Records requests for claim review

How do we answer a payer's or auditor's records request for a claim with the right records pulled, checked and sent before the due date, and what was sent logged?

Match the request to the claim and send exactly what was asked, on time, with a log. When a payer or an auditor requests records for a claim review (a prepayment review, a post-payment audit, a recovery audit, a risk adjustment or quality review), Callvu classifies the request (the requester and its authority, the claims and the dates, the records named, the due date and the format), matches each claim to the encounter in the EHR, pulls the records named from the EHR and the billing system, chases a record that is missing or unsigned from the department or the clinician through a link on the due date clock, checks the set against the request (the right patient, the dates, the signatures, nothing extra), routes an unusual request or a sensitive record to health information management in the Decision Desk, sends the set through the requester's channel with the confirmation, and logs what was sent on the claim and in the disclosure log.

In scopeComplex: multi-party handoffsCallvu moves: classify, chase and verify, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The audit request asked for twelve records by a date; nine were sent, two were the wrong patient, and the denials for the missing three were automatic.

Today, without Callvu

Payers and auditors request records by the dozen, each with a due date and a consequence: a claim not supported by the records in time is denied or recouped. The request lands in a mailroom, the records clerk pulls what they can find, the unsigned note waits for the physician, the wrong patient's record goes out in the envelope, and nobody logs what was sent. The recoupment letter is the first anyone hears of it.

A records request is a disclosure of protected health information for payment or health care operations, permitted under the privacy rule but subject to the minimum necessary standard and the accounting rules for some requesters; the auditor's authority and the due date come from the program (Medicare's additional documentation requests with 45 days, recovery auditors with their limits, commercial plan audits under the contract); the records named map to the EHR's documents. Each is a check, and the send is a logged event.

A request matched, pulled, checked and sent with a log is a claim defended; the alternative is a recoupment and a privacy incident in the same envelope.

How it runs

From the requestto the system of record.

A payer or an auditor sends a records request for one or more claims, by portal, electronic request, letter or fax. Callvu captures it, classifies it and opens the case with the due date.

Health information management: Owns the release and decides unusual requests in the Decision Desk.
Clinicians and departments: Complete or sign a missing record through a link.
Payer or auditor: Receives the records through its channel.
Callvu: Classifies, matches, pulls, chases, checks, routes, sends and logs.

Classify the request
The requester and its authority (the payer under the contract, a Medicare contractor under its program, a recovery or risk adjustment auditor, a state agency), the claims with their dates and amounts, the records named (the history and physical, the operative report, the orders, the medication administration record, the itemized bill), the due date and the required format and channel are captured and classified; a request outside the requester's authority or the minimum necessary is flagged.
Match and pull
Each claim is matched to the encounter in the EHR and the records named are pulled from the EHR and the billing system for that encounter and those dates; the set is assembled in the requester's format with the claim identifiers.
Chase and verify
A record that is missing, incomplete or unsigned is chased from the department or the clinician through a link on the due date clock; the set is checked against the request: the right patient and encounter on every page, the dates within the request, the signatures and authentication present, nothing beyond what was asked, sensitive records (substance use disorder, psychotherapy notes) excluded or consented as the rules require; an unusual request, a sensitive record or a request beyond the authority goes to health information management in the Decision Desk with only the allowed outcomes.
Send, log and write back
The set is sent through the requester's channel (the portal, the electronic attachment standard, secure fax or tracked mail) before the due date with the confirmation recorded, what was sent is logged on the claim in the billing system and in the disclosure log where the accounting rules apply, and the claim's review outcome is tracked so a denial for insufficient documentation can be appealed with the proof of what was sent.

Where it ends: The request was matched to the encounters, the records named were pulled and checked, the gaps were chased from the people who could fix them, and the set went through the requester's channel before the due date with a log of exactly what was sent. The Decision Trace shows the classification, the checks and any decision; the Audit Trace shows the chases, the send with its confirmation and the log with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

HIPAA: Disclosure to a health plan for payment and to an auditor for health care operations is permitted under 45 CFR 164.506 without authorization, subject to the minimum necessary standard (164.502(b)) for the records sent, the verification of the requester's identity and authority (164.514(h)), the exclusion of psychotherapy notes and the special rules for substance use disorder records under 42 CFR Part 2, and the accounting of disclosures where it applies; the log evidences compliance.
Medicare documentation request rules (the Program Integrity Manual chapter 3 and the additional documentation request process) and the recovery audit program limits: A provider has 45 days to respond to a Medicare additional documentation request (with the contractor's extension rules), recovery auditors are limited in the number of records they may request per period, and a claim without supporting documentation by the due date is denied as not reasonable and necessary; the due date is on the case from receipt.
Payer contract audit provisions and the state's medical records fee and timeliness rules: Commercial contracts set the audit rights, the records required, the response periods and the format; state law sets the fees a provider may charge for records and the periods for responding, which the classification applies by requester.

Company policies

Every request is classified with its authority and its due date on receipt; the minimum necessary standard limits what is sent.
Every page is checked for the right patient and encounter before anything leaves.
Sensitive records are excluded or consented as the rules require, decided by health information management.
The billing system holds the log of what was sent per claim; the EHR is the source of the records.

Controls

Request classification with authority, due date and format.
Claim-to-encounter matching and record pull from the EHR.
Chases to clinicians and departments on the clock.
Page-level checks and sensitive record screening.
Decision Desk for unusual requests.
Send with confirmation, claim log and disclosure log.

Clocks and deadlines

Due date: The program's or the contract's period from receipt (45 days for Medicare additional documentation requests), on the case.
Record completion: The clinician's signature or the missing document chased on the due date clock.

Documents and checks

The request with its classification and due date
The matched encounters and the pulled records
The checks and any decision
The sent set with the confirmation
The claim log and the disclosure log entry

In the Decision Trace

The classification and the authority.
Each check and any decision.

In the Audit Trace

The receipt with time.
Each chase with time.
The send with confirmation and the logs.

The handoff

Between the front doorand the back office.

The front door

The requester's portal, electronic request, letter or fax, captured into the case; clinicians through a link.

The back office

Health information management decides only unusual requests; the pull, the checks and the send run from the record.

The Decision Desk

A request beyond the requester's authority, a sensitive record, or a record that cannot be completed by the due date goes to health information management in the Decision Desk with the case and only the allowed outcomes.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

How is the request tracked?

It is classified on receipt with the requester's authority, the claims, the records named and the due date, and the case shows the days remaining against the program's or the contract's period.

What is checked before sending?

That every page is the right patient and encounter, the dates are within the request, the records are signed, nothing beyond the request is included, and sensitive records are excluded or consented as the rules require.

What is logged?

Exactly what was sent, to whom, through which channel and when, on the claim in the billing system and in the disclosure log where the accounting rules apply.

Related processes

Claim denial appeals Payer document requests Release of information requests Clinical documentation queries Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.