Why this matters for your practice
Every claim lodged under your Medicare provider number is your responsibility, regardless of who submitted it or who received the payment. The Department's own audit factsheet puts it plainly: "Health providers are responsible for claims made under their provider number, regardless of who submits claims or receives associated payments." A Medicare compliance audit usually starts as a polite written request for documents, but that request sits at the front of a statutory escalation path that ends in a notice to produce and, if the Department finds an overpayment, a debt claimed against you. The timing of your response matters more than most providers realise: the largest reduction available against an administrative penalty, 100%, is only available if you disclose the error before the Chief Executive Medicare contacts you at all.
What is a Medicare compliance audit?
A Medicare compliance audit is an administrative check of whether benefits were correctly claimed under the Health Insurance Act 1973. The Department's factsheet states the purpose: "The audit process aims to establish whether health benefits have been correctly claimed in accordance with relevant legislation. This includes assessing and verifying information obtained by the Department of Health and Aged Care, interaction with health practitioners, and decisions to initiate the recovery of incorrectly paid amounts."
The Health Insurance Act 1973 sets out the legislative framework for the Medicare scheme and contains the provisions that regulate compliance. A Medicare benefit is only payable where a service was rendered in accordance with the legislative requirements, which in practice means the item requirements of the Medicare Benefits Schedule.
In practice, "audits are conducted through a series of interactions between an audit officer and a health provider or a representative. An audit usually begins with a health provider receiving a written request to provide documents relevant to ascertaining whether amounts paid in respect of professional services should have been paid." That is the whole shape of the thing: a document exercise, and not a judgement on your medicine. The factsheet is explicit about the scope limit: "An audit does not assess the clinical relevance or competence of a professional service." When the audit finishes, the health provider is notified in writing that it is finalised.
How a Medicare compliance audit escalates
The audit runs in a fixed sequence, and the early stages are the ones where a provider still has options. It begins with a written request to produce documents voluntarily, which subsection 129AAD(3) requires before anything formal can happen.
| Stage | What happens | The provision or rule |
|---|---|---|
| Written request | The Department asks the provider to voluntarily produce documents relevant to whether amounts paid should have been paid | Section 129AAD(3) requires this before a notice can be given |
| Notice to produce | A formal written notice requiring production of documents or copies, which must specify the item, the date the service was rendered and the Medicare number for each service, and the reasons for the Chief Executive Medicare's concern | Section 129AAD(2) and section 129AAD(8) |
| Reach-back limit | The notice can only cover services claimed in the 2 years immediately before the day the written request was first given | Section 129AAD(4A) |
| Submission | The provider is given an opportunity to make a submission before a recovery decision is considered | Departmental audit process |
| Debt decision | The provider is advised in writing, given reasons for the decision, and told how to apply for a review | Departmental audit process |
| Internal review | The provider may seek an internal review of the decision to claim an amount as a debt | Within 28 days of being notified of the decision |
| Finalisation | The provider is notified in writing when the audit is finalised | Departmental audit process |
How far back can a Medicare compliance audit go?
A notice to produce can only reach back 2 years. Subsection 129AAD(4) provides that a notice may only be given in respect of a professional service for which a claim was made during the period set out in subsection (4A), and subsection (4A) defines that period as "2 years immediately before the day a written request under subsection (3) was first given to the person in relation to one or more professional services specified in the notice." So the clock is anchored to the day the voluntary written request was first given, not to the day the formal notice arrives.
The moment a request or notice arrives, a separate record keeping obligation starts under section 129AADA. If the Chief Executive Medicare gives you a notice under subsection 19AF(3) or 129AAD(2), or a request mentioned in subsection 129AAD(3), you must keep any document relevant to whether an amount should have been paid, for the period that begins on the day the notice or request is given and ends on the day the relevant outcome notice is given: a notice under subsection 129AAH(1) or (1A) about the amount, or a notice under subsection 129AAI(4) or 129ACA(5) claiming an amount as a debt. If you apply for review of a decision to claim an amount as a debt under subsection 129AAJ(1) or 129ACB(1), the period runs until you are notified of the outcome of the review.
The penalty for failing to keep those documents is a civil penalty: 20 penalty units for an individual, 100 penalty units for a body corporate. There is a reasonable excuse defence, but the person relying on it bears an evidential burden. Note that the 2-year figure here is the reach-back window for a notice to produce, not a general record retention period.
What are the penalties?
The primary consequence is recovery of the money. If a health provider fails to comply with a notice to produce, the amounts paid in respect of the identified professional services are recoverable as a debt due to the Commonwealth, though an amount will not be recoverable if the person satisfies the Chief Executive Medicare or delegate that the non-compliance is due to circumstances beyond the person's control. Recovery may also be sought where a Medicare benefit has been paid as a result of false or misleading information: if certain requirements are met, the excess is recoverable as a debt, and generally this results in an amount being recoverable from the health provider.
On top of the debt, an administrative penalty can apply, but only where the total amount claimed as a debt is more than $2,500, or a higher amount prescribed by the regulations. The base penalty amount is 20% of the recoverable amount under section 129AEB(2). That base penalty is then reduced depending on when you voluntarily disclose:
| When you tell the Department | Reduction in the base penalty |
|---|---|
| Before the Chief Executive Medicare contacts you under subsection 129AAD(2) or (3) about the service, telling them in the approved form that an amount paid exceeds what should have been paid | 100% |
| After contact under subsection 129AAD(3), but before a notice under subsection 129AAD(2) specifying the service and before notice of a debt decision | 50% |
| After a notice under subsection 129AAD(2), before the end of the period specified in the notice, and before notice of the debt decision | 25% |
Third parties face a different consequence. Section 129AAE creates a civil penalty for a person referred to in paragraph 129AAD(2)(b), that is, someone other than the practitioner who rendered the service or on whose behalf it was rendered, who is given a notice and fails to comply within the specified period: 20 penalty units for an individual, 100 penalty units for a body corporate. There is a defence where the failure was brought about by another person or a non-human event the person could not control or reasonably guard against. At the Commonwealth penalty unit of $364 that applies to conduct on or after 1 July 2026, 20 penalty units is $7,280 and 100 penalty units is $36,400. These dollar figures are calculated from the penalty unit value, not published in the Act.
Medicare compliance audit, PSR review or clinical audit?
A Medicare compliance audit tests the claim. It asks whether benefits were correctly claimed in accordance with the legislation, and the factsheet is explicit that it "does not assess the clinical relevance or competence of a professional service." Its outcomes are financial: amounts recovered as debts, plus a possible administrative penalty.
The Professional Services Review tests the practice. The PSR is the Commonwealth scheme that reviews whether a practitioner has engaged in inappropriate practice when providing Medicare or PBS services, with powers to require repayment of benefits, reprimand practitioners, and disqualify them from billing Medicare. It does not just check whether an item descriptor was technically met: it asks whether the practice was clinically appropriate, which is a much broader test. It sits separate from Services Australia compliance audits and from AHPRA. Where the Department identifies a concern, it can request the PSR Director to review the practitioner's provision of services.
The 80/20 rule is the bridge between the two. A prescribed pattern of services is inappropriate practice under section 82(1A) of the Health Insurance Act 1973, and section 86(1A) requires the Chief Executive Medicare to refer the practitioner to the Director of the Professional Services Review. There is no discretion at the referral stage. See our guide to the 80/20 rule and what the PSR is targeting in care plans.
A clinical audit is something else entirely. It is a quality improvement method that measures an aspect of care against an explicit standard, identifies the gap, makes a change, then re-measures to confirm the care improved. In general practice it is evidence for accreditation, not an enforcement process.
What the regulator or assessor expects
The audit is a document exercise, so what is expected is records that reconstruct each claimed service against the item requirements: the notice under subsection 129AAD(8) will specify the item, the date the service was rendered and the Medicare number of the person in respect of whom it was rendered, and you produce what answers that.
Clinical details are quarantined. Under subsection 129AAD(6), if a document, extract or copy contains clinical details relating to an individual, you are not required to produce it to anyone other than a Departmental employee who is a medical practitioner. The notice itself must state that you are not expected to produce a document containing clinical details unless it is necessary.
Self-incrimination is not a ground to refuse. Section 129AAF provides that a person is not excused from producing a document, extract or copy when required under section 129AAD on the ground that doing so would tend to incriminate the person or expose them to a penalty.
Common mistakes
Treating the first written request as optional correspondence. Subsection 129AAD(3) requires the Department to give you a reasonable opportunity to respond voluntarily before it issues a notice. That request is the first stage of a statutory process, not a courtesy letter, and ignoring it moves you to the formal notice stage.
Sending clinical records to a non-clinical officer. Subsection 129AAD(6) means documents containing clinical details relating to an individual go only to a Departmental employee who is a medical practitioner. Producing clinical material to an audit officer who is not a medical practitioner is not required.
Waiting for the notice to produce before disclosing an error. The 100% reduction in the base penalty is only available before the Chief Executive Medicare contacts you under subsection 129AAD(2) or (3). After contact, the best available is 50%, and after a notice under subsection 129AAD(2), 25%.
Assuming the practice manager or billing company carries the exposure. The factsheet is explicit that health providers are responsible for claims made under their provider number, regardless of who submits claims or receives associated payments. The practitioner owns the exposure.
Discarding records after the request arrives. Section 129AADA requires you to keep any document relevant to whether an amount should have been paid, from the day the notice or request is given until the outcome notice (or, if you seek review, notification of the review outcome). The civil penalty is 20 penalty units for an individual and 100 for a body corporate.
Confusing the audit with a PSR referral. A compliance audit does not assess clinical relevance or competence. A PSR review does, and under the 80/20 rule the referral to the PSR Director is mandatory once a prescribed pattern is identified. Responding to an audit as though it were a PSR review, or the reverse, produces the wrong response.
Frequently asked questions
What is a Medicare compliance audit?
It is an administrative check of whether Medicare benefits were correctly claimed under the Health Insurance Act 1973. It usually begins with a written request for documents, can escalate to a formal notice to produce under section 129AAD, and can end with incorrectly paid amounts recovered as a debt due to the Commonwealth. It does not assess the clinical relevance or competence of a professional service. The Department's MBS audit factsheet describes the process.
How far back can a Medicare compliance audit go?
A notice to produce under section 129AAD can only cover professional services for which a claim was made during the 2 years immediately before the day the written request under subsection 129AAD(3) was first given. The clock anchors to the voluntary request, not the formal notice. Separately, once a request or notice arrives, section 129AADA requires you to keep relevant documents until the outcome notice is given.
What is a notice to produce under section 129AAD?
It is a formal written notice from the Chief Executive Medicare requiring production of documents, extracts or copies relevant to whether amounts paid should have been paid. It can only be issued after you have had a reasonable opportunity to respond to a voluntary written request. It must specify each service, the reasons for the concern, and how documents are to be produced.
Do I have to hand over patient clinical records?
Only where necessary, and only to the right person. The notice must state that you are not expected to produce a document containing clinical details relating to an individual unless it is necessary. Under subsection 129AAD(6), clinical material is not required to be produced to anyone other than a Departmental employee who is a medical practitioner.
What are the penalties for a Medicare compliance audit?
Incorrectly paid amounts are recoverable as a debt due to the Commonwealth, including where a benefit was paid as a result of false or misleading information. An administrative penalty of 20% of the recoverable amount applies where the debt exceeds $2,500, reduced by 100%, 50% or 25% depending on when you voluntarily disclose. Failing to produce under a notice makes the amounts recoverable as a debt.
Is a Medicare compliance audit the same as a PSR review?
No. A compliance audit checks whether benefits were correctly claimed and does not assess clinical relevance or competence. A PSR review asks whether the practitioner engaged in inappropriate practice, a broader clinical test, and can end in repayment, reprimand or disqualification from billing Medicare. Under the 80/20 rule, section 86(1A) makes referral to the PSR Director mandatory once a prescribed pattern of services is identified.
Related terms
Go deeper
Last reviewed