PERM Audits of Medicaid, Managed Care and CHIP Claims are Ongoing. Are You Prepared to Respond to a PERM Audit?

/ Medicare, Medicaid & Private Payor Updates / By

Author: Ashley Morgan, Annabella Denzel

The CMS PERM Audit Program is Examining Medicaid Providers

(September 28, 2023): Providers participating in the Medicare and Medicaid programs are currently subject to audit by numerous Federal and State regulatory and law enforcement agencies. Additionally, the Centers for Medicare and Medicaid Services (CMS) has entered several contractual arrangements with private contractors to handle various aspects of administrative integrity audits of claims submitted for payment by participating providers. While most Medicare claims audits are conducted by Unified Program Integrity Contractors (UPICs)[1] and Recovery Audit Contractors (RAC), several of the lesser-known audit programs have been reasserting their role in recent years. One of these programs is the Payment Error Rate Measurement (PERM) program. In this article, we provide an overview of the CMS PERM Audit Program and the claims reviewed as part of its mandate.

I. Background of the CMS PERM Audit Program:

A PERM audit is perhaps the least understood type of administrative audit routinely conducted by contractors working for CMS, even though their findings are both significant and publicly disclosed each year. Simply stated, the PERM audit program is designed to measure an annual, national improper payment rate for Medicaid, Managed Care and the Children’s Health Insurance Program (CHIP). The origin of the PERM audit is somewhat convoluted.[2]

In 2002, with the passage of the Improper Payments Information Act (IPIA)—as later amended in 2010 by the Improper Payments Elimination and Recovery Act (IPERA) and the Improper Payments Elimination Act of 2012 (IPERIA)—the heads of Federal agencies were required to annually review certain programs and identify those that may be susceptible to significant improper payments. Once reviewed, each agency is required to project the amount of any improper payments made by their programs and submit a report to Congress setting out their findings and discussing the actions they have taken to reduce these improper payments.

In 2019, the Payment Integrity Information Act (PIIA) was passed, requiring Federal agencies to do the following:

  • Review all programs administered under the agency for susceptibility to improper payments;
  • Estimate the possible improper payment value annually;
  • Submit findings to Congress, including a report stating actions being taken to reduce that estimated value.[3]

CMS programs identified by the Office of Management and Budget (OMB) for audit review include both Medicaid and the Children’s Health Insurance Program (CHIP) programs. Consistent with their obligations under IPIA and IPERA, CMS developed and implements the PERM audit program.

The ultimate goal of the PERM audit program is to calculate an accurate projection of the true error rates in the Medicaid, Managed Care and CHIP programs. Due to the massive scope of these programs, CMS has projected these error rates through an audit of a statistically relevant sample of the universe of claims in each program. These audits are conducted each Fiscal Year (FY). Areas reviewed include:

  • Fee-for-service (FFS) claims.
  • Managed Care claims.
  • Eligibility components of each program.

After reviewing these program areas, an unbiased error rate is projected through the use of statistical sampling methodologies. Importantly, CMS has noted that this error rate is not a measure of fraud. As CMS states:

“It is important to note the error rate is not a “fraud rate” but simply a measurement of payments made that did not meet statutory, regulatory or administrative requirements.” [4]

The first PERM audit was conducted in FY 2008. At that time, only FFS Medicaid Claims were examined. Managed care and eligibility areas were not audited until later is the process. Under §601 of the Children’s Health Insurance Program Reauthorization Act (CHIPRA) of 2009, CMS was not permitted to calculate or publish a national or state-specific error rates for the CHIP program until 6 months after a new Final Rule for the PERM program had been in place. This Final Rule covering the PERM audit program was effective on September 10, 2010, thereby resulting in no CHIP error rate being published till 2012. In subsequent years, each program area was audited, until CMS suspended the PERM audit program at the onset of the national public health emergency (PHE) brought on by COVID-19 in 2019. The program resumed August 11, 2020 despite the fact that the PHE was still in place at that time.

The improper payment rate results of the Medicaid PERM audits from 2017-2022 are reflected below:[5]

Year PERM Cycles Included
Fiscal Year (FY)
Reporting Year (RY)		 Estimated Improper Payments (in billions) Overall Rate FFS Rate Managed Care Rate Eligibility Rate
2017[6] Cycle 3: FY 2014
Cycle 1: FY 2015[7]
Cycle 2: FY 2016		 $36.73 10.10% 12.87% 0.30% 3.11%
2018 Cycle 1: FY 2015
Cycle 2: FY 2016
Cycle 3: FY 2017		 $36.25 9.79% 14.31% 0.22% 3.11%
2019 Cycle 2: FY 2016
Cycle 3: FY 2017
Cycle 1: RY 2019		 $57.36 14.90% 16.30% 0.12% 8.36%
2020 Cycle 3: FY 2017
Cycle 1: RY 2019
Cycle 2: RY 2020		 $86.49 21.36% 16.84% 0.06% 14.94%
2021 Cycle 1: RY 2019
Cycle 2: RY 2020
Cycle 3: RY 2021		 $98.72 21.69% 13.90% 0.04% 16.62%
2022 Cycle 2: RY 2020
Cycle 3: RY 2021
Cycle 1: RY 2022		 $80.57 15.62% 10.42% 0.03% 11.89%

II. States Audited Under the CMS PERM Audit Program:

Notably the PERM audit program is one of the few truly random audit programs currently in place to examine the propriety of Medicaid, CHIP, and Managed Care claims. CMS has divided the country into three cycles of around 17-states apiece. PERM auditors rotate from cycle to cycle, examining the claims in each state at least once every three years.

Medicaid and CHIP States by Measurement Cycle
Cycle #1 Alaska, Arizona, District of Columbia, Florida, Hawaii, Indiana, Iowa, Louisiana, Maine, Mississippi, Montana, Nevada, New York, Oregon, South Dakota, Texas, Washington
Cycle #2 Arkansas, Connecticut, Delaware, Idaho, Illinois, Kansas, Michigan, Minnesota, Missouri, New Mexico, North Dakota, Ohio, Oklahoma, Pennsylvania, Virginia, Wisconsin, Wyoming
Cycle #3 Alabama, California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, West Virginia

III. Contractors Involved in the PERM Audit Program:

As currently designed, the PERM audit program involves several contractor components – a PERM Statistical Contractor” (ST), a “PERM Review Contractor” (RC), and a “PERM Eligibility Review Contractor” *ERC). The duties and responsibilities of each of these contractor components are summarized below.

A. Statistical Contractor (SC).

“The Lewin Group” has been contracted by CMS to serve as the Statistical Contractor for the PERM audit program. As such, the Lewin Group is responsible for handling:

  • Claims data selection duties.
  • Sample selection.
  • Error rate calculation.

In their capacity as Statistical Contractor, the Lewin Group is required to review the universe of Medicaid, Managed Care and CHIP claims (processed as FFS claims) on a quarterly basis. They are then supposed to select a statistically relevant sample of claims from each universe. After selecting the samples, the claims are then sent to each state whose claims are being audited. Each state is responsible for assembling the relevant claims information. This consolidated data is then sent to a Review Contractor.

B. Review Contractor (RC).

CMS has selected “Empower AI” (formerly known as NCI, Inc.) to serve as the Review Contractor. Upon receiving the sample sets from the Statistical Contractor, the Review Contractor sends out record requests to affected providers whose claims are being reviewed. The Review Contractor then pulls all state Medicaid and CHIP documentation, coding, billing and payment policies which will be used to conduct medical reviews of the claims. Health care providers are typically given 75 calendar days to collect and send the requested medical records and supporting documentation to the Review Contractor. If the provider fails to comply with the Review Contractor’s request, the state is notified, and the claims are denied due to no documentation.

Once the medical documentation is collected, the Review Contractor is responsible for conducting a medical review of the FFS claims. Notably, Managed Care claims are not part of this particular process. If the medical documentation submitted is incomplete, the Review Contractor is supposed to notify the provider so that supplementary information can be submitted. Health care providers are typically given 14 calendar days to submit additional information.

After reviewing the propriety of these FFS claims, the Review Contractor sends their findings back to the Statistical Contractor. The Statistical Contractor is then required to calculate both a state-by-state set of error rates and a national error rate under the PERM audit program.

C. Eligibility Review Contractor (ERC).

“Booz Allen Hamilton” is the contractor chosen by CMS that is responsible for completing eligibility case reviews and reporting eligibility case review findings. As Eligibility Review Contractor, Booz Allen Hamiliton is required to access each state’s eligibility systems and eligibility case files to verify that eligibility elements and the eligibility for beneficiaries of a sampled claim is correct.

IV. Types of Entities and Claims Subject to a PERM Audit:

Although limited to Medicaid, Managed Care and CHIP programs, PERM audits cover a wide range of provider and supplier entities. As CMS has noted in its guidance,[8] the following entities participating in these programs are subject to audit:

  • Inpatient Hospital Services;
  • Psychiatric, Mental, and Behavioral Health Services;
  • Nursing Facility, Chronic Care Services, or Intermediate Care Facilities (ICFs);
  • Intermediate Care Facilities (ICFs) for Individuals with Intellectual Disabilities (ICF/IID) and ICF/Group Homes;
  • Clinic Services;
  • Physicians and Other Licensed Practitioners Services (Includes: Advanced Practice Nurse, Physician Assistant, Nurse Midwife, and Midwife);
  • Dental and Oral Surgery Services;
  • Prescribed Drugs;
  • Home Health Services;
  • Personal Support Services;
  • Hospice Services;
  • Therapies (PT, OT, RT), Hearing, Vision, Speech, and Rehabilitation Services;
  • Day Habilitation, Adult Day Care, Foster Care, and School-Based Services;
  • Laboratory, X-Ray, and Imaging Services;
  • Outpatient Hospital Services;
  • Durable Medical Equipment and Supplies, Prosthetic/Orthopedic Devices, and Environmental Modifications; and
  • Transportation and Accommodations

V. Typical Problems Identified in PERM Audits:

Although the Payment Error Rate Measurement (PERM) program is designed to provide a national improper payment rate for Medicaid, Managed Care and CHIP claims, the problems identified in the review often vary from state to state. Nevertheless, there are several common errors that have been identified. The reasons for denial include, but are not limited to:

  • Insufficient Documentation. Far and away, the most common reason given for denying claims is the fact that there is insufficient documentation to support coverage and payment. Insufficient documentation falls into two general categories: (1) claims related documentation, and (2) eligibility related documentation. Claims related documentation includes situations where the Review Contractor was unable to conclude that the services or supplies qualified for payment due to missing information, failure to meet coverage requirements or insufficient information to establish medical necessity. In contrast, eligibility related documentation denials include situations where the Eligibility Review Contractor was unable to verify the eligibility of a beneficiary to qualify for participation in the payor program or to receive a specific service or covered supplies.
  • Provider Enrollment Denials. A number of claims denied in PERM audits are denied because of provider ineligibility, enrollment problems or failure to meet the National Provider Identifier requirements.
  • CHIP Beneficiary Enrollment Denials. The CHIP improper payment rate was also driven by claims where the beneficiary was incorrectly determined to be eligible for CHIP, but upon review was eligible for Medicaid.

VI. Steps You Should Take to Prepare for a PERM Audit:

When describing the PERM audit program, a number of states have noted that from an evaluation standpoint, the postpayment audits of a provider’s claims are meant to be an assessment of whether the payor properly paid the claim, not whether the provider submitted a claim that did not qualify for coverage and payment. While this may be technically true, it is important to keep in mind that the billing provider or supplier will ultimately be held accountable for any claims that are denied. Additionally, as the provider’s overall error rate increases, the likelihood of future claims audits will also rise.

While taking remedial steps to address problems identified in an audit will assist you in staying out of future trouble, there is no substitute for reviewing all current documentation, coding, billing and business practices now, to ensure any problems can be identified before—not after—you face a PERM or other audit. CMS takes compliance with applicable laws and regulations seriously, and its contractors are expressly directed to confirm that provider documentation fully complies with these requirements. If not, your claims will be denied. An effective compliance plan that includes internal monitoring and auditing is a necessity. If your practice or clinic has not yet developed and implemented an effective plan, you should consult legal counsel with expertise in compliance to properly train yourself and your staff.

If you have been contacted in connection with a PERM audit, we can help. Our attorneys have extensive experience representing providers in audits of Medicaid, Managed Care and CHIP claims. Give us a call at (800) 475-1906 for a free consultation.

Ashley Morgan is experienced in representing providers and suppliers in PERM audits - lilesparker

Liles Parker attorneys have had considerable experience and success in representing provider and suppliers in Medicaid audits.  Additionally, Liles Parker attorneys have significant experience in assisting providers in establishing and auditing effective compliance plans and programs. Anyone seeking further assistance in this area should contact Ashley Morgan at 800-475-1906.