Medicaid Audit Lookback Periods and the Sample Time Frame

Every state sets its own Medicaid audit review period, the window of claims an auditor can pull into a sample, through its own statute, regulation, or contract with its Medicaid managed care organization or audit contractor. A pharmacy or provider that assumes the review period matches a federal standard, or matches what a Medicare contractor uses, can misjudge how many years of claims are actually in play, and how large the eventual recoupment demand could become.

How States Set the Medicaid Audit Review Period

The closest thing to a federal baseline sits in the rules for Medicaid Recovery Audit Contractors. Under 42 CFR Section 455.508(f), a Medicaid RAC may not review claims older than three years from the date of the claim, unless the state approves a longer look-back. CMS's own RAC guidance confirms states can and do seek that exception. Outside the RAC program, the period is not standardized at all. A Husch Blackwell analysis of state Medicaid overpayment rules found lookback periods running as short as four years in Texas for qui tam-related claims, to five years in Missouri, to six years in Kansas, each tied to that state's own record retention rules or False Claims Act statute of limitations rather than to a single national number.

When the Review Period Extends Beyond the Standard Window

The period set for a routine post-payment audit is not always the period that ends up applying. When a state Medicaid agency or its Medicaid Fraud Control Unit (MFCU) characterizes the claims at issue as fraud rather than a billing or documentation error, the applicable window can shift from the audit contract's routine lookback to the longer period available under the state's own False Claims Act. How far that shift reaches, and what triggers it, is state-specific and fact-dependent. A provider responding to a records request should not assume the number printed on the audit engagement letter is the outer limit of what the state can ultimately review.

Why the Length of the Review Period Drives the Size of the Demand

The length of the review period sets the size of the universe an auditor draws a sample from before projecting the sample's error rate across every claim in that universe. A three-year review period and a six-year review period can produce demands of a different order from the same error rate, because the base being projected differs between them. The review period question sits upstream of the recoupment, the audit appeal, and, where the state alleges fraud, a False Claims Act referral or OIG exclusion action. How a recoupment of that size affects daily operations is covered in Medicaid Recoupment and Your Cash Flow. Audit findings that escalate into a termination action, rather than a recoupment demand alone, are covered separately in Medicaid Provider Agreement Termination.

The audit review period is set state by state, not by a single federal number, and the length of that period determines how many years of claims fall inside the sample an auditor projects across.

Why Early Legal Counsel Is Critical

It is critical that providers promptly retain experienced healthcare defense counsel upon receiving a Medicaid audit notice, a records request, or a self-audit demand letter. Early legal intervention can confirm which review period actually applies under the state's program integrity rules, protect the provider's rights, avoid inadvertent admissions in the records exchange, and allow counsel to communicate with the state agency or its contractor on the provider's behalf. Providers who receive a demand to self-audit and certify their own findings should review Medicaid Self-Audit Demand Letters: Options Before You Certify before responding. Delaying representation can allow a longer review period to go unchallenged and increase the eventual exposure.

How Health Law Alliance Can Help

Health Law Alliance has handled 5,000+ matters across healthcare regulatory and audit defense over 25+ years, including Medicaid audits where the state's claimed review period, and whether it was correctly applied, was itself in dispute. If your practice has received a Medicaid audit notice, a records request, or a demand tied to a review period longer than expected, contact Health Law Alliance's Medicaid audit defense attorneys for a free, confidential consultation before responding.