Medicaid Fraud Referrals Vary Widely Across States, HHS Watchdog Says

States use sharply different rules when Medicaid managed-care organizations refer suspected provider fraud, according to a new evaluation from the U.S. Department of Health and Human Services Office of Inspector General.

The evaluation, released July 21, 2026, found that state contracts set referral deadlines ranging from one day to 270 days. Some contracts did not establish a specific deadline at all. The watchdog said the differences could affect how quickly potential fraud reaches state program-integrity units or Medicaid Fraud Control Units.

What the review found

Most states told HHS-OIG that their contracts required managed-care plans to refer “any potential fraud” to the state or a Medicaid Fraud Control Unit. Other contracts used narrower terms, such as “credible allegations of fraud.”

The contracts also differed in how they described enforcement. A few states reported that their agreements did not specify what actions the state could take if a managed-care organization failed to follow fraud-referral requirements.

HHS-OIG also found gaps in training and feedback. Some states did not provide plans with training on the referral process or regular information about the referrals they submitted, even though those practices could help improve the volume and quality of referrals.

Why federal and state rules both matter

Federal Medicaid rules require managed-care plans to promptly report potential fraud, waste, or abuse to a state Medicaid program-integrity unit or Medicaid Fraud Control Unit. They also require plans to establish clear timelines for those referrals. States retain discretion over how plans submit reports.

That division of responsibility helps explain why contract language matters. The federal standard calls for prompt reporting, but states write and enforce the agreements that tell plans what counts as a referral, when it must be made, what documentation is required, and what consequences may follow from noncompliance.

The report does not establish that Medicaid managed-care organizations committed fraud, nor does it measure total fraud losses or the performance of every plan nationwide. Its focus was the oversight structure surrounding suspected provider fraud referrals.

What CMS agreed to do

HHS-OIG made four recommendations to the Centers for Medicare and Medicaid Services. The recommendations call for CMS to work with states to ensure that plans are contractually required to refer potential fraud promptly, clarify possible state actions when plans do not comply, expand feedback to plans, and assess broader federal actions that could improve referrals.

CMS concurred with the first two recommendations. For the other two, the agency did not explicitly state whether it concurred or disagreed, but said it had undertaken actions related to implementation.

All four recommendations remained open and unimplemented on the HHS-OIG report page. CMS updates were expected by January 15, 2027.

Why readers should care

Medicaid serves millions of Americans, and fraud, waste, and abuse can divert money intended to protect enrollees’ health and welfare. Clear referral procedures can help state and federal investigators identify improper billing and protect public funds.

The practical question now is whether CMS and the states create more consistent standards without slowing legitimate investigations or placing unclear requirements on plans. A 2025 HHS-OIG review found that 10 percent of reviewed managed-care plans reported no referrals of potential provider fraud, waste, or abuse in 2022. It also found that plans receiving state or Medicaid Fraud Control Unit training made more provider referrals, although only half reported receiving that training.

The newer evaluation shifts attention to the state contracts and oversight practices that shape those referrals.

Sources

• HHS-OIG 2026 Medicaid fraud-referral evaluation
• CMS Medicaid managed-care monitoring guidance