We all know that there is no law, regulation or statute that medical records supporting payment by Medicare or Medicaid must be perfect. There is no mandatory 100% compliant standard. Because humans err. In light of the ongoing financial strain brought about by the pandemic and the constraints imposed by Congress on Medicaid coverage disenrollments, State Medicaid agencies are poised to explore additional audits to manage increasing Medicaid expenditures. Recent developments, such as additional flexibilities granted by CMS, suggest a shifting landscape in how States respond to these challenges.

Anticipating a more assertive approach by States in dealing with service providers, potential measures could include rate cuts and enhanced scrutiny through service audits. This prompts a crucial examination of States’ and providers’ rights under federal Medicaid law to audit service provisions and recover overpayments, a legally intricate and noteworthy domain.

Medicaid RAC Audits are governed by 42 CFR 455 Subpart F—Medicaid Recovery Audit Contractors Program. Other Medicaid alleged overpayments are dictated by 42 CFR Chapter 433.

To establish a foundational understanding, it’s essential to consider the mandate imposed by Congress in section 1902(a)(30)(A) of the Social Security Act. States are required to incorporate provisions in their Medicaid plans to “safeguard against unnecessary utilization of … care and services.” This underscores the federal interest in ensuring responsible use of matching funds, given the federal government’s financial contribution to the program.

A landmark case illustrating the complexities of this mandate is the 1999 decision by the Supreme Judicial Court of Massachusetts in Massachusetts Eye and Ear Infirmary v. Commissioner of Medical Assistance. The court evaluated Massachusetts Medicaid’s retrospective utilization review policy, emphasizing the need for meaningful definitions of terms like “inpatient” and “outpatient” to avoid arbitrary penalties on providers.

Moving to the realm of overpayments, CMS regulations, specifically at 42 C.F.R. § 433.316, provide guidance on how States should proceed when identifying overpayments. The regulations recommend written notification to providers, with states having the discretion to choose whether to notify in cases of suspected fraud. Furthermore, States are required to take “reasonable actions” based on state collections law to recoup overpayments, with a one-year timeframe to return the federal share of identified overpayments to CMS.

Determining when a State “discovers” an overpayment is a critical aspect outlined in the regulations. The discovery is pegged to specific events, such as the state contacting the provider, the provider notifying the state, formal initiation of recoupment, or a federal official identifying the overpayment. Significantly, the regulations focus more on CMS’s relationship with the state than on the state’s relationship with providers.

Recent legal precedents, such as the Wisconsin Supreme Court’s decision in Professional Home Care Providers v. Wisconsin Department of Health Services, underscore the need for states to operate within the bounds of their granted authority. In this case, the court rejected a Medicaid agency’s “perfection” policy, emphasizing that state law must align with CMS regulations in overseeing overpayment recovery.

As States grapple with revenue shortfalls exacerbated by the pandemic, the potential for increased efforts to recoup overpayments from providers looms large. Legal challenges, exemplified by recent decisions in Massachusetts and Wisconsin, underscore the delicate balance States must strike in these endeavors, emphasizing the limits within which they must operate as they navigate the complex terrain of Medicaid law and financial constraints.

Expect audits. Be ready to defend yourself. Self audits are so important. If you self audit and find a problem and self-disclose, you will not receive penalties. Self-disclosures are key. When I told a group of law students this key information, one asked, has you told a client to self-disclose and they refused? To which I said yes. One time. A female doctor informed me that she falsified 7 medical records, I said that she should disclose. She screamed at me in her language, fired me, and hired a new attorney and withheld the information about falsifying records.

She is jail currently.