How to Prepare for a Medicaid Audit as a NEMT Provider

A Medicaid audit of a NEMT company is mostly a records review. In a state audit, the auditor usually has your claims data and has picked the sample before the first meeting. What decides the result is whether the record for each sampled leg is complete, was made at the time of the ride, and reaches the auditor by the deadline.

Who audits NEMT providers

Every Medicaid provider agrees to keep records of the services it gives and to hand them, on request, to the state Medicaid agency, the HHS Secretary, or the state fraud unit (42 CFR 431.107). Several offices use that right.

Who	What they do	What to know
State Medicaid agency (program integrity unit)	Reviews provider billing profiles after payment and looks into complaints (42 CFR 456.23 and 455.14)	Can send a warning letter, recover payments, or suspend or terminate you (42 CFR 455.16)
State Medicaid inspector general, where the state has one	Field and desk audits, prepayment review, credential checks	New York’s OMIG calls NEMT a 2026 focus area. Texas requires records at the time of the request.
Medicaid Recovery Audit Contractor (RAC)	Reviews claims for the state to find overpayments	May not review claims more than 3 years old without state approval. Must report findings within 60 days and give you a toll-free number (42 CFR 455.508).
CMS Unified Program Integrity Contractor (UPIC)	Investigates and audits Medicaid providers with the state	Leads are cleared with the state and CMS first (Program Integrity Manual, Chapter 2, revised December 23, 2025)
PERM review contractor	Measures each state’s improper payment rate	75 calendar days to send records, then 14 calendar days for more (42 CFR 431.970)
HHS Office of Inspector General	Audits state NEMT programs, using records from transportation companies	A new audit series of state NEMT payments was announced May 28, 2026
Medicaid Fraud Control Unit	Investigates and prosecutes fraud	An investigation, not an audit. See Medicaid Fraud Control Units.
Health plans and brokers	Contract audits, and checks that members received the rides billed	Plans must verify services by sampling (42 CFR 438.608). See NEMT broker audits.

Health plan and broker audits reach deep. When a Medicaid managed care plan delegates work, the state, CMS, and HHS OIG keep the right to audit the subcontractor and the subcontractor’s contractors for 10 years after the contract ends or any audit is completed, whichever is later (42 CFR 438.230). MTM Health’s standard provider agreement, in the January 1, 2023 version Pennsylvania posts, allows unannounced audits. A provider that does not allow an audit or answer a document request on time can be removed from the network.

Some states hire outside auditors to review NEMT claims. Minnesota’s Department of Human Services told legislators on March 2, 2026 that a private vendor audits its fee-for-service NEMT claims after payment. The vendor reviews trip logs, driver and vehicle credentials, and whether billing is backed by mileage and any required authorization. DHS put its count at 62 NEMT providers reviewed to date.

How auditors pick and project a sample

Auditors usually test a sample instead of every claim, then let the sample speak for the rest. Three federal audits of state NEMT programs show the scale.

OIG audit	Claims in the period	Sample	Result
Massachusetts, A-01-19-00004 (January 25, 2021)	896,792 lines of service, 2016 and 2017	100 at random	86 did not comply. Estimated at least $14.1 million in claims that did not comply.
Indiana, A-05-18-00043 (August 25, 2020)	920,338 claims, 2016 and 2017	120, stratified at random	18 did not comply. Estimated $3.5 million federal share.
New York City, A-02-21-01001 (September 12, 2022)	4,768,858 payments, 2018 and 2019	100, stratified at random	17 complied, 41 did not, 42 could not be determined. Estimated at least $84.3 million federal share that did not comply, and $112.0 million that may not have.

These audits reach the transportation company too. In the New York City audit, OIG reviewed records from the state’s transportation manager and from medical and transportation providers. In its response, New York said it had started its own audits and investigations that overlapped the audit’s scope.

A state audit of your company works the same way. New York’s OMIG generates the random sample before the audit starts and does not tell you the sampled dates of service until fieldwork is done. At the exit conference you receive the random numbers used, the claim detail for your whole audit period, and the detail for the sampled claims. OMIG then projects the sample errors over all your claims as a point estimate and a lower confidence limit.

Here is a hypothetical example of that math:

Step	Example
Legs paid in the audit period	12,000, for $420,000
Legs in the random sample	100, paid $3,500
Sampled legs that fail	8, paid $280
Average overpayment per sampled leg	$2.80
Projected overpayment for all 12,000 legs (point estimate)	$33,600

In New York, an extrapolation from a sampling method certified as valid is presumed accurate unless you rebut it with expert testimony or an accounting of every claim paid (18 NYCRR 519.18(g)). Florida law lets its Medicaid agency use statistical sampling and extension to the full population, and requires at least 5 percent of its audits to be chosen at random (2026 Florida Statutes, 409.913).

Not every audit projects. Texas’s Inspector General audited SafeRide Inc., a company that arranges and delivers NEMT for Superior HealthPlan’s STAR+PLUS members, using risk-based samples chosen for reimbursement amounts, service use, and mileage. The report of September 4, 2025 said those results could not be projected to all trips.

What auditors check on each trip

OIG’s Massachusetts audit tested four things on every sampled ride. Did the rider receive a covered medical service that day? Was there enough documentation? Was the ride given? Did the driver and vehicle meet state rules? In all 100 sampled items, driver qualifications and vehicle inspection, registration, and maintenance were not adequately documented.

New York OMIG publishes the criteria its auditors use, though an audit can turn up other findings too. Its ambulette protocol, revised July 22, 2026 for service dates through July 16, 2026, disallows a claim for any of these:

OMIG check	The claim is disallowed when
1. Documentation	The record for either leg lacks the member’s name and Medicaid ID, date, origin, destination, pickup time, drop-off time, plate number, the driver’s printed name, license number, signature, and attestation that the trip was completed
2. The claim itself	The driver’s license number or plate number is missing or wrong (since May 24, 2018), or the procedure code is wrong, in which case the difference is taken back
3. Mileage	Billed miles exceed the distance from first pickup to last drop-off. Since August 1, 2019, miles are billed to the tenth.
4. Tolls and parking	The claim shows more than the actual cost. Since August 25, 2023, tolls paid by mail are repaid at the E-ZPass rate.
5. The medical visit	The ride was not to or from a covered Medicaid service
6. Date of death	The rider died before the date of service
7. The vehicle	It was not owned, leased from a manufacturer or licensed dealer, or registered in the provider’s name, or not insured to the provider
8. Subcontracting	Another company gave the ride
9. The driver	An ambulette driver employed more than 10 days was not on the company’s DMV Article 19-A driver report that day

A driver manifest, dispatch sheet, prior authorization roster, or day program attendance log does not count as proof of a trip on its own. It can only back up the required record. The taxi and livery protocol adds checks for livery base and driver licenses from the New York City Taxi and Limousine Commission.

Other states use their own lists, but the same themes come back. Indiana’s audit checked provider qualifications, vehicles, documents such as certificates, agreements, prior authorizations, and insurance, and whether records were kept. Approvals matter too. OIG’s 2026 audit series notes that prior authorization for NEMT generally must be supported by a medical practitioner’s order. In Texas, SafeRide Inc. was paid for 38 of 58 tested trips with a leg over 75 miles without the prior written authorization its contract required.

Auditors look at people as well as trips. OMIG lists the staff who worked on the sampled dates and may ask for their training records, health requirements, license numbers, and criminal history checks. It may also interview billing and compliance staff and ask for your written policies.

The records to have ready

Build this file before any letter arrives. The trip documentation guide covers the trip record field by field.

Record	What it must show	Why auditors want it
Trip record for every leg	Rider, date, times, addresses, driver, vehicle, signatures, miles	The core of every sampled claim (trip log template)
Approval or practitioner order	Trip number, level of service, prior authorization where required	Proves the ride and its level were authorized
Proof of the medical visit	Appointment confirmation or facility sign-off	Claims with no covered service are disallowed
Mileage support	Odometer readings or GPS points at each stop	Miles above the direct trip are taken back
Toll and parking receipts	The actual cost paid	Anything above actual cost is taken back
Driver file	License, driving record, background checks, training, drug and alcohol records	Unqualified drivers make claims unallowable (driver file checklist)
Vehicle file	Title or lease, registration and insurance in the company’s name, inspections, maintenance	New York disallows rides in vans that are not yours (vehicle inspection checklist)
Exclusion screening log	A check of every owner, employee, and driver before hiring and monthly	Claims tied to excluded people are overpayments (OIG exclusion list)
Complaint and incident log	Each complaint, what you did, and how it was resolved	Texas faulted SafeRide Inc. for 13 of 30 complaints not investigated as required
Claims and payment records	What you billed, what was paid, and every adjustment	Ties the trip record to the money
Policies and training records	Your billing, documentation, and compliance policies	OMIG may ask for them
Earlier audits and self-disclosures	Letters, findings, and refunds	OMIG’s audit letter asks whether other federal or state agencies have audited the same area

How long to keep NEMT records

Keep records for the longest period any of your payers requires.

Rule	How long
New York, 18 NYCRR 504.3(a) and 517.3(b)	6 years from the date of the ride or the date it was billed, whichever is later
Texas Medicaid Provider Procedures Manual (September 2026)	5 years from the date of service, or until every audit, appeal, investigation, and court case is resolved
Florida Statutes 409.913(9) (2026)	5 years after the ride
Managed care subcontracts, 42 CFR 438.230	Audit rights run 10 years after the contract ends or an audit is completed
MTM Health standard agreement (January 1, 2023 version posted by Pennsylvania)	10 years, or longer if law or the client requires
False Claims Act, 31 U.S.C. 3731(b)	Suits generally within 6 years of the claim, and up to 10 years in some cases

An audit notice stops the clock. In New York, notice of an audit pauses the 6-year period until the audit ends (18 NYCRR 517.3(c)).

If records are lost, report it. New York requires a self-disclosure to OMIG within 30 days after you discover lost, damaged, or destroyed records. See NEMT record retention for a table by record type.

What happens during an audit, step by step

New York OMIG laid out its field audit process for providers on December 4, 2025. Other states differ in the details, but the stages are similar.

1. Notice. A letter names the service type and audit period, lists the documents you will need, and tells you to hold records until the audit ends.
2. Entrance conference. It must be held within 60 days of the letter, and OMIG can extend that once by 60 days in writing (18 NYCRR 517.3(c)). Auditors explain the scope and the sample. You may not void claims within the audit period.
3. Fieldwork. Auditors ask for original, complete records for each sampled claim and review your staff files. Before fieldwork ends, they tell you what is missing and give you a chance to supply it.
4. Exit conference. You get a summary of the findings and the sample data, and you can still present documents.
5. Draft audit report. You have 30 days from receipt to object in writing, claim by claim, with your documents. Receipt is presumed five days after the date on the report (18 NYCRR 517.5). A later hearing can cover only issues you raised in these objections.
6. Final audit report. You can pay in full within 20 days or sign a repayment agreement. Interest applies when terms run past 90 days. OMIG’s standard plan runs up to two years at no less than 15 percent of your prior year’s billings, and a hardship application can stretch it.
7. Hearing. A written request must be made within 60 days of the final report’s date (18 NYCRR 519.7). OMIG says that deadline is set in statute and regulation and it cannot extend it.
8. After the audit. OMIG expects you to check whether the same problem happened outside the audit period and self-disclose any overpayment through its Self-Disclosure Program.

Two other states show how the rules can differ:

	Texas (manual of September 2026)	Florida (2026 Statutes, 409.913)
When records are due	At the time of the request, or within 24 hours if the Inspector General sets that deadline	During normal business hours, with 24 hours’ notice if producing them would disrupt care
Late or missing records	Payment hold, recoupment of the related claims, contract cancellation, or exclusion	Records not handed over when requested cannot be used later to contest a finding
Prepayment review	Paper claims with records attached. Records sent later for a denied claim are not considered.	Up to 1 year, even with no suspicion of fraud. Claims are decided within 90 days of complete records, or 180 days when there is reliable evidence of fraud.

Florida also requires every document for a hearing to be exchanged at least 14 days before it, charges 10 percent interest a year on overpayments, and terminates a provider that neither repays nor signs a plan within 30 days of the final order.

For what happens when money is taken back, see Medicaid recoupment.

How to respond when the audit letter arrives

1. Read who sent it. A records request from a plan, a PERM request, a state audit, and a fraud unit letter call for different responses.
2. Put every deadline on a calendar, and count from the date the letter says, not the date you opened it.
3. Stop any record destruction for the audit period, including automatic deletion of GPS data or emails.
4. Do not void, rebill, or correct claims in the audit period without asking the auditor first.
5. Name one contact person who tracks every request and every document sent.
6. Pull the complete record for each sampled leg: trip log, approval, visit proof, miles, tolls, driver file, and vehicle file.
7. Never add to or change an old record. Florida considers a late note only if it was made before the audit notice. If something is missing, say so.
8. Send everything the request asks for, by the deadline. Keep a copy and a list of what you sent, because MTM’s agreement, for one, says requested records will not be returned.
9. Check the math at the exit conference. Ask for the sample list and the claim universe, and confirm each sampled claim is really yours.
10. Answer the draft report in writing, claim by claim, with documents.
11. Choose to pay, set up a plan, or appeal before the final report’s deadline.
12. Fix the cause. Retrain, change the process, and refund similar claims outside the audit period within 60 days of identifying them (42 U.S.C. 1320a-7k(d)). See the 60-day overpayment rule.

Audit or investigation: how to tell

An audit asks whether claims were paid correctly. An investigation asks whether someone committed fraud. The signs of an investigation are a letter from a Medicaid Fraud Control Unit, a state attorney general, HHS OIG agents, or the FBI, a subpoena, or a notice that your payments are suspended.

A state that finds a credible allegation of fraud must suspend all Medicaid payments to the provider unless it has good cause not to, and it does not have to warn you first (42 CFR 455.23). The notice must come within 5 days, unless law enforcement asks the state to wait, for no more than 90 days in all. It must give the general allegations, say the suspension is temporary, tell you that you may submit written evidence, and explain how to appeal.

Get a health care attorney before anyone at your company gives an interview. Keep every record exactly as it is. See NEMT fraud for the schemes investigators look for.

A monthly self-audit that keeps you ready

The best preparation is running a small audit on yourself. CMS’s Self-Audit Snapshot (August 2016) suggests starting with a baseline audit covering at least 3 months, with a random sample of 5 to 10 records for each professional who bills. For a van company, 5 to 10 legs per driver is a workable start. No one should review their own trips.

1. Pick legs at random from last month’s paid claims.
2. Run each one through the OMIG list above: record fields, claim fields, miles, tolls, visit, date of death, vehicle, subcontracting, and driver.
3. Call a few riders and destinations to confirm the rider arrived and was seen. CMS’s NEMT booklet recommends random calls to both.
4. Compare billed miles to the route, and tolls to your toll statement.
5. Check the driver and van for that date: license, exclusion check, registration, and insurance.
6. Refund what you find within 60 days, through your state’s or broker’s process.
7. Write down what you checked and what you fixed. OIG’s General Compliance Program Guidance (November 2023) lists auditing and monitoring among the seven elements of a compliance program.

NEMT audits in 2026 and 2027

• PERM, cycle 1 (review year 2028). Claims paid from July 1, 2026 to June 30, 2027 in Arkansas, Connecticut, Delaware, Idaho, Illinois, Kansas, Michigan, Minnesota, Missouri, New Mexico, North Dakota, Ohio, Oklahoma, Pennsylvania, Virginia, Wisconsin, and Wyoming will be sampled. Records requests go out from April 1, 2027 to April 15, 2028, and you get 75 calendar days to answer. The cycle 3 states will get no medical records requests for review year 2027.
• OIG’s NEMT audits. The state audit series announced May 28, 2026 is expected to finish in fiscal year 2028. The targeted review of NEMT claims announced October 15, 2025 is still in progress. See the OIG NEMT reviews.
• New York. OMIG posted revised ambulette and taxi and livery protocols on July 28, 2026. Its 2026 work plan says the protocols will add a focus on improperly claimed tolls.
• Texas. In the third quarter of fiscal year 2026, the Inspector General agreed to a $315,000 settlement with SafeRide Inc. over its NEMT audit. The audit had found SafeRide Inc. paid its transportation providers incorrectly on 31,149 of 379,920 trips and had recommended repaying $515,890.65. See the Texas OIG NEMT audit.
• Minnesota. As of its March 2, 2026 briefing, Minnesota treats NEMT as a high-risk provider type, with background checks and site visits at enrollment and at revalidation every three years. A freeze on new NEMT providers in the Twin Cities metro, extended on July 23, 2026, runs to January 27, 2027. See the Minnesota enrollment freeze.