How to pass a NEMT broker audit: what auditors check and the records to keep

Who audits NEMT providers and why

Brokers audit providers because the rules make them answer for every trip. Under 42 CFR 440.170(a)(4), a state broker must have oversight procedures to make sure “transportation is timely and that transport personnel are licensed, qualified, competent, and courteous.” The broker is also “subject to regular auditing and oversight by the State.”

Health plans that hire transportation vendors carry the same duty. Under 42 CFR 438.230, the state, CMS, and the HHS Inspector General can audit a plan’s subcontractors, and the subcontractors’ own contractors, for 10 years after the contract period ends or after any audit is completed, whichever is later.

So audits come from several directions:

Federal auditors are active. The HHS OIG announced a new NEMT audit series on May 28, 2026 to check whether selected states met Medicaid payment requirements, such as prior authorization backed by a practitioner’s order and records that support each service. Broker manuals let the broker recover overpayments from the provider who ran the trip, often by deducting them from future payments.

Audits are routine, not only a reaction to a problem. CareOregon includes a sample of every provider’s trips in regular audits. Modivcare can pick any out-of-network provider for its quarterly audit. The OIG’s targeted review, announced in October 2025, uses indicators of concerning billing to choose which NEMT services to examine.

What past audits found

Past audits show exactly what fails. The same gaps appear again and again.

The pattern is clear. Many of these failures were missing or mismatched records rather than trips that never happened. A trip you ran but cannot prove is treated like a trip you did not run.

The types of broker audits

Brokers check providers in several ways. Oregon’s CareOregon NEMT manual, Virginia’s broker requirements, and Modivcare’s guidance show the common types.

• Trip verification. CareOregon requires verification before and after the trip for 5% of all NEMT trips, with a sample of each provider’s trips in regular audits. Auditors review claims, pickup and drop-off times, level of transport, and member satisfaction.
• Billing review. Audits check that you billed the contracted amount, that any negotiated rate was authorized before the trip, and that mileage follows the most cost-effective, reasonably direct route.
• Driver file audits. Modivcare runs quarterly audits on a sample of out-of-network providers and repeats the audit the next quarter if a provider fails.
• Vehicle inspections. Virginia’s broker must inspect every vehicle in person every six months and mark it with a pass, provisional, or fail sticker. A failed vehicle is removed from service until fixed.
• Site visits. CareOregon expects an annual site visit to review records, facilities, and equipment, and allows random site visits to audit records.
• Field monitoring. Virginia’s broker must “field monitor provider vehicles,” and a driver or vehicle out of compliance can be removed from service immediately.

The records you need for every trip, driver, and vehicle

Organize records the way an auditor asks for them: by trip, by driver, and by vehicle.

Trip records

CareOregon’s minimum documentation list is a good baseline:

• Member name, date of trip, and authorization or trip number
• Pickup location and destination address
• Scheduled pickup time, actual pickup time, appointment time, and drop-off time
• Mode of transport
• Provider name, driver name, and vehicle ID or plate number
• Trip mileage and trip cost
• Any practitioner’s order your state requires. In the New York City audit, 14 sampled payments had no practitioner’s order at all.

MTM Health’s Rhode Island handbook adds the member’s signature and denies any claim missing its required data points. Our trip log template covers these fields, and our guide to NEMT documentation requirements goes deeper.

Driver files

Each driver file should hold the license, driving record, background check, drug screen results, training certificates, and dated exclusion check results. Match every file to the trip logs. The Michigan audit shows what happens when the paperwork belongs to a different driver than the one who drove. The broker credentialing guide lists what each broker requires.

Vehicle files

Keep registration, insurance, inspection records, and maintenance logs for each vehicle, plus the securement and safety equipment checks. Use a vehicle inspection checklist every day and keep the completed copies.

Policies

Brokers ask for written policies too. CareOregon, for example, expects an anti-drug policy, plans for adverse weather and business continuity, and policies on harassment prevention and on theft, violence, and gross negligence.

How long to keep records

Keep every record for the longest period that applies to you:

If you are unsure, keep 10 years. Storage is cheap next to a recoupment.

How to prepare: a self-audit you can run every month

The best preparation is auditing yourself before anyone else does. Run this check every month.

1. Pull a sample. Pick 20 completed trips from the month at random, from every broker you work with.
2. Check each trip log. Confirm every required field is filled, times make sense, and the signature is there if required.
3. Match driver and vehicle. Confirm the driver and vehicle on each trip had current credentials on that date.
4. Check mileage. Compare billed miles to a mapped direct route for the same trip.
5. Run exclusion checks. Search every driver and owner on the OIG and SAM lists and save dated results.
6. Log what you find and fix it. Retrain the driver or dispatcher, and correct the process that caused it.

A worked example: in a sample of 20 trips, two are missing actual drop-off times and one driver’s CPR card expired a week before a trip. That is a 15% error rate. Neither problem means a trip was fake, but both would fail an audit. Fix the drop-off step in the driver workflow, pull the driver from trips until the card is renewed, and check the next month’s sample for the same errors.

During and after an audit

When an audit notice arrives:

• Read the request carefully. Note the deadline, the sample, and the format. Modivcare, for example, may require driver records within three business days.
• Produce exactly what is asked, on time. Send complete copies and keep a list of what you sent.
• Never alter or backdate a record. CareOregon lists false documentation of program records as grounds for immediate driver disqualification.
• Answer findings in writing. If you disagree, show the record that supports the trip.

If the audit finds problems, expect a corrective action plan. CareOregon’s manual lists what one must contain: the causes, the person responsible, the specific actions, a timeline with deadlines, any effects on member access to care, and how the broker will monitor the fix. The broker may limit your trip volume while you correct the issues. Overpayments are recovered, and CareOregon notes this can be a deduction from a future invoice. Repeated or serious problems lead to suspension or termination. Our fraud prevention guide covers the controls that keep billing clean.

Staying audit-ready in HealthRide

HealthRide’s trip log shows every leg with scheduled and actual times, addresses, driver, vehicle, and GPS-verified miles, exported as a spreadsheet or print-ready PDF. Signatures are captured on screen in the driver app. When a broker asks for documentation, the reports are one click away, and credential expirations are flagged before they reach a trip.