A state Medicaid program integrity unit or Medicaid Fraud Control Unit (MFCU) sends a letter asking a provider to review its own billing for a defined period and report back what it owes. The letter is framed as a compliance courtesy. Functionally, it operates as an enforcement funnel: the provider performs the investigative work the state would otherwise have to do itself, and the provider's own findings, once quantified and certified, can become the evidentiary record the state uses against it. For a compliance officer, the letter raises two questions before any response goes out: whether the review period and sample are scoped correctly, and whether the certification the state wants attached to the response creates exposure a narrower reply would have avoided.
Self-Audit Letters Function As Enforcement Funnels
State Medicaid agencies and MFCUs use self-audit demand letters as part of broader state Medicaid program integrity work because they extend investigative reach without adding staff. Pennsylvania's Department of Human Services runs a formal Medicaid Provider Self-Audit Protocol that lets a provider choose between a full claim-by-claim review and a proposed work plan for a sampling-based review, and states plainly that acceptance of the resulting refund does not resolve the state's right to pursue the matter further. The department may refer the underlying conduct to state or federal authorities if the results appear to implicate fraud, even after it accepts the refund check. A self-audit scoped too broadly, covering years or billing categories beyond what actually triggered the letter, can hand the state a record supporting a demand larger than the one it originally suspected, and can supply the factual basis for a referral to the MFCU for a full investigation.
The Certification Carries False Claims Act Exposure
Most self-audit demand letters ask the provider to sign an attestation that the review was complete and the reported figure is accurate. That certification does more than close the state's file. The federal 60-day overpayment rule, codified at 42 U.S.C. § 1320a-7k(d), requires a provider to report and return an identified Medicaid overpayment within 60 days of identification. Any overpayment retained past that deadline becomes an actionable obligation under the False Claims Act's reverse false claims provision, 31 U.S.C. § 3729(a)(1)(G). A self-audit letter sets the identification date the government points to later. A response that understates the review's scope, omits claim categories the provider suspected but did not examine, or certifies a figure the provider has not actually verified can become the basis for a False Claims Act theory, built on the certification the state asked the provider to sign.
A self-audit response the provider signs and certifies can become the government's primary evidence in a fraud case, not a defense to one.
Negotiating Scope Before You Respond
Providers can negotiate the terms of a self-audit request rather than accept the state's framing at face value. Counsel can negotiate the review period and sample methodology with the agency before work begins, rather than accepting an open-ended instruction to examine all claims for an undefined period. The response can be structured the way the HHS-OIG self-disclosure protocol handles voluntary disclosures, a defined submission built on a documented investigation and a quantified overpayment, rather than an unstructured narrative letter that invites follow-up questions the state did not originally ask. Counsel can also negotiate the review methodology itself, whether a statistically valid sample supports extrapolation or a full claim-by-claim review is the more defensible path, before the provider commits to either one in writing. Declining to respond carries separate risk: a state that concludes it is facing a credible allegation of fraud can move to a payment suspension while it investigates, a more disruptive outcome than a scoped, counsel-negotiated self-audit response.
Why Early Legal Counsel Is Critical
It is critical that providers promptly retain experienced healthcare defense counsel upon receiving a Medicaid self-audit demand letter, audit notice, or other government inquiry. Early legal intervention can protect the provider's rights, ensure the review is scoped appropriately before it begins, avoid a certification that creates avoidable False Claims Act exposure, preserve defenses to the underlying billing determination, and allow counsel to communicate with the state Medicaid agency or MFCU on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance represents pharmacies and healthcare providers responding to Medicaid self-audit demand letters, from negotiating the review scope and sample methodology with the state before work begins to structuring the response and certification to limit downstream False Claims Act exposure. If your practice has received a Medicaid self-audit request, contact us for a free, confidential consultation.
