against the billed ICD-10-CM codes, and the escalation path has narrowed.
Escalation paths should follow the issue, not merely the payer letterhead
Not every adverse determination should be escalated in the same way. The packet offers a useful clue through UnitedHealthcare's rebuttal. UHC did not simply argue the outcome. It challenged the methodology, including the way diagnosis validity was judged against coding rules. Providers should take that seriously.
When the dispute concerns ICD-10-CM code assignment, the escalation should center on the provider's diagnostic statement, the record submitted, and the Official Guidelines for Coding and Reporting quoted in the MedLearn coverage. When the dispute suggests a broader integrity issue, particularly in Medicare Advantage or other capitated arrangements where diagnosis data influence funding, compliance review belongs in the process as well. The same packet says the OIG analysis has implications for payer and provider entities, not only for the MA plan reviewed.
When quality or cost-efficiency programs are involved, billing cannot handle the escalation alone. The source specifically connects ICD-10-CM clinical documentation integrity with metrics such as Medicare Spending Per Beneficiary and MIPS. A poor documentation habit can create several problems at once: payment disruption, audit exposure, and performance-measure distortion.
Start with the open review inventory and divide it into two queues: prepayment and postpayment. For every request involving diagnosis validation, have staff map the billed ICD-10-CM code to the exact provider diagnostic statement in the record before anything leaves the organization. If that link is not clean, fix the workflow now. The difference is defending the chart instead of simply forwarding paper.