You Went Paperless. Can You Still Produce the Order Medicare Asks For? The 7-Year Retention Gap

Scanning solved storage. It did not solve retrieval.

Most DME suppliers moved off paper years ago. Orders arrive by fax or email, a coordinator saves them as PDFs, and the originals go in a box or the shredder. On a normal day that works fine.

The trouble shows up in an audit. Medicare expects a supplier to keep the written order, the supporting medical records and the proof of delivery for years after the date of service. Seven years is the retention period most compliance teams plan around for DMEPOS, and HIPAA adds a separate six-year requirement for its own policies and documentation. A file named scan0042.pdf in a folder nobody has cleaned since 2022 does not meet either expectation in any practical sense.

"An auditor does not ask whether you have the document. They ask you to hand it over, complete, legible and tied to one patient and one claim."

Picture a supplier with 4,000 active patients. A reviewer asks for the order, the face-to-face note and the delivery ticket on a power-chair claim from 2023. The order was faxed, scanned twice under two spellings of the patient's name, and the delivery ticket sits in a driver's photo roll. Nothing is missing in the strict sense. Everything is simply somewhere else.

Where scanned records break down

These are the failure points we see most often in intake workflows that look tidy from the outside. The risk ratings reflect how often a gap turns into a denial or a takeback once a reviewer is involved.

What a retrieval failure costs

An ADR you cannot answer is treated as a missing record. The claim is denied, and for claims already paid the contractor can seek the money back. Teams then pay twice: once in lost revenue, and again in staff hours spent searching through drives and inboxes for documents that should have taken minutes to pull.

There is a quieter cost too. Reviewers who see an incomplete response tend to widen the sample. One missing order can turn into a request for a larger batch of claims from the same period, and those depend on the same messy filing.

Five things an audit-ready record needs

None of this needs a big technology project to start. It needs a few rules applied at the moment a document lands, because that is the cheapest moment to fix a problem.

1. One patient record, one identifier

Every order, note and delivery ticket should attach to a single patient ID and, where it applies, a claim or order number. Duplicate charts for the same person are the most common reason a search comes back half empty.

2. A completeness check on arrival

Check page count, signature, date, NPI and the ordered item before the file is saved. A coordinator who spots a missing page on the day it arrives can call the referrer that afternoon. Three years later nobody can.

3. Originals stay untouched

Keep the file exactly as received and make edits on a copy, with a note of who changed what and when. An overwritten original is hard to defend, even when the edit was innocent.

4. A written retention rule

Decide how long each record type is kept, who can access it, and who approves deletion. Put it on one page. Your compliance lead will want it in the next risk analysis anyway.

5. A retrieval drill

Once a quarter, pick five closed claims at random and time how long it takes to assemble the full packet. If it takes more than an hour per claim, you have found your next project.

Why people can't fix this by working harder

Your intake team is not the weak link here. A coordinator handling a few dozen faxes a day cannot also open each PDF, count pages, compare the signature date against the order date and rename the file properly. Something gives, and what gives is the check that nobody sees until an audit.

"The records you can defend are the ones somebody looked at on the day they arrived."

That is the argument for moving validation to the front of the workflow. A document that is checked, indexed and linked at intake costs seconds. The same document reconstructed during an ADR costs days, and sometimes the claim.

Where to start this week

Pull ten paid claims from 2023 and try to assemble the full packet for each: order, supporting notes, proof of delivery. Write down how long each took and what was missing. That one exercise tells you more about your audit exposure than any policy document will, and it gives you a concrete list to take to your compliance lead.

If more than two of the ten come up short, the fix is a change to your intake workflow rather than a one-time cleanup, because the same gaps are being created again every day.