Download signNow app
4.7 / 5 rating on

Certificate Of Medical Neccessity CMS-846 Form

Use a Fillable Online Certificate Of Medical Neccessity CMS 846 template to make your document workflow more streamlined.

What the CMS-846 Form does

The Certificate Of Medical Neccessity CMS-846 Form records a healthcare provider’s certification that a requested item or service is medically necessary. The form typically connects patient information, clinical justification, provider identification, and signatures for payer or program review. Because requirements can vary by payer and service, the submitting organization should verify the current CMS-846 instructions and supporting documentation before sending. With signNow, a sender uploads the form, checks fillable fields, routes it to authorized signers, and stores the completed PDF with an audit trail.

How the CMS-846 workflow works

The CMS-846 process moves from document preparation through authorized signatures and secure recordkeeping in four clearly documented stages.

  • Upload the form: Upload the CMS-846 document and review its medical-necessity fields.
  • Check fields: Auto-detect fillable areas, then verify provider and patient information.
  • Request signatures: Send the completed form to authorized healthcare signers.
  • Archive records: Store the signed certificate with its audit trail.

What the CMS-846 audit trail records

A signNow audit trail preserves technical evidence surrounding the CMS-846 signing event, helping healthcare teams demonstrate who acted, when, and on which document.

01

Authenticate signer:

Records the signer’s email, authentication event, and access activity.
02

Capture timestamp:

Captures the exact time each CMS-846 action occurs.
03

Hash document:

Associates the completed form with document integrity data.
04

Seal record:

Seals completed content against unauthorized post-signature changes.
05

Log activity:

Records views, fields, signatures, and completion events.
06

Export audit trail:

Allows authorized users to retrieve or export evidence.

Recommended CMS-846 workflow setup

Configure the CMS-846 workflow around signer identity, document integrity, protected health information, and the organization’s applicable retention policy.

SettingRecommendation
Authentication methodSMS OTP for signer identity
Signature typeIntent-based electronic signature
Audit trailRetain and export completion evidence
Document retentionSix years for HIPAA records
EncryptionAES-256 at rest and TLS 1.2/1.3 in transit
be ready to get more
Get legally-binding signatures now!
  • Best ROI. Our customers achieve an average 7x ROI within the first six months.
  • Scales with your use cases. From SMBs to mid-market, airSlate SignNow delivers results for businesses of all sizes.
  • Intuitive UI and API. Sign and send documents from your apps in minutes.

Security controls for CMS-846 data

Data at rest:

AES-256 encryption at rest

Data in transit:

TLS 1.2/1.3 encryption in transit

Healthcare safeguards:

HIPAA compliance with BAA

Control assurance:

SOC 2 Type II certification

Security management:

ISO 27001 certification

Electronic signatures:

eIDAS SES on all plans

Platform requirements for CMS-846

The CMS-846 workflow runs in Chrome, Firefox, Safari, or Edge on Windows and macOS, while signNow mobile apps support iOS and Android. TLS 1.2 or TLS 1.3 protects data in transit during document access and signing.

  • Browser support Chrome, Firefox, Safari, and Edge on Windows or macOS.
  • Mobile access iOS and Android mobile apps support signing and review.
  • Connection security TLS 1.2 or 1.3 protects transmitted form data.

Healthcare organizations should use managed Windows, macOS, iOS, or Android devices with current security updates. Administrators can connect signNow through API access, SSO provisioning, and supported integrations, then configure authentication and retention controls for records containing protected health information.

CMS-846 processing and signing timeline

Processing time depends on form accuracy, signer availability, and the healthcare organization’s review and archival procedures.

01

Prepare the document

Confirm the current CMS-846 version, medical details, provider data, and required attachments.
02

Deliver to signers

Send the completed form by email or a controlled signing link.
03

Complete signer review

Authorized providers and representatives review required fields and sign.
04

Archive completion

Download the signed form and audit trail for records.

Retention rules for CMS-846 records

Apply the retention rule matching the record’s legal context; healthcare organizations handling protected health information should evaluate the HIPAA period and any longer state or payer requirement.

01

Six years: HIPAA records

HIPAA 45 CFR 164.530(j) establishes the six-year retention period.
02

Three years: tax records

IRC §6501(a) generally covers tax records for three years from filing.
03

Six years: tax understatement

IRC §6501(a) permits six years when income understatement exceeds 25%.
04

Three years: payroll records

29 CFR §516.5 requires three years for covered payroll records.
05

Five years: injury records

29 CFR §1904.33 requires five years following the injury-record year.

Privacy pitfalls in CMS-846 workflows

  • Including patient identifiers or clinical details in an unintended recipient’s copy exposes protected health information beyond the CMS-846 workflow.
  • Sending the certificate before capturing required patient or provider consent can create an incomplete authorization record for the healthcare transaction.
  • Assigning a physician’s signature field to another staff member weakens attribution and may require the CMS-846 form to be corrected.
  • Leaving completed CMS-846 files in personal email or unmanaged storage increases unauthorized-access and retention-control risk.

Best practices for CMS-846 records

Accurate preparation, documented signer authority, audit-trail preservation, and healthcare-specific retention controls make the completed CMS-846 easier to review and defend.

Verify every medical-necessity field before sending

Before sending, compare every patient, provider, diagnosis, equipment, and service entry with the source clinical or billing record. Confirm that the signing roles match the current payer instructions and that no required attachment or authorization is missing from the CMS-846 package.

Export the signed certificate and audit evidence

Export the signed CMS-846 PDF and its audit trail together after completion. Preserve the original file names, completion date, signer identities, and related supporting documents so reviewers can connect the certificate with the underlying healthcare transaction.

Apply the correct healthcare retention period

Apply the retention period that matches the record category and jurisdiction. For HIPAA-covered records, 45 CFR 164.530(j) specifies six years from creation or the last effective date, while state, payer, or contractual rules may require longer preservation.

Archive protected information under controlled access

Restrict CMS-846 access to personnel with a documented business need, use managed storage, and review sharing permissions periodically. Protected health information should not remain in personal inboxes, local downloads, or unapproved collaboration folders after signing.

Key features for CMS-846 completion

signNow organizes the CMS-846 process around accurate field completion, authorized provider signatures, audit evidence, and controlled storage of the finished healthcare document.

Form preparation

Upload the CMS-846 PDF and verify its patient, provider, diagnosis, and equipment fields before sending it for signature.

Signer routing

Assign provider, supplier, or representative fields to specific recipients and preserve the intended signing sequence.

Reusable templates

Use templates to standardize recurring CMS-846 field placement without altering the form’s substantive medical information.

Audit evidence

Capture timestamps, signer activity, and completion evidence alongside the signed CMS-846 document.

Data protection

Protect transmitted and stored form data through TLS and AES-256 encryption controls.

Secure archiving

Download the signed certificate and audit trail for controlled healthcare recordkeeping.

Integrations for CMS-846 workflows

Connect CMS-846 signing with healthcare records, document storage, and operational systems to reduce duplicate entry and preserve controlled completion evidence.

Salesforce
Procore
Zapier
Microsoft Teams
Hub spot
Box
Microsoft

CMS-846 troubleshooting questions

Resolve form-specific upload, field assignment, authentication, signature, plan, and retention questions before sending a Certificate Of Medical Neccessity CMS-846 Form.

Upload the original CMS-846 PDF again and confirm that its file type and size meet signNow upload requirements. The Business plan includes document templates and audit trails, allowing the sender to recreate the workflow without changing the medical information entered on the form.

Confirm that every required provider, patient, diagnosis, equipment, and signature field is assigned to the correct signer. signNow’s field editor lets the sender add or reassign fields before delivery, reducing incomplete submissions and preserving the intended signing order.

Use signNow SMS authentication or another available signer-authentication control when identity assurance is needed. HIPAA-covered workflows require appropriate safeguards, and signNow states that HIPAA compliance requires a Business Associate Agreement before handling protected health information.

A typed or drawn eSignature can satisfy ESIGN and UETA when intent, consent, attribution, and record retention are demonstrated. The audit trail records signing events, while the healthcare organization remains responsible for confirming CMS-846 payer and program requirements.

Business includes templates and audit trails, while Business Premium adds bulk send and kiosk mode. If repeated CMS-846 distribution exceeds the selected plan’s included signature invites, review the plan’s allowance and applicable overage terms before sending.

Export the completed document and signNow audit trail after all parties sign, then store both under the organization’s records policy. HIPAA records generally require six years from creation or the last effective date under 45 CFR 164.530(j).

ROI at a Glance

Key performance indicators that demonstrate SignNow's proven track record.

28M+Documents signed
13+Years in business
4.6/5Average G2 rating

BE READY TO GET MORE

Get this form now!

If you believe that this page should be taken down, please follow our DMCA take-down process.