" "

How we work

To ensure we meet our goals, the Health Care Authority (HCA) conducts a variety of state and federal audits. We also conduct reviews to assure appropriate disbursement of Washington State's Apple Health (Medicaid) funds.

Audit process

The following items chart the processes used by HCA.


Algorithm is a form of data mining that applies complex rules-based filters to claims data. The purpose is to identify payments that Health Care Authority (HCA) may have made in error.

To perform its ongoing program integrity work, HCA's Payment Review Program (PRP) utilizes the services of Optum, a national health care services company.

PRP and Optum develop algorithms and other analytics and tools to ensure claims have been paid accurately and properly—in accordance with Washington payment rules and national coding standards.

Our analytics activities survey the broad spectrum of services paid by HCA as well as social service payments.

All of Optum's work is performed at the direction of HCA management. Compensation is not based on a contingency or pay-for-performance basis.

Overpayments identified through algorithms are processed in accordance with Washington administrative procedures.

Recoveries are managed by HCA with support from Optum. Providers who receive a notice of overpayment have the right to a formal administrative hearing, but can also seek informal resolution through Optum's provider relations specialist.

Federal Deficit Reduction Act (DRA) of 2005

The DRA applies to any entity receiving or making annual Medicaid payments of $5 million or more. Entities are required to establish and adopt written policies about federal and state false claims laws for all its employees, contractors and agents.

All programs and providers receiving Medicaid and Medical Assistance funding are subject to the False Claims Act, provided the provider receives $5,000,000 in payments annually, under a single TIN/FEIN (Tax Identification Number/Federal Employer Identification Number). These policies and procedures are primarily used and enforced by HCA's Section of Program Integrity and the DRA program manager.

Each year HCA's DRA program manager completes data runs to show which providers have made $5 million or more, under one TIN/FEIN. Providers are then notified to complete their attestation form and to send them to the agency.

A sample of these identified providers is also selected to send in copies of their policies and/or teaching materials regarding the False Claims Act to ensure they have the required policies in place.

State False Claims Act

In 2012, the Washington State Legislature passed the Medicaid False Claims Act, which funded two specialized positions with the Health Care Authority (HCA). The HCA investigators follow leads, mine data, and prepare fraud referrals for the Medicaid Fraud Control Unit (MFCU) of the Attorney General's Office, for both civil and criminal prosecution.

Federal Audits and Reviews

Recovery Audit Contractor (RAC) audits

In 2012, the Health Care Authority selected CGI Federal as its Medicaid Recovery Audit Contractor in a new federal effort to review Medicaid payments and identify payment errors - both overpayments and underpayments - as part of the Affordable Care Act. A key feature of the Recovery Audit Contractor program is that its reviews will be based on the state's data, not federal extracts. The state's contract with CGI Federal ended in June 2014. The HCA currently has an exception from CMS to evaluate the procurement.

(CMS) Payment Error Rate Measurement (PERM) reviews

PERM uses a 17-state rotational approach to measure improper payments in the Medicaid and Children's Health Insurance Program (CHIP) for the 50 state and the District of Columbia over a three-year period. As a result, each state is measured once every three years. The state will notify providers who are selected to be part of the PERM review. Providers will be contacted by the PERM contractor with a request for records.

What is PERM?

The federal Payment Error Rate Measurement (PERM) program is administered by the Centers for Medicare and Medicaid Services (CMS) through federal contractors, and measures improper payments in Medicaid and the Children's Health Insurance Program (CHIP). Individual state error rates are measured for each program, and are then combined to form a national error rate which is reported to Congress. Error rates are based on reviews of eligibility determinations, and fee-for-service (FFS) and managed care payments made for Medicaid and CHIP claims during the Federal fiscal year (FFY) under review.

Why was the PERM program created?

PERM was developed by CMS to comply with the Improper Payments Information Act (IPIA) of 2002, which was amended by the Improper Payments Elimination and Recovery Act (IPERA) in July 2010. These Acts require the heads of Federal agencies, including the Department of Health and Human Services (HHS), to annually review their programs and identify those which may be susceptible to significant improper payments. The amount of improper payments is required to be estimated and those estimates are submitted to Congress, along with a report on actions the agency is taking to reduce the improper payments. Medicaid and CHIP were identified as programs at risk for significant improper payments. Therefore, HHS must report the estimated error rates for the Medicaid and CHIP programs each year for inclusion in the Performance and Accountability Report (PAR). CMS implemented the PERM program in a Final Rule published on August 31, 2007 (72 FR 50490) and made revisions in a Final Rule published August 11, 2010 (75 FR 48816).

What are the benefits of the PERM program?

The PERM program:

  • Identifies program vulnerabilities that result in improper payments.
  • Promotes efficient Medicaid and CHIP program operations.
  • Helps to ensure medical services are provided to the truly eligible.

How often are states measured under PERM?

PERM reviews each state once every three years, rotating between three cycles, or groups, of 17 states. Washington is part of Cycle 3 and was measured during Federal Fiscal Year 2008, 2011, 2014 and will be measured for FFY 2017. This means that all claims paid during the period of October 1, 2016 through September 30, 2017 for both FFS and managed care clients are part of the universe of payments from which an audit sample is drawn.

How will I know a claim I submitted is selected for review?

Any claim that is paid between October 1, 2016 and September 30, 2017 with Medicaid or CHIP funding will be part of the payment universe. A sample of claims will be randomly drawn from each quarter, and these will be the claims reviewed by the federal contractor. If a claim you submitted is selected to be part of the PERM measurement during this cycle, you will be notified prior to receiving contact from the contractor.

I am not a "medical" provider—does PERM still apply to me?

Payments made to a wide variety of provider types contain funding from Medicaid and CHIP dollars. In addition to payments made to physicians, hospitals, nursing facilities and managed care plans, payments made to other types of providers could be in the PERM universe. These include:

  • In-home care and support services provided by an individual provider
  • Private duty nursing
  • Pharmacy claims
  • Dental claims
  • Residential and supported living services
  • Non-emergency transportation services

Who will contact me to ask for my records?

All providers with claims selected to be in the PERM sample for FFY2017 will receive an initial phone call followed by a letter from the CMS Review Contractor, CNI Advantage, LLC.   This letter will have the CMS logo across the top.  Please do not ignore this letter. If you have questions, please contact the HCA staff person listed in the letter from us or email HCAPerm@hca.wa.gov.

How much time will I have to provide records?

CNI Advantage, LLC will ask you for a fax number. It will help the record request process go faster if they can fax you their information. By statute, providers have 75 days to submit records for review by the PERM contractor. However, this is the latest due date, and it is more helpful to send your records at your earliest convenience in case there are additional questions about your documentation.

Do I really need to send in documentation?

Yes. Providers are required to keep records associated with payments received from Medicaid or CHIP programs for six (6) years. Under the authority of section 1902(a)(27) of the Social Security Act, providers are required to retain records necessary to disclose the extent of services provided to individuals receiving assistance, and providers must furnish CMS and the State Medicaid Agency with information regarding any payments claimed by the provider for furnishing services.

Even though some claims may be for small dollar amounts, because of the way these payments are divided in the claims sample, even small payments could have a big impact on a state’s error rate if the claim was found to be paid in error. Please do your part to help ensure the measurement’s success by locating and submitting your documentation as quickly as possible after you receive the request.

For more information:

CMS has posted information about PERM. The provider link on the left side of the menu has additional information specific to providers. Please check back often for updates and bookmark this page for your reference.

Laws and regulations:

Legal authority regarding PERM:

Who can I contact at HCA for more information?

You can email HCAPerm@hca.wa.gov for more information.

Unified Program Integrity Contractor (UPIC) audits

In February 2006, the Deficit Reduction Act (DRA) of 2005 was signed into law and created the Medicaid Integrity Program (MIP) under section 1936 of the Social Security Act (the Act). CMS has two broad responsibilities under the MIP.

  • To hire contractors to:
    • Review Medicaid provider activities.
    • Audit claims.
    • Identify overpayments.
    • Educate providers and others on Medicaid program integrity issues.
  • To provide effective support and assistance to States in their efforts to combat Medicaid provider fraud and abuse

UPIC works with the HCA's Section of Program Integrity (PI). They conduct audits that examine payments made to individuals or organizations providing services or items. In the course of these audits, medical documentation and other supporting information will be reviewed for paid Medicaid claims of services or items furnished. As appropriate, the audits may result in the identification of potential overpayments.

Site Visits

The HCA performs unannounced on-site visits of moderate or high risk providers when requesting enrollment in the Apple Health (Medicaid) program (Title 42 Part 455). We also perform unannounced on-site visits of currently enrolled moderate or high-risk providers during the re-validation process. A list of moderate to high risk provider specialties is listed below.

Unscheduled and unannounced pre- and post- enrollment site visits help ensure that suppliers are operational and meet applicable standards or performance standards.

In addition, unscheduled and unannounced pre- and post- enrollment site visits are a tool in determining whether a provider or supplier is in compliance with its reporting responsibilities, including the requirement in the Core Provider Agreement under Section 4:

  • Disclosure to notify the Medicaid agency of any change in address or telephone number.

Other standards that can be verified through site visits include:

  • Records storage.
  • Inventory.
  • Posted sign and hours of operation.
  • 225100000X - Physical Therapist
  • 332B00000X - Durable Medical Equipment & Medical Supplies
  • 335E00000X - Prosthetic/Orthotic Supplier
  • 251E00000X - Home Health
  • 341600000X - Ambulance
  • 291U00000X - Clinical Medical Laboratory
  • 293D00000X - Physiological Laboratory (Independent Diagnostic Testing Facilities)
  • 335V00000X - Portable X-ray Supplier
  • 251G00000X - Hospice Care, Community Based