(800) 345 - 4125 Free Case Review
Medicare Audit Attorneys · MAC · UPIC · RAC · SMRC · CERT · Five-Level Appeal

Medicare Audit Attorneys

Medicare and OIG audits have increased dramatically as CMS now seeks to eliminate areas of high-cost care from federal programs. Our Medicare audit defense team includes former Medicare auditors, payor investigators, and clinician attorneys who not only understand legal requirements, but medical standards. We know the rules so CMS can’t make them up no matter what Dr. Oz says.

We Stop Medicare Enforcement Overreach at Every Stage
  • Medicare Administrative Contractor (MAC) Medical Reviews and Targeted Probe and Educate (TPE) Audits
  • Recovery Audit Contractor (RAC) Audits
  • Comprehensive Error Rate Testing (CERT) Audits
  • Unified Program Integrity Contractor (UPIC) Audits
  • Supplemental Medical Review Contractor (SMRC) Audits
  • Office of Inspector General (OIG) Reviews and Investigations
  • Enrollment revocation and re-enrollment bar appeals
Request a Medicare Audit Defense Review
Medicare Audit Defense Hotline · Direct Line
(800) 345 - 4125
Overview

Did CMS, a Medicare Contractor, or OIG Request Your Records?

Medicare audits may come from many different angles. Sometimes a Medicare Administrative Contractor (MAC) like Noridian will issue an audit. Other times a Recovery Audit Contractor (RAC) like Cotiviti will send the demand. Unified Program Integrity Contractors (UPICs) also audit Medicare claims. Finally, CMS and HHS-OIG also conduct audits and investigations. None of these audits are done at random, and an audit or document request should serve as a warning that your Medicare claims have come under a microscope.

No matter where it comes from, Health Law Alliance’s audit defense team has handled thousands of audits for satisfied clients. We employ a specialized attorney team with the skillsets and experience to successfully navigate Medicare audits and investigations from the initial document request through anything that follows, including suspensions, revocations, and potential fraud referrals. Our Medicare audit attorneys include a former Medicare auditor and investigator from Qlarant, a CMS contractor, attorney clinicians with deep experience in documentation and coding requirements, and former government officials and regulators.

Providers should never respond to a Medicare audit, even a simple document request, without a clear read on their risk and an understanding of what may follow. Our Medicare audit defense team will help you understand why you have been selected for an audit and how to prove compliance with all Medicare billing requirements. We handle the audit, allowing you to focus on patient care.

“Medicare billing and coding requirements can be a moving target. We will hold CMS to its written policies and the law because our firm’s attorneys are former Medicare auditors.”
Protect Your Practice Now →
Medicare Audit Checklist

HLA’s Guide for Medicare Audits & Investigations

We created this guide to assist providers with Medicare audits, but it cannot substitute for specialized advice tailored to your unique circumstances.

01

Identify the contractor and the kind of review

Not all Medicare audits are created equal, and knowing the type of review and which CMS contractor is asking determines how you respond. A Medicare Administrative Contractor such as Palmetto GBA, Noridian, Novitas, National Government Services, First Coast, WPS or CGS issues additional documentation requests, runs Targeted Probe and Educate reviews and places high error rate providers on prepayment claim review. A Comprehensive Error Rate Testing (CERT) sample finding feeds the national improper payment rate and can produce a downstream review. The Supplemental Medical Review Contractor (SMRC), currently Noridian Healthcare Solutions, runs CMS-directed national review projects. A Recovery Audit Contractor such as Performant or Cotiviti reviews paid claims for overpayment on a contingency basis. A Unified Program Integrity Contractor such as Qlarant, SafeGuard Services or CoventBridge investigates suspected fraud, waste and abuse, and it can conduct site visits and interviews, recommend payment suspension and refer the matter to the HHS Office of Inspector General (HHS-OIG) or the local U.S. Attorney’s office.

A routine education-oriented probe from your MAC looks nothing like a UPIC fraud investigation that can trigger payment suspension and law enforcement referrals. Treating every letter the same is how providers lose revenue and momentum, so match the response to the contractor and the review type before anything else.

02

Treat the first records request as the start of the case

Most audits start quietly, with a request for a small number of charts. It rarely stays that way. Once the initial sample is reviewed, contractors widen the date range, add claim types and expand into other services. The language used, the documents provided and the explanations offered in that first response become the foundation for the auditor’s conclusions, and early mistakes are hard to undo later. Providers who let billing staff send an informal response are building the record the contractor will argue from.

03

Calendar the deadline the letter actually states

Response windows differ by contractor and by review type, and the controlling deadline is the one printed in the request and the governing authority, not a remembered standard. Date-stamp the letter, confirm when it was received and work backward so that legal and clinical review happen before the production date rather than on it. Extensions are not guaranteed, and any request for one should be made in writing well before the deadline.

Where records are not produced on time, the contractor is able to deny the sampled claims outright for lack of supporting documentation and then extrapolate that denial rate across the population.

04

Know what a Targeted Probe and Educate review can become

TPE is the MAC’s coaching tool, not a criminal referral. CMS instructs MACs to pull a small sample, typically 20 to 40 claims per round, for up to three rounds, to deliver one-on-one education after each round and to stop the review if the error rate improves. If problems persist, the MAC can escalate: additional rounds, 100 percent prepayment review, extrapolation or referral to another contractor to investigate potential fraud. A provider who organizes records, accepts education and effectively corrects process gaps usually exits TPE without long-term damage. A provider who treats each round as paperwork is building the record for the escalation.

05

Pull the complete record and match every claim to the coverage rule

Medicare coverage is set by national coverage determinations, and by local coverage determinations and billing articles that differ by MAC jurisdiction, and all of them are updated and changed routinely. A policy in force today may not have governed the date of service under review. Pull the historical policy for each date before evaluating any claim, assemble the full record for every requested date of service and read it the way the reviewer will: do the order, the note and the claim line support one another?

Pulling the correct historical policy is a small amount of work at the outset that can dispose of entire categories of denials later.

06

Understand what can and cannot be fixed

A well-intentioned effort to fix a chart creates a second problem on top of the first, and the second one can be worse. Authentication is different from supplementation, and supplementation is different from rewriting history. A note added late, or an order signed after the request arrived, will raise suspicions.

Before changing or adding anything after the audit has started, determine what the applicable CMS rule actually permits and preserve the original entry. There may be room to address some omissions properly, but strict rules apply.

07

Produce exactly what is required, organized so the reviewer can follow it

One common mistake is treating the response as an export: pulling the electronic record, uploading thousands of pages and assuming the reviewer will find the evidence that matters. The opposite mistake is sending less than what was asked. A defensible claim can be denied when the evidence is buried or never tied to the coverage requirement being tested, and once a record is produced it can be used for any purpose, including new audits and recoupment demands.

A contractor reviewer may have no background in your specialty. Organize the production so that a non-clinician reader can follow each claim from the coverage rule to the note that satisfies it.

A defensible production typically includes
  • A transmittal letter identifying the request, production date, beneficiaries and enclosed materials
  • A beneficiary-by-beneficiary index
  • Consistent pagination or Bates numbering
  • Records arranged by date of service
  • Clear separation between contemporaneous clinical records and later-created explanatory materials
  • A coverage map showing where each required element appears in the record
  • Appropriate labeling of signature logs, attestations, late entries and addenda
08

Assume extrapolation, and prepare to challenge it

A review of 30 to 50 claims can become a six- or seven-figure demand when the contractor projects the sample error rate across every claim in the audit window.

Under 42 U.S.C. § 1395ddd(f)(3), extrapolation requires a determination of a sustained or high level of payment error or a documented failure of a prior educational intervention, and the sampling and extrapolation must follow the requirements of the Medicare Program Integrity Manual. The sample must be a probability sample in which each sampling unit has a known probability of selection. Challenges to extrapolation methodology commonly focus on whether the sampling units were properly defined and independent, whether the random selection was documented and replicable, and whether the statistical assumptions behind the point estimate hold. The error determination itself is not subject to review, but the statistical methodology behind the projection is, and that is where most successful challenges are made.

Questions worth asking as soon as the request arrives
  • How many claims were requested, and over what span of dates of service?
  • Has the contractor identified a basis for a sustained or high level of payment error, or a prior failed educational intervention?
  • Was there a prior Targeted Probe and Educate episode or probe review?
  • What is the sampling frame, the universe definition, the random-number documentation and the full methodology?
09

Protect cash flow: prepayment review, payment suspension and revocation

Audits can stop revenue before any overpayment is decided. Prepayment review holds the claims placed on review until a reviewer approves each one. A payment suspension under 42 C.F.R. § 405.371 can be imposed based on reliable information of an overpayment or on a credible allegation of fraud and holds all Medicare payments for 180 days (or more) with only one chance to rebut the suspension’s basis. A revocation of billing privileges under 42 C.F.R. § 424.535 stops payment altogether and carries a re-enrollment bar.

Each has its own clock and its own remedy: a rebuttal statement, a corrective action plan, a reconsideration request or an appeal. For a provider running payroll against Medicare receipts, addressing the interim measure is often more urgent than the eventual recoupment.

10

Control communications and read the signs that it is more than an audit

Designate one point of contact, preferably counsel or a trained compliance leader, and route every communication through that person. Keep a contemporaneous log of every contact: date, participants, topic, documents requested, what was said and any follow-up promised. UPIC investigators, many of them former law enforcement, are trained to elicit explanations, and the attempt to talk a contractor out of an audit is where accusations of malfeasance begin.

Signs the matter may be more than an audit
  • The letter cites potential fraud, a credible allegation or a referral
  • The request covers 30 or more claims outside a TPE round, or a multi-year window
  • It comes from a UPIC rather than a MAC, or names HHS-OIG
  • A site visit or beneficiary interviews are proposed
  • Payment suspension or prepayment review is imposed
  • Questions turn to referral sources, marketers or ownership

If you need assistance working through any of these questions, the attorneys at Health Law Alliance have the experience and background necessary to guide the response. We offer flexible fee arrangements and competitive rates.

Do Not Respond without a Plan

Our attorneys will guide your response from beginning to end, using the law and medical standards to defeat arbitrary audit clawbacks.

Speak With a Medicare Audit Attorney →
What Auditors Look For

Common issues identified during Medicare audits

Medicare audit findings cluster around a predictable set of documentation, coding and utilization issues. Auditors judge your charts months or years after the service and claim, without the clinical context the provider had, and each item below is a place where that hindsight is applied.

Exposure

Potential Consequences of a Medicare Audit

A Medicare audit can quickly escalate far beyond a routine records request, including

Former professional experience

Where Our Attorneys Served Before Health Law Alliance

Department of Justice

Agency and company marks identify former professional experience of individual HLA team members. They do not imply affiliation, endorsement, or a client relationship.

Medicare Defense Outcomes

Representative Case Results

Outcomes are summarized. Client names are withheld.

Charges Dropped

Commonwealth of Massachusetts v. Pharmacy & Owner

A Medicare audit uncovered a 25,000-unit discrepancy of Zegerid and other violations, and the payor referred “fraud” to the Massachusetts Attorney General’s Medicaid Fraud Control Unit, which indicted the pharmacy owner on numerous criminal charges, including False Claims and Larceny. After Health Law Alliance was retained, the State dropped all charges before trial and abandoned the prosecution. The owner admitted no wrongdoing and was not excluded, and the pharmacy avoided all network sanctions.

State · Pharmacy and owner · Massachusetts MFCU
Civil Settlement, No Exclusion

United States v. Medical Director & Practice

A Medicare audit uncovered alleged “outlier” billing, upcoding and “impossible day” scenarios, and the physician was referred for federal investigation to the U.S. Attorney’s Office for the District of New Jersey. Health Law Alliance attorney Anthony Mahajan engineered a strategy that resulted in a successful civil settlement: the physician resolved the case for $365,000 in restitution, plus penalties and interest, admitted no wrongdoing, was not excluded and suffered no licensing or other consequences.

Federal · Medical practice · District of New Jersey
FCA Case Dismissed

United States v. Oncology Dispensing Practice

A Medicare whistleblower alleged that a Washington State oncology practice had submitted false Medicare claims, and the relator referred the “fraud” for federal investigation to the U.S. Attorney’s Office for the District of Massachusetts. Although other oncology practices settled, Health Law Alliance attorney Anthony Mahajan moved to dismiss, and the judge dismissed the case in its entirety against the practice, saving it millions in alleged false claims and penalties.

Federal · Oncology practice · District of Massachusetts

Attorney advertising. Prior results do not guarantee a similar outcome. Case summaries are generalized for confidentiality and are not a substitute for legal advice on your specific matter.

Health Law Alliance attorneys
The HLA Team

HLA Medicare Audit Defense Attorneys

Medicare audit matters can cross prepayment review, payment suspension, enrollment revocation, the five-level Medicare appeal, False Claims Act exposure and criminal referrals. Health Law Alliance handles the audit response and any parallel appeal or referral as one coordinated matter.

Common Medicare Audit Triggers

The six patterns that put a Medicare audit in motion

CMS provides its contractors claims data, peer comparators and cross-referrals from other agencies to drive audits. The following triggers are the most common predicates for a records request, prepayment review notice or focused medical review.

01
Data analytics and peer comparator outliers
Contractors score providers against their specialty peers, and a provider at the top of the distribution on a code, a modifier or reimbursement per beneficiary is more likely to be selected for review. Common high-risk patterns include high evaluation and management (E/M) code distribution (CPT 99214 and 99215 over 80% of visits), high modifier 25 utilization, high modifier 59 utilization, and outlier reimbursement per beneficiary on Part B drug administration. Recent industry-specific payment suspensions have been justified by national average outlier status.
02
Top-down Medicare Advantage pressures
CMS conducts Risk Adjustment Data Validation (RADV) audits of Medicare Advantage (MA) contracts to confirm that diagnoses used for payment are supported by medical records. Findings of non-compliance often lead to provider-level audits for the very same issues. Medicare Advantage insurers are facing CMS scrutiny for misuse of high-risk diagnosis codes so providers can expect trickle down audits by MA Special Investigation Units and Medicare directly.
03
Specialty-specific enforcement initiatives
Medicare contractors run focused enforcement initiatives targeted at specific specialties or service lines. Recent examples include skin substitute applications following the Apex Medical $309M False Claims Act (FCA) settlement, debridement coding following the Vohra $45M settlement, hospice eligibility review, home health face-to-face documentation, and remote patient monitoring billing. Providers operating in an initiative-targeted area face elevated review regardless of individual billing patterns.
04
Medicare Drug Integrity Contractor (MEDIC) referral on Part D
For pharmacies dispensing Part D claims, the Medicare Drug Integrity Contractor identifies suspicious patterns and refers them to the UPIC for parallel review. A Part D investigation at the pharmacy level can produce a review at the prescriber level, and the reverse. Cross-track exposure is common in opioid, GLP-1 and specialty dispensing patterns.
05
State Medicaid Fraud Control Unit (MFCU) cross-referral
State fraud control units investigate Medicaid claims and refer matters to CMS for parallel Medicare review when the provider participates in both programs, and the referral runs in the other direction too. The state-federal coordination is increasingly tight, and a defense that handles only one side often misses or compromises the exposure on the other.
06
Whistleblower or qui tam complaint referral
A qui tam complaint filed under seal, often by a former employee or biller, can produce a contractor review when the DOJ Civil Division wants a billing analysis to support the case. The records request that follows rarely identifies the underlying complaint, but its scope tracks the allegations closely enough that experienced defense counsel can recognize the matter behind it.
Medicare Audit Defense FAQ

Frequently Asked Questions

Eight questions that come up on almost every first call. The answers below are general; specific situations require privileged consultation.

The course of your Medicare audit will depend on the auditing entity. Recovery Audit Contractors (RACs) conduct post-payment review of paid claims for overpayment recovery on a contingency basis. Medicare Administrative Contractors (MACs) adjudicate claims and process payments, but also conduct both pre- and post-payment reviews and administer Targeted Probe and Educate (TPE) audits when providers demonstrate elevated error rates. Supplemental Medical Review Contractors (SMRCs) conduct medical review of specific topics on CMS direction. Unified Program Integrity Contractors (UPICs) are responsible for Medicare and Medicaid program integrity work in a specific geographic jurisdiction.
Pre-payment review means the contractor reviews each claim before Medicare pays it. The practice continues to submit claims, but cash flow stops while each claim sits in review, typically 60 to 180 days per claim. Post-payment review means the contractor reviews claims that have already been paid and demands recoupment of any claims found non-compliant. Post-payment review may use statistical extrapolation: the contractor reviews a sample, calculates an error rate and projects it across the full claim population for the audit window. The defenses, the cash-flow consequences and the appeal posture differ materially between the two.
Retaliation for exercising Medicare audit appeal rights is prohibited. We incorporate proper legal protections into Medicare audit responses and settlements, and maintaining existing contracts is always a priority.
The Medicare appeal track has five levels with strict statutory deadlines. Level 1 is the redetermination request to the MAC, due within 120 days of the initial determination. Level 2 is the reconsideration request to a Qualified Independent Contractor (QIC), due within 180 days of the redetermination. Level 3 is the Administrative Law Judge (ALJ) hearing, due within 60 days of the QIC reconsideration; the ALJ level has historically carried a substantial backlog. Level 4 is the Medicare Appeals Council review. Level 5 is federal district court review under 42 U.S.C. § 405(g). Missing any deadline waives the appeal at that level and forecloses subsequent levels. The redetermination and reconsideration are the most consequential steps because the record built there is the record the ALJ will review.
When the findings suggest intent rather than error: services billed but not rendered, false certifications, kickbacks to marketers or referral sources, or upcoding that follows revenue targets rather than the chart. The civil referral runs through the DOJ Civil Division and may surface as a Civil Investigative Demand. The criminal referral runs through the local U.S. Attorney or the DOJ Fraud Section and may surface as a grand jury subpoena or a target letter. Common referral patterns include: documented patterns of false certifications, evidence of services billed but not provided, kickback or anti-kickback indicators, suspected upcoding of E/M or procedure codes for financial gain, and any pattern that the auditor believes supports a False Claims Act theory.
We offer flexible fee arrangements based on the scope of Medicare audit representation required and the stage of the audit. The earlier we are involved the better, as we can shape and limit the audit scope, making legal representation more effective and less costly.
Immediately upon receiving any audit notice, and before responding to the first records request. Early intervention preserves appeal rights, controls how the matter is framed and protects your reimbursement and your license. The first production shapes everything that follows: which charts the contractor reviews, what claim universe the sample is drawn from and whether the contractor sees patterns that escalate to referral. A production made without counsel can become evidence in later civil and criminal proceedings, and the procedural defenses available on appeal, extrapolation challenges above all, can be foreclosed by an inadequate or over-inclusive response.
We help providers navigate the audit process, mitigate risk and defend their reputation:
  • Comprehensive audit defense: Full representation throughout the audit, from document submission to appeals. As former regulators for the federal government, we use our knowledge of the government’s playbook to protect your interests.
  • Minimize financial exposure: Our proven strategies are designed to reduce penalties and protect your revenue. Statistical extrapolation challenges focus on whether the UPIC's methodology meets the CMS Program Integrity Manual standards and the relevant federal court precedent.
  • Medicare compliance guidance: Before questions arise, we can help you ensure ongoing compliance with Medicare regulations to avoid future audits and licensing sanctions. The best defense is a strong offense.
  • Customized legal strategy: Tailored defense based on the unique details of your Medicare audit, your practice’s size and location, and the documentation you maintain.
  • Post-audit support: Guidance on implementing corrective measures to prevent future audit issues and ensure compliance, including remedial policies and training.
5,000+Matters handled
2,500+Clients represented
2,000+Audits overseen
ImmediateAttorney response
Health Law Alliance

Book a Free Consultation

Speak with an experienced attorney today at no cost - evaluate your situation and learn how we can help. Confidential, no obligation.

(800) 345 - 4125
Get Medicare Audit Advice from Attorney-Clinicians
(800) 345 - 4125 Speak With Counsel Today →
Related Practice Areas
See also
01
UPIC Audit Attorneys
Qlarant, SafeGuard Services, CoventBridge
Read More →
02
Hospice & Home Health Audit Attorneys
Suspensions, revocations, eligibility review
Read More →
03
DME Audit Attorneys
Proof of delivery, supplier standards, revocations
Read More →