MEDICAID COMPLIANCE, AUDITS & REMEDIATION
Strengthen your Medicaid compliance and audit readiness
HCPA helps Medicaid providers manage the federal, state and payer requirements that affect service delivery, workforce, documentation and billing.

Medicaid compliance does not end when provider enrollment is approved.
When urgent Medicaid compliance support may help
Medicaid compliance issues can affect reimbursement, enrollment, payer contracts and the provider’s ability to continue delivering funded services.
Medicaid audit or documentation findings
An audit may identify gaps in service records, authorisations, staff qualifications, EVV, billing or whether the service delivered matches what was approved.
First identify response deadlines, immediate risks and any continuing improper billing. Then assess whether the issue is isolated or evidence of a wider process failure.
Billing or overpayment concerns
Review potentially incorrect payments promptly to identify the affected claims, establish the cause and assess whether other payments are involved.
Identified overpayments must be reported and returned within applicable legal deadlines, with written reasons provided to the appropriate recipient.
Where the same weakness affects multiple claims, the response needs to address the billing or documentation process rather than correcting one claim at a time.
Corrective action and remediation
A Medicaid corrective action plan should address each finding, why the problem occurred, what has been corrected and corrective measures, responsible persons, deadlines, and what control will reduce the likelihood of the same failure happening again.
Key Medicaid compliance requirements
Medicaid compliance needs to connect enrollment, workforce, service delivery, authorisation, documentation and billing rather than treating them as separate systems.
Keep Medicaid enrollment and licenses current
Maintain the licenses, certifications, insurance and Medicaid enrollment information required for your service, and track reportable changes and revalidation deadlines before they become avoidable participation issues.
Deliver and document authorised services
Confirm that services meet the applicable coverage and medical necessity criteria, with referrals, orders, service plans and prior authorisations where required.
Records should clearly show what was authorised, what service was delivered, who provided it when and for how long. Documentation must support the codes, units and amounts billed.
Maintain workforce screening and qualifications
Keep required credentials, background checks, exclusion checks, training and competency evidence current for the employees, contractors, owners or other parties covered by the applicable state and program rules, and retain evidence of checks and resolved matches.
Keep EVV aligned with service and billing records
Internal audits can identify gaps while the provider still has time to address them.
Review a sample of real staff and client files against the applicable ACIS requirements rather than checking policy documents in isolation.
Manage incidents and reporting requirements
Build and maintain clear processes for incidents, suspected abuse, neglect or exploitation, privacy, information security, breach reporting and record retention, including HIPAA where applicable, so staff know what must be reported, who is responsible and which deadlines apply.
Monitor changes to Medicaid regulations
State provider bulletins, manuals, fee schedules, waiver changes and managed care communications can all alter operating requirements, so each relevant update should be assessed for its effect on policies, training, technology or billing.
Medicaid audits and compliance readiness
Medicaid providers can face review through state agencies, managed care organizations and program-integrity processes.
An audit may examine enrollment records, staff qualifications, service authorisations, service plans, visit records, EVV, claims, incidents, training and other evidence supporting funded services.
The strongest internal test is to choose a claim and work backwards.
Can you demonstrate:
the client was eligible for the relevant coverage on the service date
the service met applicable coverage and medical necessity requirements
required orders, referrals, service plans and authorisations were in place
the agency and worker met applicable participation and qualification requirements
the service was actually delivered and accurately documented
the supporting record is complete
EVV requirements were met where applicable
the billed units, amounts and service code are supported?

If those records do not connect cleanly, the provider may have a wider control issue rather than one isolated documentation error.
HCPA can help these systems be in place before an external audit and strengthen the controls behind any identified gaps.
What to do after receiving a Medicaid audit finding or notice
Understand the finding and deadline
Confirm who issued the notice, which requirements or claims are involved, what evidence has been requested, when the response is due and who will coordinate it.
Preserve and review the evidence
Secure the relevant authorisations, service records, workforce information, EVV, claims data and communications, including original records and audit trails, then establish what the evidence genuinely shows without altering, or retrospectively creating records.
Correct immediate compliance risks
Stop any continuing problem affecting service delivery, staffing, authorisation, EVV or billing while determining whether the same weakness exists elsewhere.
Address the underlying cause
Strengthen the workflow, training, monitoring, technology or management control that allowed the issue to occur so the response goes beyond correcting the individual finding.
Why choose HCPA for Medicaid compliance?
Medicaid compliance can become difficult because the requirements sit across federal rules, state programs, provider licensing and payer arrangements.
A documentation problem may begin with an authorisation process. An EVV issue may become a billing problem. A workforce screening lapse can affect whether services were delivered by an eligible worker.
Frequently asked questions about Medicaid compliance
How can a Medicaid provider manage both federal requirements and the rules of the state programs in which it operates?
Separate the different layers of obligation.
Federal Medicaid regulations create program-wide requirements, while individual states establish detailed rules around covered services, provider qualifications, authorisations, billing, HCBS programs and other operational areas.
Licensing, waivers and managed care contracts can add further requirements.
Map each obligation to an owner, operating process and review date rather than relying on one generic Medicaid compliance manual.
What compliance controls can help a Medicaid provider identify documentation and billing risks before an audit?
Test real claims routinely.
Trace a sample from eligibility and authorisation through the service plan, qualified worker, service documentation, EVV where applicable and the final claim.
Credential alerts, EVV exception reports, recurring file audits and billing validation can also help identify patterns before an external reviewer does.
What CMS Medicaid regulations apply to providers?
There is no single federal rule covering every provider and service.
Federal Medicaid regulations address areas such as provider screening and enrollment, program integrity and managed care, while states administer the practical provider requirements within that framework.
The relevant framework still needs to be mapped against the provider type, service and state program.
How much do Medicaid regulations vary by state?
Substantially.
The same provider can face different licensing, HCBS, managed care, EVV, workforce, authorisation, documentation and reimbursement requirements across state lines.
A compliance system designed for one state should therefore not automatically be copied into another.
What happens during a Medicaid audit?
The scope depends on who is conducting the review and why.
An audit may examine whether services were authorised and delivered, whether claims were supported, whether the workforce met program requirements and whether the provider complied with the relevant state or payer rules.
Read the actual audit request before deciding what evidence needs to be produced.
What should I do if a Medicaid audit finds an overpayment?
Promptly review the finding, identify which claims are affected, calculation and stated deadlines. Assess why the overpayment occurred and whether the same issue could affect other claims.
Then follow the applicable state or payer procedures for reporting and resolving the amount. Provide the required explanation and retain evidence of submissions, repayments and correspondence.
If the cause sits within authorisation, documentation, coding or billing controls, those processes may also need to be corrected before further claims are submitted.
What is a Medicaid corrective action plan?
A Medicaid corrective action plan explains how an identified compliance problem will be fixed and how recurrence will be reduced.
A useful plan connects:
- the finding
- the root cause
- the corrective action
- the responsible person
- the implementation timeframe
- ongoing monitoring.
Retraining one employee may correct an immediate mistake, but a stronger system control may be needed if the same mistake could occur elsewhere.
What is EVV compliance?
Electronic Visit Verification verifies specified information about certain Medicaid-funded personal care and home health services delivered in the home, subject to EVV requirements.
This includes the service type, person receiving the service, service date and location, person providing the service, and start and finish times.
States determine how their EVV systems operate, so providers need to follow the technology and workflow requirements applicable in each state where they provide relevant services.
Can EVV problems affect Medicaid billing?
Yes.
If the EVV record is missing, incomplete or inconsistent with the authorisation and service documentation, the provider may have difficulty supporting the related claim.
That is why EVV should be treated as part of the service-to-billing workflow rather than as a separate technology requirement.
How should a provider monitor changes to Medicaid regulations?
Assign responsibility for monitoring the sources that affect your business, including the state Medicaid agency, provider bulletins, manuals, fee schedules, waiver updates and managed care communications.
Then assess each meaningful change operationally.
If the rule changes, determine whether the policy, software, billing process, authorisation workflow or staff training also needs to change.
Related Medicaid resources
Become a Medicaid provider
Grow your Medicaid business
Ready to increase referrals and funded service volume?
Strengthen payer access, managed care relationships and referral pathways while making sure workforce capacity and reimbursement support sustainable growth.
Start growingWhat Our Clients Say






