Most employers never check whether their health plan paid the right amount on the right people. Here is what a claims audit looks at, the federal rule that gives you access to the data, and how the answer changes depending on how your plan is funded.
A medical claims audit is a structured review of what your health plan actually paid against what the plan document says it should have paid. It looks for duplicate payments, members who were no longer eligible, billing and coding errors, and negotiated contract terms that were never applied. For a self-funded employer, every dollar of that is your money.
In my experience, the reason employers skip this is not cost. It is that nobody ever told them it was theirs to check. The plan pays, the third-party administrator reports a number, and the number is accepted. A claims audit is simply the step where someone confirms the number is right.
What does a medical claims audit actually find?
An audit compares paid claims against the plan document, the network contract and eligibility records. The common findings are mundane rather than dramatic: claims paid for people who had already left, the same claim paid twice, services priced outside the network agreement, and coding that did not match what was delivered.
Audits fall into two broad shapes. An electronic review runs every claim in the period through a rules engine and flags exceptions. A focused review takes a sample, or a single category such as high-cost facility claims or specialty drugs, and examines it in detail. Most employers get more out of the second when they are starting, because it produces findings specific enough to act on.
What an audit will not do is tell you your plan design is wrong. That is a separate question, and it is the one your renewal evaluation should answer.
Are you allowed to see your own claims data?
Yes, and since 2021 that right has had federal teeth. The Consolidated Appropriations Act, 2021 added what are commonly called the gag clause prohibitions, and they bar your plan from agreeing to contract terms that keep your own cost and quality data away from you.
Specifically, under section 201 of Title II of Division BB of that Act — adding Internal Revenue Code section 9824, ERISA section 724 and Public Health Service Act section 2799A-9 — a group health plan may not enter into an agreement with a provider, a network, a third-party administrator or another service provider offering network access that would directly or indirectly restrict the plan from providing provider-specific cost or quality-of-care information to the plan sponsor, or from sharing that de-identified data with a business associate for plan design, plan administration, and plan, financial, legal and quality-improvement activities. Plans must submit an annual attestation of compliance to the Departments of Labor, Health and Human Services and the Treasury. The Centers for Medicare & Medicaid Services publishes the attestation requirement and the submission process.
The practical use of this is narrow but real. If a vendor tells you a data request is not permitted under its contract, that answer is now itself a compliance question — and your plan has to attest annually that no such restriction exists.
Does an audit make sense if you are fully insured?
It depends on who is carrying the risk, and that is the honest answer rather than a hedge. When the carrier holds the risk, a recovered overpayment goes back to the carrier, not to you. When you hold the risk, it comes back to the plan.
| If your plan is | Who benefits from a recovery | What an audit is mainly for |
|---|---|---|
| Self-funded | The plan, and therefore the employer | Recovering overpayments and correcting the process that caused them |
| Level-funded | Depends on the surplus-sharing terms in your contract | Confirming the claims charged against your funding account are valid |
| Fully insured | Usually the carrier | Understanding cost drivers ahead of a renewal, not recovery |
Fully insured employers should still ask for utilization and cost reporting. It will not produce a cheque, but it is the evidence base for the next renewal conversation, and medical loss ratio rules mean your carrier already tracks the underlying numbers.
What does ERISA actually require of you here?
ERISA does not require a claims audit by name. It requires something broader that an audit happens to serve: prudence, and the monitoring of the vendors you hired.
The Department of Labor's guide, Understanding Your Fiduciary Responsibilities Under A Group Health Plan, states that most employers sponsoring fully or partially self-funded group health plans exercise some discretionary authority and are therefore fiduciaries, and that fiduciary status follows from the functions performed rather than from a job title. It lists the core duties as acting solely in the interest of participants, carrying out duties prudently, following the plan documents, holding plan assets in trust, and paying only reasonable plan expenses.
On vendors, the same guidance is specific. An employer should establish a formal review process and follow it at reasonable intervals, which includes reviewing the service provider's performance, reading the reports it provides, checking the fees actually charged, asking about practices such as a third-party administrator's claims processing systems, ensuring plan records are properly maintained, and following up on participant complaints. It also notes that fiduciaries who do not meet these standards can be personally liable to restore losses to the plan.
Read that list again with a claims audit in mind. "Checking actual fees charged" and "asking about a third-party administrator's claims processing systems" are the audit, described in the government's own words.
How long does a plan have to decide a claim?
Knowing the deadlines matters, because a pattern of late decisions is one of the things an audit surfaces and one of the things participants complain about first. The Department of Labor sets minimum timeframes by claim type.
| Claim type | Initial decision | Decision on appeal |
|---|---|---|
| Urgent care | As soon as possible, no later than 72 hours | No later than 72 hours |
| Pre-service | No later than 15 days | No later than 30 days |
| Post-service | No later than 30 days | No later than 60 days |
| Disability | No later than 45 days | No later than 45 days |
Source: U.S. Department of Labor, Employee Benefits Security Administration. Fifteen-day extensions may be available for pre- and post-service claims and up to 30 days for disability claims. Plans must give claimants at least 180 days to file an appeal and may require no more than two levels of review.
When is an audit worth running?
The honest trigger is not a calendar. It is a change: a new third-party administrator, a merger or a large headcount move, a year where claims came in well above projection with no clear cause, or a renewal you intend to challenge. Those are the moments when the findings can still change a decision.
Two cautions. An audit of a period you can no longer act on has limited value, so check the recovery and reopening windows in your administrative services agreement before you scope one. And an audit is a measurement, not a strategy — if the finding is that your plan is paying correctly and is still expensive, the problem is in plan design, network or stop-loss structure, not in claims processing.
What to do next
If you are self-funded and have never audited, start by reading your administrative services agreement for three things: the data you are entitled to receive, the audit rights you already have, and the window for recovering an overpayment. Most employers are surprised by at least one of the three.
If you would like a second read on what your agreement actually permits, or on whether your claims experience justifies an audit this year, get in touch. We work with employers across the Wasatch Front, including Salt Lake City and the surrounding valley. This article is general information about employee benefit plan administration, not legal or tax advice; your plan documents and your counsel govern.
Tyson has specialized in employee benefits since 2010, helping C-suite executives and HR leaders build custom health plans that reduce costs and improve employee access to quality care.
Skyler partners with Utah employers to design strategic, data-driven employee benefits programs that align financial outcomes with workforce wellbeing — bringing the same boardroom-level thinking featured in Healthcare's C-Suite Solution to every engagement.