A routine Medicaid audit generally reaches back five years from the audit’s start date, but that is a floor, not a ceiling. Federal overpayment rules require you to look back six years to identify money you weren’t entitled to, and when fraud is suspected the False Claims Act extends the government’s reach to as long as ten years from the violation. So how far back a Medicaid audit can go depends on what the auditor is looking for: five years is the baseline, six years covers self-identified overpayments, and ten years is the outer edge when fraud enters the picture.
The Five-Year Baseline for Routine Audits
CMS set a national standard for its Unified Program Integrity Contractors (formerly Medicaid Integrity Contractors): auditors review claims going back five years from the start date of the audit. Before this policy took effect in October 2010, contractors followed whatever look-back period the state had set, which created inconsistency across the country.1Centers for Medicare & Medicaid Services. CPI Informational Bulletin – Implementation of Revised Policies Related to Audit Look-Back Period and Provider Response Time for Documentation Requests
One detail catches many providers off guard: there is no federal statutory ceiling on how far back an audit contractor can look. Five years is CMS policy, not a hard legal limit, and CMS explicitly retains the right to extend the look-back period when the facts justify it.1Centers for Medicare & Medicaid Services. CPI Informational Bulletin – Implementation of Revised Policies Related to Audit Look-Back Period and Provider Response Time for Documentation Requests Treat five years as the routine baseline and expect it to stretch when circumstances change.
The Six-Year Overpayment Look-Back
Section 6402 of the Affordable Care Act created a separate timeline that runs alongside audit look-backs. If you received a Medicaid payment you weren’t entitled to, you have to report and return it within 60 days of identifying the overpayment.2Office of the Law Revision Counsel. 42 U.S. Code 1320a-7k – Medicare and Medicaid Program Integrity Provisions The obligation to look for those overpayments stretches back six years from the date you received the money.3Centers for Medicare & Medicaid Services. Medicare Reporting and Returning of Self-Identified Overpayments
This is where a billing mistake can quietly become a fraud case. If you hold onto an overpayment past the 60-day deadline, the statute reclassifies it as an “obligation” under the False Claims Act.2Office of the Law Revision Counsel. 42 U.S. Code 1320a-7k – Medicare and Medicaid Program Integrity Provisions What started as an innocent billing error can then expose you to treble damages and per-claim penalties because you didn’t act fast enough. When an internal review turns up potential overpayments, the 60-day clock is non-negotiable.
Ten Years When Fraud Is Suspected
When auditors suspect fraud rather than simple billing errors, the look-back expands sharply. The False Claims Act allows the government to bring a civil action up to six years after the violation. If the fraud wasn’t discovered until later, the clock extends to three years after the government learned (or should have learned) the material facts, with an absolute outer limit of ten years from the date of the violation.4Office of the Law Revision Counsel. 31 U.S. Code 3731 – False Claims Procedure
That ten-year window exists because Medicaid fraud schemes are often designed to avoid detection. A provider billing for services never rendered, upcoding visits systematically, or receiving kickbacks may not draw suspicion for years. CMS’s Unified Program Integrity Contractors work with state Medicaid agencies and can refer cases to the Medicaid Fraud Control Unit or other law enforcement, which then pursue investigations under these longer timelines.5Centers for Medicare & Medicaid Services. Chapter 3 – Medicaid Investigations and Audits
Federal regulations under 42 CFR Part 455 require every state Medicaid plan to include procedures for identifying, investigating, and referring suspected fraud, and to verify that billed services were actually delivered to beneficiaries.6eCFR. 42 CFR Part 455 – Program Integrity: Medicaid When a fraud referral triggers law enforcement, the audit look-back effectively merges with the criminal or civil enforcement timeline, which can reach back a full decade.
Why the Sampled Claims Turn Into a Much Bigger Bill
Auditors don’t review every claim you submitted over five or six years. They pull a statistically valid random sample, audit those claims in detail, and then extrapolate the error rate across your entire claims universe for the look-back period. If the sample shows a 15% overpayment rate on 100 reviewed claims, that rate gets applied to every claim you submitted during the audit window.
The math produces striking results. A provider who billed $2 million in claims over five years and has a 15% error rate in the sample could face a projected overpayment demand of $300,000, even though auditors only touched a fraction of the actual claims. Extrapolation typically uses a regression estimator with a confidence interval, and the recovery demand is usually set at the lower bound of a one-sided 95% confidence interval to account for statistical uncertainty. This methodology is standard practice at both federal and state levels.
Challenging an extrapolated overpayment is notoriously hard. You generally can’t argue that the un-reviewed claims were fine. Instead, you have to attack the sampling methodology: whether the sample was truly random, whether the universe of claims was properly defined, and whether the statistical model fit. If the sample is sound, the extrapolation usually holds up on appeal.
How Long to Keep Your Records
Every provider agreement with a state Medicaid agency requires you to keep records sufficient to document the services provided to beneficiaries, and to turn those records over on request to the Medicaid agency, CMS, or the state Medicaid Fraud Control Unit.7eCFR. 42 CFR 431.107 – Required Provider Agreement The regulation doesn’t set a year count. It ties your obligation to the program’s need for the records.
Overlapping federal rules create the effective retention floor:
- Five years of claims are subject to routine audit, so records covering that period should be readily accessible.
- The six-year overpayment look-back means you need records reaching back at least six years to satisfy that obligation.
- HIPAA-covered entities must retain HIPAA policies, procedures, and required written communications for six years from creation or the date they were last in effect.8eCFR. 45 CFR 164.530 – Administrative Requirements
- Providers who also participate in Medicare face at least five years of records after cost report closure, and Medicare managed care providers must retain records for ten years.9Centers for Medicare & Medicaid Services. Medical Record Retention and Media Format for Medical Records
State medical record retention laws add another layer. Across the country, state requirements for adult patient records generally range from six to eleven years, with seven years being the most common. Retention periods for records involving minors are often longer, sometimes extending several years past the patient’s eighteenth birthday. Follow whichever requirement is longest: federal, state, or your specific provider agreement. If you’re notified of an active audit or investigation, hold all related records indefinitely until the matter is fully resolved, even if your standard retention period would otherwise allow destruction.
What Happens After the State Finds an Overpayment
Once a state Medicaid agency discovers an overpayment, a separate federal clock starts. Under 42 CFR 433.316, the state has one year from the date of discovery to recover the overpayment or demonstrate active recovery efforts. If the state doesn’t act within that year, it must refund the federal share to CMS whether or not it collected from the provider.10eCFR. 42 CFR 433.316 – When Discovery of Overpayment Occurs and Its Significance
That creates urgency on the state side. When an audit turns up overpayments, the state has strong financial motivation to move quickly on recovery. For fraud-related overpayments, the rules differ: the discovery date is the date of the state’s final written overpayment determination, and the one-year clock pauses while administrative or judicial proceedings are pending.10eCFR. 42 CFR 433.316 – When Discovery of Overpayment Occurs and Its Significance A fraud referral does two things at once: it extends the look-back period, and it pauses the recovery clock, giving the state more time to build its case and demand repayment.