OLR Research Report

August 29, 2013




By: Katherine Dwyer, Legislative Analyst II

You asked (1) for information about the Medicaid provider audit process in Connecticut and (2) if Connecticut is the only state that uses extrapolation in its audits.


In 2012, the Legislative Program Review and Investigations Committee (PRI) published an in-depth examination of the Connecticut Medicaid provider audit process titled Medicaid: Improper Payments. It served as the source for most of the information in this report.

There are four different entities that conduct post-payment Medicaid audits to identify discrepancies and recoup overpayment costs: (1) the Department of Social Services (DSS) Audit Division, (2) Recovery Audit Contractors (RACs), (3) Medicaid Integrity Contractors (MICs), and (4) cost report auditing contractors.

As part of its statistical analysis, the DSS Audit Division uses provider claim samples to extrapolate (or project) the number of payment errors and the amount of overpayments to collect from audited providers. We were unable to confirm if the RACs or MICs also use this method. Since cost report auditors audit long-term care facilities instead of individual providers, they are not discussed in this report.

Of 18 states surveyed by the National Conference of State Legislatures (NCSL), 10, including Connecticut, Massachusetts, New Jersey, and New York, use extrapolation in their Medicaid provider audits. Seven, including New Hampshire, Pennsylvania, and Vermont, do not. Rhode Island intends to use extrapolation in future audits.


The DSS Audit Division is divided into a contract audit and provider audit unit. The director of Internal Audits heads the unit, which consists of four audit teams with one supervisor and three to eight staff members. A provider audit typically takes about 44 weeks to complete and involves the following steps:

1. Selection of Provider to Audit. The director of Internal Audits, in consultation with the director of Quality Assurance, determines which providers to audit based on several factors, including (a) the directors' experience, (b) national trends, and (c) the audits' potential dollar impact.

2. Audit Notice. DSS must give each provider selected for an audit at least 30 days' notice unless the agency makes a good faith determination that (a) a service recipient's health or safety is at risk or (b) the provider is engaging in vendor fraud.

3. Field Work. Auditors use interviews, observations, record examinations, and data analysis to conduct the audits, at least in part, at the provider's location. Providers have at least 30 days to provide documentation to refute any discrepancies. The audit typically spans the previous three years, although there is no statutory limitation on the length of the period reviewed.

4. Sample. Typically, the auditors use a sample of 100 claims from the providers to test procedures and perform extrapolations (discussed below). They will occasionally use larger samples for hospital audits.

5. Preliminary Report and Exit Conference. DSS must (a) produce a preliminary written report and give it to the provider within 60 days after the audit's conclusion and (b) hold an exit conference with the provider to discuss the report after it is issued.

6. Final Report. DSS must produce a final written report and give it to the provider within 60 days after the exit conference unless DSS and the provider agree to a later date.

7. Appeals. A provider may request a rehearing within 30 days after receiving the final report. An impartial DSS commissioner designee presides over such a hearing and issues a final report. The provider may appeal the final decision to the Superior Court.

For more information about the DSS Audit Division, see the PRI report, Appendix A.


DSS uses extrapolation to determine the number of payment errors and the amount of overpayments to collect from audited providers. It does not use extrapolation to penalize or fine providers. According to the PRI report:

Extrapolation is the practice of taking the results of a sample and applying it to a larger population and, in this case, for DSS the population is claims. In practice, extrapolation works by: (1) dividing the total number of payment errors found in a sample of claims by the sample size to arrive at average errors per sample and (2) multiplying this by the total number of claims to arrive at a presumed extrapolated number of payment errors for all payments to the provider during the audited period (p. A-3).

The law prohibits basing a finding of over- or underpayment to a provider on extrapolation unless (1) there is a sustained or high level of payment error involving the provider, (2) documented educational intervention has failed to correct the error, or (3) the value of the claims in the aggregate is more than $150,000 (CGS 17b-99(d)(3)). However, according to the PRI report, the majority of audits appear to qualify for extrapolation since they typically have annual paid claims over $150,000.

In 2008, the Connecticut Supreme Court upheld the legal validity of DSS' extrapolation use in Goldstar Medical Services, Inc. v. Department of Social Services (288 Conn. 790, 955 A.2d 15). Specifically, the Court held that extrapolation from statistical sampling could be used to determine the total amount of excess reimbursements that a Medicaid provider had received.

In 2010, the Legislature passed PA 10-116, which requires DSS to adopt regulations to ensure the fairness of the audit process, including the sampling methodologies associated with it. A public hearing on the proposed regulations was held on December 10, 2012 and, according to DSS, the Attorney General's Office is currently reviewing them.


Under the federal Affordable Care Act, states are required to contract with RACs to supplement their audit efforts. The RACs review claims to identify under and overpayments and recoup overpayments. Each state is required to pay RACs a contingency fee for each overpayment identified. Health Management Systems (HMS) is the RAC currently under contract with DSS. We asked HMS if it uses extrapolation in its audit process but we did not receive a response.

MICs contract with the federal Centers for Medicare and Medicaid Services (CMS) to, among other things, conduct post-payment Medicaid provider audits and identify overpayments. There are five regional MIC contractors in the country. Island Peer Review Organization (IPRO) is the MIC contractor for the region including Connecticut. We asked IPRO if it uses extrapolation in its audit process but we did not receive a response.

For more information about the RAC and MIC audit processes, see the PRI report, Appendix A.


If an auditor suspects that a Medicaid provider committed fraudulent or abusive practices, he or she generally refers the case to DSS' Special Investigations Unit which, after conducting its own review, may refer the case to the state's attorney's Medicaid Fraud Control Unit (MFCU), the Attorney General, and the federal Office of the Inspector General. The three agencies may also receive Medicaid fraud referrals from MFCUs in other states, other government and law enforcement agencies, whistleblowers, or members of the public.

Upon receiving a referral, each agency may then conduct its own investigation and, if warranted, pursue state or federal criminal or civil charges. In addition to recouping improper payments, such charges may result in criminal convictions, administrative sanctions, or civil monetary penalties.

For a more detailed discussion of the Medicaid fraud prosecution process, see the PRI report, Appendix E.


An NCSL 18-state survey revealed the following:

1. Connecticut, Iowa, Massachusetts, Nebraska, New Jersey, New York, North Carolina, Oklahoma, Oregon, and Washington all use extrapolation when performing Medicaid provider audits;

2. Delaware, Maryland, New Hampshire, Pennsylvania, Vermont, West Virginia, and Wisconsin do not use extrapolation for Medicaid provider audits; and

3. Rhode Island has not begun extrapolating claims yet, but plans to use the method selectively in the future.


Here is a link to the 2012 PRI report on Medicaid improper payments: http://www.cga.ct.gov/pri/docs/2012/Final_Full_Approved_Medicaid_Report.pdf