Federal and state Medicaid enforcement continues to intensify on multiple fronts. The Centers for Medicare & Medicaid Services (CMS) found $37.4 billion in improper payments in fiscal year 2025—a 20% increase over the prior year—and escalating pressure on states to complete provider revalidation are two reasons for the rapidly shifting compliance landscape.
In New York, the Office of the Medicaid Inspector General (OMIG) has doubled provider audits, while expanding its compliance program review period from three months to 12.
Nixon Peabody attorneys Justin Pfeiffer, Michal Cantor, and Philip Rosenberg examine what healthcare providers need to know—and do—to protect themselves in this environment.
- According to CMS, insufficient documentation is the single largest driver of improper Medicaid payments, accounting for 77% of $37.4 billion in FY2025. Documentation quality is not just an audit risk—it is now a federal enforcement priority.
- CMS is actively pressuring states to accelerate provider revalidation, shorten enrollment timelines, and increase oversight of high-risk provider categories. Several states, including New York, have implemented enrollment moratoriums affecting new providers and change-of-ownership applications.
- Home health, personal care, Consumer Directed Personal Assistance Program (CDPAP), and community-based services remain the highest priority targets for both federal and New York State auditors, due to the limited supervision inherent in those settings and historically high error rates. Applied behavior analysis (ABA), early intervention, physician services, and laboratory services are also emerging areas of increased audit focus.
- OMIG is deploying advanced analytics, including pattern recognition and peer comparison tools, to identify billing anomalies and outliers. Electronic visit verification (EVV) data is being used as an active enforcement tool, cross-referenced against payroll and location data to surface discrepancies.
- A paper Medicaid compliance program is no longer optional. OMIG's expanded 12-month lookback means it will scrutinize not just whether a written program exists, but whether it is properly implemented. Staff should know who the compliance officer is and how to properly escalate concerns.
- Self-disclosure obligations are broader than many providers realize. Federal and New York law require providers to return Medicaid overpayments within 60 days of identification. OMIG has clarified that even minor voided or adjusted claims trigger this requirement. Providers that have never self-disclosed, or that do so infrequently, are an explicit focus of OMIG's audit efforts.
- The Medicaid audit process contains procedural deadlines that carry significant consequences, and providers have meaningful opportunities to engage at key stages, including before findings are formalized. Early engagement can substantially affect outcomes.
- New York Medicaid providers facing an audit have a range of defenses, spanning procedural, substantive, and technical grounds. Careful review of findings may reveal alleged overpayments that are not properly calculated or legally supported. A strategic approach can drastically reduce assessed overpayments.
Whether the goal is to increase audit readiness or respond to a live audit, the Nixon Peabody Healthcare team works with providers at every stage. Reach out to discuss where your organization stands and what steps make sense given the current enforcement environment.
