United States: Medicare Part A & Part B: Audits And Auditors

Last Updated: July 18 2018
Article by R. Ross Burris, III and Lidia Niecko-Najjum
  • The federal government estimates that for the Fiscal Reporting Year (FY) 2016, 11% or $41.1 billion of all Medicare Fee-for- Service (FFS) claim payments were improper.
  • The results of CMS Integrity Program, intended to curb fraud and abuse, have been mixed, and now appeals of claims denials are severely backlogged.
  • Understanding the CMS Integrity Program and its key auditors, the auditing process and, most importantly, the appeals process may help you avoid the backlog.
  • The appeals process starts at the very first request for documentation.
  • Having a process in place and strategies for addressing audits can help you win an appeal.

The audit landscape and the appeal backlog are part of much discussion these days, but it is important to understand how it all starts. To put things into context, there are approximately 1.5 million fee-for-service providers, and the federal government estimates that for the Fiscal Reporting Year (FY) 2016, 11% or $41.1 billion of all Medicare Fee-for-Service (FFS) claim payments were improper.1 An improper payment has been defined by the Government Accountability Office as "any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements."2

In FY 2016, the Centers for Medicare and Medicaid (CMS) reported that the primary causes of improper payments were insufficient documentation and medical necessity errors. To combat improper payments, CMS established the CMS Integrity Program, which coordinates the Medicare and Medicaid program integrity activities under one management structure to investigate Medicare and Medicaid providers and to identify potential overpayments.3

CMS Integrity Program contractors (described below) screen and monitor providers and suppliers enrolling in Medicare, Medicaid, and the Children's Health Insurance program (CHIP); impose moratoria on enrollment of new providers in areas where trends indicate significant potential for healthcare fraud; coordinate with private and public health payers and other stakeholders to detect and deter fraudulent behaviors; and provide outreach and education to key stakeholders to help avoid billing errors, suspending payments in cases of suspected fraudulent conduct.

The expectation for the CMS Integrity Program was to have more consistent audits over multiple lines of business; increased oversight of government contractors; increased education of providers and beneficiaries on fraud and abuse issues; quicker responses to fraudulent activity, resulting in reduced fraud and an improved industry image; increased commitment to fighting fraud and abuse; more innovative data analysis and investigative techniques; and expanded investigations across Medicare and Medicaid.

Unfortunately, the results have been mixed, and many providers find themselves under almost impossible audit circumstances. As a result of the CMS Integrity Program, some providers have been put on 100% prepayment reviews and have also been faced with post-payment audits and extrapolated overpayment demands. Many audits recommend denials of a large percentage of providers' claims for insufficient documentation, and anecdotal evidence shows that coverage policies and government contractors' internal procedures have been applied inconsistently, with little CMS oversight. To add to the frustration, many of these decisions are overturned only after providers undertake a time-consuming and expensive appeal of the audit decision.

The process for providers to appeal audit outcomes has been backlogged for years now, furnishing providers with few available tools to combat any unjust enforcement. In an effort to countervail this imbalance, the following is an overview of the CMS Integrity Program and its key auditors, the auditing process and, most importantly, the appeals process. We also provide a few key recommendations for dealing with any audit and repayment requests.

CMS Integrity Program — audits and auditors

To enforce the CMS Integrity Program, the Health and Human Services (HHS) uses its Office of Inspector General (OIG), the Department of Justice (DOJ), and the HHS Office for Civil Rights (OCR).

Briefly, the OIG is the independent watchdog agency within the HHS, which conducts audits and investigations and may impose civil monetary penalties (CMPs) and program exclusions against wrongdoers. The OIG also issues advisory opinions about the application of OIG's fraud and abuse authorities to the requesting party's existing or proposed business arrangement. Finally, the OIG assists the DOJ in False Claims Act (FCA) cases and has its own litigation unit. The DOJ investigates and prosecutes civil and criminal FCA, Stark Law and Anti-Kickback Statute violations. The HHS OCR is responsible for oversight and enforcement of the Health Insurance Portability and Accountability Act audits, self-disclosures, investigations, and fines. The OCR works with the OIG and may issue subpoenas to investigate non-compliance and may levy CMPs if non-compliance is found.

CMS also contracts with Part A and Part B Medicare Administrative Contractors (MACs), Durable Medical Equipment Medicare Administrative Contractors (DMACs), fiscal intermediaries (FIs), carriers, and others (collectively, "Medicare Contractors") to perform analysis of FFS claims data to identify atypical billing patterns and perform claims review.4 Medicare Fiscal Intermediaries are private insurance companies that mainly serve as the federal government's agents in Medicare reimbursement review and medical coverage review (e.g. Palmetto GBA, National Government Services [NGS]). Medicare carriers are Medicare-approved private insurance companies that provide Medicare plan options to Medicare beneficiaries.


CMS contracts with Medicare Contractors to conduct pre- and post-payment audits of providers. These audits may result in administrative actions to require repayment of overpayments; suspension of payment to providers; revocation of Medicare billing privileges; referral to the OIG and/or DOJ to investigate potential fraud, waste, and abuse issues; and/or impose CMPs, criminal sanctions, and/or ultimately exclusion.5

These Medicare Contractors include the following, and are described in more detail in Table 1: Zone Program Integrity Contractors, Unified Program Integrity Contractors, Supplemental Medical Review Contractors, Comprehensive Error Rate Testing Contractors, Medicare FFS Recovery Auditors, and the Medicare Administrative Contractors. Program Safeguard Contractors (PSCs) transitioned to ZPICs, except in Zone 6. PSCs perform investigations that are unique and tailored to specific circumstances and occur only in situations where there is potential fraud. PSCs can take appropriate corrective actions.

Table 1 CMS Integrity Program Review Contractors

Zone Program Integrity Contractors (ZPICs)
  • Focus on the detection and prevention of Medicare Fraud and can conduct pre-payment or post-payment review to determine adherence to federal laws and coverage policies.
  • Conduct data analytics to stem proactive audits and act on complaints or allegations of fraudulent behavior for retro-active audits.
  • Audit activity includes on-site reviews, patient interviews and visits, and physician interviews and visits.
  • ZPICs only consider documentation dated prior to the date of service to establish necessity and are not only looking to see if coverage policies have been met, but that other regulations and laws are being adhered to.
Unified Program Integrity Contractors (UPICs
  • Were implemented since 2016 to streamline the audit structure.
  • UPIC initiative combines the audit and investigation work currently conducted by the ZPICs (and their responsibilities) with the Audit Medicaid Integrity Contractors (MICs) to form the UPICs.
  • Contracts with ZPICs and MICs will end as the UPICs continue to be implemented in specific geographic regions while current contractors to transition out.
Supplemental Medical Review Contractors (SMRCs)
  • Conduct nationwide medical reviews, including identifying underpayments and overpayments.
Comprehensive Error Rate Testing (CERT)
  • Collect documentation and perform reviews on a statistically-valid random sample of Medicare Fee-for-Service claims. CERT Contractors produce an annual improper payment rate.
Recovery Auditors (RAs)
  • Formerly known as Recovery Audit Contractors (RACs), RAs apply primarily to Part A and large Part B Medicare providers, but can also impact Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS).
  • Identify underpayments and overpayments, as part of the Recovery Audit Program.
Medicare Administrative Contractors (MACs)
  • Process claims from physicians, hospitals, and other healthcare professionals, and submit payment to those providers according to Medicare rules and regulations, which includes identifying and correcting underpayments and overpayments.


The pre- and post-payment audits are generally categorized based upon how the Medicare Contractors select the claims (i.e., whether the claims are audited prior to or after payment by Medicare is made). Claims are also identified based on whether they are selected randomly or based on a specific provider, and whether the claims require a clinical review, deeming whether the audit is a complex or non-complex review.6

Prepayment reviews are intended to reduce improper payments by identifying suspected improper billing through error rates produced by the Comprehensive Error Rate Testing (CERT) program,7 vulnerabilities identified through the FFS Recovery Audit Program,8 claim data analysis, and evaluation of other information (e.g., complaints). Each year, CMS evaluates a statistically valid stratified random sample of claims to determine if they were paid properly under Medicare coverage, coding, and billing rules under the CERT program. The Medicare FFS Recovery Audit Program uses Medicare FFS RAs to identify and correct Medicare improper payments.

Providers must submit documentation within 45 calendar days of the Medicare Contractor's requests.9 The reviewers are discouraged from granting any extensions for providers to comply with the requests, and will deny claims based on requested documentation that is not received in the stated timeframe. Pre-payment reviews always result in an "initial determination." Post-payment reviews aim to recover improper payments and occur when a reviewer makes a claim determination after the claim has been paid. Providers must submit requested information within 30 calendar days of a ZPIC's request. Because there are no statutory provisions requiring that post-payment review of the documentation be completed within a certain timeframe, MACs, CERT, and ZPICs have the discretion to grant extensions to providers who need more time to comply with the requests.

Post-payment reviews result in either no change to the initial determination or a "revised determination," indicating that an overpayment or underpayment has occurred. A revised determination or an overpayment by the Medicare Contractor will then be followed by a separate overpayment refund demand from the MAC or DMAC.

The appeals process — Parts A and B (Original Medicare)

Medicare Part A providers have a separate appeals process for disputes arising from cost reports through the Provider Reimbursement Review Board (PRRB) at CMS. The Medicare Part A and B claims appeal process covers pre-payment and post-payment claim disputes for Part A providers and Part B suppliers, including Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) suppliers, Medicare beneficiaries, and Medicaid state agencies.10 There are five steps to this appeals process. Each level has procedural steps the appellant must take before appealing to the next level. Each provider and supplier may appoint a representative, such as legal counsel, to assist with the appeal process.11

Redetermination by a MAC

The first level of appeal is the redetermination following notice of the initial determination. A party to the initial determination has 120 days to request that the MAC perform a redetermination of the claim(s) regardless of the amount in controversy.12 If the initial determination found an overpayment, CMS will begin recouping the amounts beginning 41 days following the demand.13 Providers must file their appeal within 30 days to stay any recoupment actions.14 MACs will conduct an independent review of the claims using individuals not involved in the initial review.

Reconsideration by a QIC

Parties to the redetermination have 180 days to request reconsideration from a Qualified Independent Contractor (QIC) from the date of receipt of the notice of redetermination.15 It is important to note, CMS will begin recouping overpayments beginning after the 60th day from the redetermination decision.16

This is the last opportunity where all supporting evidence will be accepted without potential exclusion. The QIC has 60 calendar days to issue a decision or dismiss/remand. The QIC is bound by National Coverage Determinations (NCDs); and CMS rulings, Local Coverage Determinations (LCDs), Medicare manuals, and other guidance are owed substantial deference.

Hearing by an ALJ or review by attorney adjudicator at OMHA

Parties to an unfavorable reconsideration decision (or if the QIC's adjudication period has elapsed) may request a hearing before an administrative law judge (ALJ) if the amount in controversy of the claim is at least $160 for calendar year 2018 (claims can be aggregated to meet this threshold).17 Requests must be filed within 60 calendar days of receipt of the QIC's reconsideration decision. These requests are filed with the Office of Medicare Hearings and Appeals (OMHA). A copy of the request must be sent to the other parties to the claim. The beneficiary is a party to the claim, even if the beneficiary is not liable.

ALJs must give "substantial deference" to Local Coverage Determinations, Local Medical Review Policies, and CMS guidance, but are not bound by the guidance like the MACs. ALJs may decline to follow guidance in a particular case, but must provide justification for doing so.

OMHA has experienced a sustained and significant increase in the number of requests for hearing filed. As a result, a large backlog of appeals has emerged and wait times for hearings are estimated at 1,057 days by the Chief Judge Nancy Griswold as of February 28, 2017.18 HHS identified four primary drivers of that increase in volume leading to backlog: (1) increases in the number of beneficiaries; (2) updates and changes to Medicare and Medicaid coverage and payment rules; (3) growth in appeals from state Medicaid agencies; and (4) national implementation of the Medicare FFS RA Program.

To address this issue, OMHA announced several initiatives, including developing an appeals manual to standardize decisions, creating pilot programs such as statistical sampling and settlement facilitation, and developing new IT infrastructure from claims filing and adjudication. Most recently, HHS announced two additional initiatives: (1) expanding the Settlement Conference Facilitation (SCF) program and (2) offering a new Low Volume Appeals (LVA) settlement option. The SCF program and the LVA settlement option are just underway with no available estimates for these programs' successes.

Parties may also request to have an attorney adjudicator review the administrative record, in lieu of attending an ALJ hearing. In that case, appellants should fill out the Waiver of Right to an Administrative Law Judge (ALJ) Hearing form (Form OMHA-104) and submit it with your request for review by OMHA.

Review by Medicare Appeals Board

A provider may appeal ALJ's decision to the Department Appeals Board (DAB) Medicare Appeals Council (DAB/MAC) within 60 calendar days of the ALJ's decision.19 No new evidence will be considered at this level absent good cause and there is no hearing requirement (at discretion of Council). The DAB/MAC reviews the decision of the ALJ on the records de novo, which allows the appeals court to substitute its own judgment about whether the lower court correctly applied the law. Provider may escalate request to federal court after that time.

Judicial Review in U.S. District Court

Providers may appeal DAB/MAC decisions to the federal District Court within 60 days of the DAB/MAC decision if the amount in controversy is at least $1,600.20 Providers may also appeal to District Court if the DAB/MAC fails to rule within its required timeframe. The venue for the claim will either be in the District of Columbia or the provider's home district. The HHS Secretary's findings are conclusive if supported by "substantial evidence."

Strategies for addressing audits and appeals

In light of the frustrating situation with audits and the appeal backlog, we suggest the following strategies to shape the best response:

  • Before the demand, develop policies for dealing with audit requests, including which department and job title is responsible for handling the request, when to involve counsel, and to use subject-matter experts from the start.
  • After the demand, review claims to understand whether they are being denied based on technicalities (such as missing documentation) or medical necessity.
  • Attack statistical extrapolations on the front end; this means developing procedural and substantive arguments with a focus on medical necessity.
  • Understand how recoupment may affect the provider and adjust the timing of the appeals to stay within the shorter appeal timeline to stop recoupment.
  • Preserve the record for later levels of appeal and demand documentation and proof from the Contractors for anything that is not supported.
  • Understand and substantiate responses with relevant authorities, including supplier manuals, LCDs/NCDs, Medicare manuals, and the Code of Federal Regulations.

Originally published by Compliance Today, June 2018.


1. Centers for Medicare and Medicaid Services: 2017 National Training Program, Module 10. Available at https://go.cms.gov/2HhAu71

2. U.S. Government Accountability Office: Key Issues, Reducing Government-wide Improper Payments. Available at https://bit.ly/2qr688I

3. Ibid, Ref #1

4. CMS: Medical Review and Education. Available at https://go.cms.gov/2Hz1gFA

5. CMS: Medicare Program Integrity Manual, Chapters. 1 – 3; Chapter 8, §§ & 8.4.8.

6. CMS: Medicare Program Integrity Manual, Chapter 3, § 3.2.

7. CMS: Comprehensive Error Rate Testing (CERT). Available at https://go.cms.gov/2qtOBN8

8. CMS: Medicare Fee for Services Recovery Audit Program. Available at https://go.cms.gov/2xfXFJ3

9. CMS: Medicare Program Integrity Manual, Chapter 3, §

10. Regulations governing claims appeals found at Chapter 42 of the Code of Federal Regulations, part 405, subpart I.

11. CMS: Medicare Claims Processing Manual, Chapter 29, § 270.1.

12. CMS: Medicare Claims Processing Manual, Chapter 29, §§ 240.1-240.5.

13. CMS: Medicare Learning Network, Fact Sheet, Medicare Overpayments. Available at https://go.cms.gov/1Oy2sK1

14. Idem.

15. 42 C.F.R. § 405.962 (Timeframe for filing a request for a reconsideration). Available at https://bit.ly/2GVrrJT

16. Ibid, Ref #13

17. 42 C.F.R. § 405.1014 (Request for an ALJ hearing) Available at https://bit.ly/2Hl4EXc

18. Office of Medicare Hearings and Appeals Fiscal Year 2018 Congressional Justification. Available at https://bit.ly/2HjPIIU

19. 42 C.F.R. 405. §1100 (Medicare Appeals Council review: General) Available at https://bit.ly/2qseiN7

20. 42 CFR 405.1136 (Judicial Review) Available at https://bit.ly/2HvsVr2

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
Email Address
Company Name
Confirm Password
Mondaq Topics -- Select your Interests
 Law Performance
 Law Practice
 Media & IT
 Real Estate
 Wealth Mgt
Asia Pacific
European Union
Latin America
Middle East
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions