Health care fraud is a persistent and costly problem for both commercial and government payors. The Centers for Medicare & Medicaid Services (CMS) estimates that a significant amount of fee-for-service payments are misspent on improper payments every year, including last year when the “bulk of misspent money—$45.8 billion—went to the CMS fee-for-service program.”*
This column summarizes the major types of CMS audits that could affect physicians, as well as the entities responsible for them. It is intended to present a high-level overview of seven common audits, which include the following:
- Medicare Recovery Audit Contractors (RACs)
- Medicaid RACs
- Medicaid Integrity Contractors (MICs)
- Zone Program Integrity Contractors (ZPICs)
- State Medicaid Fraud Control Units (MFCUs)
- Comprehensive Error Rate Testing (CERT)
- Payment Error Rate Measurement (PERM)
In addition, surgeons may be subject to audits conducted by the U.S. Department of Health and Human Services (HHS) Office of the Inspector General (OIG), Medicare Administrative Contractor (MAC) prepayment reviews or audits, or the RAC Prepayment Review Demonstration Program.
What are the types of audits and what is the focus and scope of each? Who conducts these audits, and how far back can an auditor review submitted payment claims?
See Table 1.
Table 1. Scope, auditor, and look-back period
| Name | Scope | Auditor | Look-back period |
| Medicare RACs Focus: Medicare over- and underpayments |
Medicare RACs identify Medicare fee-for-service provider over- and underpayments, collect overpayments, and return underpayments.
Medicare RACs operate nationwide and only review issues approved by CMS. |
The four Medicare RACs, each responsible for a U.S. region, are private companies contracted by CMS. Medicare RACs are paid on a contingency fee basis, receiving a percentage of both the over- and underpayments they correct. |
Medicare RACs perform audit and recovery activities on a postpayment basis, and claims are reviewable up to three years from the date the claim was filed. |
| Medicaid RACs Focus: Medicaid over- and underpayments |
Medicaid RACs identify over- and underpayments of Medicaid providers’ claims and recoup overpayments.
Medicaid RACs are administered nationwide, on a state-by-state basis. States have discretion to determine which Medicaid programs to target and are not required to publicly announce audit target areas. |
States contract with a private company that operates as a Medicaid RAC to perform audits of Medicaid claims. Individual states determine how each Medicaid RAC will be paid, usually on a contingency fee basis. |
Medicaid RACs perform audits and recovery activities on a postpayment basis, and claims can be reviewed up to three years after the date they were filed. Review after this period requires approval from the state. |
| MICs Focus: Medicaid overpayments and education |
MICs review all Medicaid providers to identify high-risk areas, overpayments, and areas for provider education to reduce Medicaid fraud, waste, and abuse. | MICs are private companies contracted by CMS, which has divided the U.S. into five MIC jurisdictions, each encompassing two CMS regions.
MICs are not paid on a contingency fee basis but are eligible for financial incentives based on the effectiveness of their audits. |
MICs perform audit and recovery activities on a postpayment basis, and claims can be reviewed as far back as permitted under the laws of the states that have paid the claims (generally a five-year look-back period). |
| ZPICs Focus: Medicare fraud, waste, and abuse |
ZPICs investigate potential Medicare Parts A and B fraud, waste, and abuse and refer these cases to their associated MAC for recoupment or to other federal and state agencies for other penalties. | ZPICs are private companies contracted by CMS, which has divided the U.S. into seven ZPIC jurisdictions, each aligned with one or two MACs. ZPICs are paid directly by CMS on a contractual basis. | ZPICs have no specific look-back period. |
| MFCUs Focus: Medicaid fraud, waste, and abuse |
MFCUs, which are annually certified by the OIG, investigate and prosecute (or refer for prosecution) criminal and civil Medicaid fraud cases, as well as patient abuse and neglect in health care facilities. | MFCUs operate in each state, excluding North Dakota, and the District of Columbia and are jointly funded by the state and federal government on a matching basis. | MFCUs have no specific look-back period. |
| CERT program Focus: Improper Medicare payment rate |
The CERT program identifies and estimates the rate of improper Medicare payments and publishes an annual report describing national paid claims and provider compliance error rates.
CERT program findings are not considered a measure of fraud, as findings are based on a random sample of Medicare claims and not an examination of billing patterns. |
The CERT program is operated by two private CMS contractors. | The CERT program reviews Medicare claims on a postpayment basis. The reviewed claims are limited to the current federal fiscal year (October 1 to September 30). |
| PERM program
Focus: Improper Medicaid payment rate |
The PERM program identifies and estimates the rate of improper payments in Medicaid and the Children’s Health Insurance Program. Individual state error rates are measured and then combined to extrapolate a national error rate.
PERM program findings are not considered a measure of fraud, as findings are based on a random sample of Medicaid claims and not an examination of billing patterns. |
The PERM program is operated by two private CMS contractors. | The PERM program reviews Medicaid claims on a post-payment basis. The reviewed claims are limited to the current federal fiscal year (the complete measurement cycle is 22 to 28 months). |
What are the processes, penalties, and appeals processes for each audit?
See Table 2.
Table 2. Process, penalties, and appeals process
| Name | Process | Penalties | Appeals process |
| Medicare RACs | Medicare RACs use proprietary software programs to conduct two types of audits: Automated audits can lead to a decision without requesting a medical record; and complex audits allow a Medicare RAC to contact providers to request medical records to make a payment decision. RACs are limited to 10 medical records per single practitioner within a 45-day period. | No penalty if the provider agrees with the Medicare RACs’ overpayment determination and repays CMS. If a provider misses a deadline in the appeals process, CMS is permitted to automatically recoup alleged overpayment plus interest. RACs must wait until the second level of appeal before collecting a contingency fee. | The Medicare RAC appeals process mirrors the five-level Medicare claims appeals process. The first level of appeal must be filed by the 120th day after receiving the letter of demand. |
| Medicaid RACs | States have discretion in how to coordinate and conduct audits and recoup overpayments. States are required to set limits on the number and frequency of medical records to be reviewed by the Medicaid RAC. | No penalty if the provider agrees with determination of an overpayment and repays CMS. If a Medicaid RAC identifies potential fraud, the case could be referred to the state MFCU.
RACs only collect fees on recovered overpayments and corrected underpayments, and RAC contractors must return any recoveries after a successful provider appeal. |
States have flexibility to decide the structure of the appeals process for providers to appeal any adverse determination made by the Medicaid RAC. |
| MICs | MICs use a data-driven approach to focus on aberrant billing practices, analyze Medicaid claims, and audit providers.
Identified overpayments are referred to states for collection; there is no limit to the number of claims records that MICs can request. |
Penalties, if any, are determined by each state. | Each state individually adjudicates provider appeals. |
| ZPICs | ZPIC audits may be initiated through data analysis or directly by fraud complaints. ZPIC review of claims may occur either pre- or postpayment. There is no limit on document requests for ZPIC audits, in addition to interviews and on-site visits.
ZPICs refer identified overpayments to their associated MAC for recoupment or to other state or federal agencies for other penalties. |
ZPICs recoup overpayments and can refer findings of fraud to law enforcement for criminal, civil monetary penalty, or other administrative sanction involving the HHS OIG; ZPICs may also refer such findings to the U.S. Attorney. ZPICs also can recommend that their MAC implements prepayment or auto-denial edits, if deemed necessary. | A provider has the right to appeal ZPIC overpayment determination through the five-level Medicare appeals process by which fee-for-service providers appeal reimbursement decisions. |
| MFCUs | MFCUs are not restricted to a specific investigational or audit process. | MFCUs recoup overpayments or refer to an appropriate state agency for collection, and can refer a finding of fraud to the appropriate investigation or prosecution authority. If there is a pending Medicaid fraud investigation, MFCUs may refer providers to state Medicaid agency for payment suspension. | The appeal rights of providers investigated by MFCUs depend on entity to which the case is referred for overpayment, investigation, or prosecution. |
| CERT | CERT randomly selects a statistical sample of claims submitted to MACs and requests medical records from the providers who submitted the claims in the sample. The claims and associated medical records are reviewed for compliance with Medicare coverage, coding, and billing rules.
Errors are assigned to claims in instances of noncompliance. CMS and CERT contractors analyze the error rate data and produce a national Medicare fee-for-service error rate after the review process is completed. |
Claims selected for CERT review are subject to overpayment recoupment, potential postpayment denials, payment adjustments, or other administrative or legal actions depending on the result of the CERT review.
If a provider fails to submit a requested record to the CERT program, the claim counts as an improper payment and may be recouped from the provider. |
A provider has the right to appeal CERT determination through the five-level Medicare appeals process. |
| PERM | PERM is conducted over a three-year period, focusing on 17 states per year. PERM contractors draw random samples of claims from each state and request medical records associated with those claims from the providers, and the medical records are reviewed to validate compliance with Medicaid coverage, coding, and billing rules.
The claims determined to have been paid incorrectly are scored as errors and payments are adjusted accordingly. |
If a provider fails to submit a requested record to PERM, the claim counts as an improper payment and may be recouped from the provider. | States may pursue two levels of PERM error determination dispute: the difference resolution process and the CMS appeals process. These processes afford states the opportunity to overturn PERM error determinations. |
Where can I find more information about these audits?
*Demko P. Nearly $80 billion misspent on Medicare, Medicaid in 2014. Modern Healthcare. March 6, 2015. Available at: www.modernhealthcare.com/article/20150306/NEWS/150309918. Accessed September 28, 2015.
