A Medicaid provider may receive a billing records request, program-integrity letter, notice of overpayment, payment suspension or contact from fraud investigators and describe all of them as an audit. That shorthand obscures critical differences. An administrative review is not a finding of fraud, and a credible allegation of fraud is not a criminal conviction. Nevertheless, the procedures, evidence and potential consequences can differ substantially. A sound initial response identifies the issuing body, authority, scope, delivery and legal status of each communication before the provider begins producing records or offering explanations. If an agency’s contact involves a fraud referral, compare the first steps after a healthcare fraud referral.
Identify which Medicaid entity has contacted the provider
Medicaid involves federal rules, state agency administration and, for many beneficiaries, managed-care contracts. A Medicaid state agency, Medicaid fraud control unit, program-integrity contractor, managed-care organization, licensing board or law enforcement officer may ask different questions under different authority. Read the sender, cited law, requested records, response date and appeal instructions. Determine whether the letter is a documentation request, a formal overpayment assessment, provider-enrollment matter, credible-allegation payment suspension, compulsory subpoena or something else. More than one proceeding may exist at once.
In New Jersey, providers should distinguish state Medicaid program administration and integrity review from any separate prosecution or licensing inquiry, and also identify the specific managed-care agreement if applicable. Medicaid payment and appeal rights cannot be assumed to match Medicare fee-for-service procedures. A provider contract may govern some claims while state or federal regulations control other duties. Preserve every letter and the relevant plan and provider documents before deciding which deadline governs.
Administrative claim review: the records and coverage issue
A routine documentation request can concern whether services were furnished, ordered, documented, properly coded and permitted by the applicable Medicaid coverage standard. Build a claim-level matrix identifying the beneficiary in a secure environment, provider identifiers, claim and service dates, amounts, services, coverage rule and stated issue. Then locate contemporaneous clinical notes, orders, eligibility evidence, staff records and remittances. An administrative claim defect may be consequential without proving knowledge or intent; the provider should respond to the actual stated requirement instead of making unsupported admissions about why it occurred.
For a managed-care dispute, preserve the executed plan agreement, applicable manuals, claim edits, grievance provisions and evidence of timely submission. If a government entity seeks records under statute or regulation, analyze that authority separately. Do not assume the dispute can be resolved solely through a plan’s customer-service channel.
Payment suspension based on a credible allegation of fraud
42 C.F.R. § 455.23(a) generally requires the state Medicaid agency to suspend payments to a provider when it determines there is a credible allegation of fraud under investigation, unless good cause supports no suspension or only partial withholding. The regulation allows suspension before notifying the provider, but requires written notification under specified time rules, with possible law-enforcement-related delays. The notice must identify the general nature of the allegations without necessarily disclosing investigative detail, explain the temporary suspension, and describe rights to submit written evidence and any applicable state administrative appeal process.
The definition of a credible allegation under 42 C.F.R. § 455.2 involves indicia of reliability and the state’s careful review of allegations and facts. It does not mean wrongdoing has been judicially established. Under § 455.23, certain good-cause considerations include beneficiary access, whether available remedies protect Medicaid funds more effectively, and written evidence presented by the provider. The details of relief depend on the state’s record, the governing criteria and any applicable state procedure.
The provider’s response must address patient access and real operations accurately
If withholding threatens care, gather verifiable information on patient acuity, service availability, geography, alternative qualified providers, waiting lists, staffing and continuity risks. Section 455.23(e) and (f) specifically discuss circumstances such as a sole community physician, a sole source of essential specialized services, and service to large numbers of beneficiaries in a federally designated medically underserved area. Financial distress alone is not the same as proving those regulatory conditions. Document the actual clinical consequences without exaggeration or disclosing patient identities through unsafe channels.
Distinguish an appeal of a particular administrative payment action from investigation-related determinations. Section 455.23(a)(3) grants an administrative review where state law so requires; it is not a universal federal promise of identical appeal rights in every jurisdiction. Calendar deadlines from the applicable written notice and state rules, not from a Medicare appeals webpage.
Fraud referrals and criminal process change the risk analysis
Federal rules require Medicaid agencies to refer certain credible allegations to the Medicaid fraud control unit or other appropriate law enforcement. The fact of referral does not prove a criminal offense, but it can create parallel administrative, civil, professional and criminal exposure. If counsel needs to conduct an internal investigation, identify organizational and individual representation interests, witness-interview safeguards, document preservation, and how privilege is being asserted. Ordinary business records do not become privileged merely because an attorney reads them.
A subpoena, warrant or request from criminal investigators must be treated according to its terms and applicable legal process, not like a routine payer ADR. Respect lawful preservation and disclosure obligations. Do not encourage employees to change records, coordinate stories or conceal information. Separately protect confidential patient data and evaluate whether HIPAA, Medicaid confidentiality rules, state law or court process permits a given production.
Prepare a disciplined first-response file
- Entire communication, attachments, authority cited and proof of receipt
- Identity of state agency, managed-care plan, reviewer or investigative authority
- Claims, dates, services, remittance data, contemporaneous clinical and billing records
- Separate administrative-review, response, payment-suspension and subpoena deadlines
- Contracts, manuals, state regulatory notices and any prior investigative communications
- Document-preservation plan, authorized point of contact, patient-continuity information and transmission receipts
Primary authorities and related review topics
- 42 C.F.R. § 455.2 (definitions relevant to credible allegations)
- 42 C.F.R. § 455.23 (suspension, notices, duration, referral and good cause)
- CMS Medicaid Program Integrity (federal program integrity context)
- Subpoena at a medical practice
- Healthcare audits and investigations and government investigation counsel
Editorial update: Brian M. O’Loughlin, JD, RN | Substantive revision October 24, 2026. This article distinguishes federal regulations from state-specific procedures and offers original legal analysis rather than a jurisdiction-wide procedural guarantee.
Facing a Medicaid investigation or payment action? BOLO Health Law can help determine which action the provider received, organize the evidentiary record and evaluate possible administrative and investigative risks. Request a matter screening or call 609-200-6677. Only send general, nonconfidential details in the initial form.
Attorney advertising. General information only; Medicaid programs, state laws, contracts and procedural rules vary. A request for counsel does not establish representation or change an agency deadline. See the editorial standards.