See bold sections below:

15.33(1) Prohibitions. This rule applies to all claims paid on or after January 1, 2002:

Overpayment/Recoupment

a. Absent a reasonable basis to suspect fraud, an insurer may not audit a claim more than two years after the submission of the claim to the insurer. Nothing in this rule prohibits an insurer from requesting all records associated with the claim.

b. Absent a reasonable basis to suspect fraud, an insurer may not audit a claim with a billed charge of less than $25.

15.33(2) Standards.

a. In auditing a claim, the insurer must make a reasonable effort to ensure that the audit is performed by a person or persons with appropriate qualifications for the type of audit being performed.

b. In auditing a claim, the auditor must use the coding guidelines and instructions that were in effect on the date the medical service was provided.

15.33(3) Contents of audit request. All correspondence regarding the audit of a claim must include the following information:

a. The name, address, telephone number and contact person of the insurer conducting the audit,

b. The name of the entity performing the audit if not the insurer,

c. The purpose of the audit, and

d. If included in the audit, the specific coding or billing procedure that is under review.

See https://www.legis.iowa.gov/docs/iac/chapter/07-26-2023.191.15.pdf