CMS Data Validation Audits Are Here. Is Your SNF Ready?

Starting in January 2026, CMS began conducting random data validation audits of skilled nursing facility MDS submissions in iQIES. The program is not new in concept — CMS has validated MDS data accuracy before — but the January 2026 rollout introduced a structured audit cycle with formal selection criteria, mandatory response timelines, and a financial penalty that is both clear and significant.

Facilities selected for a data validation audit receive written notice and have 45 days to respond with clinical documentation supporting their MDS submissions. Failure to respond within 45 days, or inability to provide documentation that supports the submitted codes, results in a 2% reduction in the facility’s Annual Payment Update (APU) for the applicable payment year. For most facilities, that penalty is measurable in six figures.

The selection is random. Being survey-ready does not exempt a facility from data validation. Having a good star rating does not reduce the probability of selection. Any SNF submitting MDS data through iQIES is eligible. The question is not whether your facility could be selected — it is whether your clinical documentation is ready to support every item you have coded if you are. If you are preparing for a state survey, the State Survey Readiness Checklist covers the broader pre-survey audit framework; this guide focuses specifically on MDS data validation.

What Is a CMS Data Validation Audit and Why It Started

A CMS data validation audit is a formal review process in which CMS or its contractors compare a facility’s iQIES MDS submissions against the underlying clinical records to verify that the submitted data accurately reflects resident status at the time of assessment. The goal is to confirm that MDS coding is supported by contemporaneous clinical documentation — not retrospective entries, not care plan language alone, and not staff recollection.

CMS has conducted data validation reviews in various forms for over a decade, but the January 2026 program formalized the process with three specific changes: structured random sampling from iQIES submissions, a defined 45-day response window with automatic penalty consequences, and a centralized audit process managed through the iQIES system itself.

The timing is not coincidental. The Patient Driven Payment Model (PDPM), which replaced RUG-IV in October 2019, substantially increased the financial stakes of accurate MDS coding. Under RUG-IV, coding errors had a relatively linear effect on reimbursement. Under PDPM, coding decisions on Section I (active diagnoses), Section GG (functional abilities), and comorbidity groupings can move a resident between payment categories in ways that were not possible under the prior system. CMS data validation is a direct response to the reimbursement leverage that PDPM coding creates.

The 2% APU reduction penalty structure mirrors the existing enforcement mechanism for facilities that fail to submit required MDS data on time. By using the same APU penalty structure for data accuracy failures as for submission failures, CMS has aligned the consequences for what you submit with the consequences for whether you submit at all.

How Facilities Are Selected for Data Validation

CMS uses random sampling from iQIES MDS submissions to select facilities for data validation audits. The selection is not triggered by a complaint, a prior deficiency, or a star rating threshold. It is, in the most direct sense, a lottery — any facility submitting MDS data through iQIES is eligible every audit cycle.

CMS has not published a detailed methodology for the sampling frame, but the program structure follows the standard audit pattern used in Medicare and Medicaid data integrity programs: a base random sample supplemented by targeted selection criteria for facilities whose coding patterns fall outside expected statistical ranges. This means two things in practice:

• Any facility can be selected. Clean survey history, high star ratings, and recent accreditation do not reduce selection probability in the random sample. The audit is a data integrity check, not a survey compliance review.
• Statistically outlier coding increases targeted selection risk. Facilities with MDS coding patterns — particularly on high-value PDPM items — that differ significantly from peer facilities in their market area, case mix category, or diagnosis group are more likely to be flagged for targeted (non-random) selection in addition to random sampling.

CMS reviews iQIES submissions at the assessment level, not just the facility level. If a facility has 180 completed assessments in a quarter and is selected for data validation, CMS may pull a sample of specific assessment reference dates and request the clinical documentation supporting the MDS items coded for each of those specific assessments.

The 45-Day Response Window — What Happens If You Miss It

When a facility is selected for a data validation audit, CMS issues a formal audit notice through iQIES. The notice identifies the assessment reference dates under review, the MDS items being validated, and the documentation required to support the submission. The facility has 45 calendar days from the date of the notice to submit the requested clinical records.

The 45-day window is not a soft deadline. The APU reduction is triggered automatically for two failure modes:

1. No response within 45 days. If a facility does not submit the requested documentation by the deadline, the 2% APU reduction is assessed without further review.
2. Documentation that does not support the submitted codes. If a facility responds but the submitted clinical records do not support the MDS items being validated, the audit finding triggers the same APU reduction as non-response.

The 45-day timeline is tight when you consider what it requires: identifying the specific resident files involved, pulling clinical documentation from the assessment reference dates (which may be months in the past), compiling the records in the format requested, and submitting through iQIES. Facilities without organized clinical record systems will find 45 days more compressed in practice than it appears on paper.

There is an appeal process. Facilities can contest audit findings through the CMS administrative appeals process, but the appeals timeline is measured in months, and the APU reduction takes effect for the applicable payment year while the appeal is pending. Winning an appeal restores the withheld payment — but the cash flow impact is real during the appeal period.

The 2% APU Reduction — Dollar Impact for a Typical 120-Bed SNF

The 2% Annual Payment Update reduction may sound modest in percentage terms. In dollar terms for a typical skilled nursing facility, it is not.

Consider a 120-bed facility with 80% occupancy (96 beds occupied) and an average daily Medicare rate of $450 per patient day under PDPM. At that rate, annual Medicare revenue is approximately $15.7 million. A 2% APU reduction applied to that revenue stream equals approximately $314,000 in lost reimbursement for the affected payment year.

Facilities with higher Medicare census, higher case mix, or higher geographic wage-adjusted rates face a proportionally larger penalty. A high-acuity facility in a high-cost market could easily see a 2% APU reduction translate to $400,000 or more.

The penalty applies to the entire APU for the affected payment year — not just to the specific assessments under review. A single failed data validation audit affects the payment rate for all Medicare-covered days in the applicable year, not only those associated with the audited assessments. This is why facilities sometimes refer to data validation as an enterprise-level financial risk rather than a documentation compliance issue.

What Auditors Actually Look for During Validation

CMS data validation focuses on the items with the greatest financial impact under PDPM and the highest rate of coding variation across facilities. The documentation standard is consistent: every MDS item coded must be directly supported by clinical documentation in the resident record at or before the assessment reference date. The following areas receive the most scrutiny.

1. Section GG — Functional Abilities and Goals

Section GG drives the physical therapy and occupational therapy payment component under PDPM. Auditors look for therapy evaluations, daily therapy notes, and nursing functional assessments completed within the assessment window that directly support the GG performance codes submitted. The most common finding: GG codes that reflect a higher functional deficit than is documented in the therapy notes. Auditors compare the submitted GG code to the actual performance description in the therapy record — discrepancies are flagged for the most recent 7-day lookback period.

2. Section I — Active Diagnoses

Section I diagnoses determine the primary clinical category and secondary diagnosis groupings under PDPM, both of which have significant rate implications. Auditors verify that each diagnosis coded in Section I is documented as active in the medical record — physician orders, nursing notes, or care plan entries dated within the assessment window. Diagnoses documented in the billing record, care plan template headers, or historical problem lists without active clinical notation are frequently challenged. A diagnosis must be actively managed or monitored during the assessment period to qualify as active under MDS coding conventions.

3. Assessment Timing and Completion

Each MDS assessment type has defined lookback periods and completion windows. Auditors verify that the assessment reference date, observation dates, and RN attestation date fall within the required timeframes. They also check that care area assessments (CAAs) triggered by the MDS were completed, documented, and used in care planning. Late completions, RN signature dates that post-date the required completion window, and CAAs that were triggered but not documented are common audit findings.

4. Care Plan Alignment

Data validation auditors are not conducting a care planning review — but they do check whether the care plan reflects the clinical picture coded in the MDS. An MDS that codes a resident as requiring extensive assistance with bed mobility must be accompanied by care plan entries, nursing notes, and restorative care documentation that reflect the same level of need during the assessment period. Care plans that reflect a significantly different functional or clinical picture than the MDS coding are an indirect indicator of documentation integrity problems.

5. Section J — Health Conditions

Section J items including pain assessment (J0300–J0600), falls history (J1700), and health conditions (J1100) require specific documentation. Pain coding must be supported by a pain assessment using a standardized tool within the 5-day lookback period. Falls coding must be supported by documented fall events in the nursing notes. Auditors cross-reference Section J codes against nursing notes and flow sheet entries from the lookback window.

10-Point Preparation Checklist for MDS Coordinators

Use this checklist to assess your facility’s data validation readiness before an audit notice arrives. Each item addresses a specific documentation gap that CMS data validation audits consistently identify. The goal is not to prepare for any specific audit — it is to ensure that every MDS assessment is audit-ready at the moment it is signed.

How to Maintain Audit-Ready Documentation Year-Round

Data validation audits are conducted on historical MDS submissions — the assessments you signed months ago, not the ones you are working on today. Audit readiness is a trailing indicator: the documentation quality decisions made in prior months determine your audit exposure today. The following practices address the structural causes of documentation gaps rather than the symptoms.

Establish a concurrent documentation standard

Documentation that supports MDS coding must be entered in the clinical record at or before the assessment reference date — not afterward. Nursing flow sheets, therapy notes, physician orders, and care plan entries should reflect real-time resident status. Backdated or retroactive entries cannot support MDS submissions in data validation because auditors can cross-reference documentation dates against the assessment submission timestamp. Build a unit-level workflow that ensures nursing notes and functional assessments are completed before the MDS coordinator reviews them for coding.

Close the loop between therapy and MDS

Section GG coding discrepancies are the most common data validation finding — and they are almost entirely preventable through better coordination between the therapy department and the MDS coordinator. Establish a weekly review process in which the MDS coordinator reviews the current therapy documentation against the pending GG coding before the assessment is signed. Any discrepancy between the therapy note language and the proposed GG code should be resolved before submission, not after an audit notice arrives.

Use the CMS data specifications manual as a training tool

The CMS MDS 3.0 Data Specifications Manual and the SNF PDPM Clinical Complexity Interview materials describe exactly what documentation is required to support each item. Both are publicly available through the CMS website. MDS coordinators who have read the specifications for the items they code most frequently — particularly Section GG and Section I — are significantly less likely to submit assessments with documentation gaps. Incorporate sections of the specifications into your annual MDS training curriculum rather than relying on coding summaries alone.

Audit Section I against active orders quarterly

Section I active diagnosis coding tends to drift over time as care plans are updated and physician orders change. Establish a quarterly process in which the MDS coordinator reviews the active diagnoses coded in Section I against the current physician orders and medication administration records. A diagnosis coded in Section I that is not referenced in any active order, nursing note, or care plan within the prior 30 days should be reviewed for continued active status before the next assessment cycle.

Document your compliance program

If your facility is selected for data validation, having documentation of your internal compliance program — quarterly accuracy audits, staff training records, the correction of identified gaps — is not a substitute for accurate MDS coding. But it is evidence that your facility operates a functional data integrity program, which affects how audit findings are characterized and can support the appeals process if you contest a finding. Keep records of every internal audit, every staff training session, and every corrective action taken as a result of internal review.

Frequently Asked Questions

Key Takeaways

1. CMS data validation audits began in January 2026 and use random sampling. Selection is not triggered by deficiency history, star rating, or survey timing. Any facility submitting iQIES MDS data is eligible every audit cycle.
2. The 45-day response window is hard. The penalty — a 2% APU reduction — triggers automatically for both non-response and for documentation that cannot support the submitted MDS codes. There is no grace period.
3. The financial impact is enterprise-level. A 2% APU reduction for a mid-size facility ranges from $160,000 to over $400,000 depending on Medicare census and average daily rate. The penalty applies to the full payment year, not just the audited assessments.
4. Section GG and Section I are the highest-risk coding areas. These drive the largest rate differentials under PDPM and receive the most auditor scrutiny. Every code in these sections must be supported by contemporaneous clinical documentation from the assessment lookback window.
5. Audit readiness is a daily practice, not a pre-audit project. CMS audits historical submissions. Documentation decisions made months ago determine your audit exposure today. Concurrent documentation — entered at or before the assessment reference date — is the only documentation that counts.
6. Monitor iQIES notifications weekly. The 45-day clock starts from the notice date, not the day you see it. Designate a responsible party and check iQIES at minimum once per week.
7. Internal quarterly audits are the best early warning system. A facility that audits its own MDS accuracy quarterly, documents the findings, and corrects gaps in subsequent assessments has both better audit outcomes and a defensible compliance record to support any appeal.