Preparing for an HHS-OIG Audit of Your Organization: A Provider Compliance Review Playbook

The HHS Office of Inspector General, or OIG, is the independent oversight agency for the U.S. Department of Health and Human Services. Through its Office of Audit Services, OIG audits Medicare and Medicaid payments to providers to determine whether they complied with federal requirements. OIG's provider compliance audits often review a statistical sample of claims, estimate overpayments across a larger population, and recommend that the provider refund the estimated overpayment, conduct additional internal audits, and strengthen its controls.

OIG audits are different from routine Medicare contractor reviews. They are conducted under generally accepted government auditing standards, result in public reports, and can lead to significant repayment recommendations. In the current enforcement environment, in which federal agencies are expanding data analytics and coordination to address fraud, waste, and abuse, being prepared for an OIG audit is an important part of any compliance program.

This playbook explains how OIG provider audits work, what to expect at each stage, how to prepare your organization, how to respond to the draft report, and what happens after the final report. It is educational and not legal advice. Organizations facing an OIG audit should consider involving experienced legal counsel and compliance advisors.

What Is HHS-OIG?

OIG's mission is carried out through audits, investigations, evaluations, and inspections conducted by components that include the Office of Audit Services, the Office of Evaluation and Inspections, and the Office of Investigations. CMS's Program Integrity Manual describes OIG as investigating suspected fraud or abuse and performing audits and inspections of CMS programs, and notes that OIG's Office of Investigations is staffed with professional criminal investigators responsible for HHS criminal investigations, including Medicare fraud.

This playbook focuses on OIG audits conducted by the Office of Audit Services. If an organization is contacted by OIG's Office of Investigations, that may indicate a different type of inquiry, and legal counsel should be involved immediately.

Types of OIG Audits Providers May Encounter

Provider Compliance Audits

OIG conducts audits of individual providers to determine whether they complied with Medicare billing requirements. For example, OIG has published a series of Medicare home health agency provider compliance audits. In one such audit, OIG recommended that the agency refund identified overpayments, consider conducting additional audits or investigations to identify similar overpayments and return them, and strengthen its review processes to improve compliance with Medicare billing requirements.

Service-Specific Audits

OIG audits may review payments for a particular service, such as outpatient drug billing, inpatient stays, or specific procedures, across one or more providers.

Audits of Contractors and States

OIG also audits Medicare contractors, state Medicaid agencies, and other entities. These audits may involve requests for information from providers whose claims are included.

OIG Work Plan

OIG publishes information about its planned and ongoing work. Reviewing OIG's work planning materials, reports, and featured topics helps providers anticipate areas of focus for their service types.

The OIG Audit Lifecycle

While each audit is different, OIG provider audits generally follow a similar process.

1. Audit Start Notice

The organization receives notice that OIG is beginning an audit. The notice typically describes the audit's objective, scope, and time period, and identifies OIG contacts.

2. Entrance Conference

OIG usually holds an entrance conference to discuss the audit's scope, objectives, timeline, data needs, and points of contact. HHS training materials describe the entrance conference as the point at which OIG discusses the scope of the audit and designates key points of contact.

3. Data Requests and Fieldwork

OIG requests data and documents, such as claims data, medical records, policies, and other information. OIG may review records remotely or on-site, and may interview staff about processes.

4. Sampling and Review

OIG provider compliance audits often select a statistical sample of claims from a defined population. OIG reviews the sampled claims, often with assistance from medical review contractors, and determines whether each claim complied with Medicare requirements.

5. Estimation

When OIG uses statistical sampling, it may estimate total overpayments for the full population of claims based on the sample results. OIG reports typically describe the statistical sampling and estimation methodology in an appendix.

6. Exit Conference or Findings Discussion

OIG generally discusses preliminary findings with the organization before issuing a draft report. This is an important opportunity to clarify facts and provide additional information.

7. Draft Report

OIG issues a draft report with findings and recommendations. HHS training materials note that, for OIG's Office of Audit Services, there is no preliminary draft report, and the auditee typically has 30 days to respond to the draft report.

8. Written Comments

The organization submits written comments on the draft report. OIG reports commonly include the auditee's comments in their entirety as an appendix, along with OIG's response.

9. Final Report

OIG issues the final report, which is generally made public on OIG's website. OIG final report transmittal letters have historically stated that the HHS action official will make the final determination as to actions taken on all matters reported and have requested that the auditee respond to the action official within 30 days.

10. Resolution and Recovery

For Medicare provider audits, the Medicare Administrative Contractor generally acts on OIG's recommendations, including recovering overpayments. HHS training materials describe a resolution stage following the final report, during which the responsible agency addresses OIG's recommendations.

Common OIG Recommendations

Based on published OIG provider compliance audits, common recommendations include:

• Refund identified or estimated overpayments to the Medicare program.

• Exercise reasonable diligence, or conduct additional internal audits or investigations, to identify and return similar overpayments outside the audit period, consistent with the 60-day overpayment rule.

• Strengthen policies, procedures, and internal controls to ensure compliance with Medicare requirements.

OIG reports also commonly note whether the auditee concurred with the recommendations and summarize corrective actions the auditee has taken.

Preparing for an OIG Audit: The Playbook

Phase 1: Immediately After the Audit Notice

• Notify leadership and the compliance officer. Make sure senior leadership and the governing body are informed.

• Consider engaging experienced counsel. Counsel can help evaluate risks, manage privilege, and coordinate communications.

• Designate an audit liaison. Choose one person to coordinate all communications with OIG and track requests and deadlines.

• Issue a legal hold. Preserve all records relevant to the audit period and scope, including electronic data.

• Assemble an internal team. Include compliance, billing, clinical, health information management, information technology, and finance staff.

Phase 2: Preparing for the Entrance Conference

• Review the audit notice carefully to understand the objective, scope, and period.

• Prepare a brief overview of your organization, services, billing processes, and compliance program.

• Prepare questions about the audit approach, sampling, timelines, data formats, and how records should be submitted.

• Confirm points of contact and communication methods.

• Document everything discussed.

Phase 3: Responding to Data and Document Requests

• Track every request in a log with due dates and responsible staff.

• Provide accurate, complete data in the requested format.

• Review medical records for completeness, legibility, and correct patient identification before submission.

• Include all relevant documentation, such as orders, certifications, plans of care, and progress notes.

• Never alter or backdate records.

• Keep exact copies of everything provided.

• Request clarification or extensions in writing when needed.

Phase 4: Conducting a Parallel Internal Review

Under counsel's direction, consider reviewing the same sampled claims internally. A parallel review helps you:

• Anticipate OIG's findings.

• Identify claims where documentation supports compliance and prepare explanations.

• Identify genuine errors and begin corrective action early.

• Evaluate the sampling and estimation methodology, possibly with a qualified statistician.

Phase 5: The Findings Discussion

• Review OIG's preliminary findings claim by claim.

• Provide additional documentation or explanations where appropriate, using records that existed at the time of service.

• Ask OIG to explain the basis for any finding you do not understand.

• Note any disagreements and supporting evidence.

Phase 6: Responding to the Draft Report

The written response to the draft report is your primary opportunity to present your position in the public record.

• Calendar the response deadline, generally 30 days.

• Address each recommendation clearly, stating whether you concur, partially concur, or do not concur.

• Focus on the recommendations and the facts, and avoid overpromising. HHS training materials advise responding to the recommendations rather than arguing every finding, and caution that responses can appear defensive.

• Support any disagreements with specific evidence and policy references.

• Describe corrective actions already taken or planned.

• If you disagree with the statistical methodology, explain why, ideally with support from a qualified statistician.

• Remember that your comments will likely be published with the final report.

Phase 7: After the Final Report

• Review the final report and OIG's response to your comments.

• Prepare for MAC overpayment actions and calendar appeal deadlines.

• Consider appeal options for overpayment determinations, including challenges to extrapolation, through the Medicare fee-for-service appeals process.

• Implement corrective actions and document them.

• Address OIG's recommendation to look for similar overpayments outside the audit period, consistent with 42 CFR 401.305.

• Report results to leadership and the governing body.

Understanding Statistical Sampling and Estimation

Many OIG provider compliance audits rely on statistical sampling. Understanding the basics helps organizations evaluate findings and prepare responses.

How Sampling Works

OIG typically defines a sampling frame, which is the population of claims within the audit scope, such as all claims for a particular service during a specific period. It then selects a random sample from that frame. OIG reviews each sampled claim and determines whether it was paid correctly.

How Estimation Works

Based on the sample results, OIG may estimate the total overpayment in the full population. OIG reports commonly describe their sampling plan, sample size, sample results, and estimation methodology in appendices, and may recommend refunding an amount based on the lower limit of a confidence interval.

Why It Matters

Because estimation projects sample errors to a much larger population, even a small number of sampled errors can produce a significant estimated overpayment. Organizations should:

• Review the sampling frame to make sure it includes only claims within scope.

• Review each sampled claim finding carefully, because overturning even one error can affect the estimate.

• Consider engaging a qualified statistician to review the methodology.

• Keep in mind that sampling and estimation can be challenged through the Medicare appeals process when the MAC issues an overpayment demand.

Defining Roles and Responsibilities

A clear structure helps organizations respond efficiently and consistently. A typical OIG audit response team might include:

• Executive sponsor: A senior leader who oversees the response and keeps the governing body informed.

• Compliance officer: Coordinates the overall response, ensures compliance obligations are met, and documents corrective actions.

• Legal counsel: Advises on legal risks, privilege, communications, and the draft report response.

• Audit liaison: Serves as the single point of contact with OIG and manages the request log and deadlines.

• Billing and coding lead: Explains billing processes and reviews coding findings.

• Clinical lead: Explains clinical documentation practices and reviews medical necessity findings.

• Health information management lead: Retrieves and prepares medical records.

• Information technology lead: Supports data extraction and records preservation.

• Finance lead: Evaluates financial impact and prepares for potential repayment.

A Sample Internal OIG Audit Response Protocol

Organizations can adopt a written protocol so that everyone knows what to do when an OIG audit notice arrives. A sample protocol might include:

1. Any staff member who receives an OIG communication forwards it immediately to the compliance officer.

2. The compliance officer notifies leadership and legal counsel within one business day.

3. Legal counsel and the compliance officer determine whether the contact is an audit, an investigation, or another type of inquiry.

4. A legal hold is issued for records within the audit scope.

5. An audit liaison is designated and introduced to OIG.

6. The response team is assembled and meets regularly throughout the audit.

7. All requests, submissions, and communications are logged.

8. All submissions are reviewed for accuracy and completeness before release.

9. A parallel internal review is conducted under counsel's direction.

10. The draft report response is prepared by the team, reviewed by counsel, and approved by leadership.

11. Corrective actions are assigned, tracked, and reported to the governing body.

12. After the audit, the team conducts a lessons-learned review and updates the protocol.

Communicating With OIG Auditors

Professional, accurate, and timely communication helps the audit proceed smoothly. Practical tips include:

• Route all communications through the audit liaison.

• Confirm verbal requests in writing.

• Answer questions accurately, and if you do not know an answer, say so and follow up.

• Do not speculate or offer opinions beyond the facts.

• Request extensions in writing before deadlines, explaining the reason.

• Keep copies of all correspondence.

Appealing Overpayments Arising From OIG Audits

When a MAC issues an overpayment demand based on an OIG audit, providers generally may appeal through the Medicare fee-for-service appeals process:

• Redetermination by the MAC, generally within 120 days.

• Reconsideration by a Qualified Independent Contractor, generally within 180 days of the redetermination decision.

• Administrative Law Judge hearing, generally within 60 days of the reconsideration decision.

• Medicare Appeals Council review.

• Judicial review in federal district court.

Under 42 CFR 405.379, filing a redetermination within 30 days of the demand letter, and a reconsideration within 60 days of the redetermination decision, can limit recoupment during those appeals. Providers can challenge both claim-level findings and statistical sampling and extrapolation methodologies.

How OIG Audits Connect to Broader Compliance Risks

An OIG audit can have consequences beyond the immediate refund:

• The 60-day overpayment rule. Audit findings may provide credible information that similar overpayments exist outside the audit period. Under 42 CFR 401.305, an identified overpayment must be reported and returned within the required timeframe, subject to suspension for a timely, good-faith investigation of related overpayments.

• False Claims Act exposure. Retaining identified overpayments past the deadline can create False Claims Act liability.

• Further review. Findings may lead to additional reviews by MACs, UPICs, or other contractors.

• Public reports. OIG final reports are generally published, which may affect reputation and attract attention from other parties.

Building OIG Audit Readiness Into Your Compliance Program

HHS-OIG's General Compliance Program Guidance describes the elements of an effective compliance program, including risk assessment, auditing, and monitoring. Practical steps include:

• Review OIG reports, featured topics, and work planning materials for your service types each year.

• Incorporate OIG focus areas into your annual risk assessment and audit plan.

• Conduct internal audits using approaches similar to OIG's, including statistically valid sampling where appropriate.

• Maintain strong records management and retention practices.

• Adopt a written protocol for responding to OIG audits and other government inquiries.

• Train leadership on the audit process and the importance of accurate, timely responses.

• Document your compliance program's activities so you can demonstrate them if asked.

Common Mistakes to Avoid

• Treating an OIG audit like a routine contractor request.

• Failing to designate a single liaison.

• Missing data request deadlines.

• Submitting incomplete or disorganized records.

• Altering records.

• Waiting for the draft report to begin internal review.

• Writing a defensive response that argues every finding without addressing recommendations.

• Ignoring the recommendation to identify similar overpayments.

• Failing to calendar appeal deadlines after the final report.

Frequently Asked Questions

How do I know if an OIG contact is an audit or an investigation?

OIG audits are conducted by the Office of Audit Services and typically begin with an audit notice and entrance conference. Contact from OIG's Office of Investigations may indicate a different type of inquiry, and legal counsel should be involved immediately.

How long do I have to respond to an OIG draft report?

HHS training materials indicate that auditees generally have 30 days to respond to an Office of Audit Services draft report. Follow the deadline stated in the transmittal.

Will my response be published?

OIG reports commonly include the auditee's written comments, often in their entirety, as an appendix to the final report.

Who collects overpayments identified by OIG?

For Medicare provider audits, the Medicare Administrative Contractor generally acts on OIG's recommendations and recovers overpayments.

Can I appeal an OIG-related overpayment?

Yes. Overpayment determinations issued by the MAC based on OIG findings can generally be appealed through the Medicare fee-for-service appeals process.

Should we conduct our own review of the sampled claims?

Many organizations conduct a parallel internal review, often under the direction of legal counsel. This helps them anticipate findings, prepare explanations, and start corrective actions early.

Can we challenge OIG's statistical estimate?

When the MAC issues an overpayment demand based on an OIG audit, providers can generally challenge both claim-level findings and the sampling and estimation methodology through the Medicare appeals process.

Conclusion

An HHS-OIG audit is a formal, structured review with potentially significant financial and reputational consequences. Organizations that prepare by designating a liaison, engaging counsel when appropriate, preserving records, responding accurately and on time, conducting a parallel internal review, writing a thoughtful response to the draft report, and following through on corrective actions and overpayment obligations are best positioned to manage the process. Building OIG audit readiness into the compliance program, by monitoring OIG work, auditing high-risk areas, and documenting compliance activities, makes the process far more manageable when an audit notice arrives.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance program development, internal auditing, and government audit readiness. We help organizations prepare for OIG audits, organize data and records, conduct parallel internal reviews, evaluate findings, support draft report responses in coordination with legal counsel, and implement corrective actions. If your organization has received an OIG audit notice or wants to be prepared, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. Medicare Home Health Agency Provider Compliance Audit: VNA Care Network (A-05-22-00016). https://oig.hhs.gov/documents/audit/11254/A-05-22-00016.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Review of Medicare Outpatient Billing for Selected Drugs at Community Hospital of San Bernardino (A-09-11-02069). https://oig.hhs.gov/documents/audit/9304/A-09-11-02069-Complete%20Report.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Audit Report A-05-23-00005 (September 2024). https://oig.hhs.gov/documents/audit/9997/A-05-23-00005.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Audit Report A-07-04-01011. https://oig.hhs.gov/documents/audit/5169/A-07-04-01011-Complete%20Report.pdf

• U.S. Department of Health and Human Services, Administration for Children and Families. Navigating Audits and Investigations with the HHS Office of Inspector General. https://eclkc.ohs.acf.hhs.gov/video/navigating-audits-investigations-hhs-office-inspector-general

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Spring 2026 Semiannual Report to Congress. https://oig.hhs.gov/documents/sar/11794/Spring_2026_SAR.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Hospice Featured Topic. https://oig.hhs.gov/reports/featured/hospice/

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Exhibits. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83exhibitspdf.pdf

• Centers for Medicare & Medicaid Services. Original Medicare (Fee-for-Service) Appeals. https://www.cms.gov/medicare/appeals-grievances/fee-for-service

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• Electronic Code of Federal Regulations. 42 CFR 405.379, Limitation on Recoupment of Provider and Supplier Overpayments. https://www.ecfr.gov/current/title-42/section-405.379

• U.S. Social Security Administration. Social Security Act, Section 1893, Medicare Integrity Program. https://www.ssa.gov/OP_Home/ssact/title18/1893.htm