DME Documentation Requirements: Surviving a DMEPOS Audit

DMEPOS documentation is governed by the supplier standards at 42 CFR § 424.57, the medical-review procedures in CMS Pub. 100-08 Chapter 5, and the LCD/policy article for each HCPCS category. UPIC, SMRC, RAC, and TPE audits sample DMEPOS claims more frequently than almost any other Medicare category. The exposure is real: a typical DME audit produces 15-30% denial rates and recoupment demands that can exceed the practice's quarterly revenue.

What CMS actually requires for a DMEPOS supplier

The DMEPOS Supplier Standards at 42 CFR § 424.57(c) enumerate 30 standards a supplier must meet to bill Medicare. The core operational standards a documentation program must support:

• Maintain accreditation by a CMS-approved accreditation organization under 42 CFR § 424.57(c)(22) — three-year cycle, on-site survey by an approved AO
• Hold a surety bond of $50,000 per location under 42 CFR § 424.57(c)(26)
• Operate from a physical facility on an appropriate site under 42 CFR § 424.57(c)(7)
• Maintain a complaint resolution process under 42 CFR § 424.57(c)(21), with written records of every complaint and resolution
• Submit only claims for items the supplier provided directly and meets the medical-necessity documentation for under 42 CFR § 424.57(c)(11)

The medical-review framework lives in CMS Pub. 100-08 (Program Integrity Manual). Chapter 5 governs DMEPOS-specific medical review. Chapter 3 governs general medical-review principles. Chapter 4 governs benefit-specific procedures.

What DME practices most often miss is the relationship between the LCD, the policy article, and the SWO. The Local Coverage Determination defines the medical-necessity criteria for the HCPCS category. The policy article (separate document published with the LCD) defines the documentation required to prove those criteria are met. The SWO must reflect the ordering provider's clinical determination that the LCD criteria are satisfied. A claim where the SWO is on file but the underlying chart documentation does not support the LCD criteria will deny on review.

The documents you must maintain

A DMEPOS supplier audit binder should produce, per claim, on demand:

• Standard Written Order (SWO) under 42 CFR § 410.38(d) — beneficiary, date, item description, prescribing provider NPI, signature
• Detailed Written Order (DWO) where required by the LCD — itemized order with quantity, frequency, duration
• Proof of Delivery (POD) meeting 42 CFR § 424.57(c)(12) — beneficiary signature, date, HCPCS or item description, address
• Medical records from the treating provider supporting the LCD coverage criteria for the specific HCPCS
• Continuing medical-need documentation where the item is rented or has a defined coverage interval (e.g., CPAP compliance documentation under the LCD for E0601)
• ABN (Advance Beneficiary Notice) under Form CMS-R-131 where item-coverage is uncertain
• Refund and complaint log under 42 CFR § 424.57(c)(21) — every complaint logged, investigated, resolved, documented
• Supplier file with the accreditation certificate, surety bond, NPI verification, all owner/managing employee CMS-855S elements
• Inventory tracking from receipt through dispense, supporting the 42 CFR § 424.57(c)(7) physical-facility standard

Retention: seven years from claim payment date. Some state Medicaid programs require longer.

How DMEPOS audits actually work

Five entities audit DMEPOS claims:

1. DME MACs (Noridian Jurisdictions A and D; CGS Jurisdictions B and C) conduct Targeted Probe and Educate (TPE) under CMS Pub. 100-08 Chapter 3. TPE samples 20-40 claims per provider per round, returns findings, requires education, and can refer to RAC/UPIC for severe issues.

1. UPICs (Unified Program Integrity Contractors) conduct fraud investigations under 42 CFR § 421.300 et seq.. UPICs can request medical records, conduct on-site visits, and refer to OIG or DOJ. Recoupment can be extrapolated under CMS Pub. 100-08 Chapter 8.

1. RACs (Recovery Audit Contractors) conduct post-payment review under CMS Pub. 100-08 Chapter 5. RAC findings can be appealed through the standard five-level Medicare appeals process.

1. SMRC (Supplemental Medical Review Contractor) conducts medical-record-only review under CMS Pub. 100-08 Chapter 6. SMRC does not recoup; it refers to RAC or UPIC.

1. CERT (Comprehensive Error Rate Testing) samples claims annually to produce the Medicare improper-payment rate. CERT findings often drive RAC and UPIC targeting for the next cycle.

What we have seen drive DME audit denials, in order:

• Missing or insufficient face-to-face evaluation documentation supporting the LCD criteria. The SWO is on file, the chart note exists, but the chart does not document the specific criteria the LCD requires.
• POD missing the beneficiary signature or showing a signature where a shipping log was the only delivery evidence.
• SWO predating the face-to-face evaluation — the order was written before the provider documented the medical necessity.
• Item-quantity mismatch between SWO, claim, and POD.
• Continuing medical-need documentation missing for rentals or capped-rental items at the renewal interval defined in the LCD.
• ABN missing for items where Medicare coverage was uncertain and the supplier billed Medicare anyway.

Common gaps unique to DMEPOS

The gaps we see most often in DME audit defense:

• Accreditation lapse during a renewal cycle — the supplier kept billing during a gap.
• Surety bond expiration not tracked. Surety expiration triggers automatic revocation under 42 CFR § 424.57(c)(26).
• CMS-855S not updated within 30 days of an ownership change, address change, or managing-employee change. This is a 42 CFR § 424.516 violation independent of documentation issues.
• Treating physician clinical records held by the prescribing physician but never retrieved into the supplier file. The supplier owns the burden of producing all supporting records under 42 CFR § 424.516.
• Telehealth-originated SWOs without the additional documentation required when face-to-face was conducted via telehealth.
• POD delivered to a third-party shipping address (e.g., a relative's address) without documenting why and obtaining proper signature authority.
• Complaint log treated as a generic customer-service log instead of the supplier-standard log required by 42 CFR § 424.57(c)(21).

Maintenance cadence

• At every dispense: SWO on file before delivery (or before claim, depending on item category), POD signed and dated, item-quantity verified, ABN issued if coverage uncertain.
• Monthly: Sample 10-20 dispensed claims for SWO, POD, and supporting chart documentation completeness. Review the complaint log and verify every complaint has a documented resolution.
• Quarterly: Reconcile inventory; review denied claims by reason; refresh staff training on any LCD changes published in the quarter.
• At each LCD revision: Update the supplier's internal documentation checklist for that HCPCS category. The DME MACs publish LCD revisions on a defined schedule.
• Annually: Re-verify accreditation expiration date (target 90 days before expiration to start the renewal), surety bond status, CMS-855S accuracy, and all owner/managing-employee elements.
• Every three years: Accreditation renewal survey by the AO.
• Always: When an audit letter arrives, the seven-year retention file produces the requested claim documentation within the audit response window (typically 30-45 days for TPE/RAC, with extensions available).

State preemption to watch

State Medicaid DME programs layer additional documentation on top of Medicare DMEPOS:

• California: Medi-Cal DME has its own Treatment Authorization Request (TAR) process under DHCS rules; HCPCS coverage often differs from Medicare.
• Texas: Texas Medicaid DME requires prior authorization on most HCPCS through TMHP; documentation retention is 5 years for Texas Medicaid, but Medicare's 7-year DMEPOS rule controls when both apply.
• New York: Medicaid DME prior-authorization through eMedNY; documentation rules in 18 NYCRR Part 504 and Medicaid manuals.
• Florida: Florida Medicaid DME uses the Florida Medicaid Provider General Handbook; AHCA conducts its own DME audits independent of Medicare contractors.

Suppliers billing both Medicare and Medicaid maintain documentation to the stricter standard.

How d3rx fits

The d3rx compliance binder includes a DMEPOS section that names the SWO and POD templates, the LCD-by-HCPCS-category documentation matrix, the complaint log, the supplier-standards checklist tied to 42 CFR § 424.57, and the audit-response workflow for TPE, RAC, UPIC, and SMRC requests. See the compliance binder overview or the audit defense surface for the broader audit-response structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.