Providers

Welcome to the Providers page.  This page was developed to help Medicaid and CHIP providers better understand the PERM process and what you may be required to do during a PERM review.  CMS uses a 17 or 18-State rotation cycle for PERM. Each State is reviewed once every three years. The measurement cycles are:

• Cycle 1 - Arkansas, Connecticut, Delaware, Idaho, Illinois, Kansas, Michigan, Minnesota, Missouri, New Mexico, North Dakota, Ohio, Oklahoma, Pennsylvania, Virginia, Wisconsin, Wyoming.
  • PERM Cycle RY2025 Sampled Claim Review Period: July 1, 2023 to June 30, 2024
  • Timeframe for Medical Records Request Outreach: April 1, 2024 to April 15, 2025
• Cycle 2 - Alabama, California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, West Virginia.
  • PERM Cycle RY2026 Sampled Claim Review Period: July 1, 2024 to June 30, 2025
  • Timeframe for Medical Records Request Outreach: April 1, 2025 to April 15, 2026
• Cycle 3 - Alaska, Arizona, District of Columbia, Florida, Hawaii, Indiana, Iowa, Louisiana, Maine, Mississippi, Montana, Nevada, New York, Oregon, Puerto Rico, South Dakota, Texas, Washington.
  • Medical records request outreach to providers will not be conducted during RY 2027.
  • PERM will exclusively measure eligibility for the RY 2027 cycle. This adjustment is temporary and applies solely to RY 2027.

What should I do if I suspect I have received a fraudulent medical records request?

If you suspect you have received a fraudulent medical records request, take the following steps immediately:

1. Do not respond to the suspicious request.
2. Contact Empower AI, the PERM Review Contractor, right away:
   • Phone: 800-393-3068
   • Email: PERMRC_ProviderInquiries@empower.ai
3. Document the request by saving copies of any correspondence received.
4. Report the incident to help CMS track and address fraudulent activity.  Additional information to assist with handling fraudulent activity at CMS can be found at CMS - Fraud.

**********************************************************************************************************************

Who do I contact with questions regarding Medical Records Requests?

Providers should contact Empower AI, the PERM Review Contractor, at 800-393-3068 or PERMRC_ProviderInquiries@empower.ai right away with any questions or concerns. Please do not transmit Personally Identifiable Information (PII), Protected Health Information (PHI), medical records, or other sensitive information via the provider inquiries email address. 

**********************************************************************************************************************

How much time will I have to provide requested records?

Providers will be afforded 75 calendar days to submit documentation in response to an initial medical request letter. If a request is made for additional documentation, providers have 14 calendar days to submit the additional documentation to the Review Contractor.

**********************************************************************************************************************

What about patient privacy?

Providers are not required to obtain patient authorization to respond to medical record requests. CMS and its contractors comply with the Privacy Act and regulations. Section 1902(a) (27) of the Social Security Act and Code of Federal Regulation 42 C.F.R. §457.950 gives CMS authority to require providers to submit information regarding payments and claims as requested by the Secretary, State Agency, or both. CMS contracts with outside entities that assist with collecting and reviewing claims on behalf of CMS.