Medicaid audits are increasing in frequency and scope. On April 21, 2026, CMS Administrator Dr. Mehmet Oz announced that all 50 state Medicaid programs must submit plans to revalidate their providers within 30 days, and eleven states are under additional investigation by the House Energy and Commerce Committee. For IDD agencies, which operate in a high-scrutiny billing environment and often carry documentation-heavy compliance requirements, the audit environment in 2026 is one the most demanding it has been in years. Minnesota Department of Human Services
Understanding what a Medicaid audit actually involves, what your rights are, and what determines the outcome is essential preparation for every IDD agency executive director, compliance officer, and billing coordinator.
Who Conducts Medicaid Audits
Medicaid audit activity comes from multiple sources, and understanding who is knocking matters for how you respond:
State Medicaid agencies and their contractors conduct post-payment reviews as part of routine program integrity activity. These reviews typically examine a sample of claims and compare billing records to service documentation and EVV data.
Unified Program Integrity Contractors, known as UPICs, are federal contractors who conduct pre-payment and post-payment reviews of Medicaid claims on behalf of CMS. When a UPIC identifies an overpayment through a post-payment audit, they share findings with CMS and the state Medicaid agency. The provider then receives a review results letter from the UPIC and a demand letter from the state Medicaid agency initiating recoupment. Minnesota Department of Human Services
Medicaid Recovery Audit Contractors, known as RACs, are state-level contractors authorized under federal law to identify overpayments and recoup them on a contingency fee basis. RAC programs may not review claims older than three years from the date of the claim unless they receive state approval to go further back. Minnesota Department of Human Services
State Office of Inspector General programs conduct investigations when fraud referrals are made. These are distinct from administrative audit processes and carry more serious consequences.
What Auditors Are Looking For
IDD agency audits focus on the same documentation and billing issues that generate the most improper payment activity nationally. Approximately 79 percent of Medicaid improper payments are attributable to insufficient documentation. For IDD providers, the most common audit findings involve: Minnesota Department of Human Services
- Service notes that do not include a full description of services delivered, the goals addressed, or the data collected to support billing
- EVV records that do not match submitted claims in service type, time, or location
- Claims submitted against expired or exceeded authorizations
- Staff qualifications that do not meet the requirements for the service billed
- Services billed without an active, compliant individualized service plan
The most important thing to understand about Medicaid audits is that they are fundamentally a documentation review. Auditors are not evaluating the quality of care delivered. They are evaluating whether the documentation supports what was billed. An agency that delivered legitimate services but cannot produce documentation that meets Medicaid standards will face the same recoupment outcome as one that billed improperly.
The Audit Timeline
Most IDD agency Medicaid audits follow a predictable sequence:
The initial notice arrives by mail and typically identifies the audit scope, the time period under review, and a documentation request with a response deadline. If an overpayment is identified, the agency will issue a demand letter. Providers may have as little as 30 days to formally object. Do not let this deadline pass without action. Vertex Systems
The documentation production phase requires your team to pull service records, case notes, EVV records, staff credentials, authorization documentation, and billing records for the sampled claims. This is where agencies with organized, digital documentation systems have a significant advantage over those relying on paper files.
The findings letter details the overpayment determination and the methodology used to calculate it. For random sample audits, auditors may extrapolate findings from the sample to the full population of claims in the audit period, multiplying the impact of errors in the sample significantly. Understanding whether the audit will be extrapolated is critical because it shapes the financial exposure you are managing. Minnesota Department of Human Services
The recoupment and appeal stage begins when a demand letter is issued. Filing a timely recoupment appeal is the mechanism that pauses the government’s collection efforts while your case is being argued. An appeal preserves your cash flow and gives you time to build a fact-based challenge to the auditor’s findings. Never accept an audit finding without reviewing whether an appeal is warranted. Vertex Systems
Your Rights During a Medicaid Audit
IDD agencies have meaningful due process rights in the audit process. State Medicaid agencies must notify providers in writing of any overpayment determination and the dollar amount subject to recovery before initiating formal recoupment, and providers have the right to contest the determination through the state’s administrative process. Vertex Systems
The most important things to understand about your rights:
- You have the right to review the specific claims and documentation the auditor relied on to reach their findings
- You have the right to submit additional documentation that was not included in the initial production if it supports your position
- You have the right to challenge the extrapolation methodology if a statistical sample is being used
- You have the right to appeal at multiple levels if the initial determination is adverse
Engaging qualified healthcare counsel when a significant audit finding is issued is worth the cost. The financial exposure from an extrapolated overpayment demand can be substantially larger than the cost of professional representation during the appeal.
How to Prepare Before an Audit Arrives
The best time to prepare for a Medicaid audit is before it happens. Agencies that respond most effectively to audits are those that have already built the documentation infrastructure the audit will evaluate.
Organized, digital service records that can be retrieved by client, date, and service type without a manual search are the single most important preparation. When an auditor requests documentation for 30 claims across an 18-month period, an agency that can produce those records in hours rather than days is in a fundamentally better position.
Vertex Case Manager maintains client documentation in an organized, retrievable format with the audit trail that connects service delivery, ISP goals, EVV data, and billing records. Vertex Forms ensures service documentation is captured digitally at the point of service rather than on paper that must be located and scanned later.
Conduct internal audits on a scheduled basis. Pull a random sample of your own claims quarterly and verify that documentation is complete, that EVV records match the billing, and that the service notes meet the standards your state Medicaid program requires. Identifying your own gaps before an auditor does gives you the opportunity to correct them.
Connect with the Vertex team to understand how the platform supports audit-ready documentation management across your agency’s service programs.
