Medicare Self-Audits: Scope, Privilege, and Handling the Findings

A Medicare self-audit, an internal review a physician practice conducts of its own Medicare claims, can catch a billing problem before a Medicare Administrative Contractor or a Unified Program Integrity Contractor finds it first and turns it into a formal recoupment demand. The same review can also work against the practice if it is not scoped, staffed, and run correctly. The decisions made at the outset, which service and time period to examine and how the sample is selected, determine what the review can actually show. Whether the review is privileged depends on how it is set up and used, not on whether a lawyer is listed on the engagement letter. And once a self-audit finds an overpayment, Medicare’s reporting and return obligation applies regardless of how the finding was discovered.

Scoping the Review

The review’s value starts with its scope. A practice choosing which service and time period to examine should weigh where its own risk actually sits: a billing pattern that recently changed, a code with a history of denials, or a service line that has drawn RAC or UPIC attention industry-wide. CMS’s own guidance for physician self-audits describes building a sample large enough to support a reasonable conclusion, drawn so the staff who delivered or billed the services under review are not the ones selecting which claims get tested. Sampling at random, rather than hand-picking favorable claims, is what allows a finding to be extrapolated across the broader claim population if that becomes necessary.

Who Performs the Review

Independence matters as much as clinical training. A reviewer with no role in delivering or billing the services under examination can test the claim against the applicable local coverage determination and documentation requirements without the incentive to find a clean result. CMS’s guidance recommends pairing someone who understands billing with a clinically trained reviewer, often a nurse or physician, who can assess whether the documentation supports the service billed. That independence, and the record showing it, is part of what makes the review’s conclusions credible if they are ever tested.

Privilege Is Not Automatic

Privilege turns on how a self-audit is structured, not on who commissions it. Courts examining internal compliance reviews look at whether obtaining or providing legal advice was a genuine purpose of the engagement, whether counsel actually directed it, and how the results were used afterward. A review that counsel directs, that reports to counsel, and that exists to help counsel assess legal exposure has a stronger claim to attorney-client privilege and work-product protection than a review that functions as routine quality assurance with a lawyer’s name attached. Even a properly structured review remains open to challenge. A court can still order disclosure if it finds the review served a business purpose rather than a legal one.

Whether a Medicare self-audit is privileged depends on how the review is structured and used, not on whether a lawyer’s name appears on the engagement letter.

The Duty to Report and Return an Overpayment

The practice’s obligations under Medicare’s overpayment rule continue regardless of how the problem surfaces. Under the current version of 42 CFR 401.305, a provider has identified an overpayment when it has actual knowledge that one exists, acts in deliberate ignorance of whether it exists, or acts in reckless disregard of the question, the same knowledge standard used under the False Claims Act. Once identified, the regulation generally requires the overpayment to be reported and returned within 60 days, or by the due date of a related cost report if later, and that 60-day period runs from identification even before the exact amount is calculated. A good-faith investigation into related overpayments can pause that clock, but only on the terms the regulation sets out. Deciding how to report, how to return, and whether the facts call for the OIG self-disclosure protocol is a decision for counsel on the specific facts, the point where a self-audit’s findings stop being internal compliance and become a reportable obligation.

Why Early Legal Counsel Is Critical

It is critical that physician practices retain experienced healthcare defense counsel before a self-audit begins, not after it finds a problem. Early legal involvement shapes how the review is scoped, who performs it, and whether attorney-client privilege and work-product protection have a genuine basis to apply in the first place. Waiting until a self-audit has already produced findings outside of counsel’s direction can foreclose those protections and narrow the practice’s options for addressing what the review found.

How Health Law Alliance Can Help

Health Law Alliance’s attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.

The firm represents physician practices in Medicare audits, including the overpayment and extrapolation disputes that can follow a self-audit’s findings. Contact Health Law Alliance for a free, confidential consultation on Medicare audit defense.