NOTE: This bulletin replaces the Maintaining Complete Medical Records and Updating Contact Information bulletin, published on October 5, 2021.
This bulletin notifies providers of the upcoming Reporting Year 2026 Payment Error Rate Measurement (PERM) audit. The audit will sample fee-for-service claims collected for a full year – July 1, 2024, through June 30, 2025.
PERM is an audit program developed and implemented by the Centers for Medicare & Medicaid Services (CMS) as required by the Improper Payments Information Act (IPIA) of 2002. The program is operating under the PERM final regulation published on July 5, 2017 (Federal Register 82 FR 31158). It is used nationwide to review beneficiary eligibility determinations and claims payments made by Medicaid programs to ensure that states only pay for appropriate claims. A national report is distributed outlining the various error rates among states.
The PERM audit is required by CMS every three years and North Carolina has participated in this review process since 2007. Previously, PERM cycles were based on the federal fiscal year (FFY), but CMS revised the 2020 PERM cycle from the FFY to the state fiscal year (SFY). In addition, CMS changed the PERM cycle name from Federal Year (FY), reflecting the audit period, to Reporting Year (RY), reflecting the date the final report would be issued). As such, North Carolina’s next PERM audit cycle will be the PERM RY 2026 cycle.
The North Carolina Department of Health and Human Services (DHHS), Division of Health Benefits (DHB) is reminding providers of their obligation under § 108C-11 to have all contact information current and 10A NCAC 22F.0107 maintain medical records and to supply records when requested. State and federal regulations require that North Carolina providers must keep and maintain medical records for 11 years for adults, and for records relating to minors, they must be kept until the patient has reached 30 years old. Providers are required to provide complete medical records for all Medicaid and CHIP recipients (see 45 CFR 164.530(j). Complete documentation must reflect the service provided, and who provided the service, and all additional details relevant to the service.
As stated in the NC DHHS Provider Administrative Participation Agreement, Section 5, the submission of the claim by the provider, the provider’s authorized representative, or the provider’s billing agent on behalf of the approved provider certifies that each service is documented in the provider’s files, and that documentation is available to the Department.
Regulations also require documentation for services provided to Medicaid recipients to be made available when requested (10A NCAC 22F.0107). These records must be supplied in a timely manner for audit or review when requested by a CMS contractor on behalf of DHHS.
PERM reviews eligibility determinations for Medicaid Direct, NC Medicaid Managed Care claims and this review will be completed by CMS and contracted vendors. NC Medicaid recently completed the RY 2023 PERM audit cycle, and the next audit cycle will end in RY 2026.
CMS contractors will be mailing medical record request letters to North Carolina’s providers identified in the claims sample from April 1, 2025, to April 15, 2026.
- Each provider is notified over a 90-day period in which records are requested for each claim reviewed in the sample.
- If multiple claims were chosen within the sample, it is required to submit all records requested for each claim that was reviewed.
- It is imperative and required that providers respond to requests from CMS for medical records within the first 90 days after receipt of their letter. If no records are received, a recoupment of federal funds will be required.
- Submitting the requested records as early as possible after receipt of the letter will also help eliminate administrative burden on providers.
A provider is not required to obtain patient authorization to respond to medical record requests for the PERM audit. CMS and its contractors comply with the Privacy Act and regulations. Section 1902(a) (27) of the Social Security Act and Code of Federal Regulation 42 C.F.R. 457.950 gives CMS authority to require providers to submit information regarding payments and claims as requested by the Secretary, state agency, or both.
CMS contracts with outside entities that assist with collecting and reviewing claims on behalf of CMS. Providers must comply with CMS’, or their contracted vendors request for medical records, and will not be paid additionally to provide copies of records.
North Carolina’s goal is to decrease our error rates with each PERM cycle review. Achieving this goal requires our providers to identify and implement any needed internal quality improvements. Provider quality improvements can be realized by committing to the following best practices:
- Ensuring adherence to both state and federal regulations, guidelines, and policies related to the service type;
- Ensuring service delivery is documented appropriately, as described in state and federal regulations and NC Medicaid’s clinical coverage policies;
- Providing complete and accurate medical record documentation to substantiate the audited claim:
- Documenting that there was medical necessity for the service provided; and
- Ensuring notations confirm that the service was provided as ordered.
- Ensuring that claims are correctly and accurately coded according to standardized coding guidelines;
- Sending all required documentation for the PERM audit as requested, prior to the deadline listed in the medical records request letter;
- Updating provider information within NCTracks whenever necessary (i.e. if a move to another location occurred, if phone number changed, etc.);
- Ensuring you can access all patient records for Medicaid beneficiaries during their retention period;
- Following up regularly with your corporate offices, if the medical records request is required to be sent to them, to ensure submission to CMS or their contracted vendor within a timely manner; and
- Ensuring all staff are aware of the need to comply with any records request received from CMS or their contracted vendor and NC DHHS.
By using these and other quality improvement practices, North Carolina will be able to reduce the number of errors and assist with mitigating provider abrasion caused by multiple records requests via mail, fax and phone, as well as possible recoupment of funds.
With Health Insurance Portability and Accountability Act (HIPAA) privacy laws, many providers are concerned about the validity of documentation requests. If you receive a request for records and are uncertain if the request is valid, please contact the North Carolina Office of Compliance and Program Integrity Unit.
For more information, visit the DHB Office of Compliance & Program Integrity webpage or the CMS PERM Provider webpage.
Contact
Compliance and Program Integrity, 919-268-6481