If you received a letter from a State Medicaid Integrity Contractor (SMIC)—a private firm hired by the state to audit claims—or a direct inquiry from the Centers for Medicare & Medicaid Services (CMS), the phrase “medically unnecessary” can feel like a death sentence for your practice. In 2026, the environment for healthcare enforcement has shifted. Federal funding for state programs is increasingly tied to aggressive clawbacks and identified fraud metrics. This means states are under immense pressure to show results, and your billing data is their primary roadmap.
When provider under investigation Medicaid an auditor claims your services were not medically necessary, they are not necessarily saying the service didn't happen. They are saying that, based on their data sets, your practice is an outlier compared to your peers. Here is how to handle these inquiries without falling into the trap of over-complying or blindly "just cooperating" with requests that could undermine your legal position.
The 2026 Enforcement Climate: Why You Are Being Targeted
We are currently seeing an escalation in Medicaid fraud enforcement driven by federal funding leverage. The federal government has moved to a “pay-for-performance” model for state agencies. If a state cannot prove it is identifying and recovering significant overpayments, its future federal funding is jeopardized. This creates a downstream effect where SMICs and other auditors are incentivized to move faster and cast wider nets.
Most of these investigations are triggered by CMS data analytics. These systems aggregate billing codes from across the country to create “billing anomaly flags.” If your utilization of a specific CPT (Current Procedural Terminology) code is 20% higher than the state average, you are flagged. It is not an investigation into your clinical judgment—yet. It is a statistical outlier flag.
Understanding the "Medical Necessity Defense"
A medical necessity defense is not about proving the patient was sick; it is about proving that your clinical rationale documentation justifies the intensity and frequency of the service provided. Auditors use standardized guidelines (like Local Coverage Determinations or LCDs). If your notes do not explicitly link the patient’s symptoms to the requirements of the code, the auditor will default to “not medically necessary.”
The Danger of "Just Cooperating"
You will often hear well-meaning consultants tell you to “just cooperate” to make the audit go away. This is dangerous advice. If you submit a disorganized mountain of EMR (Electronic Medical Record) notes without context, you are handing the auditor the tools to deny your claims. Providing "too much" irrelevant data can highlight anomalies you didn't even know existed. Cooperation must be strategic, controlled, and precise.
Steps for a Strategic Utilization Review Response
When you receive an inquiry, your first response is critical. Before you send a single document, follow these steps:
Verify the Authority: Determine if the letter is from a state agency or a federal contractor. The authority they hold dictates the scope of their inquiry. Isolate the Sample: Never provide the entire patient file if only a specific code or date range is in question. Curate the response to the specific claims flagged. Draft a "Clinical Narrative": Do not rely on the medical record to “speak for itself.” Write a brief, professional cover letter that summarizes the clinical rationale for the treatments in question. Challenge Data Accuracy: If your billing looks like an outlier, ask yourself: Is the data flawed? Are the codes being compared to clinics that provide completely different services? You have the right to dispute the peer group used for the comparison.Concrete Example: The Wound Care Clinic Scenario
Let’s look at a real-world scenario. A specialized wound care clinic was flagged for “excessive frequency of debridement services.” The auditors compared the clinic’s billing to general practitioners who occasionally perform minor skin excisions. Naturally, the specialized clinic looked like an outlier.
Instead of just sending hundreds of files, the clinic’s compliance officer submitted a brief, two-page summary explaining that their patient base was restricted to diabetic ulcers with specific severity scores. They included a table showing that, within the subset of patients with high-severity ulcers, their billing frequency was actually below the regional average for specialized centers. The audit was scaled back significantly because the clinic forced the auditor to reconcile the data against a valid peer group rather than a generic one.
Checklist: Pre-Submission Audit Prep
Before you send any documentation to an investigator, check these five items:
- Is the NPI (National Provider Identifier) correct? Ensure the records correlate strictly to the provider identified in the audit letter. Are the clinical justifications highlighted? Do not assume the auditor will read through 50 pages of progress notes to find the one line justifying the service. Use highlighters or an index to point them exactly where they need to look. Did you remove PII (Personally Identifiable Information)? Only include the PII requested. Over-disclosing protected health information is a secondary liability. Is the response dated and tracked? Always use a method that provides a receipt of delivery. Have you consulted with counsel? If the potential repayment exceeds a certain threshold (typically $5,000–$10,000), internal billing staff should not manage this alone.
Common Audit Flags vs. Potential Rebuttals
The following table illustrates how to move from a reactive defensive posture to a proactive data-based rebuttal.
Audit Flag Type Auditor’s Assumption Your Data-Driven Rebuttal High-Volume CPT Coding "Provider is upcoding to maximize revenue." Provide documentation of patient acuity/severity scores. Statistical Outlier (Frequency) "Service is provided more than is medically necessary." Compare your patient demographic to the regional peer group. Incomplete EMR Notes "Treatment did not occur or was unmonitored." Provide objective clinical indicators (e.g., lab results, imaging) supporting the plan of care.Managing Payment Pauses and Deferrals
Sometimes, before an audit is even complete, you may face a payment pause or a reimbursement deferral. This is a common tactic used by state agencies to force a resolution. If this happens, your response must be immediate. You should formally request the specific regulatory basis for the hold. Most states are required to provide an informal dispute process. Do not let a payment pause sit for Visit website 60 days without a formal challenge; a silence during a payment pause is often interpreted by investigators as an admission of fault.
Conclusion: The "Fact-Checking" Mindset
Auditors are human, and their data systems are imperfect. When they tell you your billing is "medically unnecessary," treat it as a claim that needs evidence—not as a final verdict. By focusing on your clinical rationale, verifying the data benchmarks used against you, and refusing to hand over more data than is legally required, you can successfully navigate these inquiries. Enforcement may be escalating in 2026, but the requirement for investigators to provide a sound, fact-based rationale for their claims remains a fundamental protection for your practice.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Always consult with a qualified healthcare defense attorney regarding specific audit inquiries.