Understanding the CMS Payment Error Rate Measurement (PERM) Audit System

The Payment Error Rate Measurement (PERM) system is a program run by the Centers for Medicare and Medicaid Services (CMS) that assesses the accuracy of payments made under Medicaid and the Children's Health Insurance Program (CHIP). The goal is to identify improper payments—whether due to administrative errors, provider noncompliance, or insufficient documentation—and ensure that federal funds are used appropriately. The PERM system is unique from other healthcare audits because it focuses solely on the Medicaid and CHIP programs.

CMS created PERM as a result of the Payment Integrity Information Act (PIIA) of 2019, which required federal agencies to review their finances in search of improper payments and submit a report to Congress on their findings. The federal Office of Management and Budget (OMB) identified Medicaid and CHIP as programs particularly vulnerable to “significant improper payments.” Note that these payments do not imply fraudulent activity. They simply indicate a payment did not meet CMS requirements for coverage.

PERM measures improper payments across three main components:

1. Fee-for-Service (FFS) Payments: Examines claims submitted for services reimbursed on a fee-for-service basis.
2. Managed Care Payments: Evaluates capitation payments made to managed care organizations.
3. Eligibility Determinations: Assesses whether Medicaid and CHIP enrollees meet the required eligibility criteria.

Auditors search for errors related to these components. Common errors that constitute an improper payment include: 

1. Lack of screening: Providers did not undertake required, risk-based screening as part of their Medicaid contract setup. 
2. Improper documentation: Providers did not create (or provide to an auditor) all documentation required to support a claim.
3. Unnecessary expenditures: Providers received a payment that simply did not comply with regulations. This includes any incorrect payments, even if the patient’s total bill is technically correct. 

If any errors are found, the state must repay any overpayments and develop a corrective action plan, shared with CMS, to reduce future instances of noncompliance.

The good news is the PERM system is working demonstrably well. At its start in 2019, CMS identified $57.36 billion in improper payments, at an error rate of 14.9%. Errors peaked (alongside the COVID-19 pandemic) in 2021 at $98.72 billion in improper payments and an error rate of 21.69%. The latest data, as of 2024, shows improper payments down to $31.10 billion at only a 5.09% error rate. 

Any type of audit can be a major undertaking for hospitals, but PERM does offer benefits for both CMS and providers. CMS can double-check payments for accuracy, and providers are able to get a better understanding of their operational efficiencies and any issues regarding their compliance with Medicaid and CHIP rules. It’s always better to identify problems sooner than later and implement a corrective action plan (rather than face hefty fines) if the issue progresses. 

How PERM Audits Work

Every three years, CMS selects a sample of around 33% of states for PERM audits, during which claims are reviewed to determine if payments were made correctly according to federal and state requirements. Spreading out audits in this way means the system is not overwhelmed, and each sample of states begins audits at a different time. Each state is reviewed once every three years by a contracted auditor. As of writing, EmpowerAI is the official PERM auditor for CMS. 

To kick off a PERM cycle, an auditor from the contracted company will gather information to learn everything they can about how a state is applying its Medicaid programs. Then, that contractor will send audit request letters to a selection of providers of all sizes to obtain selected Medicaid- or CHIP-related medical records for review. The auditor will search for errors within these claims and assess their findings. 

Most states provide their own PERM resources to assist providers with compliance. These site pages include an overview of the program and a timeline giving providers advance notice of when they may receive a PERM audit letter. 

When is the Next PERM Cycle?

The next PERM cycle kicks off April 1, 2025 for Alabama, California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, and West Virginia. Providers in these states could receive documentation request letters as early as April.

Between April 1, 2025, and April 15, 2026, PERM auditors will send medical record requests to review claims submitted between July 1, 2024, and June 30, 2025. Audited providers will have 75 calendar days to respond to these requests. 

How Providers Can Prepare and Comply with PERM

As with any audit, providers should work to minimize errors and ensure compliance with PERM. This may involve taking one or more of the following steps:

1. Strengthen Documentation & Coding Practices

If selected for a PERM audit, hospitals must provide the requested documentation within strict timeframes. Incomplete or inaccurate documentation is one of the primary causes of improper payments. Hospitals should develop internal protocols to ensure claims are coded correctly, audits are handled properly, and documents are accurate and up to date. 

2. Stay Informed on PERM Changes and State Requirements

Medicaid and CHIP regulations can change frequently, impacting PERM requirements. Providers should subscribe to CMS updates and state Medicaid agency communications and participate in PERM-related webinars and training sessions whenever possible. It can help to designate a compliance officer or team to stay updated on policy changes.

3. Implement Internal Compliance Audits

Routine internal audits can help identify risks before they lead to PERM-related issues. Providers should regularly review a sample of claims to assess compliance with Medicaid and CHIP requirements and create a standardized process for reviewing and correcting errors.

Using myesMD to Simplify PERM Audits

Responding to an audit means pulling records, reviewing documentation, and sending a response, all while managing audit timelines. The entire process costs providers time and money. The faster and more accurate an audit response, the better. 

Many providers submit documentation by mail or through the PowerAI Portal. However, it’s much more convenient to use an online portal like myesMD.com. myesMD.com is an easy-to-use online portal allowing for rapid and secure documentation submission to CMS-approved contractors, like those that conduct PERM audits. The subscription-based service is provided in tiers to meet the needs of providers of all sizes. 

myesMD.com offers the following benefits: 

• Multi-use: myesMD.com can streamline all CMS audit processes, not just PERM. It’s a portal to multiple different contractors, meaning your audit response team needs to use just one portal rather than managing multiple contractor websites.
• Enterprise-grade security: The platform was built with security and HIPPA compliance in mind by a certified Health Information Handler (HIH). Patient privacy is integral to the myesMD.com platform, which has been vetted by CMS. 
• Status updates: When uploading documentation, myesMD.com provides feedback, including digital receipts when the contractor receives each document. 
• Subscription-based: myesMD.com is easy to sign up and the monthly cost is predictable. The Community Tier is free for individual providers to use!

As CMS continues to refine its oversight of Medicaid and CHIP payments, hospitals must remain diligent in their compliance efforts. Leveraging technology and best practices in revenue cycle management can go a long way in reducing payment errors and maintaining financial stability in an increasingly complex healthcare environment.

If your hospital is located in a PERM Cycle 2 State, you may receive an audit request letter as early as April. Now is the time to evaluate internal processes and prepare. myesMD.com makes it easier for audit response teams to successfully navigate audit requirements and safeguard their reimbursement processes. 

Learn more about myesMD.com and try it for free here.