Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
 
S CMS O
TA TE AND    VERSIGHT OF 
 
M M C
THE  EDICAID  ANAGED  ARE 
 
C  P  
REDENTIALING  ROCESS 
 
 
 
Daniel R. Levinson   
Inspector General  
 
November 2013 
OEI-09-10-00270   
   
EXECUTIVE SUMMARY:  State and CMS Oversight of the Medicaid 
Managed Care Credentialing Process  
OEI-09-10-00270 
 
WHY WE DID THIS STUDY 
 
The Centers for Medicare & Medicaid Services (CMS) issued regulations that States 
must comply with to ensure the delivery of quality health care to Medicaid beneficiaries 
under managed care.  To do so, States must establish uniform provider credentialing 
policies and include Federal credentialing provisions in contracts with Medicaid 
Managed Care Entities (MCEs).  States must also monitor MCEs compliance with these 
Federal provisions and any additional State credentialing requirements in contracts.  
 
HOW WE DID THIS STUDY  
 
We purposively sampled 6 States and 234 MCEs that included the 3 types of MCEs 
subject to the Federal credentialing regulations.  To determine the extent to which States 
complied with the Federal regulations, we reviewed State documents, such as laws, 
administrative codes, State-issued policy letters, and 32 State contracts with MCEs.  To 
determine whether States monitored MCE compliance with contracts, we reviewed 
States auditing documents and interviewed State staff.  To examine CMSs oversight of 
States contracts, we reviewed 32 checklists used by CMS regional office staff to  
evaluate compliance of the 32 State contracts with the Federal credentialing provisions.  
 
WHAT WE FOUND 
 
All six States credentialing policies and MCE contract provisions met Federal standards.    
However, five of six States did not monitor MCEs compliance with the Federal provider 
nondiscrimination contract provision.  This provision requires that MCEs not 
discriminate against providers that serve high-risk populations or that specialize in 
conditions requiring costly treatment.  Also, CMS oversight to ensure the compliance of 
State contracts was inconsistent.  Our review of 32 checklists showed that CMS regional 
office staff did not indicate whether 25 percent of contracts met all Federal credentialing 
provisions and many checklists were missing other required contract information. 
 
WHAT WE RECOMMEND  
 
We recommend that CMS issue guidance to States on monitoring MCE compliance with 
the Federal provider nondiscrimination contract provision.  We also recommend that 
CMS regional office staff accurately complete the checklist to ensure State compliance 
with the Federal credentialing provisions. 
 
 
 
   
   
TABLE OF CONTENTS 
 
Objectives .................................................................................................. 1 

Background................................................................................................ 1 

Methodology.............................................................................................. 5 

Findings.................................................................................................... 10 

All six States credentialing policies and MCE contract           

provisions met Federal standards ................................................. 10 

Five of six States did not monitor MCEs compliance with the 

Federal provider nondiscrimination contract provision ............... 10 

CMS oversight of the compliance of State contracts was 

inconsistent .................................................................................. 11 
 
Conclusion and Recommendations .......................................................... 14 

Agency Comments and Office of Inspector General Response ... 15 

Appendixes .............................................................................................. 16 

A: The Centers for Medicare & Medicaid Services Checklist
       
for Review of States Contracts With Managed Care Entities ..... 16 

B: Types of Medicaid Managed Care Enrollment by Selected 

States............................................................................................ 17 

C: Selected Criteria for Six States Uniform Credentialing and 

Recredentialing Policies............................................................... 18 

D: Additional State Credentialing and Recredentialing 

Requirements ............................................................................... 19 

E: Agency Comments  ................................................................. 21 

Acknowledgments.................................................................................... 23 

 
 
   
   
OBJECTIVES 
1. 	  To determine the extent to which States establish uniform  
credentialing policies and include the Federal credentialing provisions 
in contracts with Medicaid Managed Care Entities (MCEs). 
2.	   To determine the extent to which States monitor MCEs compliance 
with the Federal credentialing contract provisions and State 
credentialing requirements. 
3.	   To examine the Centers for Medicare & Medicaid Services (CMS) 
oversight of the compliance of State contracts with the required 
Federal credentialing provisions.  
BACKGROUND 
Medicaid Managed Care 
States are increasingly adopting managed care as a response to growing 
Medicaid expenditures.1,  2  Nationally, Medicaid enrollment grew from         
36.5 million3 in 2001 to 57.1 million in 2011.4  Of these 57.1 million 
Medicaid beneficiaries, 74 percent were enrolled in managed care.5   
During a similar period, State Medicaid expenditures increased from      
$89 billion to an estimated $156 billion, accounting for an estimated 
24 percent of States expenditures in 2011.6  Total Medicaid expenditures 
more than doubled from approximately $200 billion in 2000 to 
$432  billion in 2011.7  
MCEs 
States contract with MCEs to provide or arrange for health care services 
on a Statewide or community basis. On the basis of these contracts, an 
MCE is paid a fixed prospective payment for each beneficiary enrolled 
 
1  Robert Wood Johnson  Foundation,  Medicaid Managed Care: Cost, Access, and Quality 
of Care, Research Synthesis Report No. 23, September 2012. pp. 1-4. 
  
2 Managed care is a health care delivery system  that aims to maximize efficiency by 

negotiating rates, coordinating health care, and managing the use of services.
  
3 CMS, National Summary  of  Medicaid Managed Care Programs and Enrollment  as  
July 2010. Accessed at http://www.cms.gov on  April 30, 2013. 

4 CMS, National Summary  of  Medicaid Managed Care Programs and Enrollment  as 
 
July 2011. Accessed at http://www.cms.gov on  April 30, 2013. 

5 CMS, 2011 Medicaid Managed Care Enrollment. Accessed at https://www.cms.gov/  
on  April 23, 2012.  

6 National Association of State Budget Officers, 2010 State Expenditure  Report, pp.  

44-45. Accessed at http://www.nasbo.org/publications-data/state-expenditure-report on 
  
March 28, 2012. 

7 CMS, 2011 Actuarial Report on the Financial Outlook for Medicaid, 2012.  Accessed at 

http://www.cms.gov  on June 22, 2012. 
 
1 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
with the MCE.  This fixed payment amount is referred to as the 
capitated  rate. 
There are various types of MCEs, including Managed Care Organizations 
(MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory 
Health Plans (PAHPs).8,  9  An MCO provides health care services through 
a comprehensive risk contract with the State.10, 11  PIHPs and PAHPs 
provide health care services under a managed care contract with the State, 
but those entities do not have comprehensive risk contracts.  PIHPs 
generally provide inpatient or institutional services (e.g., mental health 
services), and PAHPs generally provide outpatient services (e.g., dental 
services). For purposes of this report, we refer to MCOs, PIHPs, and 
PAHPs collectively as MCEs.  
Federal Credentialing Contract Provisions 
The Balanced Budget Act (BBA)12 provided a framework for CMS and 
States to improve the oversight of managed care.  (In 2002, consistent with 
the BBA, CMS issued a final rule that mandated new Federal provisions 
that States must include in their contracts with MCEs.13) These provisions 
address provider selection standards that States must follow to ensure the 
delivery of quality health care.14  
Federal regulations give States considerable latitude to create their own 
uniform credentialing and recredentialing policies and procedures (which 
we refer to in this report collectively as credentialing policies).  
However, these Federal regulations established provider selection 
standards that require States to (1) establish uniform credentialing policies 
 
8 The other four types of MCEs identified  by  CMS for purposes of tracking  enrollment 
include:  (1) Primary Care Case Management Providers, (2) Health  Insuring  
Organizations,  (3) Programs for All-Inclusive Care for the  Elderly, and (4) Other.   
9 MCOs, PIHPs, and PAHPs are subject to the Federal requirements for provider  
credentialing.  42  CFR  438.214. 
  
10 Comprehensive risk contracts cover inpatient  hospital services and three or more of the 

following services:  outpatient hospital services; rural health clinic services; federally 

qualified  health center services; laboratory and x-ray services; nursing facility services; 

early and  periodic screening,  diagnostic, and treatment services; family planning services; 

physician services; and home health services. 

11 MCOs are defined in Federal regulations as entities that meet certain Federal 

requirements and have a comprehensive risk contract with the State.  In a risk contract, 

the MCE assumes risk for the cost of the services covered under the contract and incurs 
 
loss if the cost exceeds the payments.  42 CFR  438.2.  

12  BBA, P.L. 105-33,  4701-4710. 
13 67 Fed. Reg. 40989-40990 (June 14, 2002).  Accessed at 
https://www.federalregister.gov  on April 23, 2012. 
14 67 Fed. Reg. 40989, 41031  (June 14, 2002). 
2 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
and (2) in State contracts with MCEs, require that MCEs do the  
following:15,  16, 17  
 	  follow the States uniform credentialing policies,18  
 	  follow a documented process for credentialing providers that have 
signed contracts or participation agreements with MCEs,19  
	   not discriminate against providers that serve high-risk populations 
or specialize in conditions that require costly treatment,20, 21 and  
	   follow any additional requirements established by the State.22   
Provider Credentialing and Recredentialing 
Although Medicaid regulations do not define credentialing or 
recredentialing, for the purposes of this report, we define credentialing as 
an evaluation of the qualifications of health care providers (providers) that 
seek contracts or participation agreements with an MCE.23  The 
credentialing process typically includes steps such as the verification of 
information on provider applications, site reviews of provider offices, and 
determination of eligibility for payment under Medicaid.  Recredentialing 
is the periodic update of credentialing information and may also include 
provider performance data, such as beneficiary complaints, and 
pay-for-performance and value-driven health care outcomes24 to ensure 
that providers furnish quality health care.       
State Monitoring of MCEs 
States are responsible for monitoring MCE compliance with contract 
provisions, including the Federal provider selection standards and any 
credentialing requirements established by the State.25  States decide how 
 
15 42 CFR    438.200 and 438.204(g). 
 
16 42 CFR   438.214(a) and  (b).  

17 One additional requirement is that MCEs may not employ  or contract with  providers 

excluded from participation in Federal  health care programs.  42 CFR   438.214(d). 
 
18 42 CFR   438.214(b)(1). 

19 42 CFR   438.214(b)(2). 

20  42  CFR  438.214(c).  

21 High-risk  populations include, but are not limited to, adults and children  with special 

needs, such those with: mental illness, substance abuse problems, developmental 

disabilities and functional disabilities, or complex problems involving multiple medical 

and social needs like HIV/AIDS and homelessness. 
  
22 Federal regulations authorize the States to establish additional standards for their 
credentialing  policies.  42 CFR   438.214(e). 

23 We based our definition of  credentialing on CMSs Medicare Managed Care Manual, 

Pub. No. 100-16, ch. 6,  60.3.  

24 Pay-for-performance links health care spending to  quality and effectiveness.  The 

Commonwealth Fund, Pay-For-Performance in State Medicaid Programs: A Survey of 

State Medicaid Directors and Programs, April  2007. 
 
25 42 CFR   438.8(b)(6), 438.202(c), and  438.12. 
3 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
they monitor MCEs.26  For example, States may conduct compliance 
audits of MCEs. Typically these audits include the use of compliance 
tools, such as procedural documents and checklists.  Federal regulations 
require States with certain types of MCE contracts to conduct external 
quality reviews (EQRs) to ensure the delivery of quality health care.27, 28   
These regulations mandate that States conduct three types of EQR 
activities, one of which includes a review to determine MCE compliance 
with the Federal provider selection standards.29, 30,  31  
CMS Oversight of States 
Federal regulations specify that CMS regional offices must review and 
approve State contracts with MCEs.32, 33  CMS implemented the use of a 
Checklist for Managed Care Contract Approval (checklist) that regional 
office staff use when evaluating State contracts with MCEs.34  Figure 
1  illustrates this review process.  
 
 
 
 
 
26 States do not perform credentialing functions.  States, in their contracts with MCEs, 

include all credentialing requirements for MCEs to  perform.  States must monitor how 

MCEs comply with contract provisions. 

27 MCOs and PIHPs are subject to EQR regulation.  42 CFR pt. 438. 
 
28 States may choose an external quality review organization (EQRO), a qualified non-

EQRO organization, or may designate another State department to perform  the EQR. 
  
However, an independent agency, such as an EQRO, must  draft the  final EQR report.    

42  CFR  438.354. 
 
29 The review to  determine compliance with  Federal standards, State requirements, and 

other applicable  contract provisions includes  the previous 3-year period.  42  CFR pt. 438. 
   
30 The other two mandatory activities include validation  of performance measures 

outlined  by the State during the previous 12  months and  validation  of performance 

improvement projects required by  the State.  42  CFR  438.240(b)(1) and 
 
438.240(b)(2). 
 
31 There are five  optional EQR activities to assess MCO and  PIHP performance.  
          
42  CFR pt. 438. 
 
32 In some cases, CMS may review and approve model contracts.  Model contracts exist 

where there are multiple types of  health care plans that a State contracts with MCEs for, 

such as acute-care and long-term-care plans.  After being approved by CMS, the model
  
contract serves as the template for States to  write individual MCE contracts.  For 

example, a model contract may exist for all acute-care MCOs within a county or for all 

MCOs in the entire State. 

33 Federal regulations specify that CMS must review and approve all MCO, PIHP, PAHP, 

and PCCM contracts.  42 CFR   438.6(a). 

34 Although there is no  regulatory requirement for CMS to  use a checklist in the review 

process, CMS has an internal  policy that staff must use the checklist for the contract to be  

approved and released to the State.  

4 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
Figure 1: CMS Review  Process  
CMS 
regional
CMS regional office staff 
offices receive   use the  Any instances Upon
the State's  checklist to  of blank or  approval of
contracts.   evaluate  insufficient   the 
These  contract  contract  contracts,   
contracts  provisions documentation  the State 
contain  for  are addressed   writes 
Federal  compliance with the State  individual 
provider with  by CMS contracts 
selection  Federal  regional office.   with MCEs. 
standards.  provider
selection 
standards. 
 
 
Source:  OIG analysis of 32 CMS checklists and interviews with CMS regional office staff, 20112012. 
The checklist is intended to assist CMS regional office staff in 
determining whether the contracts comply with all Federal statutory and 
regulatory requirements, including the Federal provider selection 
standards.35  When completing the checklist, CMS regional staff are 
required to cite evidence from the contract (e.g., section and page number 
from the contract or supporting documentation) to support their 
assessment that the contract was compliant with each requirement.  
Regional office staff address any instances of absent or insufficient 
contract documentation with State staff during contract reviews. 
The checklist also requires the contract to include the following:  the name  
of the CMS reviewer, the name of the State, the contract period, the name  
of the MCE, the type of program, the type of MCE (e.g., MCO, PIHP, or 
PAHP), the type of review (e.g., initial contract or contract renewal), and 
the date that CMS staff reviewed the contract.  (See Appendix A for 
credentialing checklist items.)  Multiple CMS reviewers may complete 
portions of the checklist during contract review.  CMS is revising the 
checklist and expects to complete the revisions in 2013. 
METHODOLOGY 
Scope 
Our evaluation determined the extent to which the six selected States 
established uniform credentialing policies and included the required 
 
35 Statutory references and regulatory requirements include applicable sections of the  
Code of Federal Regulations, the State Medicaid  Manual, State Medicaid Directors 
Letters, and the Social Security Act (SSA). 
5 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
Federal credentialing provisions in contracts with MCEs.36  All of the 
State policy documents and contracts with MCEs that we collected were in 
effect during 2011.  We also determined the extent to which States 
monitored MCE compliance with Federal credentialing contract 
provisions and any State-established credentialing requirements.  We  
collected States most recent compliance audits of MCEs,37 which were 
from 2010; States most recent compliance tools, which were from  
2011  and 2012; and States most recent EQRs, which were from 2010 and 
2011.38  
We examined CMSs oversight of the compliance of State contracts with 
Federal credentialing provisions. We focused on the credentialing section  
of the checklist and collected checklists for active contracts with States.  
Finally, we analyzed data from interviews we conducted with CMS and 
State staff during 2011 and 2012. 
Sample Selection 
We purposively selected six StatesArizona, California, Florida, 
New York, Pennsylvania, and Texas.  We selected Arizona because it has 
some of the oldest contracts with MCEs in the United States.  We selected 
five additional States to include those with the greatest total numbers of  
MCEs per State and the largest percentages of Medicaid beneficiaries 
enrolled in these MCEs as of July 2010 (see Table 1).39,  40  Collectively,  
these six States represented 37 percent of total Medicaid managed care 
enrollment and 46 percent of the total number of Medicaid MCEs 
nationwide.41  
Within the six States, we included only the three types of MCEs that are 
subject to the Federal credentialing provisions:  MCOs, PIHPs, and 
PAHPs.  These totaled 234 MCEs. Collectively, these three types of 
MCEs represent 86 percent of Medicaid beneficiaries enrolled in managed 
care in the six States. (See Appendix B for details about the number of 
Medicaid beneficiaries enrolled in all types of MCEs.) 
 
36 For the purposes of this report, we did not assess compliance with the provider 

selection standard relating to excluded providers.  A  February 2012 OIG report 

Excluded Providers in Medicaid Managed Care Entities, OEI-07-09-00630focused on  

this requirement. 
 
37 Some States conduct compliance audits annually, whereas other States conduct them at 

intervals ranging from 1 to 3  years.   

38  EQRs are conducted every 3 years.  

39 CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 

40 For sampling purposes, we included all seven types of MCEs that CMS identifies for 

purposes of tracking enrollment:  (1) Medicaid and Commercial MCOs, (2) PIHPs,  
            
(3) PAHPs, (4) Primary Care Case Management Providers, (5) Health Insuring  
Organizations,  (6) Programs for All-Inclusive Care for the  Elderly, and (7) Other.  
41 CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 
6 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
The 6 States are under the oversight of 5 of the 10 CMS regional offices.  
As part of our evaluation, we interviewed staff from these five regional 
offices. 
Table 1: Medicaid Managed Care Enrollment in Six Sampled States  
Medicaid Beneficiaries  
Total   Total Number 
Number  Total Number  Enrolled in   Percent Enrolled in 
of MCEs  Enrolled in   Medicaid   Medicaid Managed 
State   in State   Medicaid   Managed Care   Care 
California  47  7,326,862   4,033,378   55%  
New York   61  4,740,518   3,226,755   68%  
Texas  25  3,763,896   2,520,307   67%  
Florida  69  2,853,392   1,839,940   64%  
Pennsylvania  67  2,029,591   1,658,059   82%  
Arizona  30  1,322,359   1,196,192   90%  
Purposive  
Sample of Six  29942  22,036,618   14,474,631   66%  
States 
All Other  
356  32,575,775   24,545,244   75% 
States 
   Total   655  54,612,393   39,019,875   71%  
Source:  CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 
 
Data Sources and Data Collection 
 
State establishment of uniform policies and inclusion of the required 
Federal credentialing provisions in contracts with MCEs. From the six 
States, we collected State contracts with MCEs and other State documents, 
such as State laws, administrative codes, and State-issued policy letters.  
We grouped the contracts into 32 types; each type corresponded to a 
contract or model contract that the States used for writing individual MCE 
contracts. 
State monitoring of MCE compliance with contract provisions. To 
determine whether States monitored MCEs, we conducted onsite and 
followup telephone interviews with State staff who were responsible for 
contract oversight and MCE monitoring.  We collected documents that 
substantiate States monitoring of MCEs, including compliance audits; 
audit compliance tools, such as procedures and checklists; and EQRs.  
From these six States, we collected only the credentialing sections of 
audits from 2010.  In addition, the six States provided us with their 
credentialing policy documents, such as manuals, for all MCEs. 
 
42 Although there was a total of 299 MCEs among the 6 sampled States, we included only 
the 3 types of  MCEs subject to the Federal credentialing  provisions.  These totaled  
234  MCEs. 
7 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
CMS oversight of the compliance of State contracts with required Federal 
credentialing provisions. We collected 32 checklists from the 5 CMS 
regional offices that had oversight of the 6 sampled States.  These 
32 checklists were used by CMS to review the 32 contracts used by the 
States to write individual MCE contracts.  We conducted telephone 
interviews with CMS staff in the five CMS regional offices and in the 
central office about their use of the checklists to review and approve 
managed care contracts.  We also asked CMS central office staff whether 
they provided guidance to regional offices about checklist use. 
Data Analysis  
State establishment of uniform policies and inclusion of the required 
Federal credentialing provisions in contracts with MCEs. We reviewed 
State documents, such as State laws, administrative codes, and State-
issued policy letters, to determine whether States established uniform  
credentialing policies.  We then reviewed the 32 contracts to verify that the 
States required MCEs to: 
 	  follow the States uniform credentialing policies,  
 	  follow a documented process for credentialing providers that have 
signed contracts or participation agreements with MCEs, 
 	  not discriminate against providers that serve high-risk populations 
or specialize in conditions that require costly treatment,  and 
 	  follow any additional requirements established by the State.   
State monitoring of MCE compliance with contract provisions.  We  
analyzed our interview responses from State staff to understand how the 
six States monitored MCEs compliance with Federal contract provisions 
and any State-established credentialing requirements.  We then reviewed 
compliance audits and audit compliance tools provided by the six States 
and EQRs provided by two States to substantiate our onsite interview 
responses.43  In addition, we reviewed all the MCEs credentialing policy 
documents to verify that each MCE had written credentialing policies.  To  
determine whether these documents complied with the Federal 
credentialing provisions, we compared them to the State contracts with 
MCEs. 
CMS oversight of the compliance of State contracts with required Federal 
credentialing provisions.  We reviewed the 32 CMS checklists to 
determine whether regional office staff completed the checklists 
accurately when reviewing the contracts.  To determine whether staff 
 
43 We  excluded EQRs from  four of our six States because their most recent EQRs were 
conducted  prior to 2010. 
8 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
verified that the contracts complied with the Federal credentialing 
requirements, we compared the checklists with the contracts.   We analyzed 
our interviews with CMS regional and central office staff to supplement 
and validate our understanding of how regional office staff evaluate 
compliance of State contracts and complete the checklists.  
Limitations 
The results of our analyses are limited to the purposive sample of the  
6 States we selected and their 234 MCEs.  We do not project these results 
on a national basis. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
9 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
FINDINGS 
All six States credentialing policies and MCE contract 
provisions met Federal standards  
All six States established uniform credentialing policies, such as State 
laws, administrative codes, and State-issued policy letters.  (See   
Appendix C for the criteria that these States required in their uniform  
policies.) In addition, all six States included the required Federal 
credentialing provisions in their contracts with MCEs, which required 
MCEs to: 
 	  follow the States uniform credentialing polices, 
 	  follow a documented process for credentialing providers that have 
signed contracts or participation agreements with MCEs,  
 	  not discriminate against providers that serve high-risk populations 
or specialize in conditions that require costly treatment, and  
 	  follow additional requirements established by the State. 
With respect to the additional requirements established by the States, all 
six States required that MCEs: use a peer review credentialing committee 
to evaluate provider credentialing files, conduct onsite reviews of 
physician offices, use provider performance data during recredentialing, 
and notify the State if a provider is suspended or terminated from the 
MCE network.  (See Appendix D for more information about the States 
additional requirements.) 
Five of six States did not monitor MCEs compliance 
with the Federal provider nondiscrimination contract
provision 
All six States monitored MCE compliance with three of the four Federal 
credentialing contract provisions and all State-established credentialing 
requirements.  However, five of six States did not monitor MCEs 
compliance with the Federal contract provision to not discriminate against 
providers that serve high-risk populations or that specialize in conditions 
that require costly treatment.  These five States 2011 and 2012 auditing 
tools (e.g., procedures and checklists) did not address MCE compliance 
with this requirement, nor did their 2010 compliance audits or the 
2010  and 2011 EQRs.  In addition, during our initial onsite interviews and 
followup interviews, staff from the five States could not indicate how they 
monitored this requirement.  During followup interviews with staff from  
the five States, some staff reported that MCEs complied because it was 
required in contracts. Other States staff reported that MCEs would not 
need to comply because the MCEs would not discriminate against 
10 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
providers. In those instances, the MCEs had contracts or participation 
agreements only with providers that served specialized populations (i.e., 
children under 21 with social and behavioral problems). 
In addition, in three of the five States that did not monitor MCE 
compliance with the provider nondiscrimination contract provisions, nine 
MCEs lacked the nondiscrimination requirement in their policies.  Our 
interviews with State staff and our review of MCE credentialing policy 
documents showed that staff in these three States were unaware that the 
nine MCEs lacked this requirement in their policies. 
CMS oversight of the compliance of State contracts 
was inconsistent 
CMS regional office staff are required to indicate on the checklist whether 
State contracts with MCEs comply with all Federal credentialing 
provisions. However, CMS staff did not always indicate whether 
contracts with MCEs met Federal credentialing provisions, and many 
checklists were missing other required information.   
CMS regional office staff did not indicate whether 25 percent 
of State contracts with MCEs met Federal credentialing 
provisions 
In 25 percent of CMS reviews (8 of 32 checklists), we found that regional 
office staff did not indicate whether contracts were compliant with all 
Federal credentialing provisions. Our review of the checklists identified 
three ways in which staff did not indicate whether contracts were 
compliant: 
(1)  Checklists were incomplete. Staff in two CMS regional offices 
only partially completed State contract reviews of six checklists.  
Although staff indicated that they reviewed State contracts, they 
did not indicate whether these contracts complied with all Federal 
credentialing provisions on the checklists.  
(2)  Checklist documentation was contradictory. Staff in one CMS 
regional office indicated on a checklist that a States contract with 
an MCE was both compliant and noncompliant with the Federal 
credentialing provisions. For example, on one section of the 
checklist, staff indicated that the contract included the Federal 
provider nondiscrimination provision; on another section of the 
checklist, staff indicated that this contract provision was missing.  
In this instance, CMS regional office staff could not explain this 
internal contradiction. 
(3)  Checklist incorrectly indicated compliance with Federal provision. 
Staff in one CMS regional office incorrectly indicated on the 
11 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
checklist that the Federal provider nondiscrimination provision 
was not an applicable contract requirement.  In this instance, staff  
indicated that these were contracts with MCEs that, upon 
enrollment, served high-risk populations and thus did not need to 
comply with this Federal provision.  However, all State contracts 
are subject to the Federal credentialing provisions and must be 
evaluated for compliance by CMS.  Failure to indicate on the 
checklist whether contracts comply with all Federal credentialing 
provisions may lead to inconsistent oversight by staff within the 
CMS regional offices. 
Many checklists were missing other required contract 
information  
All 5 CMS regional offices approved 15 of the 32 contracts (47 percent) 
with checklists that were missing required information other than whether 
the MCEs met Federal credentialing provisions.  The 4 most common 
types of information missing from the 15 checklists were the name of the 
CMS reviewer, the contract period, the date of contract review, and the 
type of review (see Table 2).  
 
Table 2: Required Information Missing on CMS Checklists  
 
for Reviews of State Contracts With  MCEs 
 
Number of   
  Checklists 
Required Items on the Checklist 
Missing Items 
 
(n=32)  
 
Name of CMS reviewer   11 
 
  Period of State contract with MCE   6 
 
 
  Date of CMS review  of State contract with MCE   5 
 
 
Type of review (e.g., initial, renewal, amendment)   5 
Type of program44 (e.g., waiver type or State plan 
3 
amendment)  
Name of State   1 
Name of MCE   1 
Type of entity  (e.g., PIHP, PAHP, MCO)   0 
Source:  OIG analysis of 32 CMS checklists, 2011. 
 
 
44 States provide services to eligible Medicaid beneficiaries through MCEs  under State 
plan amendments or waiver programs.  Amendments and waivers must conform to the 
Medicaid program requirements specified in  the SSA.  Waivers allow States more 
flexibility and also control Medicaid spending.  
12 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
Five of the fifteen checklists were missing two or more types of 
information.  For example, one checklist did not include the name of the 
CMS reviewer who completed the contract review, the dates of contract 
review, and the name of the State.  These 15 checklists were used to 
review and approve contracts between all 6 States and MCEs.  The lack of 
required contract information on the checklist could contribute to 
ineffective oversight.  For example, when a State amends its contracts 
with MCEs, CMS regional office staff will reference the checklists and the 
contracts. In one instance, a new staff member from one CMS regional 
office could not identify a previously approved State contract because 
information was missing from  the corresponding checklist.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
13 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
CONCLUSION AND RECOMMENDATIONS 
All six States credentialing policies and provisions for contracts with 
MCEs met Federal standards.  However, States are also required to 
monitor MCEs compliance with these contracts.  Five of six States did 
not monitor MCEs compliance with the Federal provider 
nondiscrimination contract provision.  This provision requires that MCEs 
not discriminate against providers that serve high-risk populations or that 
specialize in conditions requiring costly treatment.  Also, CMS oversight 
of the compliance of State contracts was inconsistent.  Our review of 
32 checklists showed that CMS regional office staff did not indicate 
whether 25 percent of contracts met all Federal credentialing provisions, 
and many checklists were missing other required contract information.  
We recommend that CMS: 
Issue Guidance to States on Monitoring MCE Compliance With 
the Federal Provider Nondiscrimination Contract Provision 
CMS could issue a State Medicaid Directors letter emphasizing States  
obligation to monitor MCEs compliance with the provider 
nondiscrimination provision.  Guidance could include methods for 
monitoring compliance with this provision.  In addition, CMS could work 
with States to help identify methods for monitoring compliance with this 
provision. CMS could also require that States include the provider 
nondiscrimination requirement as part of their existing monitoring 
activities, such as compliance audits, compliance tools, or protocols. 
Have CMS Regional Office Staff Accurately Complete the 
Checklist To Ensure State Compliance With the Federal 
Credentialing Provisions 
To ensure that regional offices oversee the compliance of State contracts 
with the Federal credentialing provisions, CMS could implement a process 
to ensure that its regional office staff complete the checklist when 
evaluating compliance with the Federal credentialing requirements.  CMS 
could also provide additional education and training to all regional office 
staff on how to document whether State contracts with MCEs are 
compliant with all Federal credentialing provisions. 
 
14 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
CMS concurred with both of OIGs recommendations and will implement 
changes to address them. 
CMS concurred with our first recommendation, that it issue guidance to 
States on monitoring MCE compliance with the Federal provider 
nondiscrimination contract provision.  CMS stated that it is preparing such 
guidance, which may be issued as soon as mid-2014.   
CMS concurred with our second recommendation, that it have regional 
office staff accurately complete the checklist to ensure State compliance 
with the Federal credentialing provisions.  CMS stated that to better ensure  
that regional office staff complete the checklist accurately and thoroughly 
when evaluating compliance with the Federal credentialing provisions, it 
is developing an electronic checklist.  This improved checklist template is 
expected to be operational in early 2014.  CMS will train regional office 
staff on the purpose and use of the template.  In the interim, CMS will 
reiterate the importance of fully completing the checklist to each of its 
10  regional offices. 
We did not make any changes to the report based on CMSs comments.  
The full text of CMSs comments is provided in Appendix E. 
15 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
 
APPENDIX A 
The Centers for Medicare & Medicaid Services Checklist for 
Review of States Contracts With Managed Care Entities  
The Centers for Medicare & Medicaid Services (CMS) regional offices 
must review and approve States contracts with Medicaid Managed Care 
Entities (MCEs).45  The Checklist for Managed Care Contract Approval 
(checklist) is intended for use by regional office staff to evaluate these 
contracts. The checklist instructions indicate that CMS regional office 
staff are to compare the Subject column in the checklist with the 
language in the contract to determine whether the contract contains the 
required language. CMS regional office staff are to enter in the Where 
Found column the location of the required language in the contract or 
other State documents.  If the language is present and fulfills the 
requirement, CMS regional office staff should place a check in the Met 
column.  If the language is absent, CMS regional office staff should leave 
the column blank or indicate no.  Table A-1 shows the provider 
selection items  we reviewed for this study. 
Table A-1: Provider Selection Checklist Items for States Contracts with MCEs  
Checklist  Entity   Where 
Regulatory Basis  Subject   Met  Comments  
Item  Type   Found  
Contracts with Health Care Providers. 
In all contracts with health care 
professionals, an MCE must comply  with 
42 CFR 
the requirements specified in  
D.2.01   438.12(A)(2);   MCE     
42 CFR 438.214, which include:  
42 CFR 438.214  
selection and retention of providers, 
credentialing and recredentialing 
requirements, and nondiscrimination. 
Selection and Retention of Health Care 
42 CFR  Providers. 
438.214(a);   Each contract must require the entity to 
42 CFR  have written policies and procedures and 
D.2.02   MCE     
438.214(b)(1);   a description of its policies and 
42 CFR  procedures for selection and retention of 
438.214(b)(2)   providers following the States policy for 
credentialing and recredentialing.  
Nondiscrimination. 
The contract must require that the 
entitys provider selection policies and 
42 CFR 
D.2.04   procedures not discriminate against  MCE     
438.214(c)  
particular providers that serve high-risk 
populations or specialize in conditions 
that require costly treatment.  
 
Source:  Office of  Inspector General analysis of 32  selected CMS checklists, 2011. 
 
45 42 CFR   438.6(2). 
16 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
 
APPENDIX B 
Types of Medicaid Managed Care Enrollment by Selected 
States  
States may contract with up to seven different types of Medicaid managed 
care entities (MCEs). For sampling purposes, we included only the three 
types of MCEs subject to the Federal credentialing requirements: 
Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans 
(PIHPs), and Prepaid Ambulatory Health Plans (PAHPs).  Table B-1 
shows the number of Medicaid beneficiaries enrolled in the three types of  
MCEs in our sample and the number of beneficiaries in the other four 
types of MCEs, as of June 2010. 
Table B-1: Number of Medicaid Beneficiaries Enrolled in MCEs by Entity Type46 
           
  MCO47       Four other   
          types of   
State   Commercial   Medicaid- PIHP  PAHP   MCEs48   Total 
only  
Arizona  0  1,196,192   116,014   0  0  1,312,206  
California  3,211,912   8,201   106  556,741   782,485   4,559,445  
Florida   756,125  334,754   846,885  331,953   590,594   2,860,311  
New York   881,942   2,293,891   28,574   0  22,348   3,226,755  
Pennsylvania  1,094,568   0  1,629,152   479,596   293,005   3,496,321  
Texas  240,119   1,430,435   365,127   62,980   849,756   2,948,417  
 
           
Total of six 
6,184,666   5,263,473   2,985,858   1,431,270   2,538,188   18,403,455  
States  
 
           
All Other  
5,013,645   9,433,306   6,378,372   10,014,871   7,612,348   38,452,542  
States 
 
           
Total of 50 
11,198,311   14,696,779   9,364,230   11,446,141   10,150,536   56,855,997  
States  
Source:  Office of  Inspector General analysis of  the Centers for Medicare &  Medicaid Services  2010 Medicaid Managed Care  
Enrollment Report, 2011. 
 
46 Total  number of enrollees includes those who were enrolled in more than  one managed  
care plan.  Figures also include individuals enrolled in State health care reform programs  
that expand  eligibility beyond traditional Medicaid eligibility standards. 
47 A commercial MCO provides comprehensive services both to commercial enrollees 
and to Medicaid beneficiaries and/or Medicare beneficiaries.  A Medicaid-only MCO 
provides comprehensive services only to Medicaid beneficiaries, not to commercial  
enrollees or Medicare beneficiaries. 
48 The other four types of MCEs include:   Health Insuring  Organization, Program for 
All-Inclusive Care for the Elderly,  Primary Care Case Management Provider, and Other.  
17 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
APPENDIX C 
Selected Criteria for Six States Uniform Credentialing and 
Recredentialing Policies 
Although States are required to establish uniform credentialing and 
recredentialing (credentialing) policies and include these policies in 
contracts with Medicaid managed care entities, States have the authority to 
determine the specific criteria for their policies.  Table C-1 shows the 
credentialing criteria for each of the six States in our study.  States do not 
necessarily limit their requirements to the criteria reflected in the table.  
We grouped together common requirements for all provider types (e.g., 
physicians and nonphysicians); however, some States specify other 
requirements for each provider type.  
Table C-1: Selected Credentialing Criteria for Six Sampled States  
 
 
   a
 Provider Credentialing     Arizona  California  Florida nnsylvani  New York  Texas 
e
P
Verification of the following:  
1. Current license, certifications (or practitioner number), degree(s), and residency   Y49  Y  Y  Y  Y  Y 
or specialty training 
2. Status with Medicare and Medicaid Programs, including sanctions and the 
Health and Human Services Office of Inspector General list of excluded  Y  Y  Y  Y  Y  Y 
individuals/entities 
3. Evidence of malpractice/liability insurance and pending lawsuits or litigations   Y  Y  N  Y  Y  Y 
4. Sanctions or limitations from State agencies or licensing boards  Y  Y  Y  Y  Y  Y 
5. A valid Drug Enforcement Administration certification or number   Y  Y  Y  Y  Y  Y 
6. Present in the National Provider/Practitioner Databank.  In lieu of this, verify the  
following: any disciplinary action with regulatory board, State sanctions, or  Y  Y  Y  Y  Y  Y 
disciplinary claims resulting in a judgment or settlement. 
7. Adherence to the ethics of the appropriate professional organization (e.g., 
N  N  N  Y  N  Y 
American Medical Association)  
8. Work history   Y  Y  Y  Y  N  Y 
Attestation of the following:  
9. Any limitations in ability to perform essential position functions   Y  Y  Y  N  N  Y 
10. History of loss of license or felony convictions  Y  Y  Y  N  N  Y 
11. Lack of loss or limitation of privileges or disciplinary  activity  Y  Y  Y  N  N  Y 
12. Lack of present illegal drug use   Y  Y  Y  N  N  Y 
Provider Recredentialing  
13. Occurs at least every 3 years   Y  Y  Y  Y  Y  Y 
14. Involves verifying/updating information obtained during credentialing  Y  Y  Y  Y  Y  Y 
15. Is a documented process that includes provider performance data, such as 
Y  Y  N  Y  Y  Y 
complaints, quality of care issues, and results of medical record reviews  
 
Source:  Office of  Inspector General analysis of State documents, 20112012. 
 
49 Y indicates that the State requires this credentialing criterion.  N indicates that the 
State did  not require this credentialing criterion.  
18 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
 
APPENDIX D 
Additional State Credentialing and Recredentialing 
Requirements 
Federal regulations authorized States to establish additional standards for 
their credentialing and recredentialing policies.50  Our review of six 
States credentialing and recredentialing policies for Medicaid managed 
care entities (MCEs) showed that all six States established additional 
credentialing and recredentialing requirements and included them in their  
contracts with MCEs. We developed four categories to describe these 
requirements: 
(1)  Credentialing committee. 	All six States specified that MCEs must 
designate a credentialing committee that uses a peer review 
process to evaluate provider credentialing files (including 
recredentialing files). These States typically required that a 
medical director (a physician) oversee the credentialing committee.  
One States policy required that the medical director delineate the 
credentialing roles within the committee.  The credentialing 
committee, including the medical director, is responsible for 
credentialing decisions and is required to document its steps in the 
decision process and maintain individual provider files.  
(2)  Onsite reviews. 	All six States required onsite reviews of physician 
offices during initial credentialing; however, only two of the six 
States required onsite reviews during recredentialing.  One of these 
six States required onsite reviews during recredentialing for dental 
providers only.  In addition, in  four States, MCEs may conduct  
onsite reviews of physician offices for any reason, including 
complaints from Medicaid beneficiaries.  During this site review, the 
MCEs evaluate medical records and confidentiality practices and 
investigate any type of complaints (e.g., complaints from 
beneficiaries, the public, or providers). 
(3)  Provider performance data during recredentialing.	 All six States 
required MCEs to have a documented process for monitoring 
provider performance.  In addition, all six States required MCEs to 
have procedures that consider provider performance data during 
the recredentialing process.  Examples of provider performance 
data included complaints from Medicaid beneficiaries; quality of 
 
50 42 CFR   438.214(e). 
19 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
care issues; pay-for-performance data;51 and utilization 
management information, such as emergency room use and 
beneficiaries lengths of stay in hospitals.  
(4)  Notification requirement. 	All six States required MCEs to have a 
documented process for reporting to appropriate authoritiessuch 
as the State and the State medical boardserious issues or quality 
deficiencies that result in suspension or termination of a provider.  
For example, MCEs in one State were required to document their 
disciplinary actions against providers, including suspension or 
termination of a providers privileges.  In such a case, the MCE 
must notify the provider and the State.  
   
 
51 Pay-for-performance links health care spending to  quality and effectiveness.  The 
Commonwealth Fund, Pay-For-Performance in State Medicaid Programs: A Survey of 
State Medicaid Directors and Programs, April 2007.   
20 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
  APPENDIX E 
Agency Comments 
,.
,

........
(  tf_ 
,::tz' DEPARTMENT OF HEALTH & HUMAN SERVICES  Centers for Medicare & Medicaid Serviceo
Administrator 
Washington, DC 20201 
DATE:  AUG  S Z01l 
TO:  Daniel R. Levinson 
Inspector General 
FROM:  Marilyn Tavenner 
Administrator 
SUBJECT:  Office of Inspector General (OIG) Draft Report: "State and CMS Oversight of 
the Medicaid Managed Care Credentialing Process" (OEI-09-1 0-00270) 
Thank you for the opportunity to review and comment on the subject OTG draft report. The 
Centers for Medicare & Medicaid Services (CMS) has reviewed this report and offers the 
following comments. 
Federal regulations require states to ensure the delivery ofquality health care to Medicaid 
beneficiaries under managed care. The purpose of this study was to determine the extent to 
which states comply with the federal regulations to establish uniform provider credentialing 
policies and include federal credentialing provisions in contracts with Medicaid Managed Care 
Entities (MCEs). States must also monitor MCEs' compliance with these federal provisions and 
any additional state credentialing requirements in contracts. 
The OIG sampled six states (Arizona, California, Florida, New York, Pennsylvania, and Texas) 
and 234 MCEs that included the three types ofMCEs subject to the federal credentialing 
regulations (Managed Care Organizations, Prepaid Inpatient Health Plans, and Prepaid 
Ambulatory Health Plans). To determine the extent to which states complied with the federal 
regulations, OIG reviewed state documents such as laws, administrative codes, state-issued 
policy letters, and 32 contracts. To determine whether states monitored MCE compliance with 
contracts, OIG reviewed states' auditing documents and conducted interviews with state staff. 
To examine CMS's oversieht ofstates' contracts, OIG reviewed 32 checklists used by CMS 
regional office staff to evaluate compliance ofthe 32 state contracts with the federal 
credentialing provisions. 
All six states' credentialing policies and provisions for contracts with MCEs met federal 
standards. However, states are also required to monitor MCEs' compliance with these contracts. 
The OIG found that five of six states did not monitor MCEs' compliance with the federal 
provider nondiscrimination contract provision. This provision requires that MCEs not 
discriminate against providers that serve high-risk populations or specialize in conditions 
21 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)   
   
   
 
22 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
 
ACKNOWLEDGMENTS 
This report was prepared under the direction of Timothy Brady, Regional 
Inspector General for Evaluation and Inspections in the San Francisco 
regional office, and Michael Henry,  Deputy Regional Inspector General. 
Anthony Guerrero-Soto served as the team leader for this study.  Other 
Office of Evaluation and Inspections staff from the San Francisco regional 
office who conducted the study include Marcia Wong.  Central office staff 
who provided support include Kevin Farber, Meghan Kearns, and 
Christine Moritz. Leah Bostick of the Dallas regional office also provided 
support. 
23 
State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270)  
   
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS)  programs, as well as the health and welfare of beneficiaries  served by those 
programs.  This statutory mission  is  carried  out through  a nationwide network  of  audits, 
investigations, and inspections conducted by the  following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of  fraud and misconduct  related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and abuse cases involving HHS programs,  including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.