State Medicaid programs are running post-payment audits across outpatient, intensive outpatient (IOP), residential, and opioid treatment program (OTP) substance use disorder claims at the same time, testing whether the clinical record actually supports the level of care billed rather than whether a diagnosis code is on file. A finding that the record falls short on medical necessity can cascade into a full-program recoupment, and because these providers hold confidentiality-protected treatment records, mishandling the audit's document request can create a second, separate exposure.
Medical Necessity and ASAM Level-of-Care Documentation
North Carolina Medicaid ties coverage of opioid treatment program services to the American Society of Addiction Medicine (ASAM) Criteria, Third Edition, which scores a patient across six clinical dimensions, including intoxication and withdrawal risk, biomedical conditions, and relapse potential, to assign a level of care. Clinical Coverage Policy 8A-9 requires that continued-stay and discharge documentation each address all six dimensions, not a single intake note carried forward. An auditor who cannot find a dimension-by-dimension reassessment at each continued-stay interval treats the entire billed stretch of services as unsupported, whether the patient's clinical picture changed or not. Rebuilding that six-dimension record after the fact is the first task in any Medicaid audit defense response.
Urinalysis and Toxicology Billing Patterns
Drug testing supports treatment decisions at every level of substance use disorder care, but auditors isolate urinalysis billing as its own pattern. NC Medicaid's opioid treatment program policy requires monitoring drug testing at least once a month and bundles presumptive screens and definitive confirmatory tests into the program's bundled per diem rate rather than billing them as separate line items, so an audit instead tests whether the monthly testing required to earn that rate actually happened and is documented. North Carolina's Substance Abuse Intensive Outpatient Program policy, amended January 1, 2026, lists biomedical testing for recent drug use as a required service component, not a line a provider can bill on a fixed schedule without a note tying the result to the beneficiary's current treatment response.
Group Therapy Note Sufficiency
A single narrative describing what a group discussed, copied into every participant's chart for that day, does not show that an individual beneficiary received a billable, individualized service. North Carolina's SAIOP policy caps adult group counseling at one Clinical Staff member for every 12 beneficiaries and adolescent groups at one for every six, and an audit checks both the staffing ratio and whether each beneficiary's note reflects that beneficiary's own participation and response rather than the group's shared agenda. Providers who have already received a draft Medicaid audit report built on this pattern are past the production stage and into dispute.
Confidentiality Under 42 CFR Part 2 During the Audit
A Medicaid audit of a federally assisted substance use disorder program does not bypass the confidentiality rules protecting the record. 42 CFR Part 2 governs disclosure of patient-identifying information held by a part 2 program, and its audit and evaluation provision, 42 CFR 2.53, treats a Medicaid audit or civil investigation by an agency with oversight responsibility for Medicaid as grounds to disclose records to that agency and its contractors without separate patient consent, provided the recipient agrees in writing to the regulation's use and redisclosure limits. The same section limits what happens next: the information may be used only to carry out the audit, or to investigate or prosecute the part 2 program itself, as authorized by a court order entered under 42 CFR 2.66, which separately bars using that information to investigate or prosecute the patient in a criminal matter. A program whose audit findings escalate into program integrity can also face a parallel OIG exclusion referral, distinct from a state's own exclusion and reinstatement after Medicaid exclusion process.
A part 2 program that turns over its full record to a Medicaid auditor without confirming the request fits the 42 CFR 2.53 exception has disclosed confidential patient information outside the only authority that protects the disclosure.
Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.
Why Early Legal Counsel Is Critical
It is critical that healthcare providers promptly retain experienced healthcare defense counsel upon receiving a Medicaid audit notice, document request, or other government inquiry. Early legal intervention can confirm that a records request fits the 42 CFR 2.53 audit exception rather than exceeding it, protect the provider's rights, preserve the level-of-care documentation needed to defend medical necessity, and allow counsel to communicate with the auditor on the provider's behalf. Delaying legal representation can significantly affect the outcome of the audit and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance's behavioral health audit defense team represents providers facing Medicaid audits of substance use disorder claims, from the initial document request through audit appeal. Contact us today for a free, confidential consultation.
