A billing audit from CMS can carry serious consequences. Understanding the process can improve the outcome.

  • Always respond to audit notices promptly and fully.
  • Ask an outside auditor to review the records CMS requests.
  • Annual or semi-annual audits can detect problems before the government becomes involved.

A government billing records audit will make most hospital leaders nervous because of the potential financial — and even criminal — consequences, but understanding the process and best practices can alleviate the stress, says Christina M. Kuta, JD, an attorney with Roetzel & Andress in Chicago.

The number of audits has decreased in the past year or so, but Kuta says that probably is due to disruptions caused by the pandemic. She expects them to resume in full force soon.

Medicare and Medicaid audits come in several forms, from a general audit to one specifically designed to find suspected fraud. Investigators also may focus on healthcare organizations in a specific geographic region.

A common mistake is failing to respond promptly and appropriately to the audit notice, Kuta says. No matter what kind of audit is occurring, it always starts with a letter from the government. It is important to ensure there are updated mailing addresses for the organization and that mail sent to those addresses is checked regularly. If CMS sends an audit notice to a PO box that is checked only sporadically, you could lose valuable time before the audit date.

“I’ve had a number of clients who said they never received audit notices and didn’t respond to them, and that was a major issue with Medicare. Medicare was able to prove that they sent the notice through a trackable method, but the healthcare organization did not have an organized way for handling that kind of mail, and the notice fell through the cracks,” Kuta says. “You have to have a process so that anything coming from Medicare is opened quickly and appropriately.”

The audit notice will request certain documents, often referring to specific patients. The healthcare organization responds with the requested documents, then waits for the decision from CMS. Responding promptly is important, yet many organizations do not.

“I can’t tell you how many agencies I’ve seen who consider the response deadline a suggestion and not a requirement. They don’t respond by the 30 days or whatever is specified, or they don’t send everything they asked for, or they don’t respond at all,” she says. “Now you’ve irritated Medicare — and you never want to do that. You also have not helped your case in trying to show Medicare that you’re doing everything correctly, you don’t owe them any money, and they should leave you alone.”

Failing to respond in full by the deadline always is a big mistake. If the records request is burdensome, you can request more time and CMS usually will grant it. Kuta says CMS has never refused to extend a deadline when she asked on behalf of a client.

CMS will either state that it found no problem during the audit or outline what issues were found and how much money it wants refunded.

“Medicare may suspend your payments during the review in certain circumstances as a way to capture that money in case they want money back after the audit,” Kuta says.

Audits from commercial payers usually are less extensive than a government audit, but they follow the same pattern and can be prompted by the same factors. For instance, a payer might notice that a hospital, clinic, or home health agency is billing for a certain code at a much higher rate than local competitors.

Commercial payer audits tend to strike less fear in the hearts of healthcare leaders because, unlike CMS, the third-party payers do not carry the threat of criminal penalties or kicking the organization out of government programs, which would be a death sentence for many.

Any time a healthcare organization is facing an audit by CMS, and sometimes commercial payers, it is a good idea to obtain an external audit by an independent source.

“It’s a mistake to send off all the records to Medicare with 100% confidence that everything is correct because you have total confidence in your biller who’s been doing your bills forever,” Kuta says. “That person only knows what they were taught. If you don’t have someone from outside review at least a subset of what Medicare is asking for, you’re doing yourself a disservice.”

If the outside reviewer spots problems in the records Medicare requested, the organization can note that up front when submitting the documents and explain how the problem will be corrected going forward. That will show a good faith effort and may influence CMS’ decision on refunds and penalties.

“I also encourage an annual or biannual audit of your billing records. It is always good to find your mistake before the government finds the issue,” Kuta says. “It allows the opportunity to resolve them in an efficient manner without waiting until you’re on the government’s radar.”


  • Christina M. Kuta, JD, Roetzel & Andress, Chicago. Phone: (312) 582-1680. Email: ckuta@ralaw.com.