Three lenses on the audits quietly reshaping revenue cycle risk: coding, finance, and documentation.
Most revenue cycle teams know their MAC. Many have battle scars from a RAC. But when a letter arrives from the Supplemental Medical Review Contractor — the SMRC — it often lands on a desk where nobody is quite sure what it is, how serious it is, or who owns the response. That confusion is exactly where revenue gets lost.
The SMRC is a single, nationwide medical review contractor that works at the direction of CMS. Unlike your Medicare Administrative Contractor, which processes claims and conducts reviews within its own jurisdiction, the SMRC runs discrete, project-based reviews across the entire country. CMS assigns each project based on signals of improper payment risk — CERT error-rate data, OIG and GAO findings, comparative billing analysis, and referrals from other contractors.
That project structure matters. If your organization receives an SMRC additional documentation request (ADR), you were not selected at random. Your claims matched a pattern CMS has already decided is worth national scrutiny — a specific procedure, drug, site of service, or billing behavior. Recent project areas have included chemodenervation (Botox) for chronic migraine, skin substitute applications, hospice levels of care, and high-level E/M coding, among others.
An SMRC audit is CMS telling you, at a national level, that claims like yours are suspected of being overpaid — and giving you one well-defined window to prove yours weren't.
SMRC reviewers audit against the coverage criteria in force on the date of service — not today's rules, and not your internal conventions. The most common coding-side findings we see in audit work are unit and frequency errors, missing or misapplied modifiers, diagnosis codes that don't establish coverage under the applicable LCD, and services billed under the wrong provider or site of service.
Jurisdiction matters more than teams expect: LCD requirements differ between MACs, so a multi-state organization can be compliant in one region and exposed in another for the identical service.
Medical necessity that lived in the physician's head — or in a conversation, or in a prior chart that wasn't submitted — does not exist for audit purposes. Reviewers need to find every coverage element inside the documentation you send: the qualifying diagnosis and its history, failed conservative treatment where required, valid orders, response to prior treatment for continuing therapy, and authenticated signatures.
This is why SMRC responses are a records-assembly discipline as much as a clinical one. The strongest response packages are curated: every element of the coverage policy mapped to a specific page of the record, with nothing missing and nothing extraneous.
The recoupment on the sampled claims is rarely the whole story. SMRC findings signal risk that can extend to your full population of similar claims, invite follow-on review, and in serious cases generate referrals to program integrity contractors. Meanwhile the appeal process ties up cash for months to years, and the internal cost of assembling responses lands on teams that were already at capacity.
| Contractor | Scope | What drives the review |
|---|---|---|
| SMRC | Nationwide, project-based | CMS-directed projects from CERT, OIG/GAO, and data analysis |
| MAC | Jurisdiction | Claims processing; targeted probe & educate; local edits |
| RAC | Region | Post-payment recovery; paid on contingency |
| UPIC | Jurisdiction | Suspected fraud, waste, and abuse |
The organizations that come through SMRC reviews cleanly share the same habits: they monitor active SMRC project lists against their own billing, they audit their high-risk service lines internally before anyone else does, they keep documentation templates aligned with current LCD requirements, and they have a named owner and a calendared workflow for any ADR that arrives — so the 45-day clock never gets discovered on day 30.
None of that requires heroics. It requires treating the SMRC as what it is: a standing, data-driven program that has already told you where it's looking.
CODEMED's AHIMA/AAPC-credentialed auditors have supported provider compliance reviews for over 27 years. We can review your documentation against the same coverage criteria SMRC reviewers use.
