Healthcare Audit Consultant or Healthcare Attorney? When You Need Each During a Medicare Audit

When a Medicare audit arrives, providers often ask who they should call: a healthcare audit consultant or a healthcare attorney. The answer depends on the type of audit, the risks involved, and what the provider needs to accomplish. Some audits are routine documentation reviews that a skilled consultant can help manage. Others carry legal risks that require an attorney from the start. Many significant matters benefit from both working together.

Choosing the right support early matters. A consultant can strengthen documentation responses, analyze claims, and prepare appeals efficiently. An attorney can evaluate legal exposure, protect privileged communications, interact with government investigators, and advise on decisions such as self-disclosure. Engaging the wrong type of help, or engaging the right help too late, can increase costs and risks.

This article explains what audit consultants and healthcare attorneys each do, the types of Medicare audits and the risks they carry, when you need each, how attorney-client privilege affects the decision, how consultants and attorneys can work together, and how to select and structure engagements. It is educational and does not replace legal advice.

What a Healthcare Audit Consultant Does

Healthcare audit consultants typically bring expertise in coding, billing, clinical documentation, reimbursement, and compliance operations. Common services include:

• Reviewing ADRs and organizing documentation responses.

• Conducting pre-submission documentation reviews.

• Performing internal coding and documentation audits.

• Analyzing denial patterns and root causes.

• Preparing redetermination and reconsideration appeals for documentation and medical necessity issues.

• Supporting statistical sampling analysis, often through statisticians.

• Reviewing PEPPER, Comparative Billing Reports, and other data.

• Developing corrective action plans and education.

• Building audit response processes and compliance program elements.

Consultants are often efficient and cost-effective for operational and technical work, especially when audits involve large numbers of claims.

What a Healthcare Attorney Does

Healthcare attorneys bring legal expertise in Medicare law, fraud and abuse laws, administrative appeals, and government investigations. Common services include:

• Evaluating legal exposure under the False Claims Act, Anti-Kickback Statute, physician self-referral law, and civil monetary penalty laws.

• Advising on responses to UPIC investigations, OIG audits, and law enforcement inquiries.

• Responding to subpoenas and civil investigative demands.

• Conducting privileged internal investigations.

• Advising on self-disclosure to the OIG, CMS, or the Department of Justice.

• Advising on the 60-day overpayment rule and repayment obligations.

• Representing providers in ALJ hearings, Medicare Appeals Council review, and federal court.

• Challenging payment suspensions, revocations, and exclusions.

• Negotiating settlements and corporate integrity agreements.

Types of Medicare Audits and Their Risk Levels

Lower-Risk Reviews

These reviews generally focus on documentation and payment accuracy:

• CERT reviews, which use random samples to measure the improper payment rate.

• Routine MAC medical review and Targeted Probe and Educate (TPE).

• SMRC national review projects.

• RAC reviews of approved topics.

A consultant is often appropriate for these reviews, although an attorney may be needed if findings are large, involve extrapolation, or reveal broader problems.

Higher-Risk Reviews

These reviews may involve fraud, waste, and abuse concerns or significant financial exposure:

• UPIC investigations, prepayment reviews, and postpayment reviews with extrapolation.

• Payment suspensions.

• HHS-OIG audits.

• Unannounced site visits.

• Enrollment revocation actions.

An attorney is generally recommended for these matters, often working with a consultant.

Highest-Risk Matters

These involve government investigations or potential enforcement:

• Civil investigative demands from the Department of Justice.

• Subpoenas from OIG or law enforcement.

• Search warrants.

• Qui tam or whistleblower allegations.

• Medicaid Fraud Control Unit investigations.

• Exclusion proceedings.

An experienced healthcare attorney is essential from the start. Consultants may support the attorney under the attorney's direction.

When You Need a Consultant

A consultant is often the right first call when:

• You receive a routine ADR or TPE request.

• You need help organizing documentation or responding to many ADRs.

• You want a pre-submission review of records.

• Denials appear to be documentation or coding issues.

• You need to prepare redeterminations or reconsiderations for medical necessity or documentation denials.

• You want to conduct internal audits to identify risk areas.

• You need education and corrective action for staff.

When You Need an Attorney

An attorney should be involved when:

• A UPIC contacts you, places you on review, or conducts a site visit.

• Your payments are suspended.

• You receive a CID, subpoena, or search warrant.

• OIG notifies you of an audit or investigation.

• Findings suggest potential fraud, kickbacks, or self-referral issues.

• You are considering self-disclosure.

• You identify potential overpayments and need advice on the 60-day rule.

• The overpayment is large or extrapolated and you plan to challenge it through the ALJ level or beyond.

• Your enrollment is revoked or you face exclusion.

• Employees are being interviewed by investigators.

• You suspect a whistleblower.

When You Need Both

Many significant matters benefit from both an attorney and a consultant:

• UPIC postpayment reviews with extrapolation: the attorney manages legal strategy and communication, while the consultant analyzes claims and a statistician evaluates the sample.

• OIG audits: the attorney advises on legal exposure and the draft report response, while the consultant conducts parallel claim reviews.

• Internal investigations: the attorney directs the investigation to preserve privilege, while the consultant performs claim reviews and data analysis.

• Self-disclosures: the attorney prepares the disclosure and negotiates, while the consultant estimates damages through a claim review. OIG's Health Care Fraud Self-Disclosure Protocol requires a damages estimate based on either a review of all affected claims or a statistically valid random sample of at least 100 claims, using the mean point estimate.

• ALJ hearings: the attorney presents the case, while the consultant organizes records and may serve as a witness on documentation and coding.

Attorney-Client Privilege and Why It Matters

What Privilege Protects

Attorney-client privilege generally protects confidential communications between a client and its attorney made for the purpose of obtaining legal advice. The work product doctrine generally protects materials prepared in anticipation of litigation. These protections can be critical when an audit may lead to an investigation or litigation.

Consultants and Privilege

Communications with a consultant are generally not privileged on their own. However, when an attorney engages a consultant to assist in providing legal advice, the consultant's work may be protected under the attorney's privilege or work product protections, depending on the circumstances and applicable law. This is why, in higher-risk matters, consultants are often engaged by counsel rather than directly by the provider.

Practical Implications

• If an audit could lead to an investigation, consider having counsel engage the consultant.

• Clearly document the purpose of the engagement as assisting counsel in providing legal advice.

• Limit distribution of privileged reports.

• Be careful about waiving privilege, for example by sharing privileged reports with third parties. Federal Rule of Evidence 502 addresses certain circumstances involving disclosure and waiver.

• Recognize that privilege may not protect underlying facts or documents that existed independently.

When Privilege Is Less Important

For routine ADR responses and documentation reviews where the work product will be submitted to the contractor anyway, privilege may be less important, and engaging a consultant directly may be appropriate.

Interacting With Government Investigators

Attorneys play a key role when government investigators are involved:

• Advising on how to respond to requests for documents and interviews.

• Negotiating the scope and timing of responses to CIDs and subpoenas.

• Advising employees of their rights in interviews.

• Coordinating communications with the government.

• Protecting privileged materials.

Consultants generally should not communicate directly with investigators on legal matters without counsel's involvement.

The 60-Day Overpayment Rule

When an audit or internal review suggests overpayments beyond the claims reviewed, the 60-day overpayment rule at 42 CFR 401.305 may apply. Providers must report and return identified overpayments within the required timeframe, subject to a suspension for a timely, good-faith investigation. Retaining overpayments past the deadline can create False Claims Act liability.

An attorney can advise on when an overpayment is identified, how to structure the investigation, and whether to report through the MAC's voluntary refund process, the OIG Self-Disclosure Protocol, or other channels. A consultant can perform the claim reviews and calculations needed to quantify the overpayment.

Self-Disclosure

The OIG Health Care Fraud Self-Disclosure Protocol and CMS's Voluntary Self-Referral Disclosure Protocol offer paths to resolve potential violations. OIG has explained that its general practice in self-disclosure cases is to require a minimum multiplier of 1.5 times single damages, compared with potentially higher multipliers in government-initiated cases. Decisions about self-disclosure have significant legal consequences, so an attorney should lead the process. Consultants typically support the damages calculation and corrective action.

Corporate Integrity Agreements

If a matter results in a settlement, OIG may require a corporate integrity agreement, which often includes engagement of an Independent Review Organization to perform claims reviews. Consultants may serve as Independent Review Organizations, subject to independence requirements, while attorneys negotiate and oversee compliance with the agreement.

How to Choose a Consultant

• Experience with the specific type of audit and service.

• Qualified staff, such as certified coders, clinicians, and statisticians.

• Understanding of Medicare documentation and coverage rules.

• Clear scope of work and fees.

• Willingness to work under counsel's direction when needed.

• Data security and HIPAA compliance, including a business associate agreement.

• References from similar providers.

• Avoidance of conflicts of interest.

How to Choose a Healthcare Attorney

• Experience with Medicare audits, appeals, and government investigations.

• Familiarity with the contractors and agencies involved.

• Experience with False Claims Act and fraud and abuse matters, for higher-risk cases.

• Ability to coordinate with consultants and experts.

• Clear communication about strategy, risks, and costs.

• Licensed in the relevant jurisdiction and, for court matters, admitted to the appropriate courts.

Structuring the Engagement

Direct Consultant Engagement

Appropriate for routine reviews, ADR support, and internal audits not expected to lead to legal proceedings.

Attorney-Directed Consultant Engagement

Appropriate when privilege matters. The attorney engages the consultant, defines the scope, receives the consultant's reports, and uses them to provide legal advice.

Joint Team

For major matters, the attorney leads, with consultants, statisticians, and clinical experts each assigned clear responsibilities.

Key Contract Terms

• Scope of work and deliverables.

• Who directs the work and receives reports.

• Confidentiality and privilege protections.

• Data security and business associate agreement terms.

• Fees, budgets, and billing.

• Conflict of interest representations.

Working With Statisticians and Clinical Experts

Some audits require specialists beyond a general consultant or attorney.

• Statisticians evaluate whether a contractor's sampling and extrapolation followed the Medicare Program Integrity Manual, Chapter 8, and generally accepted statistical principles. They may prepare written reports and testify at ALJ hearings.

• Clinical experts, such as physicians or therapists in the relevant specialty, can explain why services were medically necessary and how the records support the care provided.

• Coding experts can address coding disputes, including levels of service and modifier use.

In higher-risk matters, counsel typically engages these experts so their work can be coordinated with legal strategy and, where applicable, protected.

Common Mistakes

• Waiting too long to involve an attorney in a UPIC, OIG, or law enforcement matter.

• Engaging a consultant directly for an internal investigation that should be privileged.

• Sharing privileged reports widely.

• Allowing consultants to communicate with investigators without counsel.

• Using an attorney for routine documentation work that a consultant could handle more efficiently.

• Failing to coordinate between attorney and consultant.

• Not defining scope and budget clearly.

• Ignoring 60-day overpayment obligations while focusing only on the audit.

Cost Considerations

Cost is a legitimate factor in deciding whom to engage, but it should be weighed against risk.

• Consultants often provide better value for high-volume work, such as reviewing hundreds of claims, organizing ADR packets, or preparing appeals that focus on documentation.

• Attorneys provide value that cannot be replaced when legal judgment, privilege, or representation is needed. Delaying their involvement to save money can increase costs later if a matter escalates.

• In a coordinated engagement, counsel can direct the consultant to perform the bulk of claim-level work, keeping legal fees focused on strategy and legal advice.

• Ask both consultants and attorneys for budgets or phased estimates, and agree on how changes in scope will be handled.

How Roles Change as an Audit Moves Through the Appeals Process

The right mix of support can change over the life of an audit.

During the Records Request

At the ADR stage, the main task is producing complete, organized records on time. Consultants are often well suited to this work. If the request comes from a UPIC or OIG, counsel should be involved to evaluate the scope and risk.

At Redetermination and Reconsideration

These first two appeal levels are written reviews. Consultants frequently prepare these appeals for documentation and medical necessity issues. Because evidence generally must be submitted by the reconsideration level to be considered later without good cause, this stage is critical. For large or extrapolated overpayments, counsel should help shape the record, and a statistician should evaluate the sampling methodology.

At the ALJ Hearing

The ALJ level involves a hearing, legal arguments, and sometimes witness testimony. Attorneys commonly represent providers at this level for significant matters, with consultants and clinical experts supporting the presentation.

At the Medicare Appeals Council and Federal Court

These levels focus on legal error and require legal briefing. Federal court litigation requires an attorney admitted to practice in the relevant court.

Questions to Ask at the Start of Any Audit

Asking a few questions early helps determine the right support:

• Which contractor or agency sent the request, and what is its role?

• Does the request mention fraud, investigation, or law enforcement?

• How many claims and what time period are involved?

• Is extrapolation possible?

• Are payments being suspended or held?

• Does the request involve financial relationships with referral sources?

• Have similar issues been found in prior audits?

• Could the findings affect claims outside the review?

• Are any employees or former employees likely to be interviewed?

If the answers suggest legal risk, involve counsel before submitting substantive responses beyond what is clearly required.

Coordinating Communication Within the Organization

Audits involve many internal stakeholders, including billing, coding, clinical leadership, compliance, finance, and executive leadership. Clear lines of communication help avoid mistakes.

• Designate a single point of contact for the contractor or agency.

• Route legal questions to counsel and technical questions to the consultant.

• Limit internal written discussion of potential legal issues outside privileged channels.

• Keep the compliance officer and leadership informed according to the compliance program's reporting structure.

• Document decisions and the reasons for them.

A Decision Guide

• Routine ADR, TPE, CERT, or SMRC request with no warning signs: start with a consultant.

• RAC findings with a moderate overpayment: consultant for appeals, attorney if findings are large or extrapolated.

• UPIC contact, prepayment review, or site visit: attorney, with consultant support.

• Payment suspension: attorney immediately.

• OIG audit: attorney and consultant.

• CID, subpoena, or search warrant: attorney immediately.

• Potential overpayments beyond the audit: attorney to advise on the 60-day rule, consultant to quantify.

• ALJ hearing on a significant overpayment: attorney, with consultant and expert support.

A Hypothetical Example

A cardiology practice receives a UPIC records request for two years of claims, along with a notice of a site visit. The practice's administrator first calls its billing consultant, who recommends involving counsel. The practice engages a healthcare attorney, who then engages the consultant and a statistician under an attorney-directed agreement.

The attorney coordinates communication with the UPIC and prepares staff for the site visit. The consultant organizes records and conducts a privileged parallel review of the sampled claims. The review identifies a documentation problem with one type of diagnostic test. Under the attorney's advice, the practice expands the review to quantify potential overpayments outside the UPIC sample and evaluates its obligations under the 60-day rule. When the UPIC issues an extrapolated overpayment, the attorney files appeals, and the statistician's report identifies errors in the sampling frame. The coordinated approach reduces the overpayment and helps the practice address its broader obligations.

Frequently Asked Questions

Do I need an attorney for every Medicare audit?

No. Routine documentation reviews can often be handled with a consultant. Higher-risk matters, such as UPIC investigations, OIG audits, payment suspensions, and government investigations, generally require an attorney.

Are my communications with a consultant privileged?

Generally not on their own. When an attorney engages a consultant to help provide legal advice, the consultant's work may be protected, depending on the circumstances and applicable law.

Can a consultant represent me in an ALJ hearing?

Medicare appeals rules allow representatives who are not attorneys in some circumstances, but for significant or complex matters, an attorney is often advisable.

Who should calculate damages for a self-disclosure?

Typically a consultant or statistician, working under counsel's direction, using OIG's requirements for claim reviews or statistically valid samples.

When should I call an attorney?

As soon as a UPIC, OIG, or law enforcement agency is involved, payments are suspended, or you suspect potential fraud or significant overpayments.

Conclusion

Healthcare audit consultants and healthcare attorneys play different but complementary roles during Medicare audits. Consultants excel at documentation, coding, claim analysis, and appeals of routine findings. Attorneys provide legal judgment, privilege protection, and representation in higher-risk matters involving UPICs, OIG, law enforcement, self-disclosure, and litigation. For many significant matters, the best approach is a coordinated team, with counsel directing the engagement and consultants providing technical expertise. By recognizing the risk level of an audit early and engaging the right support, providers can respond efficiently while protecting their legal interests.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that helps providers respond to Medicare audits by organizing documentation, conducting claim reviews, analyzing denial patterns, preparing appeals, and supporting statistical analysis. For higher-risk matters, we work alongside and under the direction of our clients' legal counsel. If you need help deciding what support your audit requires, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure Protocol. https://oig.hhs.gov/compliance/self-disclosure-info/

• U.S. Department of Health and Human Services, Office of Inspector General. Corporate Integrity Agreements. https://oig.hhs.gov/compliance/corporate-integrity-agreements/

• Centers for Medicare & Medicaid Services. Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral/self-referral-disclosure-protocol

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 4, Program Integrity. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf

• Centers for Medicare & Medicaid Services. Form CMS-1696, Appointment of Representative. https://www.cms.gov/medicare/cms-forms/cms-forms/downloads/cms1696.pdf

• U.S. Department of Justice. False Claims Act Overview. https://www.justice.gov/civil/false-claims-act

• Office of the Law Revision Counsel. 31 U.S.C. 3733, Civil Investigative Demands. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3733&num=0&edition=prelim

• United States Courts. Federal Rules of Evidence. https://www.uscourts.gov/rules-policies/current-rules-practice-procedure/federal-rules-evidence

• U.S. Department of Health and Human Services. HIPAA Business Associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• Electronic Code of Federal Regulations. 42 CFR 405.910, Appointed Representatives. https://www.ecfr.gov/current/title-42/section-405.910