Blog

How to Reduce Your Risk of CMS Penalties Through Stronger Care Management Operations

Most CMS penalties in care management programs do not originate from intentional billing fraud. More often, they result from routine administrative gaps that build over time: incomplete time logs, outdated care plans, missed eligibility checks, or incorrect APCM risk assignments. Individually, these issues may seem minor. But when they occur across dozens or hundreds of enrolled patients, they can create significant compliance exposure that often isn't discovered until an audit brings these issues to light.

Many practices understand CMS requirements but struggle to execute the documentation, eligibility verification, patient outreach, and billing workflows needed to meet those requirements every month. Success in care management requires systems that produce compliant documentation and billing at scale.

That is one reason that healthcare organizations may evaluate whether a fully managed program, like ChartSpan's Chronic Care Management (CCM) or Advanced Primary Care Management (APCM), can reduce compliance exposure while supporting more consistent patient engagement and program performance.

In this article, we will examine the specific compliance vulnerabilities that commonly lead to CMS penalties, explain what today's audit environment means for care management programs, and outline practical strategies for reducing compliance risk before an audit request arrives.

What causes CMS penalties in care management programs

Improper payments in the care management context are claims submitted for services that do not meet the documented eligibility, time, or service requirements the Centers for Medicare and Medicaid Services (CMS) has established for the program being billed. In CCM and APCM, they most commonly stem from documentation failures, such as inaccurate time logs, outdated care plans, or enrolling patients without confirming eligibility. These deficiencies can lead to overpayment determinations, claim denials, or recoupment, making accurate documentation and consistent program operations essential to maintaining compliance.

What makes these situations particularly consequential is their scope. A single documentation deficiency is rarely an isolated event. When one patient's record reflects a vague time entry or a missing consent record, there is a strong chance the same issue exists across a significant portion of the enrolled population, because the gap reflects the underlying workflow, not a one-time mistake.

During an audit, Medicare Administrative Contractors (MAC) look for patterns that indicate systems compliance issues rather than evaluating claims in isolation. When documentation deficiencies are found to be widespread, practices may face retroactive recoupment across months of claims for every affected patient.

Documentation and billing vulnerabilities in CCM and APCM

Compliance failures in Chronic Care Management and Advanced Primary Care Management programs rarely result from isolated mistakes. More often, they stem from recurring workflow gaps that allow documentation, eligibility, and billing errors to accumulate over time. The following vulnerabilities are among the most common reasons practices face compliance issues during care management audits.

Unverified patient consent

Submitting claims under CCM or APCM without a legally compliant consent record on file is a direct compliance failure. Practices must document not only that consent was obtained, but that patients were informed of their cost-sharing responsibilities, the fact that only one practitioner can bill for these services each month, and their right to opt out at any time.

Verbal consent may be acceptable if it is properly documented in the medical record. What matters is not the format of the consent, but whether the required discussion and disclosures are reflected in the documentation. Likewise, when changing care management vendors, practices should confirm whether the transition requires new patient consent.

Because consent is established at enrollment, missing or incomplete documentation often affects every claim submitted for that patient until the issue is identified and corrected.

Deficient, outdated, or inaccessible care plans

CMS expects care plans to be patient-specific, comprehensive, and actively maintained throughout a patient's participation in CCM or APCM. A care plan created during enrollment and never updated does not demonstrate ongoing care management, particularly if it relies on templated language that fails to reflect changes in the patient's condition or goals.

Practices must also be able to demonstrate that the care plan was made available to the patient and any designated caregivers. A care plan that exists only within the EHR or another program, without evidence that it was shared, leaves a documentation gap that auditors are trained to identify.

Eligibility and patient stratification errors

Eligibility mistakes often begin at enrollment but can continue unnoticed for months if practices lack structured verification processes.

For CCM, billing requires documentation that the patient has two or more chronic conditions that are expected to last at least 12 months, and put them at significant risk of functional decline or acute exacerbation. Enrolling patients before that eligibility is adequately documented creates compliance risk from the first claim onward.

Practices offering APCM are additionally responsible for patient stratification. Billing higher service levels requires documentation supporting the patient's assigned level, including verified Qualified Medicare Beneficiary (QMB) status for Level 3 (G0558). If a patient is assigned to the wrong level during enrollment—or their status changes after enrollment—and that assignment is not revalidated, every subsequent claim may be affected.

CCM time documentation and APCM service availability gaps

Although CCM and APCM both require thorough documentation, they establish compliance in different ways.

CCM requires documented time: at least 20 minutes per month to bill CPT code 99490, and 40 to 60 minutes to bill 99439. Billing requires records that clearly demonstrate when care management activities occurred, who performed them, how much time was spent, and what services were provided. A time entry such as "care coordination, 20 minutes" is unlikely to withstand audit scrutiny because it does not document the specific work performed or its clinical purpose.

For APCM, documentation must demonstrate the continuous availability of required services and capabilities. While practices do not need to track monthly care management minutes, they must be able to show that all required care elements, including comprehensive care planning, 24/7 patient access, ongoing communication, and care transitions coordination, were consistently available to every enrolled patient during the billing period.

In either program, documentation should allow an auditor to determine that all billing requirements were met based on the medical record alone. When the same documentation gaps appear across multiple patients, they often point to a workflow issue rather than an isolated oversight.

Overlapping care management claims

CMS does not permit billing CCM and APCM for the same patient during the same calendar month. Similar restrictions apply when CCM or APCM overlap with other care management services, such as Principal Care Management (PCM) or Transitional Care Management (TCM), although the specific billing rules vary by program. For example, a patient can temporarily receive Transitional Care Management if their Chronic Care Management program is paused, then return to CCM. 

These errors often occur when enrollment, documentation, and billing are managed across separate teams or disconnected systems without a shared view of the patient's active services. Without coordinated oversight, duplicate or conflicting claims can be submitted before anyone recognizes the issue.

How fragmented workflows create compliance exposure

When a Medicare Administrative Contractor conducts an audit, it rarely remains limited to a single issue. A vague time entry may prompt a broader review of the medical record, where additional gaps can surface across consent documentation, care plan maintenance, and eligibility verification. What begins as one flagged claim can quickly expand into a systemic finding.

This happens because documentation, billing, and eligibility verification are often managed in disconnected steps across different staff, systems, or points in the billing cycle. Without a unified care management workflow, there is no final checkpoint that ensures all required elements are complete and aligned before a claim is submitted. As a result, small gaps go undetected, repeat across the patient population, and eventually surface together during audit review.

For practice leaders, this is often the inflection point: not whether care management programs provide value, but whether existing workflows can reliably support compliant delivery at scale. When they cannot, organizations increasingly evaluate whether a managed partner can serve as an extension of their care management and compliance infrastructure. ChartSpan’s CCM and APCM programs are designed to support that operational consistency.

Early warning signs organizations overlook

Most compliance findings do not emerge suddenly during an audit. The underlying issues typically appear much earlier as gaps in documentation and workflow execution. Because these issues rarely disrupt day-to-day operations, they are often dismissed as routine administrative friction rather than recognized as indicators of compliance risk.

Common early warning signs include:

• Missing required elements in time documentation. Time entries that do not consistently include required components indicate that documentation is not being captured at the level CMS expects. When those elements are absent from the records kept by multiple staff members, it suggests a workflow design issue rather than an individual oversight.
• Care plans that haven't been updated in multiple months. If a patient's care plan reflects their health status from enrollment but nothing since, it does not demonstrate active management. A pattern of stale care plans across the enrolled population is one of the clearest indicators that documentation workflows have broken down.
• APCM level assignments that were never re-verified after initial enrollment. Patients' clinical circumstances change. A patient assigned to Level 2 at enrollment may no longer meet the criteria months later, or may now qualify for Level 3 based on Qualified Medicare Beneficiary status that was not confirmed at intake. Level assignments that have never been revisited represent ongoing billing risk.
• Consent records that are incomplete or stored inconsistently. When some patient files contain complete consent documentation while others include only a brief note that consent was obtained, the documentation standard is not being applied uniformly. That inconsistency may become apparent during an audit.

These signals reflect breakdowns in the underlying workflows that generate compliant records. Addressing them proactively is substantially less costly than addressing them in response to an audit request.

The CMS nationwide CCM audit and what it means for your practice

The Centers for Medicare and Medicaid Services (CMS) is conducting a nationwide audit verifying that every patient enrolled in Chronic Care Management (CCM) has two or more qualifying chronic conditions. The audit period focuses on CCM claims submitted between 2019 through 2024, meaning practices that have been billing CCM throughout this period are subject to review.

The financial risk extends beyond any single claim under review. If enrollment documentation does not clearly establish that patients met CCM eligibility requirements, auditors may examine additional claims associated with the same enrollment process. That can significantly increase potential recoupment exposure compared with an isolated documentation error.

Practices that enrolled patients based on clinical judgment without clearly documenting qualifying chronic conditions may face greater compliance exposure. The audit will not accept the treating provider's knowledge of a patient's conditions as a substitute for documentation that exists in the record at the time of enrollment and remains current throughout participation.

The appropriate posture right now is proactive documentation readiness. That means reviewing your enrolled CCM roster, confirming that each patient has explicit, accessible documentation of two or more qualifying chronic conditions, and ensuring that the supporting documentation is complete, accessible, and can be produced quickly if requested. Waiting for an audit notice to begin that review compresses the timeline and limits your options.

For some organizations, strengthening audit readiness means redesigning internal workflows. Others choose to partner with a fully managed Chronic Care Management program to improve enrollment documentation, monthly engagement records, and billing support without adding administrative work for internal teams or hiring roles dedicated to compliance.

4 ways to reduce your risk of CMS non-compliance penalties

These are practical steps that address the documentation, eligibility, and workflow gaps most likely to surface during a CCM or APCM audit.

1. Audit your enrollment roster for eligibility documentation

Start with your current CCM enrollment roster and conduct a documentation review. Confirm that each enrolled patient has clear, dated documentation of two or more chronic conditions expected to last at least 12 months.

That documentation should identify the qualifying diagnoses, reference supporting clinical notes or problem list entries, and remain easy to locate in the patient's health record if requested during an audit.

A treating provider's familiarity with a patient's conditions is not a substitute for documented eligibility. If the required documentation is missing, establish and record it before the next billing cycle.

Given the ongoing nationwide audit, practices should treat this review as an immediate operational priority.

2. Standardize CCM time documentation

Every compliant CCM time entry should include:

• The date of the activity
• The duration in minutes
• The name and role of the staff member
• A specific description of the services provided

The difference between compliant and non-compliant documentation is significant.

Non-compliant: "Care coordination – 20 minutes"

Compliant: "RN care manager reviewed updated medication list with patient on [date], confirmed adherence to metformin and lisinopril, discussed blood pressure readings from home monitoring log, and coordinated follow-up with cardiologist. Duration: 22 minutes."*

*This is only a sample, for a fictional patient. Correct documentation may vary. 

The second entry gives an auditor enough detail to understand exactly what occurred. The first does not. Use a standardized documentation template and reinforce expectations through regular internal review rather than assuming every care manager documents consistently.

If your practice does not have the internal capacity to maintain that level of documentation discipline, ChartSpan’s CCM solution offers a fully managed workflow that includes ongoing patient outreach, documentation support, and billing processes aligned with CMS requirements.

3. Verify APCM patient stratification against CMS criteria

If your practice bills APCM, regularly verify that every patient's assigned level still matches the required documentation for the applicable APCM billing codes:

• G0556 (Level 1): One or fewer documented chronic conditions
• G0557 (Level 2): Two or more documented chronic conditions
• G0558 (Level 3): Two or more documented chronic conditions, plus confirmed QMB status

Confirm QMB status through an authoritative source such as the HIPAA Eligibility Transaction System (HETS) rather than relying on patient self-report or secondary documentation. If you have a care management vendor, they may have independent access to the HETS database to assist with this process.  

Review level assignments periodically, not just during enrollment. Chronic conditions, insurance status, and QMB eligibility can change over time, and outdated assignments create ongoing billing risk.

For primary care organizations, a managed APCM program can help coordinate patient stratification, communication, documentation, and compliance support in one streamlined process.

4. Establish a proactive internal review process

Review your CCM and APCM documentation regularly using a structured Medicare audit checklist rather than waiting for an audit request. A monthly review should include:

• Time documentation: Review a sample of CCM time entries to confirm they contain the required documentation elements.
• Care plans: Identify patients whose care plans have not been updated after changes in health status or within your organization's review schedule.
• Consent records: Confirm that every enrolled patient has complete consent documentation reflecting the required disclosures.
• APCM level assignments: Verify that a sample of patients have current documentation supporting eligibility for their assigned level.
• Level assignment verification for APCM: Review a sample of level assignments to confirm that supporting documentation exists and that QMB status has been verified through an authoritative eligibility source for all Level 3 patients.

Assign ownership of this review to a specific individual, such as a compliance officer, billing manager, or care management lead. Without clear accountability, internal audits become inconsistent and lose much of their value as a compliance safeguard. If you have a care management partner, they may have a dedicated quality and compliance team to perform these functions. 

How ChartSpan supports audit readiness and operational consistency

Addressing compliance risk requires a proactive approach. It depends on workflows that consistently capture the documentation, eligibility verification, and care management activities CMS expects to see during an audit. Without standardized processes and oversight, practices have limited visibility into whether documentation and billing requirements are being met consistently across the organization.

ChartSpan's fully managed Chronic Care Management and Advanced Primary Care Management programs help practices maintain coordinated workflows that support ongoing audit readiness.

By partnering with ChartSpan, practices receive:

• Support identifying and enrolling eligible patients.
• HETS database access to support APCM level assignment and QMB verification for Level 3 patients.
• Dedicated care managers who engage patients regularly, update care plans after each interaction, and document care activities.
• RapidBill™ technology that integrates documentation and billing into a single reviewed workflow.
• AI-assisted, HIPAA-compliant call auditing that reviews 100% of patient calls before claims are submitted.

If your practice is looking to reduce compliance risk without increasing administrative burden, ChartSpan serves as an extension of your clinical and administrative staff. The result is a more consistent approach to patient enrollment, documentation, care coordination, billing, and compliance across CCM and APCM.

If you'd like to evaluate how your current care management program compares against CMS standards, contact us to learn how we can help strengthen your practice's operations and protect against compliance exposure.

You may also like:

• CCM Compliance Frequently Asked Questions
• Interprofessional Collaboration: How to Strengthen Care Team Performance and Patient Outcomes
• The Secrets of Successful Chronic Care Management Training and Onboarding