OIG calls on states to tamp down Medicaid provider fraud

The HHS Office of Inspector General wants states to ensure stronger contractual obligations with Medicaid managed care organizations to flag Medicaid provider fraud, the agency wrote in a recent report.

Specifically, OIG called for CMS to work with state agencies to ensure stronger MCO contracts that include language that specifically requires provider fraud referral, provides a timeline for reporting potential fraud and outlines what a state might do should an MCO fail to comply with such guidelines.

This report comes as part of the Trump Administration's overall healthcare fraud crackdown. However, KFF notes that there is no reliable measure of Medicaid fraud, and improper payments should not be conflated with fraud.

Still, provider fraud is among the more common types of Medicaid fraud that gets flagged, KFF noted. According to the OIG, states must leverage their MCO contracts to support the nation's overall efforts to detect fraud.

"Most States contract with MCOs to provide benefits to Medicaid enrollees," OIG wrote in the report. "According to Federal regulations, these contracts must require MCOs to promptly refer any potential fraud they identify to the State and/or [Medicaid Fraud Control Units]. However, in 2025, OIG found that some MCOs made few or no referrals of potential provider fraud in 2022."

OIG used self-reported data from 43 states on how those states work with MCOs to flag and report potential provider fraud. Although most states have contracts, the contract language is generally not strong or specific enough, OIG found.

For example, some states said that their contracts required MCOs to refer "any potential fraud" to the state and/or Medicaid Fraud Control Units. Other contracts used terms such as "credible allegations of fraud."

There were also variable timeframes in which MCOs were required to refer provider fraud, ranging from 1 day to 270 days. Some states did not set a specific timeframe at all. This is despite federal requirements dictating that states must ensure prompt fraud referral.

What's more, OIG found that three of the 43 assessed states were not always specific about what they'd do if an MCO failed to comply with fraud referral requirements.

"According to CMS, although noncompliance with fraud referral requirements is not a required basis for sanction under the relevant Federal regulations, States have flexibility to impose State-specific sanctions in additional areas of noncompliance," OIG noted.

Of the 40 states that did outline corrective actions for noncompliance, most issued civil monetary penalties (35 states), corrective action plans (34 states) and contract terminations (27 states). Three of the 40 states with corrective action language took at least one action against a noncompliant MCO in 2024, OIG said.

It's not just contract language that falls short, the report continued. Some states did not provide fraud referral training or feedback. Additionally, 23 states said that they did not require MCOs to have program integrity staff dedicated specifically to Medicaid managed care and/or that state.

There's some data indicating that training, feedback and staffing work, OIG said. Most states that had completed a CMS program integrity review, which centered on those three key factors, saw an increase in referral volume and quality.

Nearly every state said there are guidelines that CMS could issue to help states increase the volume or quality of MCOs' provider fraud referrals.

These activities include forums for communication across states and MCOs about provider fraud trends, program integrity and fraud referral best practices. States were also in favor of guidance for evaluating the quality of MCO fraud referrals and of standard criteria for determining whether to make a fraud referral.

OIG recommended that CMS work with states to ensure all MCOs are contractually required to refer potential fraud promptly and to specify the actions they can take should MCOs not comply with fraud referral requirements. OIG also suggested CMS assist states in expanding feedback to MCOs for fraud referral practices and assess the feasibility of federal actions that could improve MCOs' provider fraud referrals.

CMS agreed with the first two recommendations, but neither agreed nor disagreed with the remaining ones.

Sara Heath is an executive editor at Xtelligent Healthcare Media, where she covers patient engagement, healthcare policy and health IT.