A Medicaid audit notice does not wait for a convenient week. State Medicaid agencies, their program integrity vendors, and, in serious matters, the state Medicaid Fraud Control Unit (MFCU), review billing and documentation across every provider type, from behavioral health clinics to home and community based services agencies. Exposure ranges from a modest overpayment to an extrapolated recoupment, a program exclusion, or a referral for prosecution. An office that treats the notice as paperwork due later loses a provider's main advantage: time to build the record before the state does.
Readiness Before Any Notice Exists
The strongest response starts before a notice arrives. Confirm that your provider enrollment file, National Provider Identifier information, and ownership disclosures are current, since a lapsed revalidation can lead the state to terminate your enrollment. Keep billing records, visit verification data, and clinical documentation organized by date of service. Review your Medicaid provider agreement and program manual on a set schedule. Your provider agreement requires you to keep records showing the services you billed, and your state's manual sets its own retention period for Medicaid records. Check your state's manual for the specific requirement, and keep records that long, longer if a claim is under appeal or active review.
When the Audit Notice Arrives
Log the notice the day it arrives: the issuing office, the date received, and the response deadline in the letter. Calendar that deadline and work backward to leave time for internal review and for counsel to weigh in. Identify exactly which claims and which period are at issue; answering the wrong claims or an incomplete period can undercut an otherwise strong defense. Name one point of contact, a compliance officer, office manager, or administrator, who coordinates every document request and serves as the practice's single voice with the auditor. Multiple staff answering independently is how inconsistent statements end up in the file.
Preserving Records Once an Audit Is Open
An audit notice is a legal hold on every record tied to the claims at issue, not only the chart. Preserve visit verification records, electronic visit verification (EVV) logs, sign-in sheets, or schedules, alongside the billing data behind each claim. Do not alter or supplement a clinical note after the audit opens; a late addition is evidence an auditor, and eventually a prosecutor, will use against the provider. Where a sampled claim could support an extrapolated recoupment across the lookback period, every document behind that claim carries weight beyond its own dollar value.
Reading the Provider Agreement and Program Manual
Every state's Medicaid provider agreement and program manual sets its own audit rules: notice requirements, required records, the sampling and extrapolation method the state may use, and the appeal rights that attach to an adverse finding. State extrapolation methods differ in ways that change the result, covered in Medicaid Extrapolation Challenges at the State Level. These rules also differ from Medicare's. Read the manual's sections on audits and the audit appeal process before responding to a records request, and confirm the forum your state designates for a provider appeal if the audit produces an overpayment finding or a proposed exclusion, as Medicaid Fair Hearings: Appealing Audit and Enrollment Actions and Medicaid Fair Hearings: Preparing Your Case cover in detail.
Bringing In Counsel Before Any Certification Is Signed
Medicaid audit responses can ask the provider to sign a certification, attesting the records are complete, or that a repayment amount is agreed to. That signature can waive defenses not yet evaluated, including a challenge to the extrapolation methodology or the medical necessity findings. Involve healthcare defense counsel before signing, not after a draft is with the state. Counsel can also assess whether a finding exposes the practice to a False Claims Act referral or an OIG exclusion action, exposure a compliance officer reviewing the audit alone is not positioned to see.
The certification a provider signs to close out a Medicaid audit can do as much damage as the audit itself, which is why it belongs in front of defense counsel before anyone signs it.
Why Early Legal Counsel Is Critical
It is critical that Medicaid providers promptly retain experienced healthcare defense counsel upon receiving an audit notice, a records request, or any other government inquiry. Early legal intervention can protect the provider's rights, shape how records are produced, avoid an inadvertent admission, and preserve defenses to extrapolation and sampling methodology. Delaying representation can narrow the options available once an overpayment demand or exclusion proceeding is underway.
How Health Law Alliance Can Help
Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience. If your practice has received a Medicaid audit notice or a records request, contact Health Law Alliance's Medicaid audit defense attorneys for a free, confidential consultation before any response is submitted.
