Written by Amanda McGurk · Published 14 November 2026 · Last reviewed 14 November 2026
Reviewed by: Jessica Miller, MHA, CPC, CPC-I, Head of Coding Operations
CDI query retention should keep every physician query, with its clinical indicators, options and response, retrievable beside the chart it changed. ADR reporting should let your team pull each record, query and code change inside the CMS window: 45 calendar days for most contractors, 30 for a UPIC.
| Figure | Number | What it means for a CDI or HIM director |
|---|---|---|
| CMS response window for a MAC, SMRC or RAC records request | 45 calendar days | The clock that runs while your team finds the query, the passage and the change history |
| CMS response window for a UPIC records request | 30 calendar days | A shorter clock, and a reason the record has to be a lookup |
| What happens when records arrive late | The contractor "has authority to deny the claim" | Under 42 CFR 405.930, a slow search can cost the claim |
| Where a compliant query must live | Health record or business record | The August 2026 AHIMA and ACDIS brief requires every actual query to be retrievable |
| Federal minimum for hospital medical records | At least 5 years | Applies to a query kept in the health record, under 42 CFR 482.24(b)(1) |
| Federal minimum for critical access hospital records | At least 6 years from the last entry | Longer if state law requires it, under 42 CFR 485.638(c) |
Response windows come from the CMS Additional Documentation Request page. The query standard comes from the AHIMA and ACDIS Guidelines for Achieving a Compliant Query Practice , August 2026 edition. Retention minimums come from 42 CFR 482.24 and 42 CFR 485.638 .
What is CDI query retention, and why does it sit next to ADR reporting?
CDI query retention is your organization's rule for where each physician query and its response are stored, who can retrieve them, and how they reach a contractor when a claim is reviewed. It sits next to ADR reporting because a query can change a diagnosis, and the diagnosis can change the payment a reviewer is checking.
The current standard is the 2026 edition of the AHIMA and ACDIS query brief. ACDIS announced it on 27 August 2026 and said the new version "replaces all previously published editions." If your query policy still cites the 2022 update, put it on the review calendar.
The brief also pulls your partners into scope. Its definition of a query professional includes "any vendor or technology platform acting in a query-generating capacity on behalf of a covered organization." If an outside CDI team or a software tool queries your physicians, its records are part of your query program.
This article is about the query record and the reports around it. For what a code-level trail records on each code, see our guide to what a medical coding audit trail must show .
What does the 2026 AHIMA and ACDIS brief require you to keep?
The brief requires that "all queries (i.e., actual queries) either be a permanent part of the health record or be retrievable in the business record." You pick which. Either way, the query has to be retrievable.
Three more requirements shape a retention policy:
- Responses stay consistent. Query responses "must be incorporated into the health record or available in the business record." They "must remain consistent with the overall health record," and if later documentation conflicts with a response, "additional clarification is required."
- Verbal queries are recorded. A verbal query must be noted with the date and time and individuals involved, the clinical indicators and their source, the nonleading query statement, the answer options and the provider's verbal response. The brief says this lets verbal queries be "recorded and tracked in the same manner as written queries and to be discoverable to other departments and external agencies." A verbal response "must be documented in the permanent health record to be coded."
- Policy covers storage and technology. The brief's policy outline asks you to define "whether queries are part of the legal health record or business record," their "inclusion in release of information processes, in collaboration with HIM," and "governance of technology, including AI tools, automated prompts, and documentation nudges."
The brief sets no retention period in years. It says "all queries should be retained according to state regulations and organizational policies," covering written, verbal and technology-generated queries. If your policy puts queries in the health record, federal minimums for medical records apply: hospitals keep records "for a period of at least 5 years" under 42 CFR 482.24(b)(1) , and critical access hospitals keep them "for at least 6 years from date of last entry, and longer if required by State statute" under 42 CFR 485.638(c) . State law can require longer. Set the period with HIM and counsel, and write it down.
What should a query record hold so it survives a records request?
A query record survives a records request when a person who never touched the chart can open it and see what was asked, why, what came back and what changed. Treat these seven fields as the floor.
| Field | What it holds | Why a reviewer needs it |
|---|---|---|
| Encounter and chart | The account the query belongs to | Ties the query to the claim under review |
| Author and date | Who sent it, and when | Shows who asked and whether it came before coding |
| Clinical indicators | The indicators cited, with their location in the record | Shows the query had a clinical basis |
| Question and options | The nonleading statement and the answer options offered | Shows the query did not lead the provider |
| Response | The provider's authenticated answer | The documentation the code rests on |
| Coding disposition | The code change, or no change, that followed | Links the answer to the billed code |
| Escalation | Any escalation when a provider did not document a response | Explains a verbal answer that never reached the record |
The brief also covers software. It says queries generated by technology, including prompts and nudges, "are subject to the same compliance standards as manually constructed queries." It adds that "organizations should not assume that a vendor-supplied or EHR-integrated tool produces compliant queries by default." Its policy outline adds "vendor vetting and compliance review of technology query tools" and "processes for human review of technology-generated queries." Both belong on your partner checklist.
How should you answer a Medicare ADR from a MAC, RAC, SMRC or UPIC?
Answer it from records your team can already find. CMS says an ADR asks for "medical record documentation to support payment" against "Medicare's coverage, coding, payment and billing policies."
The CMS ADR page sets the clocks. You get 45 calendar days for MAC prepayment review, and 45 days for post-payment review by a MAC, the Supplemental Medical Review Contractor (SMRC) or a Recovery Audit Contractor (RAC). A Unified Program Integrity Contractor (UPIC) allows 30 calendar days. A contractor may accept late records for good cause, which CMS describes as situations such as natural disasters or interruptions in business practices. If the documents do not arrive in time, 42 CFR 405.930 gives the contractor "authority to deny the claim."
A worked example. A RAC sends an ADR for an inpatient account. During the stay, a CDI specialist queried the attending about a diagnosis the record suggested but did not state. The physician answered, and the coder added the code.
- Put a copy of the ADR letter on top. CMS calls this best practice, so the record matches the right patient and claim.
- Pull the record for the billing period, including any earlier documentation that supports it.
- Add the query as sent, with its clinical indicators and options, and the physician's documented response.
- Add the code-level record for the queried code: the passage after the response, the rule applied and the change history.
- Check that the response matches the rest of the record. If it conflicts, that is a clarification issue to settle before you submit.
- Submit through a route CMS lists: mail, esMD, the MAC portal, fax, or CD, DVD or USB.
If steps 3 and 4 mean searching an inbox, a separate CDI tool and the coding system, your retention policy has a gap. Close that gap in policy while no ADR clock is running.
Which reports should a CDI director be able to run?
A CDI director should be able to run reports by facility, physician, date and reviewer that answer the questions auditors, compliance committees and coding managers ask. The 2026 brief says organizations "should monitor query volume as part of their audit and compliance programs" and check whether high query rates "for specific providers, units, or diagnoses" point to education needs. It also says organizations "should track query response rates and average response times as part of their compliance monitoring program."
| Report question | Who asks it | What the report should show | What to confirm in a demo |
|---|---|---|---|
| Which accounts does this ADR cover? | Revenue integrity | Each account with its codes, query and change history | Can you pull every listed account in one pass? |
| Which queries went out, and what happened? | CDI director | Each query with its response and the chart it belongs to | Are verbal queries recorded the same way as written ones? |
| Where are queries concentrated? | CDI director, physician advisor | Query volume by provider, unit and diagnosis | Which of these filters are live today? |
| Are physicians answering? | CDI director | Response rates and average response times | Are open queries escalated and closed per policy? |
| Where did coders change codes? | Coding manager, compliance | Overrides by coder, specialty and date | Does it show who changed what, and when? |
| How are volume, accuracy and turnaround trending? | HIM director, CFO | Results by facility and specialty | How is accuracy measured, and by whom? |
The brief sets no target for response or agreement rates, so any vendor benchmark for either is that vendor's own measure. Ask how it is calculated. Case mix index and CC or MCC capture analytics belong on your demo list as questions. For audit formulas, see how periodic coding audits measure CDI effectiveness .
What should you ask a CDI or coding partner in a demo?
Bring a closed account where a query changed a code, and ask the partner to work it live.
- Query record. Show the query, the response and the chart together, for verbal and written queries alike.
- Code evidence. Open the queried code. Does it show the chart passage and the rule behind it?
- Change history. Does every change to the chart record who made it?
- ADR test. Given a mock list of accounts, how long does it take to pull each record, and in what format?
- Exports. What leaves the platform: finished coding only, or the query and code records too? Is a per-reviewer export available?
- Report filters. Which of facility, physician, date and reviewer can you filter on today?
- Technology queries. If the tool prompts physicians, how does it meet the brief's standards for clinical indicators and answer options, and who reviews those prompts?
- Release of information. How do query records reach HIM for release of information?
If the partner cannot show items 1 to 4 on a real account, record that as a finding.
How does MediCodio AI keep queries, codes and changes together?
MediCodio AI keeps a 100% code-level audit trail: every code ships with its documentation passage and the compliance rule behind it. The product page describes the rest, and these lines are quoted from it.
- Physician Query Portal: "A documentation question goes to the physician and comes back in the platform, with the query, the response and the chart it belongs to held together."
- Audit and Compliance: "Every change to a chart is logged with who made it, and every code keeps the documentation passage and compliance rule behind it, so an audit response is a lookup rather than a reconstruction."
- Prediction Trail: "Open any code and see the passage of the chart it came from and the guideline that justified it."
- Analytics and Reporting: "Volume, accuracy and turnaround across facilities and specialties, and a coder's own accuracy trend, throughput and override patterns."
On exports, the product page says "Finished medical coding leaves as an Excel export or writes back into the system the chart arrived from." That covers finished coding. Ask us how query and trail records are produced for an ADR, and test the answer on your own accounts.
Complete charts flow through AutoPilot for fully autonomous coding. Charts where the documentation is thin or contradictory stay in CoPilot, where certified coders review and finalize the output. In either lane, every code carries its passage and rule. See how this fits hospital teams , or read more about AI medical coding .
What has not changed?
No record protects a claim from review. Your organization still answers for the documentation it submits, the queries it sends and the codes it bills. A retained query shortens the search. It does not change what the documentation supports.
The 2026 brief also says it is not a basis for denying claims, and that "substantial compliance with the principles in this brief, rather than rigid technical adherence to any specific element, is the appropriate standard for external review." CMS still sets the ADR clocks. OIG's General Compliance Program Guidance still says risk assessments "should be conducted at least annually," with audits scheduled from them. For what auditors ask about AI-assigned codes, see what auditors ask for .
Frequently asked questions
How long should CDI queries be retained?
The 2026 AHIMA and ACDIS brief sets no period in years. It says queries should be retained under state regulations and organizational policy. A query kept in the health record follows medical-record rules: at least 5 years for hospitals under 42 CFR 482.24, and at least 6 years for critical access hospitals, longer where state law requires.
Should physician queries be part of the permanent medical record?
Either choice can be compliant. The brief lets each organization decide whether queries belong to the legal health record or the business record, as long as they stay retrievable. A response to a verbal query must be documented in the permanent health record before the code it supports can be assigned.
How many days do you have to respond to a Medicare ADR?
CMS gives 45 calendar days for MAC prepayment review and for post-payment review by a MAC, SMRC or RAC, and 30 calendar days for UPIC reviews. A contractor may accept late records for good cause. If records do not arrive in time, 42 CFR 405.930 gives the contractor authority to deny the claim.
Can a Recovery Audit Contractor see CDI queries?
A RAC's ADR asks for the medical record documentation that supports payment. If a query and its response are part of that record, or explain a code under review, they can belong in the response. The 2026 brief says recorded verbal queries should be discoverable to external agencies, and asks policies to cover release of information with HIM.
Does a vendor tool make queries compliant by default?
No. The 2026 brief says technology-generated queries, including prompts and nudges, must meet the same standards as manual queries, and that organizations should not assume a vendor-supplied or EHR-integrated tool produces compliant queries by default. Query professionals and compliance leaders should evaluate, configure and monitor any such tool.
Book a Demo and we will run an accuracy check on a sample of your own charts, with the documentation passage and rule behind every code, before you commit to anything. Book a Demo
Related reading: What a medical coding audit trail must show · How periodic coding audits measure CDI effectiveness · How many charts a coding audit should review · MediCodio AI for health systems
Sources
- AHIMA and ACDIS, Guidelines for Achieving a Compliant Query Practice , August 2026.
- ACDIS, Note from the ACDIS Director: Publication of the 2026 Version , 27 August 2026.
- eCFR, 42 CFR 482.24, Condition of participation: Medical record services .
- eCFR, 42 CFR 485.638, Conditions of participation: Clinical records .
- CMS, Additional Documentation Request (ADR) .
- eCFR, 42 CFR 405.930, Failure to respond to additional documentation request .
- HHS Office of Inspector General, General Compliance Program Guidance , November 2023.
- MediCodio AI, Product .