What Is a PERM Audit? How CMS Samples Medicaid Ride Claims for Payment Errors

Most Medicaid audits look for a problem. A PERM audit does not. CMS draws claims at random to measure how often Medicaid pays wrong, so a careful company with clean records can still get a call. What decides the outcome is whether you can produce the trip record on time.

What a PERM audit measures

The Payment Integrity Information Act of 2019 requires federal agencies to estimate their improper payments each year, and CMS built PERM to do it for Medicaid and CHIP. The rules are in 42 CFR part 431, subpart Q. An improper payment is any payment made in the wrong amount or that should not have been made, so underpayments count too.

CMS reviews three parts of each state’s spending: fee-for-service claims, managed care payments, and eligibility decisions. Its rolling national Medicaid rate for 2025 was 6.12 percent, or $37.39 billion, with a fee-for-service rate of 4.60 percent (rates page updated January 20, 2026). Rides ran higher. In CMS’s 2025 supplemental data (January 2026), the transportation and accommodations service type had 12 claims in error out of 259 sampled, a projected rate of 7.76 percent, with a wide 95 percent confidence range of 2.19 to 13.33 percent.

PERM is not a UPIC audit or a Medicaid RAC audit. Those pick a provider’s claims on purpose, from a lead or from data analysis. PERM picks claims at random to grade the state, and the state then collects any overpayment from you.

Which states are in the PERM cycle

CMS reviews 17 or 18 states a year, so each state comes up once every three years. Its provider page (modified June 30, 2026) lists the cycles:

• Cycle 1, review year 2028. Arkansas, Connecticut, Delaware, Idaho, Illinois, Kansas, Michigan, Minnesota, Missouri, New Mexico, North Dakota, Ohio, Oklahoma, Pennsylvania, Virginia, Wisconsin, and Wyoming. Claims paid from July 1, 2026 to June 30, 2027 can be sampled, and records requests go out from April 1, 2027 to April 15, 2028.
• Cycle 2, review year 2026. Alabama, California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, and West Virginia. It covered claims from July 1, 2024 to June 30, 2025, and its records window closed April 15, 2026.
• Cycle 3, review year 2027. Alaska, Arizona, the District of Columbia, Florida, Hawaii, Indiana, Iowa, Louisiana, Maine, Mississippi, Montana, Nevada, New York, Oregon, Puerto Rico, South Dakota, Texas, and Washington. CMS is measuring only eligibility this time, so these providers get no records requests for review year 2027. CMS calls the change temporary.

If you bill in a cycle 1 state, the rides you run this fall are in the pool now. CMS will report the review year 2028 rates in the HHS financial report of November 2028.

Which ride claims can be picked

Only fee-for-service claims, the ones your state pays line by line, go through medical record review. For review year 2028, CMS caps each state’s Medicaid sample at 1,800 fee-for-service claims, 200 managed care payments, and 1,200 eligibility cases. A monthly payment to a health plan or a capitated broker is checked from state systems alone, with no records asked of anyone.

So the claims at risk are rides you bill to the state’s fee-for-service Medicaid program. CMS’s provider FAQ adds that brokers and other entities that submit fee-for-service claims can be selected too, along with the contact for whoever holds the trip record. That can be you. Rides you run for a health plan or a broker that the state pays a monthly amount are not sampled for records, and that company’s own broker audits apply instead.

What a records request asks for on a ride claim

The contractor calls first to confirm who holds the records, then sends a letter by fax or mail. The packet has a CMS letter citing its authority, a cover sheet with a PERM ID for the sampled claim and a checklist of documents, a summary of the claim, and the ways to send records. Under 42 CFR 431.970, you have 75 calendar days from the request.

CMS’s required document list (June 2024) names these items for transportation, each one if it applies to the claim:

• Starting point, destination, and odometer readings
• Mileage details
• The transportation log with the rider’s signature
• The schedule for the date of service
• The invoice
• A physician’s order for the ride, signed and dated
• Records showing the ride was medically necessary
• Escort or attendant records, with any approval required
• Receipts for taxi, bus, or app-based rides, and any voucher log

Example: one sampled wheelchair van ride

Say you bill a state Medicaid program directly for a wheelchair van ride on September 14, 2026, in a cycle 1 state, as an A0130 trip plus 12 miles of S0209. In May 2027, the PERM contractor calls, and the letter arrives with a PERM ID cover sheet and a due date 75 days out.

You fax back the cover sheet on top, then the signed trip log with pickup and drop-off times and odometer readings, the dispatch schedule for September 14, the claim, and the doctor’s medical necessity form showing why the rider needs a wheelchair van. The reviewer finds the drop-off odometer reading blank, so the 12 miles cannot be checked. You get an additional documentation request with 14 calendar days to answer. If nothing you hold supports the miles, the reviewer can cite the claim for units. New Mexico’s September 2026 notice to its NEMT companies names the same error code, MR6, on a taxi mileage claim, as our report on that training explains.

What happens when records are missing or short

The contractor cites each problem with a finding code. In CMS’s 2025 data, these four were the costliest medical review errors in Medicaid fee-for-service, led by documents absent from the record at a projected $2.83 billion:

• MR1, no reviewable documentation. Nothing arrived by day 75, you answered that you do not have the record, or the copy was unreadable and you did not resend it.
• MR2, documents absent from the record. You did not answer the 14-day request, or your answer still lacked an item.
• MR6, number of units. The record does not support the miles or trips billed.
• MR9, improperly completed documentation. The record exists but is filled out wrong or incomplete, such as an attendant box left unchecked.

The others are procedure coding, diagnosis coding, unbundling, medically unnecessary service, policy violation, and administrative errors. Silence is the easiest error to avoid. In the 2025 data, Medicaid providers who never answered a request accounted for 86 errors and a projected $687.28 million in federal improper payments.

Every error goes to your state. The state must return the federal share of any overpayment (42 CFR 431.1002) and has one year from discovery to recover it from you before that refund is due, whether or not it collects (42 CFR 433.312). The state must also write a corrective action plan that targets the causes of its errors (42 CFR 431.992). New Mexico answered its PERM ride findings with mandatory training for every NEMT company’s managers and billing staff in September 2026. For how a state takes money back, see Medicaid recoupment.

How to answer a PERM records request

1. Confirm the caller. Check the contractor against the contact list for your review year on CMS’s PERM contacts page, or ask your state Medicaid agency.
2. Give the right contact on the first call, and say so if a broker or billing company holds the record.
3. Calendar day 75 from the request date. CMS asks providers not to wait for the due date, so send early.
4. Pull every item on the cover sheet for that one ride, plus the driver and vehicle records for the date if your state ties payment to them.
5. Send records as they were made. Explain any gap in a cover letter instead of filling it in. The trip record corrections guide covers what a proper late entry looks like.
6. Put the cover sheet on top, send one PERM ID per transmission, and keep a copy of everything with the date sent.
7. Call to confirm receipt. The contractor contacts you again only if it needs more.
8. Answer any 14-day request in full, and tell your state’s PERM contact if you send anything late.

Keep every ride’s record for your full retention period, since a claim from almost two years earlier can be requested. The trip documentation guide lists what each record should hold, and the Medicaid audit guide covers the other audits you may face.