Medicaid audits of NEMT providers: who audits, what they pull, and how to respond

A Medicaid audit is a review of claims you were already paid, checked against the records that are supposed to prove them. For a transportation company, the claims are trips, and the proof is who rode, where they went, which vehicle and driver ran the trip, and the covered appointment behind it. Several agencies and contractors have the power to ask, each with its own rules and clock. This guide covers who they are, what they request, how findings grow through sampling, and how to answer, current to September 2026. Audits run by brokers and health plans are covered in our broker audit guide.

Who can audit a NEMT provider

Every Medicaid provider signs an agreement to keep records that show how much service it delivered and to produce them, along with payment information, on request from the Medicaid agency, the Secretary of HHS, or the state MFCU (42 CFR 431.107). The request can come from any of these:

State units and RACs

States run their own audits under state law, and federal rules also have them contract with a Medicaid RAC (42 CFR 455.502). A state can ask CMS to excuse it from some or all RAC requirements (42 CFR 455.516), so not every state has one. Federal rules put limits on the RACs that do operate (42 CFR 455.508):

• They may not review claims older than three years from the claim date without state approval.
• They must tell providers about overpayment findings within 60 calendar days.
• They must accept records on CD, DVD, or fax when the provider asks.
• They should not audit claims another auditor has already reviewed or is reviewing.
• The state must cap how many records a RAC can request and how often (42 CFR 455.506).

RACs are paid a percentage of what they recover, and a RAC must give back its fee on any finding a provider overturns on appeal (42 CFR 455.510). States may also exclude managed care claims from RAC review.

UPICs

UPICs work under section 1936 of the Social Security Act. Before opening a Medicaid case, a UPIC vets the provider with the state. When it is looking for an overpayment without projecting results, the claims in its sample must carry at least $50,000 at risk. Its work can include interviews, record requests, questionnaires, and post-payment claim reviews. Findings go out first as an Initial Findings Report. You get a chance to send rebuttal records, and then a Final Findings Report goes to the state, which recovers the overpayment. CMS’s Medicaid Program Integrity Manual calls this work investigations or audits, and notes that some state agencies call them reviews.

PERM

PERM measures the national improper payment rate. CMS rotates through the states so that each one is reviewed once every three years. For reporting year 2027, PERM measures eligibility only and sends no medical record requests to providers. The next record requests go to the Cycle 1 states, including Ohio, Pennsylvania, and Michigan, between April 1, 2027 and April 15, 2028, for claims from July 1, 2026 through June 30, 2027. If one of your claims lands in the sample, you must send the records within 75 calendar days and reply to a request for additional documentation within 14 calendar days (42 CFR 431.970). Lack of documentation and insufficient documentation both count as payment errors (42 CFR 431.960). States must refund CMS the federal share of overpayments PERM finds (42 CFR 431.1002), which is how a sampled claim can become a state recovery.

Federal reviews aimed at NEMT

HHS OIG has two NEMT projects open in 2026. Its evaluation office opened a targeted review on October 15, 2025 that picks NEMT claims to examine by billing red flags. Its audit office followed on May 28, 2026 with a series testing whether chosen states paid NEMT claims correctly under Medicaid rules, including prior authorizations backed by a practitioner’s order and provider records that support each service. OIG expects to finish the series in fiscal year 2028.

Medicaid Fraud Control Units

Every state has one, and so do Puerto Rico, the U.S. Virgin Islands, and the District of Columbia. They must be separate from the Medicaid agency. A request or visit from an MFCU is a law enforcement matter, not a billing review. See Medicaid Fraud Control Unit.

What puts a provider on an auditor’s list

Some reviews are random and some are aimed. A PERM sample is random. Targeted audits start from a lead or a billing pattern.

• Data that stands out. Florida’s Medicaid agency must review providers who fall outside their peer group and use billing analysis to find unusual increases in claims (section 409.913). OIG’s 2025 NEMT review chooses what to examine by billing red flags.
• Tips and referrals. CMS’s manual lists complaints, anonymous tips, news stories, state agencies, and the contractor’s own data mining as sources of UPIC leads.
• Routine checks. Florida may hold a provider’s claims for review before payment for as long as a year, even when no one suspects wrongdoing.

Under rules like Florida’s, a sudden jump in billing or a claim mix far outside similar companies can draw a review even when every trip happened.

What auditors pull for a transportation claim

Auditors test each sampled trip against the state’s rules for payment. New York’s OMIG publishes the checklist it uses for ambulette claims (revised July 22, 2026), and it is a clear picture of what a transportation audit tests.

Two points in that protocol deserve extra attention. Paperwork such as a driver manifest, dispatch notes, an authorization, or a day program’s sign-in sheet does not prove a trip by itself; it only supports the main record. And when the procedure code on the claim is wrong, the difference between what was paid and what the correct code pays is taken back.

Other states apply the same logic in their own terms. Florida requires documentation written when the ride happens, and its overpayment findings rest only on contemporaneous records (section 409.913). Our guide to NEMT documentation requirements covers what a trip record should hold.

How an audit unfolds

The steps are similar everywhere, but the deadlines are set by each state. New York’s rules show the full sequence (18 NYCRR 517.3 and 517.5):

1. Notice. A written notice of intent to audit. The audit must begin within 60 days, with one possible 60-day extension. The notice also pauses the six-year clock for keeping records.
2. Entrance conference. An on-site audit opens with a meeting on its nature and scope. The agency sets the time, place, and manner.
3. Record review. The auditor reviews the sampled claims and your records.
4. Draft audit report. It lists each disallowed item, the reason, the legal authority, and the amount where possible.
5. Your objections. You get 30 days after the report arrives to file written objections, item by item, with supporting documents. The state treats the report as arriving five days after the date printed on it.
6. Final determination. The agency issues its final findings.
7. Hearing. The hearing request must reach the department in 60 days or less from the written determination (18 NYCRR 519.7).

The trap is at step five. At a New York hearing, you cannot raise a new matter the agency did not consider in your draft-report objections (18 NYCRR 519.18). An objection you skip in the first 30 days is usually gone.

Sampling and extrapolation

Audits often review a sample, not every trip, and then project the error across the whole review period. That projection is called extrapolation, and it is where a small finding becomes a large demand.

A simple example: an auditor draws 100 trips from 8,000 paid in the review period and finds $1,500 unsupported. Spread across all 8,000 trips, that becomes a demand of about $120,000.

The same math runs at state scale. OIG’s September 2022 report on New York City transportation payments shows it. Auditors checked a random 100 of 4,768,858 payments for 2018 and 2019 trips, found 41 that broke the rules and 42 they could not confirm either way, and projected $84.3 million or more in federal money New York should not have claimed (OIG report A-02-21-01001).

The law generally favors the auditor’s numbers:

• Florida lets its Medicaid agency use sampling and extension to the population, and the audit report with work papers is evidence of the overpayment.
• New York treats a projection built on a certified valid sampling method as correct unless the provider brings expert testimony or an actual accounting of every claim paid.
• North Carolina gives providers more room (G.S. 108C-5). Before extrapolating, the state must show the provider failed to substantially comply with the rules or that there is a credible allegation of fraud. Limited and moderate risk providers can challenge the error rate within 15 days of the tentative results, either by reviewing 100% of the audited claims or by auditing a new sample twice the size, with 60 days to finish. Providers get at least 30 days to send documents they did not provide during the audit.

HHS OIG offers RAT-STATS, the free statistical software its own auditors use, which providers can download to select samples and estimate improper payments. It helps you check the sample size and projection in a demand letter, and a health care attorney or statistician can take the challenge further.

Deadlines that decide the outcome

A missed deadline can turn a finding you could have beaten into a final debt.

Where a date is counted from receipt, write down the day the letter arrived and keep the envelope.

How to respond

Treat every request as formal, even a small one.

1. Identify who is asking and why. A RAC, a UPIC, PERM, and the state each follow different rules. If the letter comes from an MFCU or law enforcement, or arrives with a payment suspension, get a health care attorney involved before anything goes out.
2. Put the deadline on the calendar and work backward. If you need more time, request it in writing while the deadline is still open.
3. Gather everything on each sampled trip. That means the trip log for both legs, the signature, the authorization and order, the driver’s file for that date, and proof the van was registered and insured that day.
4. Send complete, labeled copies. Index them by claim number. Keep a copy of exactly what you sent and proof of delivery. In Florida, a record you did not hand over when asked can’t be used afterward to fight the finding.
5. Never create or change records after the fact. Backdated or rewritten records can turn a billing finding into a fraud case.
6. Answer the draft findings line by line. Agree where the auditor is right and document why you disagree where they are not.
7. Check the math. Recheck the sample, the universe of claims, and the projection.
8. Plan the repayment if you owe money. See Medicaid recoupment for offsets, repayment plans, and appeals.
9. Correct the underlying problem and document the change. The auditor may ask for a corrective action plan.

Appeals

State law sets how you appeal. Federal rules require states to give providers appeal rights for adverse RAC findings (42 CFR 455.512), and each state sets the procedure. Expect to carry the burden. In New York, the provider must show the agency’s determination was wrong and that the denied claims were due and payable. In North Carolina, the petitioner bears the burden of proof, and the Office of Administrative Hearings has 180 days from filing to issue a final decision, with extensions for delays the state causes (G.S. 108C-12).

Collection may not wait for the appeal. New York keeps collecting when a hearing is requested and refunds any amount a hearing decision removes.

Staying ready between audits

The best audit response is built before the letter arrives.

• Run a small self-audit every month. Pull ten paid trips at random and check each one against the table above.
• Keep each trip file as long as the strictest rule or contract demands. New York fee-for-service providers keep them six years after the service or billing date, whichever is later. Florida sets five years after the service. Broker and plan contracts may ask for more.
• Report lost records quickly. New York asks providers to report damaged, lost, or destroyed records to its inspector general no more than 30 calendar days after finding the loss. The trips stay open to audit either way.
• Report and return errors you find. The law gives you 60 days from identifying an overpayment. Our guide explains how the 60-day rule works.
• Watch for the errors auditors disallow, such as billed miles longer than the route, trips with no covered appointment at either end, and trips billed after a rider’s death. Our NEMT fraud prevention guide lists the schemes auditors look for.

Keeping trip proof in one place

Audits go faster when each trip’s proof lives in one record. Every HealthRide trip carries its own GPS-recorded miles, timestamps for pickup and drop-off, and the rider’s on-screen signature, and the full trip log downloads from reports in CSV or PDF form. Credential expiry reminders flag a driver before an expired credential reaches a trip.