42 CFR §476.96

1. (a)General timeframe. A QIO or its subcontractor—
   1. (1)Within one year of the date of the claim containing the service in question, may review and deny payment; and
   2. (2)Within one year of the date of its decision, may reopen an initial denial determination or a change as a result of a DRG validation.
2. (b)Extended timeframes.
   1. (1)An initial denial determination or change as a result of a DRG validation may be made after one year but within four years of the date of the claim containing the service in question, if CMS approves.
   2. (2)A reopening of an initial denial determination or change as a result of a DRG validation may be made after one year but within four years of the date of the QIO's decision if—
      1. (i)Additional information is received on the patient's condition;
      2. (ii)Reviewer error occurred in interpretation or application of Medicare coverage policy or review criteria;
      3. (iii)There is an error apparent on the face of the evidence upon which the initial denial or DRG validation was based; or
      4. (iv)There is a clerical error in the statement of the initial denial determination or change as a result of a DRG validation.
3. (c)Fraud and abuse.
   1. (1)A QIO or its subcontractor may review and deny payment anytime there is a finding that the claim for service involves fraud or a similar abusive practice that does not support a finding of fraud.
   2. (2)An initial denial determination or change as a result of a DRG validation may be reopened and revised anytime there is a finding that it was obtained through fraud or a similar abusive practice that does not support a finding of fraud.