Nursing Home Medicaid Audit Readiness: Provider Revalidation and State Payment Reviews

For most nursing facilities, Medicaid is the largest payer. Medicaid pays for long-term care for residents who have exhausted their own resources, and in many facilities Medicaid residents occupy the majority of beds. That makes Medicaid enrollment and Medicaid payment accuracy central to a facility's financial health.

Medicaid oversight comes from several directions at once. Federal regulations require every state to screen and revalidate enrolled providers. States audit the data that drives Medicaid rates, including Minimum Data Set (MDS) assessments in case-mix states and cost reports in states that use cost-based rate setting. States also review eligibility-related issues, resident trust funds, preadmission screening, and claims. Medicaid Recovery Audit Contractors, state program integrity units, and Medicaid Fraud Control Units (MFCUs) add further layers.

This article explains the federal revalidation and screening requirements, the main types of state payment reviews nursing facilities face, and how to build an audit readiness program. Because Medicaid is administered by each state under its own state plan, rules vary. Facilities should always confirm requirements with their state Medicaid agency. This article is educational and does not replace legal or professional advice.

Part One: Provider Enrollment and Revalidation

The Federal Framework

Federal rules at 42 CFR Part 455, Subpart E, set minimum screening and enrollment requirements that every state Medicaid agency must follow. Key provisions include:

• 42 CFR 455.410: States must screen all initial applications, applications for new practice locations, and revalidations, and they may rely on screening already performed by Medicare.

• 42 CFR 455.412: States must verify that providers have valid licenses in the states where they practice and that the licenses have no current limitations.

• 42 CFR 455.414: States must revalidate the enrollment of all providers, regardless of provider type, at least every five years.

• 42 CFR 455.416: States must terminate or deny enrollment in specified circumstances, such as when a provider fails to submit timely and accurate information or does not cooperate with screening.

• 42 CFR 455.420: Reactivation of a provider requires rescreening and payment of any required application fee.

• 42 CFR 455.422: States must provide appeal rights as required by state law.

• 42 CFR 455.432: States must conduct pre-enrollment and post-enrollment site visits for providers designated as moderate or high risk.

• 42 CFR 455.434: States must require fingerprint-based criminal background checks for high-risk providers and their owners with a 5 percent or greater direct or indirect ownership interest.

• 42 CFR 455.436: States must check federal databases, such as the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the OIG List of Excluded Individuals and Entities, and the System for Award Management.

• 42 CFR 455.450: States must screen providers according to their categorical risk level: limited, moderate, or high.

• 42 CFR 455.460: States must collect application fees where required.

• 42 CFR 455.470: CMS and states may impose temporary moratoria on enrollment of certain provider types.

Revalidation in Practice

At least every five years, a nursing facility must submit updated information to the state and undergo screening appropriate to its risk level. States notify providers in different ways, often by letter or through the state's provider portal, and many states publish revalidation schedules. Some states have launched accelerated or prioritized revalidation for certain providers. A facility that misses its revalidation deadline or fails to respond to requests for information risks having its Medicaid enrollment terminated under 42 CFR 455.416, which would stop Medicaid payments.

CMS guidance to states explains that states may rely on revalidation screening performed by Medicare for providers enrolled in both programs, but the state remains responsible for meeting Medicaid requirements. A facility should not assume that completing Medicare revalidation satisfies its Medicaid obligations.

Risk Levels and Site Visits

Risk level determines the depth of screening. Limited-risk screening includes license verification and database checks. Moderate-risk screening adds site visits. High-risk screening adds fingerprint-based criminal background checks. States set risk levels for provider types, often aligning with Medicare categories, and may assign a higher level in some circumstances. Some states include nursing facilities among the provider types subject to site visits. During a site visit, state staff or contractors verify that the facility is operating at the enrolled address and that enrollment information is accurate.

Disclosure Requirements

Revalidation includes disclosures under 42 CFR Part 455, Subpart B:

• 42 CFR 455.104: Ownership and control information, including the name, address, date of birth, and Social Security number of each person with an ownership or control interest, and information about related parties and managing employees.

• 42 CFR 455.105: Information about business transactions, including ownership of subcontractors with significant business transactions, which must be provided on request.

• 42 CFR 455.106: Information about persons with ownership or control interests, agents, or managing employees who have been convicted of crimes related to Medicare, Medicaid, or Title XX programs.

Nursing facility ownership structures can be complex, involving holding companies, real estate entities, management companies, and related-party vendors. Federal policymakers have increased attention to nursing home ownership transparency in recent years. Facilities should maintain an accurate, current organizational chart and ownership records so that disclosures are complete and consistent across Medicare and Medicaid.

Reporting Changes

Facilities must report changes in ownership, control, managing employees, addresses, and other enrollment information within the time frames set by the state. Failure to report changes can create enrollment problems and, in some cases, overpayment liability.

Common Revalidation Problems

• Missed deadlines because notices went to an outdated address or contact.

• Incomplete ownership disclosures, especially indirect owners.

• Inconsistencies between Medicaid, Medicare, and licensing records.

• Excluded individuals among owners, managing employees, or staff.

• Expired or limited licenses.

• Failure to schedule or complete fingerprinting for owners when required.

• Missing documentation requested during site visits.

Exclusion Screening

Medicaid does not pay for items or services furnished, ordered, or prescribed by excluded individuals or entities. Facilities should screen employees, contractors, owners, and managing employees against the OIG List of Excluded Individuals and Entities and the state's Medicaid exclusion list before hire and monthly thereafter, and should document each check. Many states maintain their own exclusion or termination lists, and CMS guidance encourages monthly checks.

Part Two: State Payment Reviews

Case-Mix MDS Reviews

Many states pay nursing facilities using case-mix-adjusted rates that depend on residents' MDS assessments. For years, many states used Resource Utilization Group (RUG) classifications. When CMS moved Medicare to the Patient Driven Payment Model (PDPM), it allowed states to keep RUG-based systems temporarily by requiring an Optional State Assessment. CMS ended support for the Optional State Assessment on September 30, 2025, and states that used it have moved to PDPM-based or other classification approaches. Facilities should confirm which classification method their state uses for each rate period and which MDS items drive it.

States that use case-mix reimbursement audit MDS accuracy. State reviewers or contractors visit facilities, select samples of assessments, and compare MDS items with the medical record. When documentation does not support coded items, the state may reclassify residents, recalculate the facility's case-mix index, and adjust rates. Some states also apply penalties or expanded reviews when error rates exceed thresholds. State rules describe how facilities can request reconsideration of reclassifications.

Common case-mix errors include:

• Section GG functional items not supported by documentation.

• Diagnoses coded without physician documentation.

• Treatments, such as isolation or specialized therapies, coded without orders and records for the look-back period.

• Depression or behavioral items not supported by interviews or observations.

• Assessments completed or submitted late.

Because the MDS also drives Medicare payment and quality measures, MDS accuracy affects every payer and every program.

Cost Report Audits

States that use cost-based or cost-informed rate setting require nursing facilities to file Medicaid cost reports. State auditors or contractors examine whether reported costs are allowable, reasonable, and properly classified. Common issues include:

• Related-party costs, such as rent or management fees paid to affiliated entities, that exceed the cost to the related party.

• Nonallowable costs, such as certain marketing, lobbying, or entertainment expenses.

• Misclassified costs between direct care and other cost centers.

• Unsupported allocations among facilities in a chain.

• Census and patient day errors.

Cost report adjustments can change future rates and may create overpayments for past periods.

Preadmission Screening and Resident Review

Federal regulations at 42 CFR 483.100 through 483.138 require Preadmission Screening and Resident Review (PASRR) for all applicants to Medicaid-certified nursing facilities, regardless of payer, to identify individuals with serious mental illness or intellectual disability and determine whether nursing facility services and specialized services are needed. Under 42 CFR 483.122, federal financial participation is not available for nursing facility services furnished to a resident who has not been screened as required. States can recover Medicaid payments for days without a valid PASRR. Facilities should verify that a Level I screen, and when indicated a Level II evaluation, is completed before admission and updated when a resident's condition changes significantly.

Level of Care and Eligibility Issues

States require residents to meet nursing facility level of care criteria, and Medicaid eligibility determinations set the resident's financial eligibility and patient liability, the amount of income the resident must contribute toward care. Reviews may find:

• Medicaid billed for residents without a current level of care determination.

• Incorrect patient liability amounts applied to claims.

• Billing for days before eligibility was established or after it ended.

Resident Trust Funds

Federal regulations at 42 CFR 483.10(f)(10) set requirements for managing residents' personal funds when the facility holds them, including separate accounts, quarterly statements, conveyance of funds after death, and a surety bond. States review resident trust accounts for compliance, and misuse can lead to repayment, sanctions, and referrals.

Claims Reviews

States and their contractors review nursing facility claims for issues such as bed-hold days billed contrary to state policy, leave days, ancillary services billed separately when included in the per diem, duplicate billing, and billing during hospital stays.

Part Three: Other Medicaid Oversight Bodies

Medicaid Recovery Audit Contractors

Federal rules at 42 CFR 455.500 through 455.518 require states to establish Medicaid Recovery Audit Contractor programs, unless CMS grants an exception, to identify and recover overpayments and identify underpayments. State RAC programs differ in scope and look-back periods.

Payment Error Rate Measurement

CMS measures improper payments in Medicaid through the Payment Error Rate Measurement program under 42 CFR Part 431, Subpart Q. Nursing facility claims may be selected for medical record review, and facilities must respond to record requests.

State Program Integrity Units

State Medicaid agencies have program integrity units that conduct audits, data analysis, and investigations, and they can impose payment suspensions when there is a credible allegation of fraud under 42 CFR 455.23.

Medicaid Fraud Control Units

MFCUs, typically located in state attorney general offices and overseen by OIG, investigate and prosecute Medicaid provider fraud and patient abuse or neglect in facilities. MFCU investigations can arise from audits, complaints, or data analysis.

Building a Medicaid Audit Readiness Program

Enrollment Management

• Maintain a calendar of revalidation dates for each facility and enrollment.

• Keep contact information current with the state, including the portal.

• Maintain a master file of ownership, control, and managing employee information.

• Report changes within required time frames.

• Prepare for site visits with an organized binder of licenses, certifications, and enrollment documents.

• Track fingerprinting requirements for owners.

Exclusion Screening

• Screen before hire or contracting, and monthly thereafter.

• Include owners, managing employees, contractors, and vendors.

• Document each check and the response to any match.

MDS Accuracy

• Train MDS coordinators and interdisciplinary staff on the RAI Manual and the state's classification method.

• Audit a sample of assessments monthly, focusing on items that drive Medicaid case mix.

• Track timeliness of assessments and submissions.

• Review state case-mix audit results and correct root causes.

Cost Reporting

• Maintain documentation supporting all reported costs.

• Review related-party transactions and document the cost to the related party.

• Follow the state's cost reporting instructions and allowable cost rules.

• Reconcile census data.

PASRR and Eligibility

• Verify PASRR before admission and after significant changes.

• Track level of care determinations and redeterminations.

• Verify eligibility and patient liability before billing.

Resident Funds

• Reconcile resident trust accounts monthly.

• Provide quarterly statements and convey funds timely after death or discharge.

• Maintain the required surety bond.

Claims Accuracy

• Audit claims for bed-hold, leave, hospital days, and ancillary services.

• Correct and refund overpayments promptly. Section 1128J(d) of the Social Security Act requires reporting and returning identified overpayments within 60 days, and many states have their own repayment rules.

Responding to a State Audit

When a state audit begins:

• Identify the auditing entity, the scope, the period, and the deadlines.

• Designate a coordinator and notify leadership and counsel as appropriate.

• Produce complete, organized records within the deadline, and keep a copy of everything produced.

• Attend entrance and exit conferences and take notes.

• Review preliminary findings carefully and respond with documentation.

• Use available reconsideration and appeal rights under state law and 42 CFR 455.422 for enrollment actions.

• Implement corrective actions for valid findings.

A Hypothetical Example

A nursing facility receives a state notice that its Medicaid case-mix index will be reduced after a state review found that 30 percent of sampled assessments included Section GG and diagnosis items not supported by documentation. At the same time, its revalidation notice had been sent to a former administrator and had gone unanswered. The facility updates its contact information, completes revalidation with full ownership disclosures, retrains MDS staff on documentation, begins monthly internal MDS audits, and submits reconsideration requests with documentation for the reclassifications it believes were incorrect. Its next state review finds a substantially lower error rate.

Common Myths About Medicaid Readiness

Myth: Medicare Revalidation Covers Medicaid

States may rely on Medicare screening, but Medicaid enrollment is a separate obligation with its own deadlines, forms, and state-specific requirements.

Myth: The State Will Remind Us Several Times

States send notices, but they may go to outdated contacts or portal inboxes. The facility is responsible for tracking its own deadlines.

Myth: Case-Mix Audits Only Affect One Rate Period

Reclassifications can reduce rates for the affected period, and repeated problems can lead to expanded reviews and closer state attention.

Myth: Resident Trust Fund Issues Are Minor

Mishandling resident funds can lead to repayment, survey citations, and referrals for investigation.

Questions Leadership Should Ask

• When is each facility's next Medicaid revalidation, and who owns the process?

• Are our ownership and managing employee disclosures complete and consistent across programs?

• Do we screen every employee, contractor, and owner monthly for exclusions?

• What were the results of our last state case-mix review, and what did we change?

• Are related-party costs on our cost report documented at cost to the related party?

• Do we verify PASRR and level of care before admission?

• When were resident trust accounts last reconciled and audited?

• Do we have a written process for responding to state audits and record requests?

Key Takeaways

• States must revalidate every Medicaid provider at least every five years, with screening based on risk level.

• Complete ownership and control disclosures are required under 42 CFR 455.104 through 455.106.

• In case-mix states, MDS accuracy drives Medicaid rates and is audited.

• Cost reports, PASRR, eligibility, resident funds, and claims are all subject to state review.

• A readiness program with calendars, audits, and response procedures reduces risk.

Coordinating Medicare and Medicaid Compliance

Most nursing facilities are dually certified, so Medicare and Medicaid obligations overlap. The same MDS assessments support Medicare PDPM payment, Medicaid case-mix rates, and quality measures. The same ownership information appears on Medicare and Medicaid enrollment records. A single compliance calendar that tracks Medicare revalidation, Medicaid revalidation, cost report deadlines, and state audit cycles helps facilities avoid conflicting information and missed deadlines.

Frequently Asked Questions

How often must nursing facilities revalidate Medicaid enrollment?

At least every five years under 42 CFR 455.414, and states may require more frequent revalidation.

Can a state rely on Medicare screening?

Yes, states may rely on screening performed by Medicare, but the facility must still meet all state Medicaid requirements.

What happens if a facility misses revalidation?

The state may terminate Medicaid enrollment under 42 CFR 455.416, which stops Medicaid payments.

Why does MDS accuracy matter for Medicaid?

In case-mix states, MDS assessments drive Medicaid rates, and states audit the MDS to adjust payments.

What happens if PASRR was not completed?

Federal financial participation is not available for services furnished to residents who were not screened, and the state may recover payments.

Conclusion

Medicaid audit readiness for nursing facilities rests on two foundations: maintaining enrollment through timely revalidation, complete disclosures, and exclusion screening, and ensuring that the data and claims that drive Medicaid payment are accurate. Facilities that track revalidation, keep ownership information current, audit MDS assessments and cost reports, verify PASRR and eligibility, manage resident funds carefully, and respond to state reviews promptly will be well prepared for state and federal oversight.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that helps nursing facilities prepare for Medicaid revalidation and state payment reviews through enrollment and disclosure reviews, exclusion screening programs, MDS case-mix audits, cost report reviews, PASRR and resident fund compliance assessments, and state audit response support. If you want to strengthen your Medicaid readiness, please get in touch with us. We will be happy to help you with this topic.

References

• Electronic Code of Federal Regulations. 42 CFR Part 455, Subpart E, Provider Screening and Enrollment. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455/subpart-E

• Electronic Code of Federal Regulations. 42 CFR Part 455, Subpart B, Disclosure of Information by Providers and Fiscal Agents. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455/subpart-B

• Electronic Code of Federal Regulations. 42 CFR Part 455, Subpart F, Medicaid Recovery Audit Contractors Program. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455/subpart-F

• Electronic Code of Federal Regulations. 42 CFR 455.23, Suspension of Payments in Cases of Fraud. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455/subpart-A/section-455.23

• Electronic Code of Federal Regulations. 42 CFR Part 483, Subpart C, Preadmission Screening and Annual Review of Individuals With Mental Illness and Intellectual Disability. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-483/subpart-C

• Electronic Code of Federal Regulations. 42 CFR 483.10, Resident Rights. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-483/subpart-B/section-483.10

• Electronic Code of Federal Regulations. 42 CFR Part 431, Subpart Q, Requirements for Estimating Improper Payments in Medicaid and CHIP. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-431/subpart-Q

• Centers for Medicare & Medicaid Services, Medicaid.gov. Sub-Regulatory Guidance for State Medicaid Agencies: Revalidation (2016-001). https://www.medicaid.gov/sites/default/files/2019-12/revalidation-2016-001.pdf

• Centers for Medicare & Medicaid Services. Minimum Data Set 3.0 Resident Assessment Instrument Manual. https://www.cms.gov/medicare/quality/nursing-home-improvement/resident-assessment-instrument-manual

• U.S. Social Security Administration. Social Security Act, Section 1128J, Medicare and Medicaid Program Integrity Provisions. https://www.ssa.gov/OP_Home/ssact/title11/1128J.htm

• U.S. Department of Health and Human Services, Office of Inspector General. Exclusions Program. https://oig.hhs.gov/exclusions/

• U.S. Department of Health and Human Services, Office of Inspector General. Medicaid Fraud Control Units. https://oig.hhs.gov/fraud/medicaid-fraud-control-units-mfcu/

• Minnesota Department of Health. Case Mix Review Frequently Asked Questions. https://www.health.mn.gov/facilities/regulation/casemix/faq.html