Audit Readiness at 25+ Vehicles: What Medicaid Auditors and Brokers Pull First

Short answer: an NEMT audit almost never checks every trip. The auditor pulls a random sample, scores each sampled trip against your state's rules, and projects the error rate across every paid trip in the review period. That is why one missing rider signature, one lapsed background check or one GPS gap can cost far more than the trip it sits on. At 25 or more vehicles, a small documentation habit can turn into a six-figure projection. Here is who audits NEMT, what they pull first, how the math works and how to answer the letter.

Who audits NEMT, and under what authority

NEMT is a Medicaid service defined at 42 CFR 440.170(a). Brokers must have oversight procedures to ensure "transport personnel are licensed, qualified, competent, and courteous" and are "subject to regular auditing and oversight by the State." Every enrolled provider also signs an agreement under 42 CFR 431.107(b) to keep the records "necessary to disclose the extent of services" and to hand them over on request to the state Medicaid agency, HHS or the state Medicaid Fraud Control Unit.

Five groups use that agreement to come knocking:

Auditor	Authority and scope	What it can lead to
Brokers and Medicaid health plans	Audit rights in your provider agreement. In managed care, plans must have a method "to verify, by sampling or other methods," that services billed by network providers were received (42 CFR 438.608(a)(5)).	Recoupment and whatever remedies your contract lists
State Medicaid program integrity unit and Medicaid RACs	Post-payment reviews. RACs may not review claims over 3 years old without state approval (42 CFR 455.508(f)), and states must offer appeal rights (42 CFR 455.512).	Overpayment demands and recoupment
CMS Unified Program Integrity Contractors (UPICs)	Audits run with the state under the Medicaid Program Integrity Manual, chapter 3. NEMT is a named focus area in CMS's Comprehensive Medicaid Integrity Plan for FY 2024 to 2028.	Findings sent to the state, or a law enforcement referral
HHS Office of Inspector General (OIG)	Audits a state's NEMT claims from a statistical sample, pulling records from brokers, transportation companies and medical providers. An active work plan item, announced October 2025, covers targeted reviews of NEMT billing.	A recommendation that the state refund the federal share
State Medicaid Fraud Control Unit (MFCU)	Investigates and prosecutes Medicaid provider fraud in all 50 states, D.C., Puerto Rico and the U.S. Virgin Islands.	Criminal charges, civil settlements, exclusion

In fiscal year 2025, MFCUs reported 52 fraud convictions and 31 civil settlements or judgments involving nonemergency transportation, according to OIG's FY 2025 MFCU data snapshot. And once a state finds a credible allegation of fraud, it must suspend your Medicaid payments unless it has good cause not to, and it may do so without notice first (42 CFR 455.23).

For OIG's findings state by state, see Medicaid audit risks in NEMT billing.

What auditors pull first

Each sampled trip becomes a case file built around one question: can you prove this trip happened, to a covered service, at the authorized level, with a qualified driver in a compliant vehicle, on that date? In OIG's audit of New York City NEMT payments (A-02-21-01001, September 2022), 41 of 100 sampled payments were unallowable: 22 had no valid practitioner's order, 13 had inadequate trip documentation, 7 lacked driver qualification records, 2 were for services not provided and 1 was for a level of service that was not authorized. Another 42 could not be confirmed, largely because providers did not produce vehicle records (21) or driver license records (10).

1. Trip records against claims and remittances

The auditor starts with the paid claim and asks for the trip record behind it. In OIG's Massachusetts audit (A-01-19-00004), brokers could not produce driver trip sheets for 38 of 100 sampled items, and 24 more lacked basics such as addresses, date of ride and appointment time.

2. Authorization and level of service

Where your state or broker requires prior authorization or a practitioner's order, it must have existed and been valid on the date of service. In New York, 14 sampled payments had no order and 6 had orders dated 2 to 33 months after the trip; the late paperwork did not cure the gap. The authorized mode (ambulatory, wheelchair, stretcher) must match what you billed.

3. Driver credentialing and background checks

Section 1902(a)(87) of the Social Security Act, described in CMS's Medicaid transportation coverage guide (SMD 23-006), sets a federal floor: providers and drivers not excluded from federal health care programs, a valid license for each driver, and provider processes to address state drug law violations and to disclose each driver's driving history to the state. States add more. In the period OIG audited, Massachusetts required a criminal record (CORI) check before any rider contact and annually after. CMS's NEMT booklet for providers advises screening staff against the OIG exclusion list before hire and monthly after that. The auditor wants the driver qualification file as it stood on the sampled date, not today.

4. Vehicle inspection, registration and insurance

The New York findings turned on certificates of inspection and city licenses "that covered the sampled date of service." A vehicle inspection that is current today does not help if it lapsed for six weeks last spring and a sampled trip fell inside them.

5. Signatures and attestations

Per CMS's booklet, some states and brokers require the rider's signature on the trip record. Minnesota's version, in Minn. Stat. 256B.0625, subd. 17b, is the most detailed we have found: a dated driver signature attesting that the record and miles are accurate, a dated signature from the rider, an authorized party or the medical provider, and, if nobody will sign, a note that signatures were requested and not provided. Electronic signature capture is fine where your state and broker accept it.

6. Mileage, odometer and GPS

Medicaid generally pays only loaded miles; CMS's booklet calls billing loaded mileage for a no-show "a common form of fraud in NEMT." Minnesota requires odometer readings at pickup and drop-off. In Massachusetts, OIG suggested GPS monitoring as a control, and one broker said it would make GPS mandatory in its upcoming contracts. Where your broker requires GPS trip verification, a gap in the GPS trail is a gap in the record.

7. The link between trip, driver and vehicle

This is where larger fleets get caught. In Massachusetts, OIG could not tie driver and vehicle records to the trips, because the trip sheets did not name the driver and vehicle. Minnesota now requires records "sufficient to distinguish individual trips with specific vehicles and drivers."

How sampling and extrapolation turn one gap into a big number

Auditors review a sample and project the result. In New York, OIG sampled 100 payments, worth $8,467 in federal share, from a population of 4,768,858 payments worth $269.6 million. The 41 unallowable payments in the sample totaled $3,433. Projected across the population, the point estimate was $106.5 million. OIG recommended recovering $84.3 million, the lower limit of a two-sided 90 percent confidence interval, designed to be less than the actual overpayment 95 percent of the time. In Massachusetts, 86 errors in a 100-item sample became at least $14.1 million.

Those audits covered whole state programs, but the method can be applied to a single provider where state law allows. The UPIC manual says a UPIC must first confirm the state permits extrapolation, then follow the state's policy. Ohio's provider agreement rule says plainly that "audits may use statistical sampling" (Ohio Adm. Code 5160-1-17.2). Florida law lets its Medicaid agency use "sampling and extension to the population" and introduce the result as evidence of overpayment (Fla. Stat. 409.913(20)). Rules differ by state, so check yours.

At fleet scale it looks like this. The numbers below are hypothetical, not data from any operator or audit.

Hypothetical audit	Figure
Fleet and review period	30 vehicles, 24 months
Paid trips in the period (the population)	90,000 trips at a $45 average, $4,050,000 paid
Random sample	100 trips, $4,500 paid
Sampled trips that fail	7: three missing a required rider signature, two by one driver whose annual background check had lapsed, one in a van with an expired inspection, one with no GPS or odometer record
Dollar value of the 7 failures	$315
Error rate in the sample	7% of sampled dollars
Projected overpayment (7% of $4,050,000)	$283,500 point estimate

$315 of bad trips becomes a demand about 900 times larger. Recovering at a confidence interval's lower limit, as OIG does, would trim it, but it stays a six-figure number.

The lesson: fix systems, not trips. If the driver with the lapsed check ran 3% of your trips during those months, roughly 3% of a random sample lands on them, and every one fails. One gap in one file spreads across every trip it touches; so does a van with an expired inspection or a week with a broken signature pad. Some reviews start with a probe: the UPIC manual recommends 20 to 40 claims to decide whether a fuller review is needed.

Record retention: how long the files must survive

42 CFR 431.107 creates the duty to keep records but sets no single period. Your state, your provider agreement and each broker or plan contract do, and they vary. New York requires 6 years from the date of service (18 NYCRR 504.3(a), quoted in the OIG New York report). Ohio requires 6 years from payment, or until any audit started in that window closes (Ohio Adm. Code 5160-1-17.2(D)). Florida requires 5 years after the service (Fla. Stat. 409.913(9)). Managed care plans keep certain records for at least 10 years (42 CFR 438.3(u)), and the state, CMS and OIG can audit plan subcontractors for 10 years after the contract ends or any audit finishes (42 CFR 438.230(c)(3)); brokers and plans can pass that language down to you. The False Claims Act allows civil cases up to 6 years after a claim, and in some cases 10 (31 U.S.C. 3731(b)).

Lookbacks differ too: Medicaid RACs stop at 3 years without state approval, while UPICs follow the state's lookback and check with CMS past 5 years. Our record retention and audit trail guide has the fuller state table and a practical floor of 10 years from the date of service, or until any open audit closes. Keep driver and vehicle files just as long. A trip record is only as good as the credential file behind it.

What changes at 25+ vehicles

A five-van owner who reads every trip sheet can survive loose filing. A 30-van company cannot. Four things change:

• More files, more expiration dates. Every driver carries a license, a background check (annual in some states), a driving history disclosure and monthly exclusion checks; every van carries registration, inspection and insurance. Each is a date that can lapse, and each is tested as of the trip date.
• A bigger population to project across. The same 7% error rate costs a 30-van fleet about six times what it costs a 5-van fleet running the same trips per van. Volume also puts you in range of data-driven reviews: the UPIC manual sets a $50,000 dollars-at-risk threshold for its proactive Medicaid projects, and a fleet billing millions a year can clear that on a single billing code.
• More hands on each record. Several dispatchers, shift swaps and shared vans mean that unless your system records the driver and vehicle per trip, you cannot link the trip to the right files.
• More payers with their own rules. Two brokers and a plan contract can mean three signature rules, three retention periods and three sets of audit rights. Meet the strictest.

At this size a monthly internal sample, not the owner, is the control. Our guide to revenue auditing and billing documentation covers the billing side of that routine.

The file-pull checklist by audit type

Audit type	What usually starts it	What they pull first	Response clock
Broker or health plan audit	Contract audit rights, routine service verification, complaints	Trip records against billed trips, rider signatures, GPS or trip verification data, driver and vehicle files	Your provider agreement. Read it now.
State program integrity or Medicaid RAC review	Data analysis, complaints, routine post-payment review	Full trip records, authorizations, level of service, driver and vehicle files as of the service date	State rule. Ohio: 30 days, or payments are withheld
UPIC audit	Data analysis flags you as an outlier, or a state lead	Records for specific sampled claims, sometimes a 20 to 40 claim probe first	30 days plus a 15-day extension on request, unless the state or CMS sets otherwise
HHS-OIG audit of your state's program	OIG work plan	Sampled payments, with records from the broker, you and the medical provider	Set in the request; findings go to the state
MFCU investigation	A fraud referral or tip	Subpoenaed records, interviews, sometimes a search warrant	Call health care counsel first

For each sampled trip, build one packet, indexed by claim number:

1. The trip record: rider, date, pickup and drop-off addresses and times, loaded miles, driver and vehicle.
2. The authorization or practitioner's order valid on that date, and the level of service it approved.
3. The rider or facility signature, or the documented refusal, plus the driver attestation where required.
4. GPS trail or odometer readings that support the miles billed.
5. The driver file as of that date: license, background check, drug and alcohol program records where required, driving history, exclusion check results, required training.
6. The vehicle file as of that date: registration, inspection, insurance, any state or city permit.
7. The claim as submitted and the remittance showing what was paid.
8. Proof of the covered medical appointment, where you hold it.

How to respond to an audit letter

1. Identify who sent it and the deadline. Each auditor runs on different rules. Calendar the due date the day the letter arrives.
2. Escalate anything that mentions fraud. A payment suspension notice, a subpoena, or contact from an MFCU or law enforcement goes to health care counsel before you produce anything.
3. Name one owner and log every request, document and call.
4. Produce exactly what was asked, one packet per trip, and keep a copy of everything you send.
5. Never alter, backdate or recreate a record. The UPIC manual tells reviewers to look for obliterated sections, inserted pages, white-out and "excessive late entries." If a document is missing, say so in a dated cover note. A recreated record turns a documentation finding into a potential fraud case.
6. Ask for the sampling method: population, sample size, how it was drawn, strata and how the projection was calculated. You cannot test an extrapolated demand without it. What you are entitled to varies by state and auditor.
7. Rebut item by item. It works: in New York, after the state submitted more documentation, OIG revised its determinations for 16 sampled payments.
8. Track the appeal deadline. States must offer appeal rights for RAC findings, but each state sets the deadlines, and they are short.
9. If your own review finds overpayments, federal law requires them to be reported and returned within 60 days of identification (42 U.S.C. 1320a-7k(d)). Work out the how with counsel.
10. Fix the cause and document the fix.

FAQ

What is extrapolation in a Medicaid NEMT audit?

The auditor finds the error rate in a random sample of paid trips and applies it to every paid trip in the review period. OIG's New York audit turned $3,433 of unallowable sampled payments into an $84.3 million recovery recommendation. Whether and how a state extrapolates against an individual provider depends on state law.

How far back can an NEMT audit go?

It depends on the auditor. Medicaid RACs stop at 3 years unless the state approves more, and UPICs follow the state's lookback. Retention runs 5 to 6 years in Florida, Ohio and New York, managed care contracts can carry 10-year audit rights, and the False Claims Act reaches back 6 years and sometimes 10.

Can I add a missing signature after the auditor asks?

No. Adding or backdating a signature after the fact is altering a record, and reviewers look for late entries. Say it is missing and provide other evidence the trip happened, such as GPS data or the facility's confirmation.

Do brokers audit transportation providers?

Yes. Federal rules make brokers subject to state audit and responsible for overseeing transport personnel, and managed care plans must verify by sampling that billed services were delivered. Those duties reach you through the audit clause in your provider agreement, so read it for required records, deadlines and retention.

What to do in the next 30 days

1. Pull 30 random paid trips from the last 12 months and build the full packet for each. Time it.
2. Score every packet. Any failure that repeats is a system problem; fix the system.
3. Rebuild your driver and vehicle files with effective and expiration dates for every credential, and run every driver and owner against the OIG exclusion list and SAM.gov. Set the monthly re-check.
4. Read the audit and retention clauses in every broker and plan agreement, and adopt the strictest.
5. Confirm your dispatch system records driver and vehicle per trip, keeps signature and GPS data, and exports by claim number.
6. Write a one-page audit response procedure: who opens the letter, who logs it, which attorney gets the call.

Not legal advice. Audit, retention and extrapolation rules vary by state and contract; confirm yours with health care counsel or your state Medicaid agency.

Related reading

• NEMT record retention and audit trails: rules by state
• 5 Medicaid audit risks in NEMT billing: what OIG found
• NEMT billing, claims and cash flow guide

Audit findings, rule changes and the operators dealing with them land in The NEMTrepreneur Dispatch every Tuesday. Subscribe free.