Skip to main content

Possible online services disruption due to Internet related outage

A worldwide technology outage is causing disruption to some State of Illinois online systems.  We are aware of this issue and are diligently working on restoration.

Payment Error Rate Measurement (PERM)

The PERM audit process is overseen by the HFS OIG’s Bureau of Medicaid Integrity Quality Control Unit. For any questions regarding this program, please contact:

Jamie Randell, PERM Program Manager

*Please do not include PII/PHI in email communication or attachments



The purpose of the PERM program is to measure and report a national improper payment rate for Medicaid and the Children’s Health and Insurance Program (CHIP) as required by the Payment Integrity Information Act (PIIA) of 2019.

PERM helps states identify areas for improvement and helps cut down on fraud, waste, and abuse. PERM requires states to estimate improper payments in the Medicaid program and CHIP and to report the state- specific improper payment rates for purposes of computing the national improper payment estimates for these programs. The intended effects of PERM are to identify errors and target corrective actions; reduce the rate of improper payments; and increase program savings at both state and federal levels. As part of the corrective action, states are required to return the federal share of overpayments and pursue recoveries under applicable laws and regulation.

PERM reviews are conducted every three years. The current PERM cycle for Illinois covers Review Year (RY) 2025 and will review claim payments between July 1, 2023 through June 30, 2024.

PERM is administered by three federal contractors:

·Statistical Contractor (SC) – The Lewin Group, Part of Optum Serve
·Review Contractor (RC) - Empower AI (formerly NCI, Inc)
·Eligibility Review Contractor (ERC) - Booz Allen Hamilton

Results are forwarded to states for review. The state may file a Difference Resolution (DR) with the contractor if they do not agree with the determination. DR results may be eligible for appeal with the Centers for Medicare & Medicaid (CMS). However, CMS appeal determinations are final.

What type of reviews do the Contractors conduct?

PERM is comprised of three review components: Data Processing (DP), Eligibility (ER), and Medical Records (MR). For DP review, the RC validates whether the state processed the claim correctly for fee-for-service (FFS). For Managed Care (MC), payments are reviewed to determine if the state accurately processed the capitation payment or premium. For ER reviews, the ERC focuses on whether a determination, redetermination, or change was processed by the state accurately and appropriately based upon relevant policy. MR review determines the medical appropriateness of the payment to the provider. The RC will request medical records from the provider for all sampled claims. MR reviews are conducted by federal RC contractor Empower, AI (formerly NCI, Inc).

Review results are sent to BMI-QC. Those results are then reviewed by a certified medical coder within the OIG Audit department or other qualified HFS staff.

How are claims selected for PERM reviews?

PERM measures and reports an unbiased estimate for the true improper payment rate of Medicaid and CHIP. CMS, through their contractor, selects a statistically valid sample from the universe of claims to review and may extrapolate those results to the universe if warranted. A detailed description of the SC’s sampling process can be found here. (See pages 30-36)

What is the state required to do with PERM results?

States are required by federal regulations to provide details on the root cause of each claim that is not cited as correct in PERM reviews. A Corrective Action Plan (CAP) must be submitted to CMS at the conclusion of each PERM cycle. The CAP details the actions that the state plans to take to reduce the error rate in future PERM cycles. The CAP is completed by BMI-QC in joint effort with multiple state agencies/units. Data needed to adequately complete CAP’s is collected throughout the PERM process. More information on the CAP can be found at 42 CFR 431.992.

What is the provider role?

During PERM audits, contractors may request records to support the payment review of randomly sampled claims by providers. The provider’s role is to submit complete and accurate medical records upon request and respond promptly to requests regarding medical documentation by the contractor and BMI-QC. Provider cooperation with the PERM audit is required. Failure of providers to comply with the audit will result in audit findings (or errors) and the recovery of subsequent overpayments. Audit findings may also result in sanctions or other penalties, including but not limited to: (1) termination or suspension of the provider's eligibility to participate as a Medicaid and/or CHIP provider; (2) suspension or denial of the provider's payments; and (3) civil monetary penalties. For more information on HFS policy, see:

The Provider Handbook and IMPACT Terms and conditions.

Where does the RC mail the Medical Record Request (MRR)?

The RC uses provider contact information from claims billing, provider contact information, and IMPACT to determine where a request should be sent. Federal regulations require states to maintain current contact information. 42 CFR 431.970(a)(2) Providers are required to enroll in the IMPACT system as a condition of Illinois Medical Programs enrollment. Providers should verify that their contact information is up to date in IMPACT. (See IMPACT enrollment terms and conditions)

How will providers know if any of their claims are sampled for a PERM MR review?

The RC will send a Medical Records Request (MRR) to the provider. The letter will provide details of the sampled claim, information on what should be submitted, and instructions on submission of records. Records are due within 75 days of the date on the MRR letter. The RC will send a reminder letter after 30 days if the records are not received. The RC will also reach out to the provider at the 45-day and 60-day mark for documentation. If the RC deems the records incomplete, an Additional Documentation Request (ADR) will be sent to the provider. The provider has 14 days from the date of the ADR letter to submit the requested records. BMI-QC staff will also begin outreach efforts with providers at each step. A sample ADR letter can be found here. A sample MRR letter can be found here.

How will a provider be notified of a PERM MR error citation (audit finding)?

BMI-QC will notify the provider by mail of MR1 (no records submitted) and MR2 (incomplete records submitted) findings at the end of the PERM cycle. Providers with an error citation other than MR1/MR2 will receive an education letter shortly after the actual error citation. A second letter will be sent at the end of the PERM cycle explaining that BMI-QC is reviewing the claim for potential recoupment or other actions.

What about patient privacy?

Providing medical records for Medicaid/CHIP beneficiaries does not violate the Health Insurance Portability and Accountability Act (HIPAA). Patient authorization is not required to respond to the PERM request. CMS and its contractors will comply with the Privacy Act and regulations. For more information, see Health Insurance Portability and Accountability Act (HIPAA) of 1996 and implementing regulations at 45 Code of Federal Regulations, parts 160 and 164. In addition, the Department uses this webpage to communicate HIPAA specific information to providers in a concise and consistent manner.

Where can I find more information on PERM?

CMS PERM website: Payment Error Rate Measurement (PERM) | CMS.
Specifically for Providers: PERM Overview for Providers
PERM Provider Education FAQ PERM fast facts: here.
Data Processing: Data Processing Overview
Medical Records: Medical Records Overview
Eligibility: Eligibility Overview

What effect do MR errors have on the provider?

Provider failure to comply with the audit will result in audit findings and the recovery of overpayments. Audit findings may also result in sanctions or other penalties, including but not limited to: (1) termination or suspension of the provider's eligibility to participate as a Medicaid and/or CHIP provider; (2) suspension or denial of the provider's payments; and (3) civil monetary penalties. The state is required to repay to CMS the federal share of claims paid in error within 1 year of the end of the PERM cycle. Therefore, the state will seek recovery from the provider for those errors.