How to respond to a Medicare ADR by fax: deadline, cover page, proof

A Medicare ADR gets 45 calendar days for a response, or 30 for a UPIC, and CMS's manual tells contractors to deny the claim when records arrive late. CMS calls a copy of the ADR letter as page one a best practice, and the fax goes to the number on the letter with only the records the letter names.

How do you respond to a Medicare ADR by fax?

A Medicare additional documentation request (ADR) is answered by fax when the letter lists fax among its methods: the records the letter names go to the fax number it prints, within 45 calendar days, or 30 for a UPIC, with the contractor's chosen first page on top. The Program Integrity Manual, chapter 3, tells the MACs, CERT, the SMRC and the RACs to accept paper, fax, CD or DVD, esMD and their website portals, and it tells reviewers to state in each ADR letter which methods they accept.

CMS's esMD page calls esMD voluntary and says providers content with faxing or mailing may continue. No patient authorization is needed: CMS's sample MAC letter says providing Medicare patients' records to the MAC program does not violate HIPAA, and 45 CFR 164.506(c)(3) permits disclosures for the payment activities of the entity that receives them.

ADRs reach the Medical Review Correspondence Address in PECOS, which CMS's ADR page asks providers to keep current. The enrollment forms call it the Medical Record Correspondence Address (CMS-855B section 2A4, CMS-855I section 2E, CMS-855A section 2D). On the CMS-855I that section does not apply to a practitioner who reassigns all benefits to a group, so a group practice checks the address on the group's enrollment record.

CMS's July 10, 2025 MLN Connects alert says CMS generally does not initiate audits by fax or email unless a provider asks, and it says to confirm a suspicious request with the Medical Review Contractor before answering. The Review Contractor Directory lists each state's contractors.

Who sends ADRs, and how long do you have?

ADRs come from Medicare Administrative Contractors (MACs), Recovery Audit Contractors (RACs), the Supplemental Medical Review Contractor (SMRC), the CERT program and Unified Program Integrity Contractors (UPICs), and the Program Integrity Manual gives 45 calendar days for a MAC, RAC or SMRC request and 30 for a UPIC. CMS's ADR page places post-payment reviews by MACs, the SMRC and RACs under 42 CFR 405.929, and the manual adds CERT. The table sets each sender beside its clock and its fax rule.

Contractors may accept documentation after the 45-day or 30-day time frame for good cause, and CMS encourages providers who need more time to work with their MAC.

What goes first, and what stays off the fax?

The first page is the one the contractor names: a copy of the ADR letter, which CMS calls best practice so the records match the right patient and claim, or the response cover sheet the letter encloses. A home-made fax cover sheet goes on only when the contractor asks for one. The contractors' own instructions differ:

• CGS's DME MAC Jurisdiction B ADR page says to use the ADR letter as the cover sheet, because its system will not recognize your own.
• First Coast's CERT fast facts say to use the barcoded cover sheet as the only one and to send a separate fax for each claim.
• CMS's sample MAC post-payment letter, in the Program Integrity Manual exhibits, places the enclosed ADR Response Cover Sheet Form on top, with a Post Pay ADR Response Separator Sheet between the responses for each Document Control Number (DCN).
• Palmetto GBA's ADR Response Cover Sheet (MR-JJ-A-3000, MR-JJ-B-3000, MR-JM-A-3000, MR-JM-B-3000) takes one sheet for each claim and DCN, with every field required.
• The SMRC's How to Respond page places its SMRC Response Cover Sheet on top of each claim, and its fax page asks for a fax cover sheet with the page total, Noridian SMRC and the provider's name and contact information.
• Noridian's JE Part B page accepts the ADR letter on top of each claim, or a provider letter or form carrying the facility contact, Medicare ID, facility name, provider number, DCN and date of service.
• CGS Part A's page on what to send asks for a copy of the ADR letter with each claim and a cover sheet naming a contact with a name, email and telephone number.
• CGS Part B's ADR article says the QR barcode at the bottom right of the letter's first page indexes the response to the pended claim.
• WPS's ADR guide has providers return the letter with the records, using the state's Development Resolution form, and never answer through the PWK process.

A PWK claim cover sheet is no ADR cover: CGS's Part B PWK Fax/Mail Cover Sheet says it should not be used to fax an ADR response. Whether a Medicare claim can be faxed covers the PWK side.

The manual bars every review contractor from requesting psychotherapy notes as defined in 45 CFR 164.501, and CMS's sample MAC letter asks for no Powers of Attorney, Living Wills or correspondence.

Which records should you send?

The records to send are the ones the ADR names, because the Program Integrity Manual requires contractors to list only the pieces of documentation needed to make a determination. CMS's ADR page asks for documentation that supports the services for the billing period under review, which may include records from before that period. Novitas's JH ADR page limits a response to the requested date of service and procedure code, and CGS Part A asks for no entire charts.

CMS's signature requirements fact sheet, MLN905364, says a contractor that needs a signature attestation or log will ask whether the billing entity wants to submit one within 20 calendar days. The manual makes the billing provider whose payment is at risk responsible for the response, even when another clinician holds the records, and CMS's sample letters require a response by the due date even when the records cannot be found.

CMS's fact sheet MLN4840534 cites 42 CFR 424.516(f), which requires providers of covered ordered, certified, referred or prescribed Part A or B services to keep that documentation for 7 years from the date of service. The fact sheet warns that failing those requirements may lead to revocation of Medicare enrollment under 42 CFR 424.535(a)(10).

How do you prove the response arrived on time?

An ADR response counts as on time when the contractor receives it, so the proof that matters is the contractor's own confirmation or claim status, kept beside the sender's delivery record. Cotiviti's submission instructions say an "OK" on a fax machine means the sender's own fax server took the transmission, not necessarily Cotiviti. The manual encourages the MACs, CERT, the SMRC and the RACs to confirm every successfully received fax where they can.

The SMRC's FAQ asks providers to submit documents once and to look for confirmation responses on fax and esMD. CGS Part A lets providers watch the S M50MR status/location in FISS to verify that CGS received the documentation. Palmetto GBA asks senders to verify the transmission and re-fax every page after an interruption, and it will not accept duplicate responses.

For esMD, the receipt date is the esMD Cloud receipt date, or the next business day when that falls outside the contractor's hours. How to tell if a fax went through covers the sender's side of the record.

Novitas asks for faxes of 200 pages at most and requires a copy of the ADR letter with each. Noridian JE Part B asks for another method when records run past 200 pages or are too large for one transmission, and it asks for each ADR to be faxed separately after the previous one finishes. Cotiviti advises against single transmissions over 50 pages.

What happens if the response is late or incomplete?

A late ADR response leads to a denial, because the manual tells contractors to deny claims when documentation is not received in time, under 42 CFR 405.930. The manual's codes for an unanswered ADR include remark code M127, missing patient medical record for this service, with reason code 50. Palmetto GBA's cover sheet says claims are denied automatically on day 46.

A late arrival can still be reopened at some contractors. The manual gives a MAC discretion to reopen when the records arrive within a reasonable number of days, generally 15 calendar days after the denial date, and a MAC that reopens has 60 calendar days to decide. CGS Part A allows a 56900 reopening within 120 days of the denial, outside the appeals process, and Noridian's JE Part B reopening process takes a faxed Reopening form with the records inside the time frame printed on that form. A Recovery Auditor does not reopen.

The manual's CERT chapter 12 makes a claim with no documentation within 60 days of the first CERT ADR a no documentation error with error code 99, and CMS's sample CERT letter warns that missing records lead to claims adjustments or overpayment recoupment through the MAC.

After a denial, the appeal clock is 120 calendar days. 42 CFR 405.942 sets the redetermination deadline from receipt of the initial determination, which it presumes happened 5 calendar days after the notice date. CMS's redetermination page takes the request in writing, on form CMS-20027 or in a letter with the required information.

How do other Medicare reviews and audits compare?

Other Medicare reviews use the same fax job with their own scale and clocks: Targeted Probe and Educate typically reviews 20 to 40 claims a round, a Recovery Auditor pays for copies, and Medicare Advantage plans collect records for risk adjustment data validation. CMS's TPE page gives at least 45 days to make changes before another 20 to 40 claims are reviewed, up to 2 additional times. CGS Part A asks for its TPE ADR Documentation Cover Sheet with each TPE claim.

A Recovery Auditor's complex review needs the medical record, so the RAC issues an ADR. RACs pay a maximum of $15.00 per record, including first class postage, for documents sent by mail, fax, CD or DVD, and the MACs, the SMRC, CERT and UPICs are not required to pay.

For Medicare Advantage, 42 CFR 422.310(e) requires MA organizations and their providers to submit a sample of medical records for risk adjustment data validation, as CMS requires.

How do you answer an ADR from a HIPAA fax account?

An ADR answered from Fax Pigeon starts with the ADR letter or the contractor's response cover sheet as page one, since Fax Pigeon's cover sheet is optional. The records the letter names follow as a PDF from the browser or from email, under the BAA signed at signup. Each delivered fax gets delivery proof, kept beside the contractor's own confirmation or claim status. A faxed confirmation or follow-up from the contractor lands in the shared inbox, where roles and assignment route it to whoever is preparing the response.

* Official sources (CMS, the eCFR, CGS) were read on October 19, 2026. Fax Pigeon prices and plan terms as of October 20, 2026.