PERM is comprised of three review components: Data Processing (DP), Eligibility (ER), and Medical Records (MR). For DP review, the RC validates whether the state processed the claim correctly for fee-for-service (FFS). For Managed Care (MC), payments are reviewed to determine if the state accurately processed the capitation payment or premium. For ER reviews, the ERC focuses on whether a determination, redetermination, or change was processed by the state accurately and appropriately based upon relevant policy. MR review determines the medical appropriateness of the payment to the provider. The RC will request medical records from the provider for all sampled claims. MR reviews are conducted by federal RC contractor Empower, AI (formerly NCI, Inc).

Review results are sent to BMI-QC. Those results are then reviewed by a certified medical coder within the OIG Audit department or other qualified HFS staff.

PERM measures and reports an unbiased estimate for the true improper payment rate of Medicaid and CHIP. CMS, through their contractor, selects a statistically valid sample from the universe of claims to review and may extrapolate those results to the universe if warranted. A detailed description of the SC’s sampling process can be found here. (See pages 30-36)

States are required by federal regulations to provide details on the root cause of each claim that is not cited as correct in PERM reviews. A Corrective Action Plan (CAP) must be submitted to CMS at the conclusion of each PERM cycle. The CAP details the actions that the state plans to take to reduce the error rate in future PERM cycles. The CAP is completed by BMI-QC in joint effort with multiple state agencies/units. Data needed to adequately complete CAP’s is collected throughout the PERM process. More information on the CAP can be found at 42 CFR 431.992.

During PERM audits, contractors may request records to support the payment review of randomly sampled claims by providers. The provider’s role is to submit complete and accurate medical records upon request and respond promptly to requests regarding medical documentation by the contractor and BMI-QC. Provider cooperation with the PERM audit is required. Failure of providers to comply with the audit will result in audit findings (or errors) and the recovery of subsequent overpayments. Audit findings may also result in sanctions or other penalties, including but not limited to: (1) termination or suspension of the provider's eligibility to participate as a Medicaid and/or CHIP provider; (2) suspension or denial of the provider's payments; and (3) civil monetary penalties. For more information on HFS policy, see:

The Provider Handbook and IMPACT Terms and conditions.

The RC uses provider contact information from claims billing, provider contact information, and IMPACT to determine where a request should be sent. Federal regulations require states to maintain current contact information. 42 CFR 431.970(a)(2) Providers are required to enroll in the IMPACT system as a condition of Illinois Medical Programs enrollment. Providers should verify that their contact information is up to date in IMPACT. (See IMPACT enrollment terms and conditions)

The RC will send a Medical Records Request (MRR) to the provider. The letter will provide details of the sampled claim, information on what should be submitted, and instructions on submission of records. Records are due within 75 days of the date on the MRR letter. The RC will send a reminder letter after 30 days if the records are not received. The RC will also reach out to the provider at the 45-day and 60-day mark for documentation. If the RC deems the records incomplete, an Additional Documentation Request (ADR) will be sent to the provider. The provider has 14 days from the date of the ADR letter to submit the requested records. BMI-QC staff will also begin outreach efforts with providers at each step. A sample ADR letter can be found here. A sample MRR letter can be found here.

BMI-QC will notify the provider by mail of MR1 (no records submitted) and MR2 (incomplete records submitted) findings at the end of the PERM cycle. Providers with an error citation other than MR1/MR2 will receive an education letter shortly after the actual error citation. A second letter will be sent at the end of the PERM cycle explaining that BMI-QC is reviewing the claim for potential recoupment or other actions.

CMS PERM website: Payment Error Rate Measurement (PERM) | CMS.
Specifically for Providers: PERM Overview for Providers
PERM Provider Education FAQ PERM fast facts: here.
Data Processing: Data Processing Overview
Medical Records: Medical Records Overview
Eligibility: Eligibility Overview

Providing medical records for Medicaid/CHIP beneficiaries does not violate the Health Insurance Portability and Accountability Act (HIPAA). Patient authorization is not required to respond to the PERM request. CMS and its contractors will comply with the Privacy Act and regulations. For more information, see Health Insurance Portability and Accountability Act (HIPAA) of 1996 and implementing regulations at 45 Code of Federal Regulations, parts 160 and 164. In addition, the Department uses this webpage to communicate HIPAA specific information to providers in a concise and consistent manner.

Provider failure to comply with the audit will result in audit findings and the recovery of overpayments. Audit findings may also result in sanctions or other penalties, including but not limited to: (1) termination or suspension of the provider's eligibility to participate as a Medicaid and/or CHIP provider; (2) suspension or denial of the provider's payments; and (3) civil monetary penalties. The state is required to repay to CMS the federal share of claims paid in error within 1 year of the end of the PERM cycle. Therefore, the state will seek recovery from the provider for those errors.