A Medicaid billing compliance checklist NY providers can actually work from has to start with a number rather than a list of good intentions. New York requires a formal compliance program of providers that claim or receive at least one million dollars from the Medicaid program in any consecutive twelve month period.
That threshold is the line between a practice that should have a compliance program and one that must have one, and it catches organizations that do not think of themselves as large. A million dollars across any rolling twelve months is a mid-sized practice in several specialties.
Confirm Where You Sit Against the Threshold
The measure is any consecutive twelve month period rather than a calendar or fiscal year, which means a practice can cross the line mid-year and not notice.
Run the calculation on a rolling basis rather than annually. Include Medicaid fee-for-service and managed care payments, since both count toward what a provider claims or receives from the program.
A practice approaching the threshold should build the program before crossing it rather than after, because the obligation attaches to the period rather than to the discovery of it.
Build the Program Elements the Regulation Expects
The state regulation sets out what an adequate program contains, and these are the items an auditor looks for.
Designate a compliance officer responsible for day-to-day operation of the program, with the standing and access to do the job. Establish a compliance committee of senior managers that meets at least quarterly, with documented minutes.
Maintain written policies describing compliance expectations and who is responsible for what. Provide annual training covering the required topic areas, including risk areas, policies, and billing requirements, and keep attendance records.
Create a confidential route for staff to report concerns without fear of retaliation. Conduct routine audits focused on the identified risk areas. Review the program annually and document what the review found.
Written Records Are the Program
An element that happened without documentation did not happen, as far as a review is concerned.
Keep training rosters, committee minutes, audit workpapers, and the annual review findings. These are what demonstrate that the program operates rather than exists on paper, and assembling them retroactively during an audit is not a position any provider wants.
Certify Annually & Treat It Seriously
Required providers certify compliance with the regulation on an annual basis, with managed care organizations collecting certifications through their own portals or dedicated addresses.
Certification is a statement about the state of your program. Confirm each element is actually in place before signing rather than treating the certification as an administrative renewal.
Calendar the certification window for each entity that collects one, since providers contracted with several managed care plans may face several submissions.
Return Overpayments Inside the Deadline
This is the requirement that converts a billing error into a compliance matter when it is missed.
Identified overpayments must be reported and returned by the later of sixty days after identification or the date a corresponding cost report is due. The clock runs from identification rather than from the decision about what to do.
Self-disclosure statements require the compliance officer’s signature and a detailed account of the circumstances, how the issue was found, and what corrective action was taken.
Practices that find an overpayment and spend ninety days deciding how to handle it have turned a correctable error into a separate problem. Build an internal rule that identification triggers a documented decision within a defined number of days, well inside the sixty.
Watch the Current Audit Focus Areas
The state publishes an annual work plan naming where its reviews are concentrated, and the 2026 plan is specific enough to act on.
Compliance programs and self-disclosure are themselves listed focus areas, alongside home and community based services, managed care, and pharmacy.
Named service areas include home health, personal care, private duty nursing, consumer-directed personal assistance, and traumatic brain injury services. Behavioral health work covers personalized recovery oriented services, telehealth, and opioid treatment programs. Developmental disability services cover community habilitation, care coordination, supported employment, and day habilitation.
Children’s services draw attention to applied behavior analysis for autism spectrum disorder, early intervention, and children and family treatment and support services. Direct medical care areas include diagnostic and treatment centers, hospital outpatient departments, physician services, and independent laboratories. Transportation, durable medical equipment, and pharmacy round out the list.
Program Integrity Methods Have Changed
The work plan also describes how reviews are conducted, and that matters as much as where.
Managed care audits now include data matching against incarceration and death records and eligibility checks. Advanced analytics are used to detect billing patterns, and pre-payment claim review is in use alongside post-payment audit.
Pattern detection changes what a provider should watch internally. An outlier billing pattern that would once have passed unnoticed is now the kind of thing that generates a review, which makes internal monitoring of your own utilization patterns worth doing before someone else does it.
Providers in a named focus area, particularly those handling high-volume service lines, often bring in outside billing and compliance support such as AAA Medical Billing to run the internal audits the regulation expects, because reviewing your own claims against the same risk areas a regulator is examining is the point of the exercise.
Verify Credentials & Exclusions on a Schedule
Provider credential verification appears in the current program integrity priorities, and exclusion screening is a routine audit finding when it lapses.
Screen employees, contractors, and vendors against federal and state exclusion lists at hire and on a recurring schedule. Payments tied to an excluded individual are recoverable, and the recovery is not limited to that person’s direct billings.
Keep the screening records with dates, since the documentation is what demonstrates the schedule was followed.
A Working Checklist
Confirm your rolling twelve month Medicaid receipts against the one million dollar threshold. Name a compliance officer and a committee that meets quarterly with minutes.
Put written policies in place and run annual training with records kept. Open a confidential reporting route. Run routine audits against your risk areas, and review the whole program annually with documented findings.
Certify on schedule with every entity that collects one. Set an internal clock on overpayment identification that lands well inside sixty days. Screen for exclusions on a defined cycle and keep the records.
Check your service lines against the current work plan and audit yourself where the state is looking.
