SURS: the state Medicaid unit that reviews provider billing patterns

What SURS is

SURS is the review function built into every state’s Medicaid claims system. CMS’s State Medicaid Manual lists Surveillance and Utilization Review as one of the six core subsystems of a state’s MMIS, next to recipient, provider, claims processing, reference file, and management reporting. Staff in the Medicaid agency, or in a state inspector general’s office, use its reports to decide which providers to review.

States organize this work in different offices. Texas’s Office of Inspector General, for example, reports 15,236 surveillance utilization reviews completed in fiscal year 2026. A SURS review is one of several ways a ride company gets audited; the guide to Medicaid audits for NEMT providers covers the others and how to respond.

The federal rules behind it

Every Medicaid agency has to run a statewide surveillance and utilization control program that guards against unnecessary or inappropriate use of services and excess payments, and that assesses their quality (42 CFR 456.3). Two parts matter to providers:

• Post-payment review. The agency must be able to build utilization profiles of beneficiaries, service profiles of providers, and exception criteria, then use them to find and correct misuse by either group (456.23).
• Ongoing sampling. The agency must evaluate a sample of services on a continuing basis for need, quality, and timeliness (456.22).

The State Medicaid Manual adds how the subsystem works: statistical profiles by category of service, computerized exception processing, at least nine months of paid claims on file with six or more used for exceptions, and a required annual run of every report for every provider.

How NEMT claims get flagged

A SURS profile compares your billing with other providers in the same category of service. Florida’s statute puts the method in plain terms: its agency reviews providers who are exceptions to peer group norms and uses statistical methods, provider profiling, and billing analysis to catch unusual increases in claims (section 409.913). For example, a company billing far more miles per trip than similar companies would likely stand out on that kind of report, even if every mile was driven.

Transportation has one match the data makes easy: a ride billed on a day with no medical service billed for the rider. Answering a federal audit published in January 2021, Massachusetts said it had added claim edits after 2017 so a ride pays only when a qualifying medical service happened that day, and that it was building post-payment reports to list rides with no matching medical service.

What happens after a flag

A questionable pattern triggers a first-stage inquiry; the agency must then judge whether the facts support a full investigation (42 CFR 455.14). If the agency suspects provider fraud, it refers the case to the Medicaid Fraud Control Unit (455.15). Otherwise a case can end with a warning letter, suspension or termination, recovery of payments, or other sanctions under the state plan (455.16).

Ohio’s rule shows the softer end. Its post-payment review of paid claims can produce an educational letter, a request for a corrective action plan, or recovery of claims paid in error (Ohio Admin. Code 5160-1-27).

A sample can set the bill for the whole period. Florida’s statute lets its agency calculate an overpayment with statistical methods that include sampling and extension to the population (section 409.913(20)). When a provider defends a claim with documents, the agency weighs only contemporaneous records (409.913(21)), so a trip log rebuilt after the letter arrives does not help.

A review runs on records. In HealthRide, the trip log in reports exports each ride’s GPS-recorded miles, timestamps, and signature as a CSV or PDF, so the trips a reviewer names can be pulled by date.