The Medicaid site visit for new NEMT providers: what the inspector looks at

Many states send someone to see a new transportation company in person before approving it, either agency staff or a contractor working for the state. The visit is short, but it can decide your application. Knowing what the reviewer needs to confirm, and having the proof ready, makes it routine. This guide covers the federal rule, why transportation companies are often visited, and what the inspection covers, as of September 2026.

Why the state sends an inspector

The visit verifies the information on your application and checks that you comply with federal and state enrollment requirements (42 CFR 455.432). The same rule requires every enrolled provider to let CMS, the state, and their contractors make unannounced inspections at any of its locations.

The stakes are simple. A provider that does not permit access for a site visit must be denied or terminated, unless the state documents in writing why that would not serve the program (42 CFR 455.416).

Who gets visited: the three screening levels

States assign each provider type one of three risk levels, and the level sets how deep screening goes (42 CFR 455.450).

Screening levels apply to first applications, applications for a new practice location, and revalidations. When a new location is added to a moderate or high risk enrollment, CMS guidance calls for a visit to that location but not a full rescreening. See Medicaid provider risk levels.

Why transportation companies often screen higher

Non-emergency transportation is a Medicaid provider type with no Medicare counterpart, so CMS leaves its risk level to each state. CMS recommends that states weigh the kinds of evidence it uses for Medicare, including GAO and OIG reports, input from law enforcement, and the level of enforcement actions against a provider type.

The record for transportation is long. GAO reported in 2022 that from fiscal years 2015 through 2020, investigations by state Medicaid Fraud Control Units led to nearly 200 criminal convictions, civil settlements, and judgments against transportation providers in 25 states. Officials in states GAO studied described providers billing for trips that were never given and trips run by unauthorized drivers or in unauthorized vehicles, and CMS has identified NEMT as a program area at risk for fraud.

How several states classify transportation providers:

Illinois tells NEMT applicants to expect on-site visits from the state’s Office of the Inspector General during enrollment, and all but government-run vendors and private automobiles must complete fingerprint-based background checks. A company can also be moved up to high risk on its own record. Federal rules require the move after a payment suspension based on a credible allegation of fraud, an existing Medicaid overpayment, or an exclusion within the past 10 years. They also require it when a company blocked by a moratorium applies within six months after the moratorium ends.

How a visit usually runs

North Dakota publishes its reviewers’ checklist, form SFN 570, with a section written for commercial NEMT providers. It is the most detailed public picture of a visit, and it runs in this order.

1. Outside. The reviewer verifies the address, notes whether the business appears to be operating, and checks for visible signage, business hours posted for each day, and a phone number for after-hours contact.
2. Introductions. The reviewer asks for the owner or manager. If the person on site is not an owner, the reviewer asks who the owners are and records whether that person knows.
3. The tour. At a transportation company, the reviewer looks for a garage, maintenance logs, and a dispatch area, and asks for printed material showing your rates, the number riders call, a business card, and the website you advertise.
4. Vehicles. Enrollment staff indicate which vehicle types you should have: wheelchair, minivan, stretcher, or taxi. The reviewer confirms each one is present and records your reason for any that is not. If there is no garage, the form asks where vehicles are stored, such as a lot or the owner’s home.
5. Policies. The reviewer checks whether your employee handbook explains whistleblower protections and False Claims Act duties and includes a quality assurance plan, then asks for your HIPAA compliance officer’s name and credentials and your written HIPAA procedures.
6. Records. Questions cover where documentation of your services is stored, paper or electronic, whether the storage is secure, and whether electronic records require a password.
7. Billing. At your billing location, the reviewer asks who submits claims, what training or certification the biller has, whether coding references are current for the year, and how you stay current on the state’s Medicaid policies.

Other states add items. Arizona’s inspector checks that each vehicle carries the company logo. California’s statute requires an applicant to show an established place of business suited to the services billed, which includes being open and available to the general public, keeping regular posted hours, having adequate supplies on hand, meeting local business licensing rules, and having the equipment for day-to-day work.

Expect questions as well as a walk-through. When North Carolina’s contractor described its NEMT visits to applicants in 2016, it said they typically ran 90 to 120 minutes, with two screeners testing how well the company understands North Carolina Medicaid policies and reviewing policies and procedures, employee background checks, DMV reports, and employee files.

Getting ready: the office, the vehicles, and the binder

Most preparation is making sure the reviewer finds what the checklist expects.

• Put up a sign where local rules allow it, and post your hours for each day.
• Keep a business line that reaches a person after hours.
• Have an owner, or a manager who knows every owner by name, on site during posted hours.
• Keep every vehicle listed on the application on site during those hours, or have a written reason for any that is out.
• Mark vehicles the way your state requires.
• Lock up paper trip records and password-protect electronic ones.

Then gather the documents in one binder before you submit the application.

Our guides to NEMT policies and procedures and HIPAA for NEMT cover the written policies. Use the driver file checklist to build each driver’s folder, and read the False Claims Act entry for the handbook section.

Flexibility CMS gives states

• Video for remote locations. When terrain or distance makes an in-person visit too difficult, a state may use synchronous video. Photographs do not satisfy the requirement.
• Combined with a licensing inspection. A state may combine the Medicaid visit with a licensing or certification visit if it decides to do so before the visit and documents the enrollment check separately.
• An earlier visit. A state can accept a site visit that Medicare performed at a location on your application, for the same business name and tax ID, or rely on screening done by another state’s Medicaid program.

Home-based companies

Federal law does not rule out a home office, but proving an operating business gets harder. Under CMS guidance, a provider in the moderate or high risk group that reports a home address and delivers all its services at other places, such as patients’ homes or nursing homes, does not need a visit under the federal rule, though the state can choose to visit or be required to by state law. For a transportation company, the practical questions are where the vehicles park, where records are locked up, and whether your state expects a public place of business, as California does. See running NEMT from a home office.

If the visit goes badly

• Refused access. Denial or termination, unless the state documents a reason not to.
• No one there. North Dakota makes one return visit on a different day during posted hours, unless the first attempt shows the business has obviously closed, and recommends denial if the second attempt fails.
• Problems found. North Dakota also recommends denial when the business is not at the listed address, lacks the supplies or equipment for its services, or shows ownership different from the application.
• A missed deadline. North Carolina denies automatically when the visit or the new-provider training is unfinished at its contractor’s deadline.
• California discrepancies. If significant problems found at a visit are not fixed, the state can suspend the provider temporarily, effective 15 days after notice. The notice must allow at least 60 days to correct them, and failing to correct them ends the enrollment.

Appeal rights come from state law, which the federal rule requires states to honor (42 CFR 455.422). For appeals and reapplying, see when your Medicaid enrollment is denied or stuck.

Visits after approval

Approval does not end the inspections.

• Post-enrollment visits. Moderate and high risk providers are visited after enrollment as well as before.
• Unannounced inspections. Every enrolled provider must allow them at all its locations, and California’s law lets the state visit applicants and enrolled providers alike without notice.
• Revalidation. States revalidate every enrollment at least once every five years and repeat screening at the current risk level. Arizona revalidates every four years, which can bring another site visit and fingerprints.
• Broker inspections. Brokers inspect under their own contracts. In Virginia, MTM reinspects vehicles twice a year after the first inspection and can pull noncompliant vehicles or drivers from service until they are corrected.

Keeping records ready for the next visit

Records are easier to show an inspector when they live in one system. HealthRide is HIPAA compliant: each person sees only what their role allows, and every change is recorded. Drivers complete a vehicle inspection in the app at the start of every shift, and each trip keeps GPS-recorded miles, timestamps, and signatures that export as a trip log.