Medicaid Managed Care Audits: How MCOs and PBMs Enforce Contract Terms

A pharmacy that contracts with a Medicaid managed care organization (MCO) does not deal with the state Medicaid agency when an audit notice arrives. It deals with the MCO, or more often the pharmacy benefit manager (PBM) the MCO has delegated to administer its pharmacy benefit. Unlike a state fee-for-service Medicaid audit, often called an OMIG audit, a Medicaid managed care audit is triggered, scoped, and appealed under the terms of the network provider agreement the pharmacy signed. Pharmacies that treat the two processes as interchangeable can miss deadlines that cost them the right to appeal. Effective Medicaid managed care audit defense starts with the contract, not the state regulation alone.

Federal Framework Under 42 CFR Part 438

Medicaid managed care is governed at the federal level by 42 CFR Part 438, which sets the terms every state must build into its MCO contracts. Subpart H, at 42 CFR 438.608, requires each plan to maintain a compliance program with a designated compliance officer and routine internal monitoring to detect fraud, waste, and abuse. The same section requires the plan to report identified or recovered overpayments to the state within 30 calendar days, and requires network providers to return an identified overpayment to the MCO within 60 calendar days. These deadlines govern the plan's relationship with the state. They do not describe how a pharmacy audit is conducted, what documentation standard applies, or how a pharmacy appeals a recoupment. Those procedures come from the contract.

MCOs Delegate Audit Authority To PBMs

MCOs rarely audit pharmacies directly. Under 42 CFR 438.230, an MCO may delegate program integrity and audit functions to a subcontractor, most often the PBM that already processes its pharmacy claims, but the MCO retains ultimate responsibility and must put the arrangement in a written agreement specifying the delegated activities and reporting responsibilities. In practice, the PBM runs the resulting PBM audit using the same playbook it applies to commercial and Medicare Part D business: claims pulls, document requests, and desk or on-site review. The same regulation gives the state, CMS, the HHS Inspector General, and the Comptroller General the right to audit the subcontractor's books for 10 years from the end of the contract period or completion of the audit, whichever is later.

The Provider Agreement Controls Audit Procedure

This delegation structure creates the fact a pharmacy needs to understand before it responds to an audit letter: the operative rules typically live in the network provider agreement and the PBM provider manual incorporated into it, not the Medicaid statute of the pharmacy's state. The provider agreement usually sets the documentation standard, the sampling and extrapolation method the auditor may use, the response timeline, and the internal appeal deadline before the pharmacy loses the right to contest a recoupment. A pharmacy that responds to an MCO or PBM audit letter using the procedural rules from a state OMIG audit can miss a contractual deadline a fee-for-service audit would never impose.

The state's Medicaid regulations set the floor for a managed care audit. The network agreement with the MCO and its PBM decides what actually happens to the pharmacy during that audit.

Recoupment, Extrapolation, and Appeal Deadlines

When a PBM audit finds errors, the MCO or PBM issues a recoupment demand against future claims payments, sometimes based on an extrapolated error rate applied across the full claims universe rather than the audited sample. The contract, not state Medicaid regulation, usually sets the window to challenge that demand through an internal appeal or reconsideration process, and missing that window can convert a disputed finding into a final, collectible debt. Medicaid managed care enrollees have separate grievance and fair hearing rights under Part 438 that do not extend to network providers disputing a recoupment, so a pharmacy facing an MCO or PBM audit should assume its appeal rights come from the provider agreement it signed, not a state administrative hearing.

Why Early Legal Counsel Is Critical

It is critical that pharmacies and other Medicaid managed care network providers promptly retain healthcare defense counsel upon receiving an audit notice, document request, recoupment demand, or other inquiry from an MCO or its PBM. Early legal intervention can protect the provider's rights, ensure appropriate responses to the plan's requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with the MCO or PBM on the provider's behalf. Delaying legal representation can significantly affect the outcome of the audit and expose the provider to unnecessary risk.

How Health Law Alliance Can Help

Health Law Alliance defends pharmacies facing Medicaid managed care audits, from the initial PBM document request through recoupment appeals and, where necessary, proceedings before the MCO or the state. The firm reviews the network provider agreement and PBM provider manual that govern the audit, builds the documentation record the plan is entitled to see, and represents the pharmacy through every appeal deadline the contract imposes. If your pharmacy has received an audit notice, document request, or recoupment demand from a Medicaid MCO or its PBM, contact us for a free, confidential consultation.