Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
 
M E
EDICAID  NHANCED 
 
 
P E
ROVIDER  NROLLMENT 
 
 
S H N
CREENINGS  AVE  OT 
 
 
B F I  
EEN  ULLY  MPLEMENTED 
 
 
 
 
Daniel R. Levinson 
Inspector General 
 
May 2016 
OEI-05-13-00520   
   
EXECUTIVE SUMMARY:  MEDICAID ENHANCED PROVIDER ENROLLMENT 
SCREENINGS HAVE NOT BEEN FULLY IMPLEMENTED  
OEI-05-13-00520 
 
WHY WE DID THIS STUDY  
 
To bill for items and services provided to beneficiaries, providers must enroll, and 
periodically revalidate this enrollment, in Medicaid.  Effective provider enrollment 
screening is an important tool in preventing Medicaid fraud.  To protect Medicaid against 
ineligible and fraudulent providers, the Affordable Care Act requires States to screen 
Medicaid providers according to their risk for fraud, waste, and abuse using enhanced 
screening procedures.  These can include fingerprint-based criminal background checks 
and site visits.  To help States meet the demands of applying enhanced screening to all 
new and existing providers, the Centers for Medicare & Medicaid Services (CMS) allows 
States to substitute Medicare or other State Medicaid agency or Childrens Health 
Insurance Program screening results for their own.  Ensuring that States screen all 
providers in accordance with the new requirements is vital to protecting Medicaid, 
especially as it grows to serve more beneficiaries. 
 
HOW WE DID THIS STUDY 
   
To determine the extent to which States have screened high- and moderate-risk providers 
using risk-based screening, we surveyed States and requested data about their progress as 
of August 2014.  We also asked States whether they used screening results from 
Medicare or other State Medicaid agencies as substitutes for their own activities.  In 
addition, we asked States to provide data on the number of new and existing high- and 
moderate-risk providers requiring screening. 
 
WHAT WE FOUND 
 
State implementation of risk-based screening is incomplete.  Most States reported not 
having fingerprint-based criminal background checks while waiting for the requirement 
to take effect.  Although CMS did not initially require States to conduct these checks, 
pending additional guidance, CMS did issue this guidance in June 2015, albeitmore than 
 
4 years after the other enhanced screening activities went into effect.  In addition, 
11 States reported that they have not implemented site visits.  Meanwhile, most States 
reported challenges and concerns regarding substitution of screening results from 
Medicare or other States for their own. These included difficulties accessing external 
screening data and ensuring the quality of other State and/or Medicare screening efforts.  
Some States that did not have all screening activities in place still enrolled and 
revalidated thousands of providers categorized as posing a high or moderate risk to 
Medicaid.  Finally, 14 States reported that they would not finish revalidating existing 
high- and moderate-risk providers by the September 2016 deadline.   
 
   
   
   
WHAT WE RECOMMEND  
 
To ensure full implementation of Medicaid enhanced provider screening, we recommend 
that CMS (1) assist States in implementing fingerprint-based criminal background checks 
for all high-risk providers, and (2) assist States in overcoming challenges in conducting 
site visits.  To facilitate substitution of screening results and minimize variation between 
Medicare and Medicaid, we recommend that CMS (3) enable States to substitute 
Medicare screening data by ensuring the accessibility and quality of Medicare data, 
(4) develop a central system where States can submit and access screening results from 
other States, and (5) strengthen minimum standards for fingerprint-based criminal 
background checks and site visits.  Finally, to ensure that States conduct enhanced 
screening of existing Medicaid providers, we recommend that CMS (6) work with States 
to develop a plan to complete their revalidation screening in a timely way.  CMS 
concurred with all six of our recommendations.
   
 
TABLE OF CONTENTS  
 
Objective ......................................................................................................1 
Background ..................................................................................................1 
Methodology ................................................................................................7 
Findings........................................................................................................9 
Most States reported not having fingerprint-based criminal 
background checks while waiting for the requirement to take 
effect ................................................................................................9 
Eleven States reported not conducting required site visits ............12 
Screening substitution is challenging for many States ..................12 
Fourteen States reported that they would not finish revalidating 
existing high- and moderate-risk providers by the 
September 2016 deadline ...............................................................15 
Conclusion and Recommendations ............................................................17 
Agency Comments and Office of Inspector General Response .....20 
Appendix ....................................................................................................21 
A:  Detailed Methodology .............................................................21 
B:  Agency Comments ...................................................................23 
Acknowledgments......................................................................................26   
   
OBJECTIVE 
To determine the extent to which States have implemented risk-based 
screening activities for high- and moderate-risk providers. 
 
BACKGROUND  
Providers and suppliers, hereinafter referred to as providers, must enroll 
in Medicaid and periodically revalidate their enrollment to be eligible to 
bill Medicaid.1  The Centers for Medicare & Medicaid Services (CMS) has 
stated that provider enrollment is the gateway to Medicaid.2  If this 
gateway is not adequately safeguarded, Medicaid is at increased risk of 
enrolling ineligible providers or providers with intent to defraud the 
program.  Effective enrollment screening is an important tool in 
preventing Medicaid fraud, waste, and abuse.  Ensuring that States screen 
all providers in accordance with the new requirements is vital to protecting 
Medicaid, especially as it grows to serve more beneficiaries. 
Beginning in 1997 the Office of Inspector General (OIG) has identified 
,
numerous vulnerabilities regarding provider enrollment and has made 
recommendations for improvement.  In an effort to combat fraud, waste, 
and abuse resulting from vulnerabilities in the enrollment process, the 
Affordable Care Act (ACA) called for the establishment of risk-based 
provider enrollment screening procedures.3, 4  To this end, the ACA gave 
CMS the authority to enhance provider enrollment screening with a set of 
new enrollment tools.5   
In contrast to past screening standards, which varied by State, the ACA 
requires States to more uniformly screen providers according to the risk 
for fraud, waste, and abuse that they pose to Medicaid.6  The ACA also 
requires risk-based screening for all providers in Medicare and the 
Childrens Health Insurance Program (CHIP).7  In the ACA, Congress 
mandated that States use risk-based screening for all providers seeking 
                        ____________________________________________________________ 
1 42 CFR  455.410.    
2 Shantanu Agrawal, M.D., Medicaid Program Integrity:  Screening Out Errors, Fraud, 
and Abuse, Testimony before the United States House Committee on Energy and 
Commerce, Subcommittee on Oversight and Investigations, June 2, 2015.  
3 The Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), as 
amended by the Health Care and Education Reconciliation Act of 2010, P.L. No. 111-152 
(March 30, 2010), is known as the Affordable Care Act. 
4 ACA,  6401. 
5 ACA  6401. 
6 ACA,  6401(a)(3), (b)(1)(B). 
7 ACA  6401(a), (c). 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  1 
   
   
enrollment as participating providers in Medicaid.8  However, the ACA 
granted CMS discretion to determine which screening activities, other than 
licensure checks, would be required and to establish screening 
procedures.9  CMS issued the risk-based screening requirements, effective 
March 25, 2011.10  
Provider Screening 
States must screen all providers using risk-based screening upon initial 
enrollment, re-enrollment, or revalidation of enrollment.11  Enrolling 
providers are those either newly enrolling or re-enrolling in Medicaid.  
Revalidating providers are those enrolled in Medicaid as of 
March 25, 2011.  Initially, in 2011, CMS directed States to complete the 
revalidation of existing providers under the risk-based screening by March 
24, 2016.12  Then, in January 2016, CMS issued additional subregulatory 
guidance that revised its earlier direction.  At that time, CMS required 
States to (1) notify all affected providers of the revalidation requirement 
by March 24, 2016 and (2) complete all revalidations by 
September 25, 2016.13  CMS also required States to revalidate all 
providers enrollment at least every 5 years from the date of initial 
enrollment.14   
Screening Activities by Risk Category   
States must screen providers according to the risk category to which providers 
are assigned.  States must assign providers to one of three risk categories:  
high, moderate, or limited.  
The screening activities that States must use vary, depending on the risk 
category to which a provider is assigned.  The screening activities become 
more extensive as the risk level increases.  For example, States must conduct 
six screening activities for high-risk providers, while they need conduct only 
three screening activities for limited-risk providers.  Newly enrolling providers 
and revalidating providers are subject to the same screening activities, 
                        ____________________________________________________________ 
8 ACA,  6401(b). 
9 ACA,  6401(a)(3), (b)(1)(B). 
10 76 Fed. Reg. 5862 (February 2, 2011). 
11 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, December 23, 2011, p. 2.  Accessed at http://www.medicaid.gov/Federal-
Policy-Guidance/downloads/CIB-12-23-11.pdf on June 13, 2014. 
12 Ibid.   
13 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Revalidation 
(2016-001).  Accessed at 
https://www.medicaid.gov/affordablecareact/provisions/downloads/revalidation-2016-
001.pdf on January 20, 2016. 
14 42 CFR  455.414. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  2 
   
   
depending on their risk category.  See Table 1 for the screening activities 
required by risk category.   
Table 1:  Screening Activities Required by Risk Category  
Screening Activities   High  Moderate  Limited 
Verification of any provider/supplier-specific requirements established by 
X  X  X 
Medicaid/CHIP 
Verification of licenses (may include licensure checks across State lines)  X  X  X 
Database checks (to verify:  SSN, NPI, the NPDB, licensure, HHS OIG 
exclusion, taxpayer identification, tax delinquency, death of individual 
X  X  X 
practitioner, and persons with an ownership or control interest or who are 
agents or managing employees of the provider)* 
Site visits  X  X   
Criminal background checks  X     
Fingerprinting  X     
Source:  OIG analysis of 76 FR, p. 5896 and CMS guidance. 
 
*SSN = Social Security Number, NPI = National Provider Identifier, NPDB = National Practitioner Data Bank, HHS OIG = 
U.S. Department of Health and Human Services, Office of Inspector General. 
Initially, CMS did not require States to conduct the criminal background 
checks or fingerprinting (hereinafter referred to as fingerprint-based criminal 
background checks) for high-risk providers.15  In its Final Rule and its initial 
December 2011 guidance, CMS instructed States that fingerprint-based 
criminal background checks for high-risk providers were not required until 
CMS issued additional guidance.16  However, CMS indicated that States had 
discretion to implement fingerprint-based criminal background checks in the 
absence of guidance.17  Similarly, CMS did not require fingerprint-based 
criminal background checks for Medicare providers until August 2014, after it 
finalized an agreement with a contractor to conduct these checks for 
Medicare.18  
                        ____________________________________________________________ 
15 In general usage among CMS and States, criminal background checks and 
fingerprinting are commonly referred to as fingerprint-based criminal background 
checks.  CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002).  Accessed 
at http://www.medicaid.gov/federal-policy-guidance/downloads/SMD060115.pdf on 
June 4, 2015. 
16 76 Fed. Reg. 5862, 5902; CMS, CMCS Informational Bulletin:  Medicaid/CHIP 
Provider Screening and Enrollment, p. 9.  In the CMCS Informational Bulletin, CMS did 
not indicate when it planned to issue the additional guidance.  
17 76 Fed. Reg. 5862, 5902. 
18 CMS, The Basics of Internet-based Provider Enrollment Chain and Ownership System 
(PECOS) for Physicians and Non-Physician Practitioners.  Accessed at 
https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-
MLN/MLNMattersArticles/downloads/SE1417.pdf  on November 20, 2015. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  3 
   
   
CMS issued the additional guidance requiring fingerprint-based criminal 
background checks in a letter to State Medicaid Directors on June 1, 2015.19  
This guidance offered States some insight into how to conduct these checks 
and what to do with the results of these checks.  For instance, CMS 
recommended that States conduct a Federal Bureau of Investigation (FBI) 
criminal history check and follow some elements of Medicares process for 
fingerprint-based criminal background checks.  CMS also suggested that States 
may leverage any existing protocols for obtaining fingerprint-based criminal 
background checks (such as in hiring employees or under CMSs National 
Background Check Program for Long-Term Care Facilities and Providers).20, 21  
However, CMS did not require these activities and indicates that each State 
may decide the type and extent of its checks.  CMS also left to States 
discretion the form and manner for fingerprint submission.  CMS also provided 
some instruction as to when States must terminate or deny enrollment, 
including if a provider fails to submit fingerprints within 30 days of request, 
fails to submit them in the form and manner requested by the State, or has a 
conviction related to his or her involvement with Medicare, Medicaid, or CHIP 
in the last 10 years.   
Then, in January 2016, CMS issued further guidance providing States with 
two methods for complying with the fingerprint-based criminal background 
check requirement.22   
Risk Category Assignments  
States are required to assign a provider to a risk category according to the 
types of health services the provider offers.  State assignment of provider 
                        ____________________________________________________________ 
19 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002).   
20 CMSs National Background Check Program for Long-Term Care Facilities and 
Providers is a voluntary program.  See ACA  6201.  A 2016 OIG report of this program 
found that 13 of 25 States participating at the time of our review had not obtained 
legislation that would enable them to conduct background checks and that 10 of 25 States 
did not yet have the ability to collect fingerprints.  See OIG, National Background Check 
Program for Long-Term-Care Employees:  Interim Report, OEI-07-10-00420, 
January 2016. 
21 In a 2015 OIG report on background checks for home health employees, we 
recommended that CMS promote minimum standards for background checks by 
encouraging State participation in the National Background Check Program for 
Long-Term Care Facilities and Providers.  See OIG, Home Health Agencies Conducted 
Background Checks of Varying Types, OEI-07-14-00130, May 2015.   
22 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  
Fingerprint-based criminal background checks (FCBC) (2016-002).  Accessed at 
https://www.medicaid.gov/affordablecareact/provisions/downloads/fcbc-2016-002.pdf on 
January 20, 2016. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  4 
   
   
types to the various risk categories also depends on whether the provider 
type is recognized by both Medicare and Medicaid or by Medicaid only.23 
Medicare-recognized provider types.  When Medicare recognizes a 
provider type, CMS requires States to use the risk category Medicare 
assigns.24, 25  The Medicare-recognized provider types and their assigned 
risk categories are: 
  High risk:  newly enrolling home health agencies (HHAs) and 
newly enrolling durable medical equipment, prosthetics, orthotics, 
and supplies (DMEPOS) providers;  
  Moderate risk:  ambulance service suppliers, community mental 
health centers, comprehensive outpatient rehabilitation facilities, 
hospice organizations, independent diagnostic testing facilities, 
independent clinical laboratories, physical therapists enrolling as 
individuals or group practices, portable x-ray suppliers, 
revalidating HHAs, and revalidating DMEPOS providers; 
  Limited risk:  all other Medicare provider types.26  
Medicaid-only provider types.  When only Medicaid recognizes a provider 
type (e.g., personal care attendants), States must assess the provider types 
risk for fraud, waste, and abuse and assign the appropriate risk category.  
In making these decisions, States must use criteria similar to those used to 
determine risk categories for the Medicare-recognized provider types.27   
Screening Substitution 
CMS gives States the option of using the results of screening activities 
conducted by Medicare and other States Medicaid or CHIP agencies as 
substitutes for conducting their own screening.28  According to CMS, such 
substitutions could save States time and money.  Previously, in its 
December 2011 bulletin, CMS indicated that States could substitute 
                        ____________________________________________________________ 
23 In States that administer CHIP separately from Medicaid, the regulations indicate that 
all screening provisions that apply to Medicaid apply to CHIP.  See 76 Fed. Reg. 5862, 
5895 (February 2, 2011). 
24 76 Fed. Reg. 5862, 5895 (February 2, 2011). 
25 States may establish provider screening methods in addition to, or more stringent than, 
those required by 42 CFR 455, subpart E.  See CMS, CMCS Informational Bulletin:  
Medicaid/CHIP Provider Screening and Enrollment, p. 2. 
26 42 CFR  424.518. 
27 76 Fed. Reg. 5862, 5895 (February 2, 2011). 
28 42 CFR  455.410. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  5 
   
   
screening results only if Medicare or another States Medicaid or CHIP 
agency has completed all applicable screening activities.29   
In its June 2015 letter to State Medicaid Directors and subsequent 
November 2015 subregulatory guidance, CMS modified its original 
instruction about what States can use to substitute a screening to avoid 
unnecessary cost and burden on States. 30, 31  CMS indicated that States 
may rely on the results of Medicares provider screening for approved 
providers without verifying each screening activity.  States may rely on 
Medicares screening up to and including a particular risk category, 
regardless of whether the Medicare record indicates that a particular 
screening activity was completed.  This could mean that States do not 
have to conduct a fingerprint-based criminal background check if a 
provider is enrolled in Medicare, even if Medicare has not conducted such 
a check for that provider.   
States obtain external screening information in different ways, depending 
on the entity that completed the screening.  To obtain the results of 
screening activities conducted by Medicare, States may access screening 
information contained in the Medicare Provider Enrollment, Chain, and 
Ownership System (PECOS).32  PECOS stores CMSs Medicare provider 
screening results.  States can access PECOS information either through a 
Web-based portal or, as of October 2013, through an extract file that 
contains basic Medicare enrollment information.  To obtain results of 
screening activities conducted by other States Medicaid or CHIP 
agencies, States must contact other States individually.  No national 
database exists to facilitate the sharing of Medicaid or CHIP screening 
results among States. 
Related Reports  
This evaluation builds on a body of OIG work related to provider 
enrollment in both Medicaid and Medicare that dates to 1997.  Most 
recently, OIG reviewed the implementation of ACAs risk-based screening 
                        ____________________________________________________________ 
29 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, p. 9.   
30 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002), Q&A 11.   
31 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Instructions for 
relying on provider screening conducted by Medicare (42 CFR 455.410) or conducting 
additional screening when required.  Accessed at 
http://www.medicaid.gov/affordablecareact/provisions/sub-reg-guidance.html on 
December 3, 2015.  
32 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, p. 3. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  6 
   
   
in Medicare and found vulnerabilities in the screening process.33  We 
discuss the implications of these vulnerabilities for Medicaids screening 
process in our findings.  
In addition, an April 2016 Government Accountability Office (GAO) 
report examined the screening of Medicaid managed care providers.34  
GAO reviewed 10 States and 16 plans from those States.  It found that 
States and Medicaid managed care plans faced significant challenges in 
screening managed care providers. 
METHODOLOGY 
This review evaluated the status of States progress with enhanced 
provider screening as of August 31, 2014.  See Appendix A for a detailed 
methodology. 
Scope  
This inspection was national in scope and focused on Medicaids ACA 
risk-based screening.  We included all 50 States and the District of 
Columbia in this review (hereinafter referred to as States).   
We limited our review to high- and moderate-risk providers because they 
pose the most risk to Medicaid.  In previous reports, OIG and GAO have 
raised concerns about many of the high- and moderate-risk provider types.  
Data Collection and Analysis  
Data Collection Instrument.  We sent a data collection instrument to all 
51 States in October 2014.  We followed up with States twice by phone 
and twice by email.  We obtained responses from 48 States.  We counted 
as nonrespondents the three States that, despite our followup efforts, did 
not submit survey results. 
The instrument had two sectionsa survey and a data request.   
Survey.  The survey focused on States progress in implementing 
the ACA screening requirements.  We conducted most of our 
analysis on multiple-choice questions with response rates of 48.  
We counted the number of States per response item.  A few 
questions had responses ranging from 43 to 47.  Where appropriate 
in the text, we indicated when the number of States responding was 
fewer than 48.  We also analyzed responses to open-ended 
questions primarily designed to develop themes concerning 
                        ____________________________________________________________ 
33 OIG, Enhanced Enrollment Screening of Medicare Providers:  Early Implementation 
Results, OEI-03-13-00050, April 2016.   
34 GAO, Medicaid Program Integrity:  Improved Guidance Needed to Better Support 
Efforts to Screen Managed Care Providers, GAO-16-402, April 2016. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  7 
   
   
challenges States face with the risk-based screening activities.  
Forty-five of the 48 States responded to the question about 
challenges they face.  
Data Request.  We asked States for data on the number of 
high- and moderate-risk providers applying to enroll after 
March 25, 2011, and the number of high- and moderate-risk 
providers enrolled prior to March 25, 2011.  We also asked States 
for data on the number of providers that were subject to all 
screening activities and the number of providers approved to enroll 
in Medicaid.  Only 27 of the 48 responding States provided data 
sufficient for use in our analysis.  Our work further summed across 
States the number of providers approved to enroll in Medicaid.    
Limitations  
Our analysis relied on self-reported data, which we did not independently 
verify.  However, as part of our data collection, we asked States to identify 
their limitations and concerns with self-reported data.  
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  8 
   
   
FINDINGS 
CMS issued the risk-based screening requirements in February 2011 with 
all but the fingerprint-based criminal background check requirement 
effective March 25, 2011.35  CMS issued initial guidance related to these 
requirements in December 2011.36  In both the Final Rule and initial 
guidance, CMS did not require States to conduct fingerprint-based 
criminal background checks until it issued additional guidance.37  
According to CMS, these checks pose unique operational and privacy 
concerns.38  CMS issued this additional guidance in June 2015, more than 
4 years after the effective date of the other screening requirements.39  It 
issued further guidance in January 2016.40        
Most States reported not having fingerprint-based 
criminal background checks while waiting for the 
requirement to take effect  
At the time of our review in August 2014, CMS did not require States to 
implement fingerprint-based criminal background checks.  In total, 37 of 
47 responding States reported that they had not implemented 
fingerprint-based criminal background checks for new and existing 
providers.  This means that these States did not screen high-risk providers 
using fingerprint-based criminal background checks. 
The delays in requiring fingerprint-based criminal background checks 
potentially exposed Medicaid to increased risks related to fraud, waste, 
and abuse.  Of the 37 States without fingerprint-based criminal 
background checks in place, 27 reported allowing approximately 
25,000 high-risk providers to enroll in Medicaid without completing 
fingerprint-based criminal background checks between March 2011 and 
August 2014.  Of these 25,000 high-risk providers, nearly two-thirds were 
newly enrolling providers not known to State Medicaid agencies.  The 
remaining 10 States could not provide information on the number of      
                        ____________________________________________________________ 
35 76 Fed. Reg. 5862 (February 2, 2011). 
36 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment. 
37 76 Fed. Reg. 5862, 5902; CMS, CMCS Informational Bulletin:  Medicaid/CHIP 
Provider Screening and Enrollment, p. 9.   
38 76 Fed. Reg. 5871. 
39 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002). 
40 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  
Fingerprint-based criminal background checks (FCBC) (2016-002). Accessed at 
https://www.medicaid.gov/affordablecareact/provisions/downloads/fcbc-2016-002.pdf on 
January 20, 2016. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  9 
   
   
high-risk providers enrolled or revalidated since the other risk-based 
screening activities went into effect.   
States faced challenges with fingerprint-based criminal 
background checks, including the need for guidance  
States faced challenges implementing fingerprint-based criminal checks.  
Most States reported the need for guidance, in general, and some States 
specifically noted as a challenge the need for guidance to implement this 
screening activity.  States may also face additional challenges to timely 
implementation.   
Need for CMS guidance.  At the time of our review, most States without 
this screening activity in place reported that they needed guidance.  
Specifically, 29 of the 37 States without fingerprint-based criminal 
background checks reported needing guidance to resolve challenges with 
the ACA screening activities.  Although most States did not specify the 
subject of the guidance needed, three States specifically offered that they 
did not implement fingerprint-based criminal background checks while 
waiting for guidance from CMS on this screening activity.  One of the 
three States reported that it was uncertain how to comply with the 
fingerprinting and criminal background checks.  The second State reported 
that it did not implement so as to avoid incorrect implementation.  The 
third State indicated that waiting for CMS to issue guidance was a 
barrier to implementation.   
Challenges to timely implementation.  States may struggle to conduct 
fingerprint-based criminal background checks because of limited 
experience with these checks and the effort that this screening activity 
entails.   
Implementing these checks requires States to collect and transmit 
fingerprints to the FBI or State law enforcement for processing in a secure 
manner.  Overall, 34 of the 37 States without fingerprint-based criminal 
background checks indicated that they did not have experience conducting 
these checks for Medicaid enrollment.   
In addition, the effort entailed in fingerprint-based criminal background 
checks may make implementation difficult.  Because most States have not 
implemented these checks, we cannot determine how widespread 
implementation problems may be.  However, five States identified specific 
challenges that other States may also face as they move forward.  These 
include operational concernssuch as not having authority from their 
State to review results of fingerprint-based criminal background checks
and logistical concerns about integrating this check into their enrollment 
systems.   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  10 
   
   
CMS no longer requires full implementation by June 2016 
CMS issued guidance in June 2015 and January 2016 about 
fingerprint-based criminal background check implementation.  Although 
CMS initially instructed States to comply with completing these checks, it 
later offered States an alternative path to compliance.  This alternative 
path could mean that full implementation of these checks by States will 
not occur until after 2016.  According to CMS, implementation means that 
the State has conducted a fingerprint-based criminal background check 
with respect to each provider designated as high risk, including those 
newly enrolling in Medicaid, those seeking re-enrollment in Medicaid, and 
those enrolled at the time of revalidation.41 
June 2015 guidance.  CMS did not provide States with guidance on 
fingerprint-based criminal background checks for more than 4 years.  In 
June 2015, subsequent to our review, CMS provided its first guidance in a 
State Medicaid Director Letter.42  CMS instructed States that, from the 
date of the letter, they had (1) 60 days to begin implementing 
fingerprint-based criminal background checks and (2) 1 year to complete 
implementation of fingerprint-based criminal background checks.   
January 2016 guidance.  In January 2016, CMS issued additional 
guidance acknowledging the challenges that States may face but no longer 
requiring full implementation by June 2016.  CMS acknowledged its June 
2015 recommendation that States conduct FBI criminal history checks and 
stated that it continues to work with the FBI to facilitate State access to the 
infrastructure necessary to conduct such checks.  Because of this 
continued work, CMS offered an alternate path to compliance and asked 
States when they anticipated fully implementing fingerprint-based 
criminal background checks.   
This guidance provides States with two ways to comply with the 
fingerprint-based criminal background check requirement by June 1, 2016:  
(1) implement fingerprint-based criminal background checks as initially 
required in the June 2015 State Medicaid Director letter or (2) have a 
fingerprint-based criminal background check compliance plan approved 
by CMS by June 1, 2016.43   
States submitting compliance plans had to do so by April 15, 2016.  As 
part of a compliance plan, CMS asked States to describe the barriers they 
face to full implementation.  Submitting a compliance plan does not equal 
                        ____________________________________________________________ 
41 CMS, State Medicaid Director Letter, June 1, 2015 (SMD# 15-002). 
42 Ibid. 
43 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  
Fingerprint-based criminal background checks (FCBC) (2016-002).   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  11 
   
   
compliance; only receipt of a CMS approval letter on or before 
June 1, 2016, will do so. 
However, having an approved compliance plan does not ensure timely 
implementation, as CMS did not require a deadline for States.  Instead, 
CMS asked States to indicate when they anticipate fully implementing the 
fingerprint-based criminal background check requirement.      
Eleven States reported not conducting required site 
visits  
Although most of the States indicated that they have implemented required 
site visits, 11 of 47 responding States reported, at the time of our review, 
that they did not have this screening activity in place for high- and 
moderate-risk providers.  Six of these States indicated that the primary 
reason for not implementing site visits was insufficient resources, 
including too few staff and financial constraints.  Further, one State noted 
that its large geographical size made site visits difficult to implement 
because staff would have to travel hundreds of miles to visit a provider in 
a small town.  The remaining five States did not offer reasons why they 
did not have required site visits in place.   
Between March 2011 and August 2014, 6 of these 11 States reported 
allowing approximately 21,000 high- and moderate-risk providers to 
enroll in Medicaid without site visits.  The remaining five States could not 
provide the number of high- and moderate-risk providers enrolled or 
revalidated since risk-based screening went into effect.  See Table 2 for a 
breakdown of the number of high- and moderate-risk providers allowed to 
enroll in Medicaid without site visits. 
Table 2:  High- and moderate-risk providers allowed to enroll in Medicaid without site 
visits 
  Number of States  High-risk providers  Moderate-risk providers  Total 
Newly enrolled providers  5  5,896  9,505  15,401 
Revalidated providers  3  600  4,946  5,546 
Source:  OIG analysis of State survey responses, 2014. 
Screening substitution is challenging for many States 
Although CMS allows (but does not require) States to substitute screening 
results from Medicare and other State Medicaid agencies in place of 
conducting their own, many States do not do so.44  In fact, 18 States 
reported that they do not substitute screening results from Medicare, and 
                        ____________________________________________________________ 
44 42 CFR  455.410(c). 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  12 
   
   
an additional 13 States reported that they substitute few screening results 
from Medicare.  Although the remaining 17 States reported that they 
substitute screening results from Medicare, most could not report the 
extent to which they did so.  Similarly, 30 States reported that they do not 
substitute screening results from other State Medicaid agencies.  An 
additional seven States reported that they substitute few screening results 
from other State Medicaid agencies.  The remaining 11 States reported 
substituting screening results, yet 10 of these States could not determine 
the extent to which they did so.  
States could benefit by using substituted screening results, but challenges 
associated with substitution exist.  Use of substituted screening results 
could help States reduce the costs and burden associated with screening 
activities, especially as they work to meet the demands of screening all 
new and existing providers according to the ACA requirements.  However, 
operational challenges, coupled with issues regarding the quality of 
Medicare and other State screening data, hinder States ability to benefit 
from this option.  
States face challenges substituting screening results from 
Medicare  
States reported challenges to obtaining data from PECOS, the CMS data 
system that stores Medicares provider screening results.  Specifically, 
11 of 45 States reported such challenges.  The challenges included 
difficulty accessing PECOS, such as password problems, and/or difficulty 
navigating the system.  Moreover, PECOS does not allow States to run an 
automated match of their providers against the system.  Instead, States 
have to enter individual provider information into PECOS to retrieve 
screening results for that provider, which can be time intensive.  
Even if States overcome the challenges to obtaining PECOS data, using 
Medicare screening results or enrollment data may open the door to other 
vulnerabilities for Medicaid and the States because Medicare screening 
data may not be complete or thorough.   
States may not benefit from substituting Medicare screening results 
because PECOS may contain incomplete information.  An April 2016 OIG 
report on the implementation of Medicare enhanced provider screening 
found that PECOS did not contain all the information needed for effective 
oversight.45  PECOS was missing risk category designations in 10 percent 
                        ____________________________________________________________ 
45 OIG, Enhanced Enrollment Screening of Medicare Providers:  Early Implementation 
Results. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  13 
   
   
of cases and application submission reasons (e.g., new enrollment or 
change of information) in 12 percent of cases.   
Further, GAO and OIG have raised concerns about the thoroughness of 
Medicares screening process.  In a June 2015 report, GAO identified 
weaknesses in CMSs procedure for verifying a providers practice 
location and licensure status.46  The April 2016 OIG report on Medicare 
enhanced provider screening raised similar concerns, finding that 
Medicare contractors did not verify key provider information, such as 
identification numbers and criminal convictions, during the enrollment 
process.47  OIG also found that Medicare contractors were inconsistent in 
applying site visit procedures and using site visit results for enrollment 
decisions. 
CMSs decision to allow States to substitute incomplete Medicare 
screening results may leave States vulnerable to fraud, waste, or abuse.  
CMS guidance indicates that States can skip a fingerprint-based criminal 
background check if a provider is enrolled in Medicare, even if Medicare 
has not conducted such a check for that provider.48  Although this direction 
applies only to newly enrolling HHAs and DMEPOS providers, OIG and 
GAO have identified these provider types as problematic.  As a result, if 
Medicare has not conducted fingerprint-based criminal background checks 
for these providers and States use proof of Medicare enrollment as a 
substitute for their own screening, States are vulnerable to fraud, waste, 
and abuse because these providers have not undergone a fingerprint-based 
criminal background check and may have no history with the State 
Medicaid agency.   
Similarly, States face challenges substituting screening 
results from other States 
States may not be able to substitute screening results from other States 
because of difficulties obtaining the results of other States screening 
activities.  Specifically, 9 of 45 States reported challenges obtaining 
screening results.  Generally, these States reported that the lack of a single 
database for recording the results of screening activities means that States 
                        ____________________________________________________________ 
46 GAO, Medicare Program:  Additional Actions Needed to Improve Eligibility 
Verification of Providers and Suppliers, GAO-15-448, June 2015. 
47 OIG, Enhanced Enrollment Screening of Medicare Providers:  Early Implementation 
Results. 
48 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Instructions for 
relying on provider screening conducted by Medicare (42 CFR 455.410) or conducting 
additional screening when required.  Accessed at 
http://www.medicaid.gov/affordablecareact/provisions/sub-reg-guidance.html on 
December 3, 2015.  See also CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 
15-002), Q&A 11. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  14 
   
   
must contact each other on a case-by-case basis.  This requires significant 
resources and time.  States reported that State-to-State substitution is 
further complicated because there is no consistent or easy means of 
State-to-State communication regarding substitution.   
Even if States could readily obtain other States screening data, those 
results may not meet a particular States standards because screening 
practices may not be complete and are not consistent across States.   
Similar to concerns about Medicare substitution, States may not be able to 
benefit from substituting other States Medicaid or CHIP screening results 
because they may be incomplete.  If a State is not conducting one or more 
of the required screening activities, such as site visits or fingerprint-based 
criminal background checks, others may not want to substitute the 
screening results.  Two States reported that they do not substitute 
screening data from other States because they have found that States are at 
various stages of compliance with risk-based screening.  
In addition, States may be reluctant to use each others screening results 
because each State creates its own standards for screening providers, 
particularly for fingerprint-based criminal background checks and site 
visits.  CMS allows States discretion on the type and extent of their 
criminal background checks.49  While CMS recommends that States adopt 
elements of Medicares screening process and conduct an FBI criminal 
history check, which provides national information, it does not require 
them to do so.  CMS allows similar discretion for site visits, stating that 
States have the flexibility to determine the activities that constitute a site 
visit.50  This means that States can create their own standards for 
conducting these screening activities.  States that have stricter standards 
may be unwilling to use results from another State with less strict 
standards.  In fact, two States cited this variation as a concern.   
Fourteen States reported that they would not finish 
revalidating existing high- and moderate-risk 
providers by the September 2016 deadline 
Although 34 States reported that they would finish revalidating all 
providers, 14 indicated they would not finish by the September 2016 
                        ____________________________________________________________ 
49 76 Fed. Reg. 5862, 5902-03.  
50 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, p. 10. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  15 
   
   
deadline.51  These States expected to complete their revalidation screening 
between later in 2016 and 2019.52 
Some of the States reporting that they would not meet the revalidation 
deadline provided various reasons for this.  For example, six States 
attributed the delay to their data management systems.  These States 
variously indicated that they were updating their systems, that their 
systems needed to be updated, or that they had a paper-based, manual 
process.  Four States cited resource issues, such as the number of 
providers to be revalidated, or having to hire more staff.  Lastly, two States 
mentioned the delay in CMS guidance.  One discussed the 10-month delay 
in initial guidance after the regulations became effective.  The other cited 
the delayed guidance for fingerprint-based criminal background checks for 
high-risk providers.   
The remaining 34 States reported that they were on schedule to meet the 
deadline.  However, 26 of these States reported, at the time of our review, 
not having fingerprint-based criminal background checks, and 9 reported 
not conducting site visits.  Thus, although these States reported that they 
were on schedule, our findings suggest that their revalidation screening 
may not include all required screening activities.53   
   
                        ____________________________________________________________ 
51 Initially, CMS directed States to complete risk-based screening for revalidating 
providers by March 24, 2016.  However, CMS changed this date to September 25, 2016.  
See CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Revalidation 
(2016-001).   
52 One of the States expecting to be finished in 2019 reported that it had an approved 
alternate compliance date with CMS. 
53 According to CMS, the screening requirements for revalidating existing high- and 
moderate-risk providers are the same as for new providers.  To meet the deadline for 
screening existing high- and moderate-risk providers, States would need to complete all 
required screening activities, including site visits and the now-required fingerprint-based 
criminal background checks.  See CMS, CMCS Informational Bulletin:  Medicaid/CHIP 
Provider Screening and Enrollment, p. 12. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  16 
   
   
CONCLUSION AND RECOMMENDATIONS 
OIGs past work found vulnerabilities in the Medicaid provider enrollment 
process.  To reduce enrollment vulnerabilities, the ACA required that 
States screen providers according to their risk for fraud, waste, and abuse 
to Medicaid.  Implementing the ACA screening activities is critical to 
safeguarding Medicaid as it grows to serve more beneficiaries.  
However, our findings indicate that State implementation of ACA 
screening activities is incomplete for high- and moderate-risk providers.  
Notably, CMS did not require fingerprint-based criminal background 
checks for high-risk providers for more than 4 years.  States with 
incomplete screening activities enrolled thousands of providers 
categorized as posing a high- or moderate-risk to Medicaid.  The option to 
substitute screening results from Medicare or other States could help 
States to meet the demands of screening all new and existing providers 
according to the ACA requirements.  However, States reported challenges 
associated with substituting screening results from both Medicare and 
other States.  Further, substituting screening results, especially incomplete 
or inconsistent screening results, from Medicare or other States may leave 
States open to fraud, waste, and abuse by risky providers.   
Not implementing the required enhanced provider screening activities 
poses risks to Medicaid and its beneficiaries that the ACA intended to 
prevent.  Regardless of the challenges that prevented States from 
implementing enhanced provider screening and CMSs decision not to 
enforce fingerprint-based criminal background checks, not implementing 
the screening activities leaves Medicaid vulnerable to providers who may 
be ineligible or intent on defrauding the program and harming patients in 
the process.  Preventing fraudulent and abusive providers from enrolling 
in Medicaid is critical to ensuring the integrity of the program, especially 
as it grows to serve more beneficiaries.  Therefore, to strengthen 
Medicaids provider enrollment screening process, we recommend that 
CMS: 
Assist States in implementing fingerprint-based criminal 
background checks for all high-risk providers   
CMS should assist States in implementing fingerprint-based criminal 
background checks within a reasonable timeframe.  CMSs assistance 
could include technical support to States or dissemination of best practices 
from States that are further along in the process.  CMS should also 
consider the feasibility of making Medicares fingerprint-based criminal 
background checks contractor available to States for these checks. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  17 
   
   
Assist States in overcoming challenges in conducting site 
visits 
CMS should ensure that all States implement required site visits.  CMS 
should work with the 11 States that have not implemented site visits to 
address the challenges that those States identified.  CMS could provide 
technical assistance or share practices from other States that overcame 
similar challenges.  
Separately, we referred to CMS for appropriate followup information for 
the 11 States that indicated that they did not have the required site visits in 
place.  CMS should consider the number of high- and moderate-risk 
providers enrolled in each State when prioritizing its followup.   
Enable States to substitute Medicare screening data by 
ensuring the accessibility and quality of Medicare data 
States could save time and money by substituting Medicare screening 
results or enrollment for their own.  However, many States reported that 
they did not take advantage of this option because of difficulties accessing 
and using Medicare data and concerns about the completeness and 
accuracy of that data.  CMS should resolve these concerns and could do so 
in various ways.  For instance, CMS could enhance PECOS, its national 
data repository for Medicare provider enrollment information, to resolve 
States password problems and inability to obtain enrollment-screening 
results for multiple providers in a timely way.  To ensure that PECOS data 
are complete and accurate, CMS should improve the completeness and 
accuracy of the Medicare enhanced provider screening, including ensuring 
implementation of complete fingerprint-based criminal background checks 
for high-risk providers, to protect Medicare and Medicaid.  
Develop a central system where States can submit and access 
screening results from other States 
CMS should develop a central system that allows States to submit and 
access provider enrollment screening results from other States to make it 
easier for States to substitute screening results from other States.  Such a 
system should also allow States to search for multiple providers at once.  
As the Federal partner for all States, CMS is uniquely positioned to 
provide and oversee a central system to which all States can contribute 
their screening results.  Toward that end, CMS could work with States to 
develop core, consistent submission requirements so States have common 
data elements across screening results.  CMS could consider incorporating 
State information into PECOS.  
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  18 
   
   
Strengthen minimum standards for fingerprint-based criminal 
background checks and site visits 
CMSs existing minimum standards for fingerprint-based criminal 
background checks and site visits could produce variations across States 
such that States do not want to substitute each others screening results.  
While States can determine the type and extent of their criminal 
background checks and the activities that constitute their site visits, CMS 
could facilitate substitutions by working with States to strengthen 
minimum standards for these checks.  Doing so could alleviate States 
concerns about variation in screening standards.  For fingerprint-based 
criminal background checks, CMS could consider requiring States to 
conduct national background checks.  CMS could consider requiring a 
shared standard for site visits conducted by both Medicare and States that 
promotes consistency.  
Work with States to develop a plan to complete their 
revalidation screening in a timely way  
CMS should ensure that all States complete the necessary revalidation 
screening.  CMS should work with the 14 States that reported they would 
not meet the September 2016 deadline and help them to develop plans to 
complete their revalidation screening.  CMS should add to the list of 
14 States any State that it identifies as unable to meet the deadline.    
Separately, we referred to CMS for appropriate followup the 14 States that 
indicated they would not complete their revalidation screening by the 
September 2016 deadline.  Again, CMS could consider the number of 
high- and moderate-risk providers enrolled in each State when prioritizing 
its followup. 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  19 
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with all six of our recommendations.  In its comments, 
CMS highlighted its most recent efforts to improve the Medicaid enhanced 
provider screening process.  For example, CMS indicated that it has 
worked with the FBI to issue guidance in January 2016 to help States 
implement fingerprint-based criminal background checks.54  CMS also 
indicated that, in March 2016, it published the Medicaid Provider 
Enrollment Compendium, a consolidated resource for guidance on 
Medicaid enhanced provider screenings.55  With regard to screening 
substitution from Medicare, CMS indicated that it has provided States 
with direct access to Medicares enrollment database, PECOS, as well as 
monthly PECOS data extracts that States can systematically compare to 
their enrollment records.  Finally, with regard to States revalidation 
efforts, CMS indicated that it has taken several steps to help States fulfill 
the requirement to revalidate Medicaid providers, including the 
assignment of CMS staff to work with States.   
We look forward to receiving updates on CMSs progress but have 
concerns.  We look forward to efforts by CMS to strengthen minimum 
standards for fingerprint-based criminal background checks and site visits 
and its efforts to assist States in sharing screening results with one another.  
However, we have concerns that CMSs January 2016 guidance on 
fingerprint-based criminal background checks could mean full 
implementation of these checks will not occur until after 2016.  CMS has 
asked States submitting a compliance plan to indicate when they 
anticipated full implementation.  Further, we have concerns about CMSs 
response to our recommendation on States substituting screening results 
from Medicare.  We encourage CMS to think broadly about this 
recommendation and to consider what steps are necessary to ensure that 
States have access to complete and accurate Medicare provider enrollment 
screening data.  Implementing our related recommendations in OIGs 
report on Medicare enhanced provider screenings (OEI-03-13-00050) may 
assist States in substituting screening results from Medicare.   
For the full text of CMSs comments, see Appendix B.   
                        ____________________________________________________________ 
54 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  
Fingerprint-based criminal background checks (FCBC) (2016-002).   
55 CMS, Medicaid Provider Enrollment Compendium, March 21 2016.  Accessed at 
https://www.medicaid.gov/affordablecareact/provisions/downloads/mpec-032116.pdf on 
May 12, 2016. 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  20 
   
   
APPENDIX A 
Detailed Methodology 
Data Collection and Analysis 
Data Collection Instrument.  Forty-eight of 51 States responded to the data 
collection instrument.  Arkansas, Florida, and Rhode Island did not 
respond. 
The instrument had two sectionsa survey and a data request.   
Survey.  The survey had two types of questions, multiple-choice 
questions that required States to select from a set of responses and 
open-ended questions that allowed States to comment and provide 
additional information.   
In general, the multiple-choice questions asked how States conduct 
their screening activities, whether States substitute screening 
results from other sources, and what the status of States 
revalidation screening was.  All 48 States responded to nearly all 
of the multiple-choice questions.  For two questions, 43 and 47 
States responded, respectively.  Where appropriate in the text, we 
indicate when the number of States responding was fewer than 48.  
The open-ended questions generally asked some States to elaborate 
on their responses to the multiple-choice questions, depending on 
their answers, and about any challenges States faced in 
implementing the ACA screening activities.  For questions that 
asked States to elaborate on a response to a multiple-choice 
question, in all but one case, all of the States that had an 
opportunity to respond to the question did so.  For the remaining 
question, only one State did not respond.   
Data Request.  We requested data on States high- and 
moderate-risk providers.  We relied on States determination of risk 
for their providers.   
We did not receive all of the requested data from all of the 
48 responding States.  Eight States did not provide any of the 
requested data.  The remaining 40 States provided some or all of 
the requested data.  However, only 27 States provided sufficient 
data for our analysis.  To determine which States data we could 
use in our analysis, we reviewed each States data for internal 
consistency and verified that each State provided the specific data 
fields we planned to use. 
Our analysis summed across States the number of providers that 
they approved to enroll in Medicaid.  One State indicated that it 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  21 
   
   
could not distinguish between newly enrolling providers and 
revalidating providers.  In our analysis, we included this State in 
our count of revalidating providers because we deemed that 
category as less risky to Medicaid because revalidating providers 
already had been screened under States previous enrollment 
standards.  This State accounted for approximately 
3,000 providers, which means that we could be undercounting the 
newly enrolling providers by up to 3,000 and overcounting the 
revalidating providers by up to 3,000.     
CMS Documentation.  We also reviewed CMS documents related to the 
ACA screening requirements, including subregulatory guidance, an 
informational bulletin, and a State Medicaid Director Letter.      
 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  22 
   
   
APPENDIX B 
Agency Comments 
 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  23 
   
   
 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  24 
   
   
 
   
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  25 
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Thomas F. Komaniecki, 
Regional Inspector General for Evaluation and Inspections in the Chicago 
regional office, and Laura T. Kordish, Deputy Regional Inspector General.  
Nicole Hrycyk served as team leader for this study, and Jonathan Jones 
served as lead analyst.  Other Office of Evaluation and Inspections staff 
from the Chicago regional office who conducted the study include Jane 
Ahn.  Central office staff who provided support include Kevin Farber, 
Joanne Legomsky, and Kevin Manley.  
 
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520)  26 
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS) programs, as  well  as the health  and welfare of individuals served by those programs.  
This statutory mission is carried  out through a nationwide network of audits, investigations,  
and inspections conducted by the following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of fraud and misconduct  related to HHS programs, operations, and individuals.  With  
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and  abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.