42 CFR §476.88

1. (a)Authorization to examine records. A facility claiming Medicare payment must permit a QIO or its subcontractor to examine its operation and records (including information on charges) that are pertinent to health care services furnished to Medicare beneficiaries and are necessary for the QIO or its subcontractor to—
   1. (1)Perform review functions including, but not limited to—
      1. (i)DRG validation;
      2. (ii)Outlier review in facilities under a prospective payment system; and
      3. (iii)Implementation of corrective action and fraud and abuse prevention activities;
   2. (2)Evaluate cases that have been identified as deviating from the QIO norms and criteria, or standards; and
   3. (3)Evaluate the capability of the facility to perform quality review functions under a subcontract with the QIO.
2. (b)Limitations on access to records. A QIO has access to the records of non-Medicare patients if—
   1. (1)The records relate to review performed under a non-Medicare QIO contract and if authorized by those patients in accordance with State law; or
   2. (2)The QIO needs the records to perform its quality review responsibilities under the Act and receives authorization from the facility or practitioner.
3. (c)Conditions of examination. When examining a facility's operation or records the QIO must—
   1. (1)Examine only those operations and records (including information on charges) required to fulfill the purposes of paragraph (a) of this section;
   2. (2)Cooperate with agencies responsible for other examination functions under Federal or Federally assisted programs in order to minimize duplication of effort;
   3. (3)Conduct the examinations during reasonable hours; and
   4. (4)Maintain in its principal office written records of the results of the examination of the facility.