New CMS Audits Reveal QPA Calculation and Disclosure Failures

What did the newly published QPA audits find?

CMS's Center for Consumer Information and Insurance Oversight identified noncompliant QPA calculation, claim-identification, and disclosure practices in audits of CareSource of Indiana and the School Employees Retirement System of Ohio. Both audits covered items and services furnished from January 1, 2022 through May 31, 2023.

The CareSource report found that the issuer used usual-and-customary rates instead of contracted rates in all 952 QPA calculation records supplied for review. The Ohio report, based on six air ambulance claims and eight QPAs, found that two claims were incorrectly excluded from No Surprises Act processing and identified incomplete QPA and IDR disclosures.

What did CMS find in the CareSource audit?

CareSource did not produce contracted-rate data for the 952 QPA calculation records reviewed. It supplied usual-and-customary rates used in place of contracted rates. CMS found that practice inconsistent with the applicable QPA methodology and required a self-audit of all affected NSA-eligible claims beginning January 1, 2022.

The report also found disclosure failures. Across 106 sampled claims, CMS identified 735 QPAs for which required information was not provided with the initial payment or notice of denial. CareSource also failed to provide certain additional QPA information on time when providers requested it.

CMS directed CareSource to identify claims where the reported QPA was higher than the QPA calculated under the applicable rules and refund excess consumer cost sharing. The report states that CareSource had already begun corrective work and that corrected rates went live in its systems in October 2024.

What did CMS find in the Ohio SERS audit?

The Ohio SERS audit was much narrower: six sampled air ambulance claims containing eight QPAs. CMS found that an incorrect retiree-only designation in the administrator's system caused two claims to bypass NSA processing. It also identified failures to disclose the QPA for each item or service and incomplete language about the deadline for initiating federal IDR.

The report separately observed that contracted rates for contracts under which no claims were filed had been excluded from the QPA calculation. Those rates are often called “ghost rates.” That observation must be read against the continuing TMA III litigation over the QPA methodology. After the audit report was completed, the Fifth Circuit's August 2026 en banc decision affirmed parts of the judgment striking certain QPA calculation rules, and CMS said the Departments were reviewing the decision.

The operational findings are distinct from that contested methodology issue. An incorrect plan designation, failure to identify eligible claims, and missing disclosures do not depend on whether unused contracted rates ultimately belong in the QPA calculation.

Halkovich Law's commentary

These audits matter because the QPA enters the dispute before a provider can test how it was built. It may affect patient cost sharing, the initial payment record, open negotiation, and the evidence placed before the certified IDR entity. A benchmark controlled by one party should come with reliable calculations and complete disclosures.

The CareSource result is especially significant. The issue was not a rounding error in a handful of lines. CMS found the wrong category of rate used across all 952 calculation records produced for the audit. The disclosure findings also show why a provider cannot evaluate an initial payment if the required QPA information is absent or late.

The evidence does not establish that every payer or every QPA is wrong. The reports cover specific organizations, jurisdictions, dates, and samples. They do establish that material QPA compliance failures can occur at both the methodology and claim-processing levels, and that federal audits can uncover them years after the affected services.

What should providers do when a QPA appears questionable?

• Preserve the full claim, remittance advice or EOB, initial payment or denial, and the line-level QPA.
• Confirm that the payer supplied the required NSA disclosures and the correct contact for open negotiation.
• Request the additional QPA information available under federal rules and retain the request and response dates.
• Track repeated anomalies by payer, plan, geography, specialty, code, and service date rather than reviewing each claim in isolation.
• Protect the 30-business-day open-negotiation period and the federal IDR initiation deadline while the QPA issue is investigated.
• Document consumer cost-sharing concerns and any claim that appears to have been excluded from NSA processing.

A provider may not be able to reconstruct a payer's full contracted-rate database. It can still build a record showing missing disclosures, inconsistent QPAs, unusual code-level results, late responses, and recurring processing patterns.

What should regulators take from the audit reports?

Public audit reports are useful only if publication becomes timely, regular, and broad enough to reveal whether a finding is isolated or systemic. CMS currently lists three final QPA audit reports. The public record should identify the universe audited, the sampling method, the nature of each failure, the corrective action, and whether affected claims and consumer cost sharing were actually corrected.

Transparent auditing would improve the federal IDR debate. It would allow policymakers to evaluate provider offers and outcomes against a benchmark whose own compliance history is visible.

Frequently asked questions

Sources and scope

This article is Halkovich Law's original provider-side commentary on TechTarget's reporting and the final CMS audit reports. Audit findings are described within their stated samples and periods. The page provides general information, not claim-specific legal advice, and does not independently audit any plan's QPA data.