Other general comment 
U.S. Department of Health and Human Services 
Office of Inspector General 
 
Twenty-Three 
States Reported 
Allowing 
Unenrolled 
Providers To Serve 
Medicaid 
Beneficiaries  
 
OEI-05-19-00060 
  Christi A. Grimm 
March 2020 
Principal Deputy 
 
Inspector General 
oig.hhs.gov  Report in Brief  U.S. Department of Health and Human Services 
March 2020 
Office  of Inspector General 
OEI-05-19-00060 
 
 
Twenty-Three States Reported Allowing  Why OIG Did This Review 
An effective provider enrollment 
Unenrolled Providers To Serve Medicaid 
process plays a vital role in 
Beneficiaries  safeguarding Medicaid from 
Key Takeaway  fraudulent and abusive providers.  To 
What OIG Found  The Medicaid program  strengthen Medicaid provider 
We found thatcontrary to Federal  and its beneficiaries are  enrollment, the Cures Act stipulated 
requirements23 States had not enrolled all  exposed to providers that  that States must require all Medicaid 
providers serving Medicaid beneficiaries in  have not been screened  providersboth those in Medicaid 
their respective Medicaid programs, exposing  by the States.   FFS and Medicaid managed careto 
them to potentially harmful providers that had  enroll with their respective State 
not been screened for fraud, waste, and abuse.   Medicaid agencies.  The Cures Act 
These 23 States reported that they had not enrolled all providers in Medicaid  mandated that OIG submit a report 
managed care or that they had not enrolled all ordering, referring, or  to Congressby March 31, 2020
prescribing (ORP) providers in Medicaid fee-for-service (FFS).       that assesses the extent to which 
  Twenty-one of the 23 States had not enrolled all providers in Medicaid  States had enrolled all providers that 
managed care.  The 21st Century Cures Act (Cures Act) required States to  serve Medicaid beneficiaries.  As part 
enroll these providers as of January 1, 2018.  Most States had enrolled  of the request, OIG must also 
some, but not all, providers in the networks of managed care  provide Congress with information 
organizations (MCOs).  However, four States had not attempted to enroll  about the amount of Federal 
MCO network providers.  The Centers for Medicare & Medicaid  financial participation (FFP) that 
Services (CMS) also reported that it was not disallowing reimbursements  States received for services provided 
to States for payments associated with unenrolled providers in MCOs  by Medicaid MCOs with unenrolled 
networks because it does not have the authority to do so.      providers.    
  The Federal share of these 21 States expenditures for Medicaid managed 
How OIG Did This Review 
care was $85 billion in 2018; States could not report the exact Federal 
We based this study on data from 
share for individual unenrolled MCO network providers.  
the 49 States and the District of 
  Ten of the 23 States had not enrolled all ORPs in Medicaid FFS as of 
Columbia (States) that responded to 
January 1, 2017, the enrollment date required by the Cures Act.   
our survey.  One State 
Of the 27 States that reported enrolling all providers, 11 States enrolled all 
(Massachusetts) did not respond.  
providers according to Federal requirements and had enforcement controls.  
We requested information on the 
However, 16 of the 27 States reported that they were not collecting the 
extent to which States had enrolled 
required identifying and ownership information necessary for effectively 
all providers.  We conducted 
screening Medicaid providers, or that they lacked enforcement controls to 
followup with 39 States to clarify 
ensure ongoing State compliance with the Federal requirements.  
their survey responses.  We asked 
What OIG Recommends   States to report the Federal dollars 
We recommend that CMS (1) take steps to disallow Federal reimbursements  associated with unenrolled providers.  
to States for expenditures associated with unenrolled MCO network  Many States could not report FFP 
providers, including seeking necessary legislative authority; (2) work with  associated with unenrolled MCO 
States to ensure that unenrolled MCO network providers do not participate in  network providers.  As a result, we 
Medicaid managed care and assist States in establishing ways to do so;  used information about capitation 
(3) work with States to ensure that they have the controls required to prevent  payments (i.e., payments that States 
unenrolled ORPs from participating in Medicaid FFS; and (4) work with States  make to MCOs) from the 
to ensure that they are complying with requirements to collect identifying  Transformed Medicaid Statistical 
and ownership information on Medicaid provider enrollment forms.  CMS  Information System (T-MSIS).  Finally, 
concurred with our recommendations.          we queried staff from CMS on their 
work to enforce the Federal provider 
Full report can be found at oig.hhs.gov/oei/reports/oei-05-00060.asp  enrollment requirements.     
TABLE OF CONTENTS 
BACKGROUND  1 
Methodology  9 
   
FINDINGS   
Twenty-three States reported allowing unenrolled providers to serve Medicaid beneficiaries    11 
Of the 27 States that reported enrolling all providers, 16 reported lacking enrollment  17 
processes or enforcement controls to ensure ongoing compliance  
   
CONCLUSION AND RECOMMENDATIONS   
Take steps to disallow Federal reimbursements to States for expenditures associated with   21 
unenrolled MCO network providers, including seeking necessary legislative authority  
Work with States to ensure that unenrolled MCO network providers do not participate in   21 
Medicaid managed care and assist States in establishing ways to do so  
Work with States to ensure that they have the controls required to prevent unenrolled ORPs  22 
from participating in Medicaid FFS  
Work with States to ensure that they are complying with requirements to collect identifying    23 
information and ownership information on Medicaid provider enrollment forms 
 
AGENCY COMMENTS AND OIG RESPONSE  24 
   
APPENDICES   
A. 21st Century Cures Act Mandate for This OIG Report     25 
B. Detailed Methodology   26 
C. Extent of Unenrolled MCO Network Providers   30 
D. Extent of Unenrolled FFS ORP Providers   35 
E. Federal Share of States Capitation Payments to MCOs With Unenrolled Network   37 
Providers                   
  
F. Federal Share of States Payments for Items and Services Ordered, Referred, or Prescribed 
 38  
by Unenrolled FFS ORP Providers   
 
G. States That Enrolled All Providers but Did Not Collect All Required Identifying and 
Ownership Information  39 
H. Agency Comments   40  
ACKNOWLEDGMENTS  43 
   
BACKGROUND 
Objectives 
1.  To assess the extent to which States had enrolled providers in 
their Medicaid managed care and fee-for-service (FFS) 
programs; and  
2.  To provide information on the amount of Federal financial 
participation (FFP) that States reimbursed to managed care 
organizations (MCOs) with unenrolled network providers.  
3.   
The Medicaid program serves more people than any other Federal health 
care program.1  Approximately 74 million people receive health coverage 
from Medicaid at an annual cost of nearly $600 billion.2  Given the 
number of beneficiaries and the amount of expenditures, the Medicaid 
provider enrollment process is an important tool for protecting Medicaid 
beneficiaries and the Federal and State governments against fraudulent 
and abusive providers.  As part of the enrollment process, States are 
supposed to screen providers applying for enrollment to determine 
whether they have a history of fraud, waste, or abuse.3  States can then 
deny fraudulent or abusive providers applications to serve Medicaid 
beneficiaries.  Previous studies from the Office of Inspector General (OIG) 
and U.S. Government Accountability Office (GAO) have found problems 
with States implementation of Medicaid provider enrollment.4, 5   
To strengthen Medicaid provider enrollment, the 21st Century Cures Act 
(Cures Act) required that all providers that serve Medicaid beneficiaries 
enroll with their State Medicaid agency effective January 1, 2018.6  The 
Cures Act required OIG to submit this report to Congress assessing States 
compliance with the provider enrollment requirements by 
March 31, 2020.7  In addition, the Cures Act required that no FFP be paid 
for managed care expenditures when States have not complied with the 
requirement to enroll MCO network providers.8  The Cures Act also 
required that OIG provide information in this report about the amount of 
FFP paid to States for payments to MCOs with unenrolled network 
providers.9   
The Medicaid Program  
States administer and finance their Medicaid programs through a 
partnership with the Federal government.  States have the flexibility to 
administer their Medicaid programs within broad Federal requirements, 
resulting in various combinations of health care delivery and payment 
systems in each State.  Generally, States offer Medicaid services through 
the FFS model, by contracting with MCOs, or through a combination of 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   1 
OEI-05-19-00060   
both.  States may provide their Medicaid beneficiaries with the option to 
voluntarily obtain their health care benefits through MCOs, or they may 
mandate that all Medicaid beneficiaries or categories of beneficiaries 
obtain their care through MCOs.10   
These modelsMedicaid FFS and Medicaid managed careuse distinct 
payment structures.  Under the FFS model, providers submit claims to the 
State for Medicaid items or services and the State directly reimburses 
them.  Under the managed care model, States pay MCOs a per-member, 
per-month fee for each Medicaid beneficiary enrolled in the plans 
administered by the MCO.  In return for this amountknown as a 
capitation paymentMCOs pay network providers for all Medicaid 
services included in the MCOs contract with the State.  The MCO submits 
recordsknown as encounter recordsto the State to show the Medicaid 
items and services received by managed care beneficiaries.11 
States report their Medicaid expenditures to the Federal Government 
every quarter.12  The Federal Government then calculates its share of 
States Medicaid expendituresknown as the FFPusing States Federal 
Medical Assistance Percentages (FMAPs).13  Each States FMAP is based on 
how far that States per capita income deviates from the national average 
per capita income.14  This formula results in higher Federal funding to 
States with lower per capita incomes.  For fiscal year 2018, FMAP rates for 
Medicaid expenditures ranged from 50 percent to 75.65 percent.15  The 
FMAP applies to both FFS expenditures and managed care capitation 
payments.    
Medicaid Provider Enrollment  
The U.S. Congress has passed two laws requiring that all providers serving 
Medicaid beneficiaries enroll with the State.  In 2010, the Affordable Care 
Act mandated that States screen and enroll all Medicaid providers but did 
not set a deadline for enrolling these providers.16  In 2016, the Cures Act 
established deadlines for States to enroll all providers in FFS and 
managed care.17      
The Cures Act required all providers that serve beneficiaries in Medicaid 
FFS to enroll with the State by January 1, 2017.18  This requirement 
included all providers that furnish, order, refer, prescribe, or provide items 
and services to Medicaid beneficiaries.  Furnishing providers bill and 
receive payments from States for services provided to beneficiaries.19  By 
contrast, ordering, referring, or prescribing (ORP) providers may serve 
Medicaid beneficiaries without billing the State Medicaid agency.20  ORP 
providers refer beneficiaries to other providers for services or write 
prescriptions for beneficiaries.21  For example, a provider employed by the 
Department of Veterans Affairs (VA) may refer a veteran who is also a 
Medicaid beneficiary to a Medicaid provider for a service not available at 
a given VA facility.22   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   2 
OEI-05-19-00060   
The Cures Act required States to enroll all MCO network providers by 
January 1, 2018.23  To become part of an MCOs network, a provider 
contracts with the plan to furnish, order, refer, or prescribe items and 
services for the plans beneficiaries.24  MCOs pay network providers either 
for services provided to beneficiaries or with set periodic payments.25  
MCOs can also designate providers that provide a limited number of 
services to the plans beneficiaries as out-of-network providers.  Although 
States must enroll all MCO network providers, they do not need to enroll 
MCOs out-of-network providers.26  According to the Federal rules, States 
must require (1) managed care contracts to include stipulations that 
ensure that all MCO network providers enroll with the State as Medicaid 
providers, and (2) MCOs to remove providers from their networks that fail 
to submit timely or accurate enrollment information to the State.27, 28   
 
FFS and MCO Provider Definitions  
   
FFS furnishing providers bill and receive payments from States for 
services provided to Medicaid beneficiaries.   
FFS ORP providers serve Medicaid beneficiaries without billing the 
State Medicaid Agencythese providers refer beneficiaries to 
Medicaid providers for services or write prescriptions for Medicaid 
beneficiaries. 
MCO network providers contract with MCOs to furnish, order, refer, 
or prescribe items and services to the plans beneficiariesthese 
providers either bill the MCOs for each service they provide or 
receive set periodic payments from the MCO.   
Medicaid Provider Enrollment Process  
Before enrolling a provider, States must require the provider to complete 
a provider agreement with the State.  According to the Federal rules, 
States should ensure that all providers serving Medicaid beneficiaries 
have (1) completed a provider agreement (application) with the State,29 
(2) disclosed the required identifying and ownership information on their 
enrollment application,30 and (3) undergone the required risk-based 
screening activities.31  Ideally, only after providers satisfy these 
requirements and pass the screening activities should they be approved 
to enroll in the Medicaid program.   
Provider agreement.  According to the Medicaid Provider Enrollment 
Compendium (MPEC), all providers serving Medicaid beneficiaries must 
have a provider agreement with the State Medicaid Agency.32  In the 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   3 
OEI-05-19-00060   
MPEC, CMS states that the provider agreement is the provider enrollment 
application.33   
Identifying and ownership information.  States must require providers to 
submit identifying information and any applicable ownership information 
on the enrollment application.  Identifying information must include the 
name, provider specialty, date of birth, Social Security number, National 
Provider Identifier (NPI), Federal Taxpayer Identification Number, and the 
State license or other certification number.34  States must also require 
providers to disclose all individuals with an ownership or control interest 
when submitting their applications for Medicaid enrollment.35  Although 
some providers may not have owners, States are required to collect 
ownership information when applicable.  According to the MPEC, these 
requirements apply to ORP providers.36  
Risk-based screening.  State Medicaid programs must screen providers to 
ensure that they are eligible to serve Medicaid beneficiaries.  States first 
assign providers to low-, moderate-, or high-risk categories.37  Depending 
on the risk category, States must conduct a set of screening activities for 
all newly enrolling providers.38  These screening activities entail checks of 
Federal databases, including databases containing information on 
terminated providers, site visits, and fingerprint-based criminal 
background checks.39  In addition to screening newly enrolling providers, 
States must periodically re-screen providers that are already enrolled 
throughout their enrollment.40  States can rely on other States or 
Medicare for screening results or delegate the screening activities to third 
parties.  However, States bear the responsibility for ensuring that 
providers undergo the screening activities.41   
Ideally, a State would approve a providers application after it had 
completedand the provider had passedall required screening 
activities under both State and Federal rules.  However, as demonstrated 
in past OIG work, some States have approved providers applications to 
serve in the Medicaid program (i.e., enrolled these providers), even 
though those providers have not undergone all required screening 
activities.  For example, OIG reported in 2019 that 13 States had not 
implemented fingerprint-based criminal background checks for high-risk 
providers enrolled with the State.42   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   4 
OEI-05-19-00060   
 
Provider Enrollment Requirements: States 
 
States must ensure that provider applications contain all required 
information, conduct risk-based screenings before enrolling 
providers, and enroll only eligible FFS furnishing, FFS ORP, and MCO 
network providers. 
States that do not conduct all of these steps are not in compliance 
with Federal rules.  States are also required to prevent payments to 
providers that are not enrolled, which means that States should 
have some enforcement controls.        
 
Enrollment status terms and definitions.  In this report, OIG uses 
two termsenrolled and unenrolledto describe the enrollment status of 
providers that serve Medicaid beneficiaries.  Please see the definitions 
below.    
 
Enrollment Status Definitions  
   
Enrolled providersproviders that have completed the States 
provider enrollment application and have been approved to serve 
Medicaid beneficiaries by the State.  For the purposes of this report, 
enrolled providers may include providers that the State approves to 
serve Medicaid beneficiaries without having (1) collected all 
required identifying and ownership information or (2) conducted all 
required screening activities.   
Unenrolled providersproviders that serve Medicaid beneficiaries, 
even though they have not completed the States provider 
enrollment application and had it approved by the State.  
State Oversight and Enforcement Controls 
States use a variety of controls to ensure that providers who serve 
Medicaid beneficiaries are enrolled.  CMS grants States flexibility on how 
they ensure that all providers are enrolled.   
For Medicaid FFS furnishing providers, States may use prepayment claims 
edits to prevent or delay payments for claims submitted by unenrolled 
FFS furnishing providers.  The claims edit would deny or delay payment 
for submitted claims that do not contain an enrolled furnishing providers 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   5 
OEI-05-19-00060   
NPI.  These prepayment edits are generally performed after a service is 
provided but before a claim is paid. 
States may also use prepayment claims edits or point-of-sale edits for 
prescriptions to prevent or delay payments for claims associated with 
items and services ordered, referred, or prescribed by unenrolled FFS ORP 
providers.  These claims edits would deny or delay payments for medical 
and pharmacy claims that do not contain an enrolled ORP providers 
NPIas required by Federal rules.43  Because ORP providers may not have 
a billing relationship with the State, the claims edit would deny or delay 
payments to the (1) furnishing provider that submitted the claim referred 
or ordered by the unenrolled ORP provider, or (2) pharmacy that 
dispenses the prescription by the unenrolled ORP provider.  The latter 
point-of-sale edit occurs at the pharmacy before a beneficiary receives 
their medication.   
In the case of Medicaid managed care, States cannot directly prevent or 
delay payments to unenrolled MCO network providers.  Instead, States 
can require that MCOs edit claims and then deny or delay payments to 
unenrolled network providers.  In additionafter MCOs submit encounter 
recordsStates can use edits to compare the MCOs network providers 
against the States provider enrollment records.44  The State could then 
deny encounters associated with unenrolled MCO network providers, 
which may reduce the MCOs future capitation payment rates.  (See 
Exhibit 1 on the next page for examples of how States may use edits.)  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   6 
OEI-05-19-00060   
Exhibit 1: Examples of edits that States may use to ensure that providers are enrolled  
 
Source: OIG review of Federal rules and documents from CMS, Medicaid and the State Childrens Health Insurance Program Payment and 
Access Commission (MACPAC), and various States.45   
 
CMS Oversight and Enforcement Controls 
CMS is required to recover or disallow FFP for State Medicaid 
expenditures if States do not implement provider enrollment 
requirements.  CMS reviews States payments for compliance with Federal 
requirements and may recover FFP paid to the State for claims associated 
with FFS providers who were not properly enrolled.46  CMS must also 
disallow FFP for States payments to MCOs if the State has not complied 
with the requirement to enroll MCO network providers.47  CMS does not 
currently assess whether MCO network providers were appropriately 
screened and enrolled when determining whether States have made 
improper payments to MCOs.48 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   7 
OEI-05-19-00060   
 
Provider Enrollment Enforcement Requirements: CMS 
 
 
CMS reviews States payments to check for compliance with State 
and Federal policies and identify improper payments.  CMS may 
recover FFP for improper payments associated with unenrolled or 
improperly screened FFS providers. 
CMS must disallow FFP for States payments to MCOs if the State 
has not complied with the requirement to enroll and screen all MCO 
network providers. 
 
Related OIG Work 
OIG has repeatedly found problems with States implementation of 
provider enrollment screening requirements.  These problems entailed 
(1) States having approved enrollment applications for providers that did 
not submit the required ownership information as a part of their 
enrollment application, and (2) States having approved enrollment 
applications for providers that had not been properly screened.   
OIG has found problems with the completeness and accuracy of the 
information that States have collected from providers and MCOs.  
In 2018, OIG found that MCOs typically did not provide the State with 
information about providers terminated or otherwise removed from their 
networks.49  In 2016, OIG found that few State Medicaid programs 
requested that providers disclose all federally required ownership 
information.  In the same study, 14 State Medicaid programs reported 
that they did not verify the completeness or accuracy of provider 
ownership information.50  In 2014, OIG found that collecting additional 
informationsuch as a Social Security number and date of birthwould 
help to more effectively screen providers against existing Federal and 
State termination databases.51   
OIG has also found repeated problems with States implementation of the 
required screening activities.  In a 2019 report on fingerprint-based 
criminal background checks, OIG found that 13 States had not 
implemented required criminal background checks.52  In 2016, OIG found 
that 11 States had not implemented the required site visits.53   
CMS has yet to implement key recommendations from these studies.  
Specifically, CMS has not fully implemented the recommendation that it 
clarify the information MCOs are required to report when providers are 
terminated or otherwise leave MCO networks.  Further, CMS has not 
implemented and did not concur with OIGs recommendation to require 
State Medicaid programs to verify the completeness and accuracy of 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   8 
OEI-05-19-00060   
provider ownership information.  For OIGs work on the provider 
enrollment screening activities, CMS has not fully implemented OIGs 
recommendations to assist States in implementing background checks 
and site visits.  Additionally, for OIGs work on terminated providers, CMS 
has not implemented the recommendation to require that each State 
Medicaid agency report all terminations.   
The requirements in the Cures Act help to address OIGs outstanding 
recommendations.  Specifically, the Cures Act established requirements to 
enroll all Medicaid providers by January 1, 2018, and established new 
requirements related to terminated providers.54  OIG is conducting related 
work on the extent to which providers terminated in one State continued 
to be enrolled in other State Medicaid programs.55  
Methodology  For this evaluation, we sent a survey to 50 States and the District of 
Columbia.  We included all States and the District of Columbia in our 
study to ensure that we had comprehensive information about Medicaid 
FFS and MCO network provider enrollment.  Forty-nine States and the 
District of Columbia (hereinafter referred to as States) responded to our 
survey.  One StateMassachusettsdid not respond to OIGs survey.  See 
Appendix B for a summary of OIGs correspondence with Massachusetts.  
We conducted followup with 39 States to clarify their survey responses, 
through either email or an interview, to ensure that we had the most 
accurate information.  We contacted 27 States via email alone to followup 
on their survey.  We interviewed 12 additional States to clarify their survey 
responses, particularly with regard to the extent to which they had 
enrolled all providers serving Medicaid managed care beneficiaries.  In 
August 2019, we also sent a set of questions to the CMS officials who 
oversee Medicaid provider enrollment.  Because many States could not 
report expenditures associated with unenrolled MCO network providers, 
information on States managed care expenditures came from the 
Transformed Medicaid Statistical Information System (T-MSIS).  
Appendix B provides a detailed methodology. 
Limitations 
Our analysis relied on State-reported data, which we did not 
independently verify for every State.  
In addition, we were not able to report all States MCO capitation 
payments because of incomplete T-MSIS data.  As a result, the payment 
amounts we report underestimate actual capitation payments that States 
made to MCOs with unenrolled network providers.  Each State may differ 
in the completeness of its T-MSIS data.  For example, some States did not 
submit capitation payment records to T-MSIS for all or most of the study 
period, even though these States have Medicaid managed care programs.  
In those instances, we did not include an amount for the States capitation 
payments.  (See Appendix E for the six States excluded from this analysis.)    
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   9 
OEI-05-19-00060   
 
SSttaannddaarrddss   We conducted this study in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   10 
OEI-05-19-00060   
FINDINGS 
Twenty-three States  As of December 31, 2018, a total of 23 States reported that they had not 
enrolled all MCO network providers or FFS ORP providers.  Twenty-one of 
reported allowing 
the 23 States had not enrolled all MCO network providers serving 
unenrolled 
beneficiaries through Medicaid managed care.  Although these 23 States 
providers to serve  had enrolled all FFS furnishing providers, 10 had not enrolled all ORP 
providers serving beneficiaries through their Medicaid FFS programs.56  
Medicaid 
One StateMassachusettsdid not respond to OIGs survey for this 
beneficiaries 
report despite OIGs repeated attempts to obtain a response.57 
Twenty-one States reported that they had not enrolled all MCO 
network providers because of various challenges  
Twenty-one States reported that they had not enrolled all providers 
serving Medicaid beneficiaries through managed care by 
December 31, 2018nearly a full year after the enrollment deadline 
specified in the Cures Act.58  States experienced challenges to (1) enrolling 
MCO network providers and (2) putting enforcement controls in place to 
prompt unenrolled MCO network providers to enroll.  (See Exhibit 2 for 
the States that had not enrolled all MCO network providers.)    
Exhibit 2: Twenty-one States had not enrolled all MCO network 
providers as of December 31, 2018. 
 
Source: OIG analysis of State survey and interview responses, 2019. 
These 21 States served the majority of their Medicaid beneficiaries 
through managed care.  In these States, 83 percent of Medicaid 
beneficiaries received services through managed care in 2018.59  The 
Federal share of these States expenditures for Medicaid managed care 
was $85 billion in 2018, but States could not, in most cases, determine 
how much of these expenditures were associated with unenrolled 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   11 
OEI-05-19-00060   
providers.  (See Appendix E for a breakdown of Federal expenditures by 
State.)60   
Of these 21 States reporting unenrolled MCO network providers, 17 were 
in the process of enrolling MCO network providers with the State.  
Four States had not started enrolling MCO network providers.  (See 
Exhibit 3 for details on these 21 States specific statuses.)   
Exhibit 3: States status enrolling MCO network providers as of 
December 31, 2018 
 
Source: OIG analysis of State survey and interview responses, 2019. 
The 17 States that were in the process of enrolling MCO network 
providers reported a range of estimates for the percentage of unenrolled 
MCO network providers.  These States reported having 50 to 
46,000 unenrolled MCO network providers.  The following States are at 
the high, middle, and low points of the reported range:        
  Michigan reported that approximately half of its MCO network 
providers46,000 providerswere unenrolled.   
  Florida reported that about one-third of its MCO network 
providers31,000 providerswere unenrolled.   
  Utah reported that 1 percent of its MCO network providers
50 providerswere unenrolled.   
Of the four States that had not started enrolling MCO network providers, 
two States each reported over 100,000 unenrolled MCO network 
providers:  
  Minnesota reported that it needed to enroll approximately 
120,000 MCO network providers and that it planned to enroll all 
MCO network providers between July 2019 and July 2022.    
  Louisiana reported that it needed to enroll approximately 
110,000 MCO network providers and that it planned to enroll all 
MCO network providers between August 2019 and February 2020.      
(See Appendix C for States estimates of the number of MCO network 
providers left to enroll.)    
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   12 
OEI-05-19-00060   
Challenges to enrolling MCO network providers.  The challenges that 
States faced differed depending on whether they had started the process 
of enrolling MCO network providers.  The 17 States that were in process 
often had challenges to identifying which unenrolled MCO providers 
needed to enroll.  The four States that had not started enrolling MCO 
network providers were redesigning their enrollment systems.   
The 17 States that were in the process often experienced challenges 
accurately identifying which remaining providers needed to enroll.  To 
determine which MCO providers needed to enroll, some of these States 
initially relied on MCOs to provide them with information about which 
MCO providers were in-network.  However, these States found that MCOs 
provider lists (1) did not include indications of providers network status 
and (2) included providers that were not in MCOs networks.  
Consequently, these States needed more assistance from their MCOs to 
determine which providers were in-network and, therefore, were required 
to enroll under the Federal rules.61   
At the time of our review, some of these 17 States were working with their 
MCOs to identify the remaining network providers that needed to enroll.  
For example, California planned to require its MCOs to identify the 
remaining unenrolled providers and exclude them from the monthly 
report on active network providers sent to the State.  Michigan planned to 
require that MCOs identify network providers not already enrolled with 
the State by using a claims edit.  Enabling this edit required Michigan and 
the MCOs to share and compare the list of providers billing the MCOs, 
including network and out-of-network providers, and the State list of 
providers already enrolled with the State. 
The four States that had not started enrolling MCO network providers 
were redesigning their provider enrollment systems.  Both Louisiana and 
Minnesota reported that they were transitioning from a paper enrollment 
application to an online application.  These States reported that they 
would not begin enrolling their MCO network providers until they 
established their online systems.  Virginia reported that State Medicaid 
staff were developing an online enrollment system that MCO network 
providers would use to enroll with the State.  Finally, Rhode Island 
reported that it had not yet developed an enrollment application for 
MCO network providers.   
Challenges to putting MCO network provider enrollment enforcement 
controls in place.  At the time of our review, 17 States were in the process 
of determining how and when to begin using enforcement controls for 
MCOs with unenrolled network providers.  Because MCO network 
providers do not directly receive reimbursements from the States, States 
use the following enforcement controls: (1) imposing financial penalties 
on the MCO by denying encounters for unenrolled network providers, 
thereby decreasing future capitation payments, or requiring the MCO to 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   13 
OEI-05-19-00060   
deny payments to unenrolled network providers; or (2) requiring MCOs to 
remove from their networks any providers that fail to enroll with the State 
in a timely way.62  States lacked information from CMS about how it 
would enforce requirements through its disallowance process.      
States reported challenges to imposing financial penalties for services 
associated with unenrolled MCO network providers.  States that had 
difficulties identifying which unenrolled MCO providers were in-network 
and needed to be enrolledas described abovealso had difficulties 
determining which encounters were associated with unenrolled MCO 
network providers and should be denied.  These States may need to rely 
on their MCOsas in the example of Michigan aboveto edit the claims, 
identify unenrolled network providers, and suspend payments to those 
providers until they enroll with the State.   
States also reported concerns that requiring MCOs to remove unenrolled 
providers from their networks before enough providers have enrolled 
would reduce the number of providers available to serve beneficiaries.  
The Federal rules generally require that MCOs terminate network 
providers that have not enrolled with the State within 120 days; however, 
States may determine that denial or termination of enrollment would not 
be in the best interests of the Medicaid program.63  Some States reported 
that they had not required MCOs to terminate unenrolled network 
providers because of concerns about beneficiaries access to care.  
Further, one State had questions about whether the Cures Act requires 
them to report network providers terminated by MCOs to CMS, which 
would trigger cascading requirements to terminate those providers from 
Medicare and other State Medicaid programs.64 
Finally, some States had not determined when to begin enforcing 
penalties for noncompliance with MCO network provider enrollment 
requirements without direction from CMS on its plans for disallowing 
reimbursements to States.  In December 2019, CMS reported that they 
were not disallowing reimbursements to States for expenditures 
associated with unenrolled MCO network providers.65  CMSs reasons 
were twofold: (1) concerns that its authority under the Cures Act requires 
it to fully disallow reimbursements to States for payments to MCOs with 
unenrolled providers, regardless of whether some network providers in 
the MCO were enrolled; and (2) concerns that such disallowances would 
jeopardize beneficiaries access to care.  Further, CMS staff reported that 
they had informally advised States that CMS had not set a date for 
disallowing reimbursements in cases where States had concerns about 
beneficiaries access to care.   
 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   14 
OEI-05-19-00060   
Ten States reported that they had not enrolled FFS providers that 
ordered, referred, or prescribed items and services for Medicaid 
beneficiaries because of various challenges  
As of December 31, 2018, a total of 10 States reported that unenrolled 
FFS providers continued to order, refer, or prescribe items and services
nearly 2 years after the enrollment deadline specified in the Cures Act.66  
States also reported challenges to enrolling FFS ORP providers and 
establishing enforcement controls.  (See Exhibit 4 on the next page for the 
States that had not enrolled all ORP providers.)   
Exhibit 4: Ten States had not enrolled all FFS ORP providers as 
of December 31, 2018.  
 
Source: OIG analysis of State survey and interview responses, 2019. 
These States reported receiving FFP for claims associated with unenrolled 
FFS ORP providers.  Five of the 10 States with unenrolled ORP providers 
reported receiving approximately $60 million in Federal money for claims 
associated with these providers.  The remaining five States could not 
identify the exact FFP for claims associated with unenrolled ORP 
providers, although they reported receiving Federal dollars for these 
claims.67  (See Appendix D for information on the extent to which States 
had unenrolled ORP providers.  Also, see Appendix F for the FFP reported 
by each State.)     
Challenges to enrolling FFS ORP providers.  States reported that enrolling 
their FFS ORP providers took time because of outdated systems and the 
need for provider education.  These States reported delays to enrolling 
ORP providers because of necessary upgrades to their enrollment 
systems, such as moving from paper-based enrollment applications to 
electronic ones.  Further, States reported that outreach efforts to educate 
providers about the enrollment requirements took time because they 
lacked contact information for many of these providers.  Without a way to 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   15 
OEI-05-19-00060   
directly contact these providers, States had to coordinate with a number 
of other stakeholders.  For example, Michigan reported that it had 
conducted years of outreach through professional associations, 
pharmacies, and licensing boards to contact ORP providers and inform 
them of the enrollment requirement.    
Challenges to putting FFS ORP provider enrollment enforcement controls 
in place.  Similar to MCO network providers, FFS ORP providers presented 
challenges to enforcement because they do not directly receive 
reimbursements from the States.  Financial penalties designed to enforce 
ORP provider enrollment requirements directly affect other providers and 
beneficiaries rather than the unenrolled ORP providers.  To enforce ORP 
provider enrollment requirements, States reported that they needed to 
deny claims for: (1) services provided by furnishing providers that were 
originally ordered or referred by unenrolled ORP providers, and (2) 
beneficiaries prescriptions that were written by unenrolled ORP providers.  
Because denying claims for prescriptions at the point of sale affects 
beneficiaries access to medications, States specifically struggled to 
enforce enrollment requirements for ORP prescribing providers.   
At the time of our review, none of the 10 States with unenrolled FFS ORP 
providers had started denying payments for prescriptions written by 
unenrolled ORP providers.  Two StatesFlorida and New Hampshire
were in the process of requiring that ORP providers NPIs be submitted on 
claims, which is necessary for identifying claims associated with 
unenrolled ORP providers and denying payment for them.68  The 
remaining States primarily reported concerns that denying payments 
would mean that beneficiaries would not receive their prescriptions.  
When States deny payments for prescriptions written by unenrolled 
ORP providers, pharmacists do not get paid and may send beneficiaries 
away without their medication.  OIG recognizes that States must balance 
efforts to enforce the enrollment requirement for ORPs with the need for 
beneficiaries to receive their medications.     
However, some States reported progress in establishing enforcement 
controls that would prompt the enrollment of FFS ORP providers without 
disrupting beneficiaries access to medications.  For example, California 
reported that it was using a warning edit at the point of sale.  This edit 
alerts the pharmacy when an unenrolled ORP provider has written a 
prescription.  Instead of denying payment for the prescription, the edit 
initiates a process for conducting targeted outreach with the unenrolled 
provider.  California reported that it would eventually introduce an edit 
that denies claims associated with unenrolled ORP providersonce it had 
enrolled enough ORP providers to not disrupt access to medicationsbut 
it did not specify a date. 
 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   16 
OEI-05-19-00060   
Of the 27 States that  Twenty-seven States reported that they had enrolled all providers that 
serve beneficiaries in their Medicaid programs as of December 31, 2018.69  
reported enrolling 
Twenty-two of these 27 States reported that they enrolled all providers by 
all providers, 16 
the earlier dates requested in the Cures Act.70  Further, 11 of these 
reported lacking  27 States reported complying with all Federal provider enrollment 
requirements, but the remaining 16 States reported that they lacked the 
enrollment 
enrollment processes or enforcement controlsor bothnecessary to 
processes or 
ensure ongoing compliance with the requirements.71  (See Exhibit 5 for 
enforcement 
each States reported enrollment status.) 
controls to ensure 
Exhibit 5: Twenty-seven States reported that they had enrolled 
ongoing compliance   a  l l Medicaid providers as of December 31, 2018. 
 
Source: OIG analysis of State survey and interview responses, 2019. 
Eleven States reported they enrolled all providers in compliance 
with Federal requirements and had enforcement controls   
Eleven States reported that they had enrolled all providers that serve 
Medicaid beneficiaries in compliance with the Federal provider enrollment  
requirements.  These 11 States reported collecting all required identifying 
and ownership information for their MCO network providers, FFS 
furnishing providers, and FFS ORP providers as well as conducting all the 
required screening activities for them.  Collecting the required identifying 
and ownership informationand conducting the required screening 
activitiesallows States to confirm the identity of providers applying to 
enroll; determine whether these providers have a history of fraud, waste, 
or abuse; and prevent any fraudulent or abusive providers from enrolling 
in the State Medicaid program.72   
These 11 States also reported having enforcement controls to ensure 
ongoing compliance with the MCO and FFS provider enrollment 
requirements.  The States with managed care reported using (1) reviews 
of encounter records or (2) comparisons of MCO network provider rosters 
with State provider enrollment records to identify any unenrolled MCO 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   17 
OEI-05-19-00060   
network providers on an ongoing basis.  The States with FFS programs 
reported having prepayment edits in place to prevent payments for services 
provided by unenrolled FFS furnishing providers.  They also reported having 
prepayment and point-of-sale edits in place to deny payments for services 
and prescriptions ordered, referred, or prescribed by unenrolled 
FFS ORP providers.   
Eight of the 16 States were not in compliance with all provider 
enrollment requirements   
Eight of the 16 States reported that they were not collecting all identifying 
and ownership information necessary to screen providers and their 
owners or conducting all screening activities.  Seven of these States 
reported not always collecting all required elements of identifying and 
ownership information.  Four of these States reported allowing providers 
to serve beneficiaries without having conducted all required screening 
activities.73  (See Exhibit 6 for which States were not collecting all 
identifying and ownership information or not conducting all required 
screening activities.)    
Exhibit 6: Eight States reported enrolling providers without all 
required information or all required screening activities as of 
December 31, 2018. 
 
 
 
 
 
 
 
 
Source: OIG analysis of State survey and interview responses, 2019.  Three States did not collect all 
identifying and ownership information and had not conducted all screenings. 
These States varied in the degree to which they were collecting providers 
identifying and ownership information on enrollment applications.  Some 
States with separate ORP provider application processes were collecting 
identifying and ownership information for FFS furnishing providers but not 
for FFS ORP providers.  For example, Arizona and West Virginia reported 
collecting all identifying and ownership information from FFS furnishing 
providers, but they reported not collecting required identifying 
informationsuch as name and date of birthfrom their ORP providers.  
(See Appendix G for a breakdown of missing identifying and ownership 
information by State.) 
States must collect the required identifying informationas well as any 
applicable ownership informationfrom providers applying to enroll to 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   18 
OEI-05-19-00060   
confirm a providers identity, assess the risk that a provider poses to 
Medicaid, and screen that provider accordingly.74  If States do not collect 
the required identifying and ownership information needed to properly 
screen providersor conduct all screening activitiesbeneficiaries may 
be exposed to fraudulent or abusive providers that have been enrolled by 
the State.  For example, Arizona reported not collecting all identifying and 
ownership information from FFS ORP providers and, as a result, could not 
assess their risk or screen them accordingly.  The State reported that it 
was developing a system to ensure compliance with provider enrollment 
requirements for ORP providers.  Although many ORP providers enroll as 
individuals, some ORP providers may have owners that they need to 
disclose.  The MPEC states that ORP providers must comply with the 
Federal ownership disclosure and provider enrollment screening 
requirements where applicable.75   
Eleven of the 16 States lacked enforcement controls necessary for 
ensuring future compliance with provider enrollment requirements 
Eleven of the 16 States reported lacking some controls that would allow 
them to effectively conduct ongoing oversight of provider enrollment 
requirements across managed care and FFS.  Two States reported not 
having any controlssuch as audits or reviews of encountersto prevent 
payments to MCOs with unenrolled network providers.  Two States 
reported that they lacked prepayment edits to prevent payments to 
unenrolled FFS furnishing providers.  These two States also reported they 
did not have prepayment edits to deny payments for medical services 
ordered or referred by unenrolled FFS ORP providers.  Finally, 10 States 
reported that they did not have a point-of-sale edit that would deny 
payments for prescriptions written by unenrolled ORP providers, which is 
a control that ensures that States are complying with the Federal rules to 
deny such payments.76  Without having such controls in place, these 
States may continue doing business with unenrolled providers.  (See 
Exhibit 7 on the next page for which States lacked controls in each area.)  
 
 
 
 
 
 
 
 
 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   19 
OEI-05-19-00060   
Exhibit 7: Eleven States reported enrolling providers without 
controls to ensure compliance as of December 31, 2018. 
 
Source: OIG analysis of State survey and interview responses, 2019.  Some States reported missing 
more than one of the controls listed above.  For example, two States did not have an FFS prepayment 
edit or an FFS point-of-sale edit. 
 
 
   
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   20 
OEI-05-19-00060   
CONCLUSION AND RECOMMENDATIONS 
States must ensure that only enrolled providers serve Medicaid 
beneficiaries.  As of December 31, 2018, States reported enrolling all 
Medicaid FFS furnishing providers, but 23 States reported that they had 
not enrolled all Medicaid MCO network providers or all Medicaid FFS ORP 
providers or both.  The Cures Act stipulates that no FFP should be paid to 
States for managed care expenditures if the State has not complied with 
the requirement to enroll MCO network providers.77  States must also 
return to CMS the Federal share of overpayments associated with 
unenrolled FFS providers.78  CMS reported that it is not able to disallow 
reimbursements to States for payments associated with unenrolled MCO 
network providers because it does not have the specific authority to 
disallow a portion of capitation payments to MCOs in this case.  In 
contrast, CMS reported that its authority under the Cures Act only allows 
it to disallow all payments to MCOs that have any unenrolled providers in 
their networks.  Further, CMS reported concerns that disallowing all 
payments to an MCO would result in many beneficiaries losing access to 
care.   
Twenty-seven States reported that they had enrolled all providers serving 
Medicaid beneficiaries.  However, 16 of these States reported not being 
compliant with all provider enrollment requirements or lacking 
enforcement controls to ensure ongoing compliance.  
To protect the beneficiaries served by the Medicaid program and taxpayer 
dollars, CMS must work with States to ensure that only enrolled providers 
serve Medicaid beneficiaries.  To ensure that States enroll all providers, 
OIG recommends that CMS:  
Take steps to disallow Federal reimbursements to States for 
expenditures associated with unenrolled MCO network 
providers, including seeking necessary legislative authority   
CMS should take steps to disallow Federal reimbursements to States for 
expenditures associated with unenrolled MCO network providers.  The 
Cures Act requires that no FFP shall be paid to States for managed care 
expenditures if the State has not complied with the requirement to enroll 
these providers.79  At the time of OIGs review, CMS was not examining 
whether MCO network providers were appropriately screened and 
enrolled as part of its process for determining whether States have made 
improper payments to MCOs.  Further, CMS reported that the Cures Act 
authority only permits it to fully disallow Federal reimbursements to 
States for entire payments to MCOs with unenrolled providers.  CMS 
reported that it cannot conduct partial disallowances for the payments 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   21 
OEI-05-19-00060   
associated with unenrolled MCO network providers and that full 
disallowances would jeopardize beneficiaries access to care.  To the 
extent that CMS determines that it cannot conduct full disallowances, 
CMS should seek the necessary legislative authority to conduct partial 
disallowances.   
Work with States to ensure that unenrolled providers do not 
participate in Medicaid managed care and assist States in 
establishing ways to do so 
CMS should work with States to ensure that unenrolled providers do not 
participate in Medicaid managed care networks.  CMS should determine 
the most appropriate way to facilitate candid communication with States 
that have not enrolled all MCO network providers.  For example, CMS 
could reach out to States identified in this report with offers of targeted 
assistance, particularly for any States that have not already worked with 
CMS to enroll their MCO network providers.  CMS could use this process 
to share best practices for attaining compliance while maintaining 
beneficiaries access to care from States that have enrolled all providers 
and established systems to ensure ongoing compliance.  CMS could also 
develop a model managed care contract for States that includes language 
requiring MCOs to implement controls to prevent payments to unenrolled 
providers.   
Work with States to ensure that they have the controls required 
to prevent unenrolled ordering, referring, or prescribing 
providers from participating in Medicaid FFS 
CMS should work with States to ensure that they have adequate controls 
in place that prevent unenrolled FFS ORP providers from serving 
beneficiaries in Medicaid FFS.  To implement this recommendation, CMS 
should first work with States to ensure claims contain the NPI for ORP 
providers before paying the claim, as required by Federal rules.80  Second, 
CMS should work with States to ensure that they are verifying that ORP 
providers are enrolled with the State prior to paying claims associated 
with them.  For example, CMS could conduct targeted reviews in States 
with unenrolled ORP providers.  CMS could also communicate regularly 
with those States about their progress toward compliance.  CMS should 
also establish and communicate to States best practices for ensuring 
ongoing enforcement of the requirement that all ORP providers enroll 
with the State.  For example, before implementing payment denial edits, 
States could use warning edits to advise furnishing providers or 
pharmacies that they will not be paid for future services or prescriptions 
associated with an unenrolled ORP provider if that provider does not 
enroll.  Warning edits could be a useful tool in prompting ORP providers 
to enroll.   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   22 
OEI-05-19-00060   
 
Work with States to ensure that they are complying with 
requirements to collect identifying information and ownership 
information on Medicaid provider enrollment forms  
CMS should work with States to ensure that they collect all required 
identifying informationas well as any applicable ownership 
informationwhen enrolling providers.  Collecting all required identifying 
and ownership information is necessary to confirm providers identities 
and effectively screen them.  CMS should work with the seven States 
listed in Exhibit 6 that have not collected all required identifying and 
ownership information for FFS providers and, in one State, MCO network 
providers, to determine whether they need to update their enrollment 
applications to obtain this information from providers and screen them 
accordingly.  Using the findings of the outreach with these seven States, 
CMS should set individual dates for when these States enrollment 
applications should collect all outstanding information for effectively 
screening their providers for Medicaid enrollment.   
 
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   23 
OEI-05-19-00060   
AGENCY COMMENTS AND OIG RESPONSE 
CMS concurred with all four of our recommendations and described steps 
to implement each.   
In response to our first recommendation, CMS has requested legislative 
authority to issue financial penalties to reduce States administrative 
matches for noncompliance with provider enrollment, screening, and 
revalidation requirements.  CMS requested this legislative authority as 
part of the Presidents FY 2021 Budget.   
In response to our second recommendation, CMS plans to conduct 
targeted outreach with the States identified in the report.  Further, CMS 
plans to share examples of State managed care contract language and to 
use program integrity reviews focused on managed careand any 
resulting corrective action plansto rectify issues unresolved by CMSs 
technical assistance and support.  
In response to our third recommendation, CMS plans to continue working 
with States and conduct program integrity reviews with States.  For this 
recommendation, CMS should work with States to ensure claims contain 
the NPI for ORP providers before paying the claim, as required by Federal 
rules.  CMS should also work with States to ensure that they are verifying 
that ORP providers are enrolled with the State prior to paying claims 
associated with them.  
In response to our fourth recommendation, CMS plans to conduct 
targeted outreach with the seven States identified in the report.  CMS 
believes that setting a separate deadline for collection of information 
would be duplicative.  We understand CMSs concern.  We encourage 
CMS to work with individual States on timelines for collecting all required 
information.       
OIG and CMS share the goal of ensuring that all States have an effective 
Medicaid provider enrollment screening process.  We are encouraged by 
CMSs current efforts and plans for ensuring that States achieve this goal.  
We look forward to receiving CMSs updates and progress on these 
recommendations.   
For the full text of CMSs response, see Appendix H.     
 
 
 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   24 
OEI-05-19-00060   
APPENDIX A: 21st Century Cures Act: Section 
5005(e), Public Law 114-255  
The text below outlines the OIG report mandated by the Cures Act.  OIG has conducted 
two evaluations in response to the mandate.  This evaluation addresses the mandated 
work regarding the Medicaid provider enrollment requirements.  A second OIG 
evaluation (OEI-03-19-00070) addresses terminated providers. 
(e) OIG REPORT.Not later than March 31, 2020, the Inspector General of 
the Department of Health and Human Services shall submit to Congress a report 
on the implementation of the amendments made by this section. Such report shall 
include the following: 
(1) An assessment of the extent to which providers who are included 
under subsection (ll) of section 1902 of the Social Security Act (42 U.S.C. 
1396a) (as added by subsection (a)(3)) in the database or similar system 
referred to in such subsection are terminated (as described in paragraph 
(8) of subsection (kk) of such section, as added by subsection (a)(1)) from 
participation in all State plans under title XIX of such Act (or waivers of such 
plans). 
(2) Information on the amount of Federal financial participation paid 
to States under section 1903 of such Act in violation of the limitation on 
such payment specified in subparagraph (D) of subsection (i)(2) of such 
section and paragraph (3) of subsection (m) of such section, as added by 
subsection (a)(4).  
(3) An assessment of the extent to which contracts with managed 
care entities under title XIX of such Act comply with the requirement 
specified in paragraph (5) of section 1932(d) of such Act, as added by 
subsection (a)(2).  
(4) An assessment of the extent to which providers have been 
enrolled under section 1902(a)(78) or 1932(d)(6)(A) of such Act (42 U.S.C. 
1396a(a)(78), 1396u2(d)(6)(A)) with State agencies administering State 
plans under title XIX of such Act (or waivers of such plans). 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   25 
OEI-05-19-00060   
APPENDIX B: Detailed Methodology  
This appendix provides a detailed methodology on our data sources and 
analysis.   
Scope 
We included all 50 States and the District of Columbia in our study to 
ensure that we could provide comprehensive information about 
implementation status across State Medicaid programs. 
Data Sources and Collection 
The data on States status regarding Medicaid provider enrollment came 
from an online survey to the States and from a structured questionnaire 
to CMS.  In April 2019, OIG surveyed State Medicaid staff that manage 
provider enrollment.  On the basis of these survey responses, OIG 
followed up with 39 States to corroborate their respective responses on 
the survey from May through October 2019we contacted 27 States by 
email and conducted structured telephone interviews with 12 additional 
States.  OIG followed up with these 39 States to (1) determine whether 
they enrolled all Medicaid providers by the end of 2018, (2) obtain 
additional information about their unenrolled providers, and (3) clarify 
survey responses that were unclear.  In August 2019, OIG also sent 
questions to CMS staff overseeing Medicaid provider enrollment.   
Information on States managed care expenditures came from the 
Transformed Medicaid Statistical Information System (T-MSIS).  CMS has 
established T-MSIS as a national database of Medicaid claims and 
encounter data.  In addition to Medicaid claims and encounter data, 
T-MSIS contains data on beneficiary eligibility, providers, and 
expenditures.81  We used T-MSIS data from OIGs data warehouse to 
obtain final action capitation payments (the per member per month 
amount) paid to MCOs by States.     
Survey to States.  We used the survey to ask States about their 
implementation of provider enrollment requirements for three groups of 
providers: FFS furnishing providers, FFS ORP providers, and MCO network 
providers.  We asked States to report (1) whether they had enrolled all 
FFS furnishing, FFS ORP, and MCO network providers by the applicable 
Cures Act deadlines; (2) the numbers of enrolled and unenrolled providers 
in the State as of December 31, 2018; and (3) whether the State had 
completed all required screening activities as of December 31, 2018.  We 
also asked States to describe both the controls they had in place to 
prevent payments to unenrolled providers and any provider enrollment 
challenges they faced.  Finally, we asked States about the FFP they 
received for FFS and MCO payments associated with unenrolled providers.  
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   26 
OEI-05-19-00060   
Below is a summary of the questions we asked of States in the survey and 
in the email followup, grouped by theme.   
  Cures Act deadlines.  We asked States to report whether they had 
enrolled all FFS furnishing and FFS ORP providers by the 
January 1, 2017, deadline.  We also asked States to report whether 
they had enrolled all MCO network providers by the 
January 1, 2018, deadline. 
  Extent to which States had enrolled providers serving Medicaid 
beneficiaries.  We then asked States to report the numbers of 
enrolled and unenrolled FFS furnishing, FFS ORP, and MCO 
network providers for each risk category as of December 31, 2018.  
We chose this date to provide the most up-to-date status on 
States progress on Medicaid provider enrollment.  We also asked 
States to provide (1) an explanation for why providers remained 
unenrolled, (2) a description of the methods they used to calculate 
the number of providers, and (3) explanations for when they could 
not report these numbers.  
  Extent to which States had screened and collected the required 
identifying and ownership information from all providers serving 
Medicaid beneficiaries.  We asked States whether they had 
completed all the required screening activities for all limited-, 
moderate-, and high-risk providers.  To assess whether States had 
collected all information necessary to conduct provider screening 
and enrollment, we asked States to select, from a close-ended list, 
the pieces of information they collect from providers as part of the 
enrollment process.  We created the list based on the identifying 
information required by the Cures Act (name, Social Security 
number, date of birth, specialty, Federal Taxpayer Identification 
Number, NPI, and license or certification number) and the 
ownership information required by the Affordable Care Act. 
  Controls.  We asked States to select controls they use to monitor 
FFS furnishing, FFS ORP, and MCO network provider enrollment 
from close-ended lists.  We asked States whether they (1) used 
prepayment or point-of-sale edits for claims, (2) reviewed or 
audited encounter data, and (3) compared State provider 
enrollment and MCO network provider records.  We created the 
lists using feedback from States and controls States reported using 
in previous OIG work.  We also allowed States to report any 
additional controls they had in place. 
  Federal share.  We asked States to provide information about the 
FFP received for (1) payments to MCOs associated with unenrolled 
network providers; (2) claims billed by unenrolled FFS furnishing 
providers; and (3) claims ordered, referred, or prescribed by 
unenrolled FFS ORP providers.  States with unenrolled providers 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   27 
OEI-05-19-00060   
that could not report this information were asked to explain why 
they could not provide this information.  As a note, many States 
could not report this information for unenrolled Medicaid MCO 
network providersas a result, we used T-MSIS data to determine 
expenditures associated with MCOs in States with unenrolled MCO 
network providers.  We used the information from the survey to 
report the FFP for expenditures associated with claims ordered, 
referred, or prescribed by unenrolled ORP providers.   
  Challenges.  Finally, we asked States to report their provider 
enrollment implementation challenges.  We asked States to select 
challenges to enrolling each group of providers from a 
close-ended list we provided.  We created the list using both 
challenges that States had reported in OIGs provider enrollment 
report from 2016 and challenges that States discussed during 
survey pre-test interviews. 
  Followup emails to States.  To ensure that we had the most 
accurate data from States, we sent followup data collection emails 
to 27 States to corroborate their survey responses on their status 
as of December 31, 2018.  We sent followup emails to the 
following: (1) States that did not clearly indicate whether they had 
enrolled all FFS and MCO providers as of December 31, 2018; 
(2) States that reported some conflicting information on their 
survey (e.g., States that reported having enrolled all FFS providers 
but reported many unenrolled providers); (3) States that reported 
an unknown number of unenrolled providers; and (4) States that 
reported enrolling all providers but not collecting all identifying 
and ownership information or conducting all screening activities.  
We conducted followup with these States to ensure that we had 
the most accurate information.    
Fifty States responded to the survey.  One StateMassachusettsdid not 
respond.  After we sent five emails and made three phone calls to 
Massachusetts, provider enrollment staff in Massachusetts reported that 
they would not respond to the survey, stating that they lacked the staff to 
provide the requested information in a timely manner.   
Structured Interviews With States.  We conducted followup interviews 
with 12 States that were not in compliance with the Cures Acts MCO 
network provider enrollment requirements.  OIG conducted these 
interviews to provide additional context regarding States implementation 
status, provider enrollment challenges, and financial risk associated with 
unenrolled providers.  We selected States that (1) had many unenrolled 
MCO network providers, (2) could not estimate the exact number of 
unenrolled MCO network providers but reported having many 
outstanding providers to enroll, and (3) requested to speak with us to 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   28 
OEI-05-19-00060   
clarify or expand on their survey responses.  We conducted these 
interviews in May and June 2019. 
Questions for CMS.  To clarify CMSs guidance on MCO network provider 
enrollment, we sent a set of questions to CMS staff responsible for 
provider enrollment in August 2019.  Specifically, we asked CMS for an 
update on whether they were enforcing the requirements in the Cures Act 
and, if not, why.   
Data Analysis 
We analyzed surveys, followup emails, and interview responses to 
understand States progress toward enrolling all FFS and MCO network 
providers.  First, we reviewed survey responses to understand whether 
States had enrolled all Medicaid providers by the Cures Act deadlines.  To 
determine whether States had enrolled all providers by the end of 2018, 
we followed up with States that had not finished by the Cures Act 
deadlines and whose survey responses did not clearly indicate their status 
at the end of 2018.  This followup was conducted via emails and 
interviews. 
After identifying States that did not enroll all FFS and MCO network 
providers by the end of 2018, we reviewed States survey and interview 
responses to gain greater insight into why providers remained unenrolled 
and the challenges that States faced when enrolling providers.  In some 
cases, we identified additional reasons and challenges during interviews 
that States had not reported on their surveys.  
We analyzed States surveys and interview responses to identify whether 
States reported controls, collected all identifying and ownership 
information, and completed all provider screenings. 
We analyzed data that States submitted to T-MSIS to calculate the 
amount of capitation payments made to MCOs by States with unenrolled 
MCO network providers.  Because many States could not report 
expenditures associated with unenrolled MCO network providers, T-MSIS 
proved the best source of information on capitation payments.  We used 
aggregated Medicaid final action capitation payments (including negative 
payment amounts) reported in T-MSIS for each State for calendar 
year 2018.  We did not include CHIP capitation payments, other 
capitation payments, or denied capitation payments.  To calculate the FFP 
for capitation payments, we applied each States regular FMAP for fiscal 
year 2018.    
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   29 
OEI-05-19-00060   
APPENDIX C: Extent of Unenrolled MCO Network 
Providers  
Some States provided OIG with numbers of enrolled and unenrolled MCO 
network providers in their survey responses.  For these States, OIG used 
the reported numbers to calculate a percentage of unenrolled MCO 
network providers.  Other States provided estimated percentages of 
unenrolled MCO network providers in their narrative survey responses or 
as part of followup discussions.  States often qualified their answers
whether exact numbers or estimated percentageswith explanations for 
why the numbers were approximations.   For example, not all States could 
identify and exclude out-of-network providers for their analysis.  Some 
States were not able to provide any sort of estimate.  Please see the State 
breakdown on the following pages. 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   30 
OEI-05-19-00060   
Total 
Unenrolled  Total Enrolled 
MCO  MCO 
Providers   Providers   Percentage of 
Reported  Reported by  Unenrolled  Other Information 
State  by State     State     MCO Providers     Provided by States 
California         103,083     30%     California estimated that 30% of 
MCO providers remain unenrolled by 
comparing State enrollment records 
with MCO rosters.  California 
reported that this 30% likely includes 
some out-of-network providers or 
providers in the process of enrolling. 
Delaware         246,682            Delaware was not able to report any 
numbers or estimates for unenrolled 
MCO network providers.  
Florida  31,371     81,562     28%     Florida reported the number of MCO 
network providers not enrolled with 
the State.   
Hawaii  4,068     12,091     25%     Hawaii reported the number of MCO 
network providers not enrolled with 
the State.   
Idaho                       Idaho was not able to report any 
numbers or estimates for MCO 
network provider enrollment.  
Illinois                       Illinois was not able to report any 
numbers or estimates for MCO 
network provider enrollment.  
Kansas                10%     During a followup interview, Kansas 
estimated that it had 10% of its MCO 
network providers to enroll. 
Louisiana  112,722                 Louisiana had not started to enroll 
MCO network providers that only 
serve managed care beneficiaries.  
Based on an analysis of its MCO 
provider registry, Louisiana estimated 
that it needed to enroll up to 112,722 
MCO network providers.  Louisiana 
estimated that 11,000 enrolled FFS 
providers were also MCO network 
providers. 
   Indicates that a State did not provide the information. 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   31 
OEI-05-19-00060   
Total 
Unenrolled  Total Enrolled 
MCO  MCO 
Providers   Providers   Percentage of 
Reported  Reported by  Unenrolled  Other Information 
State  by State     State     MCO Providers     Provided by States 
Maryland         58,428     10%     Based on its MCOs' comparison of 
network providers and State 
enrollment records, Maryland 
estimated that 10% of MCO network 
providers remain unenrolled. 
Michigan  45,911     52,913     46%     Michigan compared MCO network 
lists with FFS provider records.  
Michigan reported in narrative 
responses that some unenrolled 
MCO providers may no longer be 
active network providers.  
Minnesota  120,138                    Minnesota had not started to enroll 
any of its MCO network providers 
that serve only managed care 
beneficiaries and needed to enroll up 
to 120,138 MCO network providers.  
Minnesota could not provide 
information on the number of MCO 
network providers already enrolled 
as FFS providers. 
Missouri         778            Missouri did not report numbers of 
unenrolled MCO network providers 
due to inaccuracies in the network 
provider lists provided by its MCOs. 
Nevada  857     13,215     6%     Nevada compared MCO provider 
lists with FFS provider records.  
Nevada reported the number of 
unenrolled likely includes some 
providers not required to enroll (e.g., 
provider types not eligible to enroll 
in Medicaid or single case agreement 
providers). 
   Indicates that a State did not provide the information. 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   32 
OEI-05-19-00060   
Total 
Unenrolled  Total Enrolled 
MCO  MCO 
Providers   Providers   Percentage of 
Reported  Reported by  Unenrolled  Other Information 
State  by State     State     MCO Providers     Provided by States 
New Jersey                 1223%      Comparing State provider enrollment 
records with MCO network providers, 
New Jersey estimated that 23% of 
MCO network providers remain 
unenrolled, while its MCOs estimate 
that 12% remain unenrolled.  They 
are in the process of reconciling this 
difference. 
New York                       New York could not compare State 
provider enrollment records with 
MCO network rosters to provide an 
estimate because the rosters were 
not in a data format that was 
compatible with State enrollment 
records.  
Ohio  2,984     62,539     5%     Ohio analyzed encounter data to 
identify unenrolled NPIs.  Ohio 
reported that the number of 
unenrolled NPIs likely includes some 
providers not required to enroll  
(e.g., out-of-state providers or out-
of-network providers). 
Oregon         2,981            Oregon reported that it did not have 
time to conduct the necessary 
encounter analysis. 
Rhode Island  20,000                   Rhode Island had not started to 
50,000   enroll MCO network providers that 
serve only managed care 
beneficiaries and estimated that 
somewhere between 20,000 and 
50,000 MCO network providers need 
to be enrolled.  Rhode Island had not 
determined how many MCO network 
providers were already enrolled as 
FFS providers. 
Utah  54     5,035     1%     Utah analyzed encounter data to 
identify unenrolled NPIs.  
  Indicates that a State did not provide the information. 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   33 
OEI-05-19-00060   
Total 
Unenrolled  Total Enrolled 
MCO  MCO 
Providers   Providers   Percentage of 
Reported  Reported by  Unenrolled  Other Information 
State  by State     State     MCO Providers     Provided by States 
Virginia                     Virginia reported that it had not 
started to enroll any MCO network 
providers that serve only managed 
care beneficiaries and could not 
calculate the number of MCO 
network providers already enrolled in 
FFS before beginning the MCO 
provider enrollment process. 
Washington         46,111            Washington did not report a number 
of unenrolled MCO network 
providers but found 16,352 
unduplicated unenrolled NPIs on 
encounters. 
   Indicates that a State did not provide the information.  
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   34 
OEI-05-19-00060   
APPENDIX D: Extent of Unenrolled FFS ORP 
Providers 
Some States provided OIG with numbers of enrolled and unenrolled 
FFS ORP providers in their survey responses.  For these States, OIG used 
the reported numbers to calculate a percentage of unenrolled ORP 
providers.  Other States reported percentages of claims with unenrolled 
ORP NPIs in their narrative survey responses.  Some States were not able 
to provide any sort of estimate.  Please see the State breakdown on the 
following page. 
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   35 
OEI-05-19-00060   
Percentage of 
Total  Total  Unenrolled 
Unenrolled  Enrolled FFS  FFS ORP 
FFS ORP  ORP  Providers 
Providers  Providers   Based on State-
Reported by  Reported by  Reported  Other Information 
State  State     State     Numbers     Provided by States 
California  15,432  2,407  87%  California reported the number of 
actively enrolled FFS ORP providers 
by querying its State records.  
California conducted a claims 
analysis to identify unenrolled FFS 
         ORP providers. 
Delaware      681      Delaware reported the number of 
enrolled FFS ORP providers by 
querying its State enrollment 
         records.  
Florida         4           
Florida could not report the exact 
number of unenrolled FFS ORP 
providers.  
Illinois                       Illinois was not able to report any 
numbers or estimates for FFS ORP 
enrollment.  
Kansas  1,395  326  81%  Kansas conducted a claims analysis 
to identify unenrolled FFS ORP 
         providers.   
Maine  3,788  74  98%  Maine conducted a claims analysis 
to identify unenrolled FFS ORP 
         providers.  
Maryland  32,925  1,378  96%  Maryland conducted a claims 
analysis to identify unenrolled FFS 
         ORP providers.  
Michigan  9,857  83,918  11%  Michigan conducted a claims 
analysis to identify unenrolled FFS 
         ORP providers. 
New                 New Hampshire was not able to 
Hampshire  report exact numbers or estimates 
      for FFS ORP enrollment.  
Oregon  1,122          Oregon conducted a claims 
analysis to identify unenrolled FFS 
         ORP providers.   
               
    Indicates that a State did not provide the information.  
       
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   36 
OEI-05-19-00060   
APPENDIX E: Federal Share of States Capitation 
Payments to MCOs With Unenrolled Network 
Providers 
Federal share of capitation payments to MCOs with unenrolled network providers for 2018. 
 
State  Federal Share of Capitation Payments 
NY  $20,115,146,812 
CA  $13,955,891,080 
OH  $10,135,152,072 
FL  $9,543,534,936 
MI  $5,959,729,583 
NJ  $4,839,174,290 
LA  $4,794,290,381 
IL  $4,521,775,645 
MN  $2,841,403,495 
MD  $2,570,597,036 
WA  $2,185,498,050 
OR  $1,743,827,099 
NV  $973,828,604 
UT  $689,754,855 
ID  $176,239,072 
DEa    
HIb    
KSc    
MOb    
RIa    
VAc    
Source: Medicaid MCO Capitation Data From T-MSIS for Calendar Year 2018; FY18 FMAP rates from the Federal Register.82  
a State reported negative total capitation payments. 
b OIG determined State capitation payment information was incomplete given the size of its Medicaid managed care program.  
c State was missing months of capitation payments on or after January 1, 2018, when we collected these data from T-MSIS. 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   37 
OEI-05-19-00060   
APPENDIX F: Federal Share of States Payments 
for Items and Services Ordered, Referred, or 
Prescribed by Unenrolled FFS ORP Providers 
Federal share of claims associated with unenrolled FFS ORP providers from July 1, 2018, through 
December 31, 2018  
 
State  Federal Share of Claims 
 
CA  $38,143,633 
 
MI  $13,160,424 
 
ME  $7,186,549   
 
OR  $1,129,483 
 
KS  $423,423 
 
DEa   
 
FLa     
ILa     
 
MDa   
 
NHa   
 
 
Source: OIG analysis of State surveys, 2019.83 
a State did not provide information. 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   38 
OEI-05-19-00060   
APPENDIX G: States That Enrolled All Providers 
but Did Not Collect All Required Identifying and 
Ownership Information  
Some of the 27 States that reported enrolling all providers did not collect some or all required 
identifying and ownership information from these providers.  Each States missing information is 
indicated below.    
 
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   39 
OEI-05-19-00060   
Appendix H:  Agency Comments  
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   40 
OEI-05-19-00060   
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   41 
OEI-05-19-00060   
 
   
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   42 
OEI-05-19-00060   
ACKNOWLEDGMENTS 
Jonathan Jones served as the team leader for this study, and Sarah Vogel 
served as the lead analyst.  Others in the Office of Evaluation and 
Inspections who contributed to this study include Jonathan Carroll, 
Randi Hall, and Samantha Handel-Meyer.  Office of Evaluation and 
Inspections staff who provided support include Althea Hosein, 
Kevin Manley, and Christine Moritz.  
This report was prepared under the direction of Thomas Komaniecki, 
Regional Inspector General for Evaluation and Inspections in the Chicago 
regional office, and Laura Kordish and Kelly Waldhoff, Deputy Regional 
Inspectors General.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
To obtain additional information concerning this report or to obtain 
copies, contact the Office of Public Affairs at Public.Affairs@oig.hhs.gov.  
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   43 
OEI-05-19-00060   
 
ENDNOTES 
 
1 CMS, 2017 Actuarial Report on the Financial Outlook for Medicaid.  Accessed at https://www.cms.gov/Research-
Statistics-Data-and-Systems/Research/ActuarialStudies/Downloads/MedicaidReport2017.pdf on October 22, 2019. 
2 Ibid.   
3 Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), as amended by the Health Care 
and Education Reconciliation Act of 2010, P.L. No. 111-152 (March 30, 2010)known as the Affordable Care Act 
(ACA).  The Affordable Care Act required States to enroll all Medicaid providers.  ACA,  6401(b).  See also CMCS, 
Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, December 23, 2011.  Accessed at 
https://www.medicaid.gov/federal-policy-guidance/downloads/cib-12-23-11.pdf on December 1, 2017. 
4 OIG, Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks, 
OEI-05-18-00070, July 2019; OIG, Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully 
Implemented, OEI-05-13-00520, May 2016. 
5 See also GAO, Improved Guidance Needed To Better Support Efforts To Screen Managed Care Providers (GAO-16-
402), April 2016.  Accessed at https://www.gao.gov/assets/680/676768.pdf on October 18, 2018. 
6 Cures Act, P.L. No. 114-255 (Dec. 13, 2016),  5005(b)(1),(2); Social Security Act (the Act),  1902(a)(78), 
1932(d)(6).  ACA,  6401(b). 
7 Cures Act,  5005(e)(4).  
8 Cures Act,  5005(a)(4)(B) states no payment shall be made under this title to a State with respect to 
expenditures incurred by the State for payment for services provided by a managed care entity ... unless the State 
... beginning on January 1, 2018, complies with the [provider enrollment] requirement specified in section 
1932(d)(6)(A). 
9 Cures Act,  5005(e)(2).  The Cures Act requests information on FFP paid to States that have MCOs with 
unenrolled providers and does not request any information about FFP provided to States for items and services 
furnished by unenrolled FFS providers.  Another OIG study will address the requirement to provide information on 
the amount of FFP provided to States for (1) items and services furnished by terminated providers and (2) 
managed care services when the State does not have a contract that complies with requirements in section 
1932(d)(5) of the Act.  
10 Henry J. Kaiser Family Foundation (KFF), Medicaid: A Primer, 2013.  Accessed at https://www.kff.org/wp-
content/uploads/2010/06/7334-05.pdf on October 30, 2019. 
11 CMS, Encounter Data Toolkit, November 2013.  Accessed at https://www.medicaid.gov/medicaid-chip-program-
information/by-topics/delivery-systems/downloads/medicaid-encounter-data-toolkit.pdf on September 12, 2019. 
12 KFF, Issue Brief.  Medicaid Financing: The Basics.  March 2019.  Accessed at https://www.kff.org/report-
section/medicaid-financing-the-basics-issue-brief/ on July 15, 2019.  
13 The Act,  1905(b). 
14 Ibid. 
15 These rates do not include enhanced FMAPs or increased FMAPs for newly eligible Medicaid beneficiaries under 
Medicaid expansion.  81 Fed. Reg. 80078 (Nov. 15, 2016). 
16 ACA,  6401(b).  See also CMCS, Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, 
December 23, 2011.  (See Endnote 3 for URL information.) 
17 Cures Act,  5005(b).  See also CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 10.  Accessed 
at https://www.medicaid.gov/affordable-care-act/downloads/program-integrity/mpec-7242018.pdf on August 6, 
2019. 
18 Cures Act,  5005(b). 
19 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, pp. 4142.  (See Endnote 17 for URL 
information.) 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   44 
OEI-05-19-00060   
 
20 CMCS, Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, December 23, 2011, p. 13.  (See 
Endnote 3 for URL information.) 
21 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 19.  (See Endnote 17 for URL information.) 
22 Ibid, p. 39. 
23 Cures Act,  5005(b); 42 CFR  438.602(b)(1).   
24 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 87.  (See Endnote 17 for URL information.) 
25 MACPAC, Medicaid Managed Care Payment.  Accessed at https://www.macpac.gov/subtopic/medicaid-
managed-care-payment/ on August 9, 2019.   
26 42 CFR  438.602(b)(1).  See also CMS Medicaid Provider Enrollment Compendium, July 24, 2018, p. 89.  (See 
Endnote 17 for URL information.) 
27 42  CFR 438.608(b), 455.100107, and 455.400470.  See also CMS, State Guide to CMS Criteria for Medicaid 
Managed Care Contract Review and Approval, p. 73.  Accessed at https://www.medicaid.gov/medicaid/managed-
care/downloads/mce-checklist-state-user-guide.pdf on September 9, 2019.   
2842 CFR  438.602(b)(2) and 455.416. 
29 42 CFR  431.107.  See also Medicaid Provider Enrollment Compendium, July 24, 2018, p. 10 and p. 88: In 
summary, effective January 1, 2018, providers under all service delivery models may furnish services to Medicaid 
participants, including as ORPs, only where the state has executed a provider agreement with the provider and 
performed all applicable screening, unless an exception applies as described herein, and CMS interprets the 
statutory reference to an enrollment application as the provider agreement with the state in the Medicaid 
context.  (See Endnote 17 for URL information.) 
30 42 CFR  455.100 through 455.107; Cures Act,  5005(b); the Act,  1902(kk).  See also CMS Medicaid Provider 
Enrollment Compendium, July 24, 2018, p. 9.  (See Endnote 17 for URL information.)    
31 42 CFR  455.450.  See also CMS Medicaid Provider Enrollment Compendium, July 24, 2018, p. 10.  (See 
Endnote 17 for URL information.) 
32 42 CFR  431.107.  See also CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, pp. 10, 41, and 88. 
33 Medicaid Provider Enrollment Compendium, July 24, 2018, p. 88: CMS interprets the statutory reference to an 
enrollment application as the provider agreement with the state in the Medicaid context.  (See Endnote 17 for 
URL information.) 
34 Cures Act,  5005(b)(1),(2); the Act,  1902(a)(78) and 1932(d)(6).  See also Medicaid Provider Enrollment 
Compendium, July 24, 2018, p. 9.  (See Endnote 17 for URL information.) 
35 42 CFR  455.104(c).  See also Medicaid Provider Enrollment Compendium, July 24, 2018, p. 33.  (See Endnote 17 
for URL information.) 
36 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 19.  (See Endnote 17 for URL information.) 
37 42 CFR  455.450.  See also Medicaid Provider Enrollment Compendium, July 24, 2018, pp. 2125.  (See 
Endnote 17 for URL information.) 
38 42 CFR  455.450. 
39 42 CFR  455.436, 455.450, and 455.416.  See also Medicaid Provider Enrollment Compendium, July 24, 2018, 
pp. 8082.  (See Endnote 17 for URL information.) 
40 42 CFR  455.450. 
41 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 37 and p. 47.  (See Endnote 17 for URL 
information.) 
42 OIG, Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks, 
OEI-05-18-00070, July 2019.   
43 42 CFR  455.440; CMCS, Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, December 23, 
2011, p. 6.  (See Endnote 3 for URL information.) 
44 States could use similar systems logic used for editing encounter data to compare MCO encounters and/or lists 
of network providers with State records.  CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 91.  
(See Endnote 17 for URL information.) 
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   45 
OEI-05-19-00060   
 
45 42 CFR  456.722.  See also MACPAC, The Medicaid Fee-for-Service Provider Payment Process, July, 2018, pp. 34.  
Accessed at https://www.macpac.gov/wp-content/uploads/2015/01/Medicaid-fee-for-service-provider-payment-
process.pdf on August 6, 2019.  See also CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 91 (see 
Endnote 17 for URL information) and Georgia Department of Community Health, New Medicaid Requirements for 
Ordering, Prescribing, or Referring Providers an Overview, August 2013, p. 2.  Accessed at 
https://www.mmis.georgia.gov/portal/Portals/0/StaticContent/Public/ALL/NOTICES/OPR%20FAQ%2020-08-
2013%20163045%2020-03-2015%20163053.pdf on August 20, 2019. 
46 The Act,  1903(d)(2); 42 CFR  431.1002.  Overpayments due to provider enrollment errors are subject to 
recovery.  See CMS, Payment Error Rate Manual Version 1.7, January 2018, p. 43 and p. 74.  Accessed at 
https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/Downloads/FY17PERMManual.pdf on December 4, 2019.   
47 Cures Act,  5005(a)(4)(B) states no payment shall be made under this title to a State with respect to 
expenditures incurred by the State for payment and services provided by a managed care entity ... unless the State 
... beginning on January 1, 2018, complies with the [provider enrollment] requirement specified in section 
1932(d)(6)(A).  
48 GAO, CMS Oversight Should Ensure State Implementation of Screening and Enrollment Requirements (GAO-20-8), 
October 2019, p. 28.  (See Endnote 5 for URL information.) 
49 OIG, Weaknesses Exist in Medicaid Managed Care Organizations Efforts To Identify and Address Fraud and Abuse, 
OEI-02-15-00260, July 2018. 
50 OIG, Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure, OEI-04-11-00590, May 
2016. 
51 OIG, CMSs Process for Sharing Information About Terminated Providers Needs Improvement, OEI-06-12-00031, 
March 2014. 
52 OIG, Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks, 
OEI-05-18-00070, July 2019. 
53 OIG, Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented, OEI-05-13-00520, 
May 2016. 
54 Cures Act,  5005. 
55 OIG, States Need To Improve Their Compliance With Requirements To Prevent Medicaid Payments to Terminated 
Providers, OEI-03-19-00070, March 2020.   
56 Eight of the 10 States referenced in this sentence overlap with the 21 States that had unenrolled MCO network 
providers.  Two StatesMaine and New Hampshiredid not have managed care programs but had unenrolled 
ORP providers in FFS.   
57 Massachusetts Medicaid staff stated that they could not respond to OIGs survey questions for this report in a 
timely way.  The Cures Act required OIG to submit this report to Congress by March 31, 2020.  See Cures Act, 
 5005(e)(4).  
58 The Cures Act requires that States enroll all MCO network providers by January 1, 2018.  P.L. No. 114-255, 
 5005(b)(2).  Beneficiaries in these States accounted for approximately 67 percent of the beneficiaries enrolled in 
all States Medicaid managed care programs.  See CMS, 2017 Managed Care Enrollment Summary.  Accessed at 
https://data.medicaid.gov/Enrollment/2017-Managed-Care-Enrollment-Summary/uw3d-3r25 on July 31, 2019. 
59 CMS, 2017 Managed Care Enrollment Summary.  (See Endnote 58 for URL information.) 
60 Not all of this $85 billion was for expenditures associated with unenrolled MCO network providerssome of 
these expenditures were for enrolled MCO network providers.  However, quantifying the exact portion associated 
with these expenditures is complex because of the capitation payment system in Medicaid managed care.  Further, 
CMS reported to OIG that it considers the full amount disallowable under  5005(a)(4)(B) of the Cures Act.  (See EN 
8 for relevant Cures Act language.)  
61 42 CFR  438.608(b). 
62 42 CFR  438.602 and 455.416.   
 
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   46 
OEI-05-19-00060   
 
63 42 CFR  438.602 and 455.416.   
64 42 CFR  438.602 and 455.416(c); Cures Act,  5005(a)(1).   
65 At the time of OIGs review, CMS was also not examining whether MCO network providers were appropriately 
screened and enrolled as part of its process for determining whether States have made improper payments to 
MCOs.  See GAO, CMS Oversight Should Ensure State Implementation of Screening and Enrollment Requirements 
(GAO-20-8), October 2019.  (See Endnote 5 for URL information.) 
66 The Cures Act requires that States enroll all FFS providers by January 1, 2017.  P.L. No. 114-255,  5005(b)(1).  
Beneficiaries in these States accounted for approximately 36 percent of the beneficiaries enrolled in all States FFS 
Medicaid programs.  See CMS, 2017 Managed Care Enrollment Summary.  (See Endnote 58 for URL information.) 
67 These five States reported not enrolling all FFS ORP providers and also reported lacking the controls necessary 
to prevent payments associated with unenrolled FFS ORP providers.  However, these States could not conduct the 
analysis to quantify the FFP received for claims associated with these providers in time to submit the survey. 
68 42 CFR  455.440; CMCS, Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, December 23, 
2011, p. 6.  (See Endnote 3 for URL information.) 
69 These States had enrolled (1) all network providers in Medicaid managed care, (2) all of their FFS furnishing 
providers that directly bill the program, and (3) all of their FFS ORP providers.  Notably, all States reported 
enrolling all FFS furnishing providers as of December 31, 2018.   
70 The Cures Act requires that States enroll all FFS providers by January 1, 2017, and all MCO network providers by 
January 1, 2018.  P.L. No. 114-255,  5005(b).  
71 These States reported lacking the processes or controls to ensure that all providers applying for enrollment and 
all providers needing to be rescreened in the futureas part of the revalidation of their enrollment in Medicaid
have met the enrollment requirements.  Three of the 16 States referenced in this sentenceArizona, Montana, 
and South Carolinalack both enrollment processes and controls to ensure ongoing compliance.  Five States only 
lack enrollment procedures that comply with Federal requirements, while eight States only lack controls. 
72 Cures Act,  5005(b)(1),(2); the Act,  1902(a)(78) and 1932(d)(6).  See also 42 CFR  455.436 for the requirement 
that States confirm the identity of providers applying to enroll.   
73 OIG asked States whether they had completed required screenings for limited-, moderate-, and high-risk 
providers.  Two States had not completed screenings for any FFS ORP providers, one had not completed 
screenings for moderate- or high-risk FFS furnishing providers, and one had not completed screenings for high-
risk FFS furnishing providers. 
74 Cures Act,  5005(b); the Act,  1902(kk).  See also Medicaid Provider Enrollment Compendium, July 24, 2018, pp. 
46, 57, 58, and 60.  (See Endnote 17 for URL information.)  See also 42 CFR  455.436 for the requirement that 
States confirm the identity of providers applying to enroll. 
75 CMS, Medicaid Provider Enrollment Compendium, July 24, 2018, p. 19.  (See Endnote 17 for URL information.) 
76 42 CFR  455.440.  CMCS, Informational Bulletin: Medicaid/CHIP Provider Screening and Enrollment, December 
23, 2011, p. 13.  (See Endnote 3 for URL information.) 
77 Cures Act,  5005(a)(4)(B). 
78 42 CFR  431.1002; CMS, Payment Error Rate Manual Version 1.7, January 2018, p. 43 and p. 74.  (See Endnote 47 
for URL information.)   
79 Cures Act,  5005(a)(4)(B). 
80 42 CFR  455.440. 
81 CMS, Transformed Medicaid Statistical Information System (T-MSIS).  Accessed at  
https://www.medicaid.gov/medicaid/data-and-systems/macbis/tmsis/index.html on August 26, 2019.  
82 81 Fed. Reg. 80078 (Nov. 15, 2016). 
83 These figures are for payments made from July 1, 2018, through December 31, 2018.  To ease the burden on 
States, OIG asked only that States provide these calculations for a 6-month period.    
Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries   47 
OEI-05-19-00060   
ABOUT THE OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by 
Public Law 95-452, as amended, is to protect the integrity of the 
Department of Health and Human Services (HHS) programs, as well as the 
health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the following operating 
components: 
Office of Audit  The Office of Audit Services (OAS) provides auditing services for HHS, 
either by conducting audits with its own audit resources or by overseeing 
Services 
audit work done by others.  Audits examine the performance of HHS 
programs and/or its grantees and contractors in carrying out their 
respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations.  These assessments help 
reduce waste, abuse, and mismanagement and promote economy and 
efficiency throughout HHS. 
Office of Evaluation  The Office of Evaluation and Inspections (OEI) conducts national 
evaluations to provide HHS, Congress, and the public with timely, useful, 
and Inspections 
and reliable information on significant issues.  These evaluations focus on 
preventing fraud, waste, or abuse and promoting economy, efficiency, and 
effectiveness of departmental programs.  To promote impact, OEI reports 
also present practical recommendations for improving program 
operations.   
Office of  The Office of Investigations (OI) conducts criminal, civil, and 
administrative investigations of fraud and misconduct related to HHS 
Investigations 
programs, operations, and beneficiaries.  With investigators working in all 
50 States and the District of Columbia, OI utilizes its resources by actively 
coordinating with the Department of Justice and other Federal, State, and 
local law enforcement authorities.  The investigative efforts of OI often 
lead to criminal convictions, administrative sanctions, and/or civil 
monetary penalties. 
Office of Counsel to  The Office of Counsel to the Inspector General (OCIG) provides general 
legal services to OIG, rendering advice and opinions on HHS programs 
the Inspector 
and operations and providing all legal support for OIGs internal 
General 
operations.  OCIG represents OIG in all civil and administrative fraud and 
abuse cases involving HHS programs, including False Claims Act, program 
exclusion, and civil monetary penalty cases.  In connection with these 
cases, OCIG also negotiates and monitors corporate integrity agreements.  
OCIG renders advisory opinions, issues compliance program guidance, 
publishes fraud alerts, and provides other guidance to the health care 
industry concerning the anti-kickback statute and other OIG enforcement 
authorities.