OAR 410-123-1025
Program Integrity and Provider Audits

(1) The Oregon Health Authority (Authority) uses several approaches to promote program integrity and preventing fraud, waste and abuse in the Medicaid program. OAR 410-120-1360 (Requirements for Financial, Clinical and Other Records) through 410-120-1580 (Provider Appeals — Administrative Review) generally describe Authority program integrity activities related to Medicaid providers and payment. Providers enrolled with the Authority or under contract with the Authority or the Department of Human Services (DHS) receiving payments from the Authority or DHS are subject to audit or other post payment review procedures for all payments applicable to items or services furnished or supplied by the provider to or on behalf of Authority or DHS clients.
(2) Providers must comply with OAR 410-120-1510 (Fraud and Abuse), OAR 461-195-0601 (Intentional Program Violations; Defined) and the requirements therein for prompt reporting of fraud, waste and abuse in the Medicaid program:
(a) Providers must report all suspected fraud, waste and abuse by a provider, including fraud, waste or abuse by its employees or in the Authority administration, to the Medicaid Fraud Control Unit (MFCU) of the Department of Justice (DOJ) or to the Authority’s Office of Program Integrity (OPI). Information on how to report may be found online at all times: https:/­/­www.oregon.gov/­oha/­FOD/­PIAU/­Pages/­Report-Fraud.aspx.
(b) Providers must report all suspected fraud or abuse by an Authority or DHS client to the DHS’s Office of Payment and Recovery (OPAR) Fraud Investigations Unit (FIU). Information on how to report may be found online at all times: http:/­/­www.oregon.gov/­OHA/­HSD/­OHP/­/­Pages/­Policy-General-Rules.aspx.
(c) Authority will take all actions necessary to investigate and respond to credible allegations of fraud, waste and abuse in the Medicaid program, including but not limited to suspending or terminating the provider from participation in the medical assistance programs, withholding payments or seeking recovery of payments made to the provider, or imposing other sanctions provided under OAR 410-120-1400 (Provider Sanctions), state laws or regulations. These actions and any outcome(s) will be reported to CMS, or other federal or state of Oregon entities, or law enforcement, as appropriate.
(3) Providers delivering goods or services to OHP members and receiving payment under Oregon’s medical assistance programs may be audited by the Authority, MFCU, Oregon Secretary of State, the Department of Health and Human Services (DHHS), or their authorized representatives.
(a) The audit rules and procedures applicable to oral health providers and MCE participating providers are in OAR 410-120-1396 (Provider and Contractor Audits). The Authority conducts periodic audits of providers to ensure proper payments are made based on requirements applicable to covered services, to ensure program integrity of the Authority or DHS medical programs as outlined in OAR 410-120-1260 (Provider Enrollment) and OAR 407-120-0310 (Provider Requirements), recover overpayments and uncover possible instances of fraud, waste, and abuse.
(b) Providers must submit true, accurate, and complete claims and encounters to the Authority. The Authority treats the submission of a claim or encounter, whether on paper or electronically, as certification by the provider of the following: “This is to certify that the foregoing information is true, accurate, and complete. I understand that payment of this claim or encounter will be from federal and state funds, and that any falsification or concealment of a material fact maybe prosecuted under federal and state laws.”
(c) Providers must maintain clinical, financial and other records, capable of being audited or reviewed, consistent with the requirements of OAR 410-120-1360 (Requirements for Financial, Clinical and Other Records) Requirements for Financial, Clinical and Other Records, and all rules applicable to the specific service or item in OAR Ch 410 and Ch 309.
(d) Access to records, inclusive of medical charts and financial records does not require authorization or release from a member if the purpose is:
(A) To perform billing review activities;
(B) To perform utilization review activities;
(C) To review quality, quantity, and medical appropriateness of care, items, and services provided;
(D) To facilitate payment authorization and related services;
(E) To investigate a client’s contested case hearing request;
(F) To facilitate investigation by the MFCU or DHHS; or
(G) Where review of records is necessary to the operation of the program.
(e) If a provider determines that a submitted claim or encounter is incorrect, the provider is obligated to submit, within 30 calendar days of the date on which the overpayment was identified, an Individual Adjustment Request and refund the amount of the overpayment, if any, consistent with the requirements of OAR 410-120-1280 (Billing). When the provider determines that an overpayment has been made, the provider must notify and reimburse the Authority immediately, following the reimbursement procedures in OAR 410-120-1397 (Recovery of Overpayments to Providers — Recoupments and Refunds).
(f) Upon written request from the Authority, MFCU, Oregon Secretary of State, the DHHS, law enforcement agency or their authorized representatives the provider must furnish, at the providers expense, requested documentation immediately or within the time-frame specified in the request. Copies of the documents may be furnished unless the originals are requested. At their discretion, official representatives of the Authority, Department, MFCU, or DHHS may, together or separately, review and copy the original documentation in the provider’s place of business.
(g) Payment may be denied or subject to recovery if a review or audit determines the care, service or item was not provided in accordance with Authority rules or does not meet the criteria for quality or medical appropriateness of the care, service or item or payment.
(h) PIAU will use the sampling methods and calculation of overpayment methodology outlined in OAR 410-120-1396 (Provider and Contractor Audits). When the Authority determines that an overpayment has been made to a provider, the amount of overpayment is subject to recovery.
(i) Prior to identifying an overpayment, the Authority or designee may contact the provider for the purpose of providing preliminary information and requesting additional documentation. Provider must provide the requested documentation to Authority within the time frames requested, unless any good cause for an extension in OAR 410-120-1396 (Provider and Contractor Audits) is shown.
(j) When an overpayment is identified, Authority will notify the provider in writing, as to the nature of the discrepancy, the method of computing the dollar amount of the overpayment, and any further action that the Authority may take in the matter.
(k) The provider may appeal an Authority notice of overpayment in the manner provided in OAR 410-120-1396 (Provider and Contractor Audits).
(A) All Authority administrative review decisions are subject to procedures established in OAR 410-120-1396 (Provider and Contractor Audits) and OAR 137-004-0080 (Reconsideration — Orders in Other than Contested Case) to 137-004-0092 (Stay Proceeding and Order — Orders in Other than Contested Case) and judicial review under ORS 183.484 (Jurisdiction for review of orders other than contested cases) in the Circuit Court.
(B) The contested case hearing process is conducted in accordance with ORS 183.411 (Delegation of final order authority) to 183.497 (Awarding costs and attorney fees when finding for petitioner) and the Attorney General’s Uniform and Model Rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 (Rules for Office of Administrative Hearings) to 137-003-0700 (Stay Proceeding and Order) and OAR 410-120-1396 (Provider and Contractor Audits).
(L) When overpayment is identified in an audit finding, the Authority may recover overpayments made to a provider by direct reimbursement, offset, civil action, or other actions authorized by law.
(m) Authority will suspend provider enrollment and any payments, all or in part, when a credible allegation of fraud exists pursuant to federal law under 42 CFR 455.23, whether presented to the Authority, DHS, DOJ MFCU, or law enforcement entity; unless there is a pending investigation and good cause exists to continue payment.
(n) In addition to any overpayment, Authority may impose sanctions on a provider in connection with the actions that resulted in the overpayment or pursue other remedies specific to contract(s) between the provider and Authority.
(4) Provider sanctions in OAR 410-120-1400 (Provider Sanctions) may result in suspension or termination of the provider enrollment and the provider’s Division assigned provider number.
(5) Authority may communicate with and coordinate any program integrity actions with the MFCU, DHS, and other federal and state oversight authorities.

Source: Rule 410-123-1025 — Program Integrity and Provider Audits, https://secure.­sos.­state.­or.­us/oard/view.­action?ruleNumber=410-123-1025 (accessed May 26, 2025).

May 26, 2025

Rule 410-123-1025's source at or​.us