A corrective action plan (CAP) is the document a provider submits after a state Medicaid agency issues audit findings, and it is not a private compliance memo. The agency keeps the CAP in the audit file, and a Medicaid Fraud Control Unit (MFCU) or a state office of inspector general can read it in any later review. States commonly require the CAP within a fixed window after the audit report, often 30 days, and expect it to name a root cause, a remediation step, a responsible person and a completion date for every finding. What the plan admits about how the error happened, and how long it went uncorrected, can outlast the audit that produced it.
What the State Expects in the Corrective Action Plan
State Medicaid audit protocols share a common shape even though the reviewing office changes name state to state. Arkansas's Office of the Medicaid Inspector General requires a CAP that identifies the specific finding, explains the plan of correction, names the person responsible, and sets a target date for completion, the structure most state protocols use under different labels. A CAP that stops at the finding rarely satisfies the reviewer. Agencies generally expect the plan to trace the finding to its root cause, a documentation gap, a billing system default, or a training failure, and to describe the control or training that prevents recurrence, not only the fix for the claims already flagged. A plan that corrects the sampled claims without addressing why they happened invites the same finding on the next audit appeal cycle.
Who Signs and Certifies the Plan
The CAP is typically submitted over the signature of an authorized representative, most often the provider's compliance officer or an owner with authority to bind the practice. That signature is a certification the state Medicaid agency can rely on: it tells the reviewer the practice reviewed the finding, accepted a stated cause, and committed to a specific fix by a specific date. A CAP that overstates the scope of the problem, or concedes a characterization the facts do not support, is signed language the agency can quote back in a later review or a referral. This is a provider-facing document written after the state has already found a problem, distinct from a provider-initiated Medicaid self-disclosure, where the provider brings the issue forward first.
A corrective action plan is signed language the state can quote back in a later review, so what it concedes about the root cause deserves as much care as the fix itself.
The Follow-Up Review
Accepting a CAP does not close the audit file. State Medicaid agencies generally reserve the right to conduct a follow-up review, sometimes a desk review of updated records and sometimes a return site visit, to confirm the plan was implemented and that it worked. Arkansas's Inspector General describes this directly: a follow-up site review may occur after a CAP is accepted, to confirm compliance and implementation. The review tests two things: whether the provider did what the plan said, and whether doing it actually stopped the billing pattern that triggered the audit. A CAP that promised a training session but produced no record of it fails on implementation even though the original paperwork was accepted.
What a Second Finding Can Cost
A follow-up review that finds the same errors again changes the state's posture. Most state Medicaid provider manuals authorize sanctions, including payment suspension, contract termination or exclusion, when a provider fails to submit an acceptable CAP or fails to correct deficiencies it already agreed to fix. A pattern that persists after a signed CAP can also support a credible allegation of fraud, the finding that triggers mandatory payment suspension under 42 CFR 455.23, and can become the basis for a referral to the state's MFCU or, in serious cases, a path toward OIG exclusion. Because the CAP already put the root cause in writing, a second review has less to establish. The exposure at that point runs beyond a routine recoupment; it can reach False Claims Act territory if the state characterizes the repeat finding as a knowing failure to correct.
Why Early Legal Counsel Is Critical
It is critical that healthcare providers promptly retain experienced healthcare defense counsel before submitting a corrective action plan to a state Medicaid agency. Early legal intervention can protect the provider's rights, ensure the plan's language does not concede more than the facts support, and preserve defenses if the same finding recurs. Delaying legal representation can significantly affect the outcome of the audit and expose the provider to unnecessary risk in a follow-up review or referral.
How Health Law Alliance Can Help
Health Law Alliance has overseen 2,000+ audits, including state Medicaid audit findings and the corrective action plans that follow them. Our Medicaid audit defense attorneys review the finding, draft or edit the CAP language before it is signed, and represent providers through the follow-up review if the state's Medicaid Fraud Control Unit revisits the file. Contact Health Law Alliance for a free, confidential consultation.
