By Eldar Murtazaev, Legal Department, WCH
What New York’s OMIG audit protocols and published findings reveal about Medicaid billing risks—and how providers and billing companies can respond before an error spreads.
A hospital bills Medicaid separately for an emergency room visit, even though the patient is admitted as an inpatient that same day and the inpatient rate already covers the service. The additional claim creates an improper payment.
This is not a hypothetical scenario. In its April 16, 2026, final audit report for Brookdale Hospital Medical Center, New York’s Office of the Medicaid Inspector General (OMIG) identified $6,422.29 in overpayments associated with clinic and emergency room services, laboratory tests, and other ordered ambulatory services billed separately even though they were included in the inpatient rate. With $1,423.15 in interest, the total amount due was $7,845.44.
The report illustrates a billing problem with a clear financial consequence. For providers, the next question is whether the same billing practice affected other claims. For billing companies, it raises a practical issue: what controls are in place to catch a claim that conflicts with the payment rules for the same episode of care?
OMIG’s audit protocols provide a starting point for that review. Its published audit findings show how failures in billing, documentation, and other program requirements can result in disallowances and recoveries.
What OMIG Audit Protocols Tell Providers
OMIG publishes audit protocols for specific Medicaid fee-for-service provider and service categories. These documents summarize the criteria used to assess compliance with applicable program requirements. They help providers understand what an audit may examine, but they do not replace the underlying statutes, regulations, Medicaid manuals, or other controlling guidance.
The OMIG Audit Protocols page lists protocols for areas including diagnostic and treatment centers, hospital outpatient services, dental, durable medical equipment (DME), pharmacy, home care, transportation, behavioral health, and services for people with developmental disabilities. The agency also identifies protocols in development and provides publication dates and service-date ranges where applicable.
Providers should check the current listing before starting an internal review. The version of the protocol and the requirements in effect on the dates of service matter. The service-date range shown in a protocol does not, by itself, determine the scope of an individual audit. OMIG’s Audit Protocols FAQ explains that audits are generally limited to services furnished or billed, whichever is later, within the six years preceding OMIG’s notice of intent to audit. A longer period may be reviewed where fraud is involved.
The protocols should also be read alongside OMIG’s 2026 Work Plan. The Work Plan describes the agency’s broader program-integrity priorities; individual protocols set out criteria for particular service categories. The protocols are specifically used in audits of fee-for-service providers and service categories. Providers participating in managed care must also consider the requirements and review procedures applicable to their plans.
Where OMIG Is Focusing in 2026
The 2026 Work Plan identifies several areas of oversight relevant to providers and billing teams. Long-term care, home health and community-based services, behavioral health, direct medical care, pharmacy, transportation, and DME are among the areas addressed.
For direct medical care, OMIG describes reviews intended to validate services and confirm physician visits and orders in both fee-for-service and managed care environments. Its existing protocol areas include diagnostic and treatment centers and hospital outpatient departments. Physician Services and Independent Laboratories are listed as areas targeted for protocol publication in 2026; this is a publication target, not confirmation that those protocols have been finalized.
OMIG also anticipates completing approximately 200 compliance program reviews in 2026. Reviews initiated after July 1, 2025, use a 12-month review period rather than the three-month period used previously. These reviews assess whether required providers’ compliance programs meet regulatory requirements and identify risks that need attention.
Several other initiatives have direct billing implications. OMIG plans to continue audits involving pharmacy claims for controlled substances, non-emergency transportation, DME, and payments to unenrolled or excluded providers. The agency also plans system-match audits to identify fee-for-service claims and managed care encounters for clinic, emergency room, laboratory, and other ordered ambulatory services billed during an inpatient stay when those services were already covered by the hospital’s all-inclusive rate.
That last initiative connects directly to the Brookdale findings discussed below. It also shows why providers should not assume that a billing issue identified in one audit is relevant only to the provider named in the report.
These are stated program priorities, not evidence that every category has the same error rate. Providers should identify the priorities relevant to their services and then examine the applicable protocol and program rules.
What Published Audit Findings Show
The Brookdale report is one example of a billing error with a direct payment consequence. OMIG reviewed claims for clinic, emergency room, and ancillary services billed during inpatient hospital stays from January 1, 2020, through December 31, 2024. The agency found that services already included in the inpatient rate had also been billed separately.
The report identified $6,022.05 in clinic and emergency room overpayments, $16.76 in laboratory overpayments, and $383.48 in other ordered ambulatory service overpayments. Together, these amounts total $6,422.29. Interest of $1,423.15 brought the total amount due to $7,845.44. Brookdale agreed with the draft audit findings, according to the final report.
A different example comes from OMIG’s June 2025 final audit report for The Eliot at Catskill LLC, an Assisted Living Program provider. OMIG reviewed a random sample of 100 claims and identified 46 claims with at least one error. The findings included 22 instances in which annual performance evaluations had not been documented, 15 instances involving missing documentation of required in-service training for personal care aides, six involving missing tuberculosis testing or follow-up documentation, four involving plans of care that had not been updated as required, and two involving missing service documentation.
These findings concern a specific provider and audit sample; they should not be presented as statewide error rates. They nevertheless illustrate two distinct sources of compliance risk. Brookdale’s findings involved billing services separately when the inpatient payment already covered them. The Eliot at Catskill findings involved required staff, care-planning, and service records.
For providers, the distinction affects what needs to be tested. A billing review focused only on codes and units may not detect missing personnel evaluations or outdated plans of care. Conversely, complete documentation does not make a separately billed service payable if the applicable rate already includes it.
The relevant protocol and program rules determine which checks are necessary for each service category.
When One Error May Indicate a Wider Problem
Consider a claim that includes more units than the clinical record supports. The provider should compare the submitted claim with the contemporaneous documentation, identify the applicable requirement, and determine whether the payment exceeded the amount supported by that requirement.
The next step is to establish whether the same cause could have affected other claims. If units were entered manually, examine claims processed through the same workflow. If a system populated the units automatically, test claims using the same configuration. If the issue involves missing documentation, determine whether records for other dates of service can be retrieved.
The review should follow the evidence. An isolated entry error may call for a limited correction and a check that the error has not recurred. Similar discrepancies across multiple claims may indicate a broader process failure and justify expanding the review.
The same approach applies to duplicate billing. If a hospital discovers that clinic or emergency room services were separately billed for patients admitted as inpatients on the same day, the review should determine whether the same billing logic affected other encounters. The relevant dates, claim types, and payment rules should guide the selection of claims to examine.
Billing companies can help identify patterns in the claims they process, but they may not have access to all clinical records or authority to determine whether a service met every program requirement. Providers and billing companies should establish who will obtain the supporting documentation, investigate the cause, quantify any overpayment, and document the findings.
The review should leave a record of the claims examined, the criteria tested, the exceptions found, and the rationale for the scope of the investigation. If a workflow or system control changes, a follow-up sample should establish whether the change has prevented the same error from recurring.
When the Review Identifies an Overpayment
A billing discrepancy does not automatically establish an overpayment. The provider must determine what happened, apply the relevant requirements, and establish whether Medicaid paid more than it should have.
When an overpayment is identified, OMIG’s Self-Disclosure Frequently Asked Questions states that Medicaid entities and providers must report, return, and explain identified overpayments within 60 days of identification or by the due date of the corresponding cost report, whichever is later. Voiding or adjusting a claim alone does not satisfy the obligation to report and explain the overpayment.
OMIG’s Full and Abbreviated Self-Disclosure processes serve different purposes. The abbreviated process may be appropriate for qualifying routine or transactional errors that have already been voided or adjusted. Systemic billing or claim-processing issues, documentation errors resulting in overpayments, and matters requiring a formal corrective action plan are among the examples OMIG identifies for the full process. Providers should consult the current Self-Disclosure Guidance to determine the appropriate route.
Managed care overpayments follow the applicable plan’s procedures. Network providers should disclose identified overpayments to their managed care plan in accordance with its requirements rather than assume that the fee-for-service process applies unchanged.
Records management creates a separate compliance obligation. Under OMIG’s 2026 Work Plan, providers that discover their Medicaid records have been damaged, lost or destroyed must report the circumstances to OMIG as soon as practicable and no later than 30 days after discovery. The agency’s Self-Disclosure Guidance explains the reporting process.
A missing record does not necessarily establish that a service was never delivered. It can, however, leave the provider unable to substantiate a claim under the applicable requirements. Providers should therefore test whether required records can be retrieved and whether their retention procedures meet Medicaid requirements.
Put the Protocol to Work Before an Audit
An internal review should begin with the protocol and requirements applicable to the services being examined. The provider identifies the claims to test, verifies the relevant billing and documentation elements, records exceptions, and investigates whether they share a cause.
The review should also identify who is responsible for corrective action and how its effectiveness will be tested. If an overpayment is found, the provider must assess the amount involved and follow the applicable reporting requirements.
OMIG’s protocols cannot predict every question an auditor will ask. They can give providers and billing companies a defined basis for checking whether claims are supported, payment rules have been followed, and internal controls are working. When one claim fails that test, the task is to establish whether the error is isolated or whether the same process has affected other payments.
Sources
- New York State Office of the Medicaid Inspector General (OMIG). Audit Protocols. Published protocols, service-date ranges and protocols in development.
- OMIG. Audit Protocols Frequently Asked Questions. Protocol purpose and general audit look-back period.
- OMIG. 2026 Work Plan. Program-integrity priorities, compliance program reviews and provider oversight activities.
- OMIG. Final Audit Report, Audit No. 2025Z01-047M: Brookdale Hospital Medical Center. April 16, 2026; clinic, emergency room and ancillary services billed during inpatient stays.
- OMIG. Final Audit Report, Audit No. 23-1872: The Eliot at Catskill LLC. June 26, 2025; Assisted Living Program services and related documentation findings.
- OMIG. Self-Disclosure Guidance. Overpayment disclosure and damaged, lost or destroyed records.
- OMIG. Self-Disclosure Frequently Asked Questions. Reporting deadlines, disclosure processes and managed care overpayments.
Discover more from Doctor Trusted
Subscribe to get the latest posts sent to your email.
