Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
M :  
EDICAID   
 
 
V R
ULNERABILITIES  ELATED 
 
 
P E
TO  ROVIDER  NROLLMENT 
 
 
O  
AND  WNERSHIP 
 
D  
ISCLOSURE
 
Suzanne Murrin   
Deputy Inspector General for 
Evaluation and Inspections 
 
May 2016 
OEI-04-11-00590   
   
EXECUTIVE SUMMARY  MEDICAID:  VULNERABILITIES RELATED TO PROVIDER 
ENROLLMENT AND OWNERSHIP DISCLOSURE 
OEI-04-11-00590 
WHY WE DID THIS STUDY  
States can prevent inappropriate payments, protect beneficiaries, and reduce time-consuming and expensive 
pay and chase activities by ensuring that providers that intend to engage in fraudulent or abusive activities are 
not allowed to enroll in Medicaid.  For States to identify potentially fraudulent providers, as well as those that 
may be associated with excluded individuals or entities, providers must disclose accurate and timely 
information about their owners (i.e., individuals or corporations with a 5-percent or more ownership or 
controlling interest; agents; or managing employees).  According to the Centers for Medicare & Medicaid 
Services (CMS), the highest incidence of regulatory noncompliance among State Medicaid programs is in their 
collection of ownership information from providers.   
 
HOW WE DID THIS STUDY 
We determined the extent to which States requested and verified provider ownership information and checked 
exclusions databases.  Additionally, for selected providers, we collected and compared three sets of owner 
names:  (1) those on record with State Medicaid programs for Medicaid enrollment purposes, (2) those 
submitted by providers directly to the Office of Inspector General (OIG) for this evaluation, and (3) those on 
record with CMS for Medicare enrollment purposes.  We determined the extent to which owner names from 
these sources matched.  When we compared names, if we found owner names that were not identical but were 
reasonably similar, we considered the names to match. 
 
WHAT WE FOUND 
Few State Medicaid programs requested that providers disclose all federally required ownership information.  In 
addition, 14 State Medicaid programs reported that they did not verify the completeness or accuracy of provider 
ownership information.  We also found that 14 State Medicaid programs reported that they did not check all 
required exclusions databases, which could allow providers with excluded owners to enroll in Medicaid.  
Additionally, we found that most providers in our review had names on record with State Medicaid programs 
that did not match the names that providers submitted to OIG.  Further, nearly all providers in our review had 
names on record with State Medicaid programs that did not match those on record with CMS.  The prevalence 
of nonmatching owner names raises concern about the completeness and accuracy of information about 
Medicaid providers ownership.  It also demonstrates that providers may not be complying with the requirement 
to report ownership changes to State Medicaid programs.  Taken together, these findings reveal vulnerabilities 
that could allow potentially fraudulent providers to enroll in State Medicaid programs and that limit States 
ability to provide adequate oversight.   
 
WHAT WE RECOMMEND  
We recommend that CMS (1) work with State Medicaid programs to identify and correct gaps in their 
collection of all required provider ownership information, (2) provide guidance to State Medicaid programs on 
how to verify the completeness and accuracy of provider ownership information, (3) require State Medicaid 
programs to verify the completeness and accuracy of provider ownership information, (4) ensure that State 
Medicaid programs check exclusions databases as required, (5) work with State Medicaid programs to educate 
providers on the requirement to report changes of ownership, (6) work with State Medicaid programs to review 
providers that submitted nonmatching owner names and take appropriate action, and (7) increase coordination 
with State Medicaid programs on collecting and verifying provider ownership information in Medicaid and 
Medicare.  CMS concurred with all of our recommendations.
   
   
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 
Rationale ......................................................................................................1 
Background ..................................................................................................2 
Methodology ................................................................................................4 
Findings........................................................................................................7 
Few State Medicaid programs requested that providers disclose  
all required ownership information ..................................................7 
Fourteen State Medicaid programs reported that they did not  
verify the completeness or accuracy of provider ownership 
information .......................................................................................8 
Fourteen State Medicaid programs reported that they did not  
check all required exclusions databases, which could allow 
providers with excluded owners to enroll in Medicaid ..................10  
The prevalence of nonmatching owner names raises concern  
about the completeness and accuracy of information about 
Medicaid providers ownership ...................................................... 11 
Conclusion and Recommendations ............................................................13 
Agency Comments and Office of Inspector General Response .....16 
Appendixes ................................................................................................17 
A:  Detailed Methodology .............................................................17 
B:  Extent to Which State Medicaid Programs Requested  
Required Ownership Information, 2013 ........................................22  
C:  Agency Comments ...................................................................24  
Acknowledgments......................................................................................27 
 
   
   
OBJECTIVES 
To determine the extent to which: 
1.  State Medicaid programs requested and verified provider ownership 
information and checked exclusions databases as part of the Medicaid 
enrollment process. 
2.  Owner names on record with State Medicaid programs matched the 
names submitted to the Office of Inspector General (OIG) for this 
evaluation and the names on record with the Centers for Medicare & 
Medicaid Services (CMS). 
RATIONALE 
States can prevent inappropriate payments, protect beneficiaries, and 
reduce time-consuming and expensive pay and chase activities by 
ensuring that providers that intend to engage in fraudulent or abusive 
activities are not allowed to enroll in Medicaid.1  For States to identify 
potentially fraudulent providers, as well as those that may be associated 
with excluded individuals or entities, providers must disclose information 
on owners and others with control interest in the business.   
However, State Medicaid programs may not be collecting complete 
ownership disclosures from providers.  In August 2010, CMS reported that 
the highest incidence of regulatory noncompliance among State Medicaid 
programs is in the collection of provider ownership disclosures.2  In 
particular, CMS noted problems with the forms used to collect provider 
ownership disclosures, such as the forms not requesting or including space 
for providers to disclose all required information.3 
Additionally, in some health care fraud schemes, individuals have 
concealed providers true ownership from State Medicaid programs.  For 
example, in May 2014, an individual was sentenced to 1 to 3 years in 
prison for his involvement in a multiyear fraud scheme that amounted to 
more than $16 million in fraudulent payments from the New York 
Medicaid program.  The individual admitted to being the straw owner of 
____________________________________________________________ 
1 In a Medicaid fee-for-service program, a provider is any individual or entity 
furnishing Medicaid services under an agreement with the Medicaid agency.  For 
a Medicaid managed care program, a provider is any individual or entity that is 
engaged in the delivery of health care services and is legally authorized to do so by the 
State in which it delivers the services.  42 CFR  400.203. 
2 CMS, Best Practices for Medicaid Program Integrity Units Collection of Disclosures 
in Provider Enrollment, August 2010, p. 3.  Accessed at 
https://www.cms.gov/FraudAbuseforProfs/Downloads/bppedisclosure.pdf on October 27, 
2015.   
3 Ibid., p. 4. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 1 
   
   
three pharmacies that were owned and controlled by his father, who had 
previously been excluded from participating in the New York Medicaid 
program.4   
Concerns about provider ownership information are also prevalent in 
Medicare.  In a companion report issued concurrently to this report, OIG 
found that 2 of 11 CMS contractors reported that they do not check 
required exclusions databases, which could allow providers with excluded 
owners to enroll in Medicare.5   Additionally, when we compared the 
owner names on record with State Medicaid programs with the owner 
names that providers submitted to OIG for this review, the names did not 
match for over three-quarters of the providers.   
BACKGROUND  
Medicaid Ownership Disclosure 
Providers enrolling in Medicaid must discloseand States must collect
specific information, including the name and address of any person 
(individual or corporation) that has an ownership or controlling interest of 
5 percent or more, or that is a managing employee. 6, 7  (In this report, we 
refer to all three types as owners.)8, 9  Providers enrolling in Medicaid or 
renewing their Medicaid agreements must also disclose whether any 
owners have been convicted of a criminal offense.10 
____________________________________________________________ 
4 New York State Office of the Attorney General, A.G. Schneiderman Announces Prison 
Term for Rogue Pharmacy Owner in $16 Million Medicaid Theft, May 5, 2014.  
Accessed at http://www.ag.ny.gov/press-release/ag-schneiderman-announces-prison-
term-rogue-pharmacy-owner-16-million-medicaid-theft on October 27, 2015. 
5 OIG, Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership 
Disclosure (OEI-04-11-00591), May 2016. 
6 42 CFR  455.101.  Medicaid providers, other than an individual practitioner or group 
of practitioners, are entities that must disclose ownership.   
7 Social Security Act  1124(a)(2)(B); 42 CFR  455.104(b)(1)(i) and 455.106(a).  
In Medicare, providers that are enrolling must disclose specific information to CMS, 
must disclose specific information to CMS, including the identity of any person who has 
an ownership or controlling interest or is an agent or managing employee.  42 CFR 
 420.204(a)(1)-(2) and 420.206(a)(3). 
8 42 CFR  455.101.  Medicaid providers, other than an individual practitioner or group 
of practitioners, are disclosing entities that must disclose ownership.   
9 Social Security Act  1124(a)(2)(B); 42 CFR  455.104(b)(1)(i) and 455.106(a).  
In Medicare, providers that are enrolling must disclose specific information to CMS, 
including the identity of any person who has an ownership or controlling interest or is an 
agent or managing employee.  42 CFR  420.204(a)(1)-(2) and 420.206(a)(3). 
10 42 CFR  455.106(a).  In Medicare, providers that are enrolling must disclose whether 
any owners have been convicted of a criminal offense, subjected to any civil monetary 
penalties, or excluded from participating in federally funded health care programs.  
42 CFR  420.204. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 2 
   
   
Once they are enrolled in Medicaid, providers must report changes of 
ownership to State Medicaid programs within 35 days of the change.11  In 
addition, State Medicaid programs must revalidate providers enrollment 
information at least every 5 years.12, 13   
The State Medicaid program must deny enrollment or terminate the 
enrollment of any provider if the provider or an owner does not submit 
timely and accurate information.14 
Verification of Provider Ownership Information 
Although there is no Federal requirement that State Medicaid programs 
verify the completeness and accuracy of ownership information disclosed 
by providers, CMS recommends that State Medicaid programs do so.  In 
particular, CMS recommends, as a general rule, that: 
States should not process a providers disclosure information that 
does not appear complete or does not include information on 
individuals with ownership or control interests in the provider 
entity, including managing employees, until the State verifies the 
accuracy and completeness of the information.15   
CMS does not describe how States should verify the completeness and 
accuracy of provider ownership information.    
Additionally, CMS provides State Medicaid programs with limited access 
to its Medicare enrollment systemthe Provider Enrollment, Chain, and 
Ownership System (PECOS).16  States can use this access during provider 
screening to determine if a provider is currently enrolled in Medicare, is 
enrolling, or has been denied enrollment. 
____________________________________________________________ 
11 42 CFR  455.104(c)(1)(iv).  In Medicare, enrolled providers must report changes of 
ownership or control to CMS within 30 days of the change.  42 CFR  424.516(e)(1). 
12 42 CFR  455.414.  In Medicare, enrolled providers must submit and recertify 
enrollment information every 5 years.  42 CFR  424.515.   
13  Section 6401(a) of the Patient Protection and Affordable Care Act requires all enrolled 
providers and suppliers to revalidate their enrollment information under new enrollment 
screening criteria.  This requirement includes providers and suppliers that were enrolled 
prior to March 25, 2011. 76 Fed. Reg. 5969, 5865.  The deadline for State Medicaid 
programs to complete this revalidation-of-enrollment process for all providers is 
September 25, 2016 (an extension from the original deadline of March 24, 2016).  See 
CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, December 23, 2011, p. 2.  Accessed at http://www.medicaid.gov/Federal-
Policy-Guidance/downloads/CIB-12-23-11.pdf on October 28, 2015. 
14 42 CFR  455.416(a). 
15 CMS, State Medicaid Director Letter #08-003, June 12, 2008, p. 3.  Accessed at 
https://downloads.cms.gov/cmsgov/archived-downloads/SMDL/downloads/ 
smd061208.pdf on October 28, 2015. 
16 CMS, CMCS Informational Bulletin:  Medicaid/CHIP Provider Screening and 
Enrollment, December 23, 2011, p. 3.  Accessed at http://www.medicaid.gov/Federal-
Policy-Guidance/downloads/CIB-12-23-11.pdf on October 28, 2015.  
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 3 
   
   
Program Exclusions 
As part of the process of enrolling Medicaid providers, State Medicaid 
programs are required to confirm that providers disclosed owners are not 
excluded.17  To do so, States must determine the exclusion status of 
providers and any owners through routine checks of Federal databases, 
including OIGs List of Excluded Individuals/Entities (LEIE) and the 
General Services Administrations Excluded Parties List System 
(EPLS).18, 19  The LEIE is a database that contains all individuals and 
entities currently excluded by OIG from participating in federally funded 
health care programs.20  The EPLS is a Governmentwide database with 
information on individuals and entities that have been suspended or 
excluded from receiving Federal financial assistance and benefits.21  A 
provider with excluded owners should not be allowed to enroll in 
Medicaid. 
METHODOLOGY 
We used multiple data collection activities and sources for this report.  
First, in April 2013, we sent an electronic questionnaire to 51 State 
Medicaid programs.22  The electronic questionnaire collected information 
on how each State Medicaid programs collects and processes ownership 
information disclosed by providers.  In particular, we asked each State 
Medicaid program how it verifies the completeness and accuracy of 
provider ownership information.  We also asked each State Medicaid 
program whether it compared the ownership information that providers 
disclosed with the ownership information in the LEIE and EPLS.  
Additionally, we collected supporting documentation from State Medicaid 
programs, which included the forms used to request ownership 
disclosures.  We reviewed States documentatione.g., their provider 
enrollment applications, their State-specific ownership disclosure forms, 
and screenshots from their provider enrollment systemsto determine the 
____________________________________________________________ 
17 42 CFR  455.436. 
18Ibid. 
19 In July 2012, the EPLS was consolidated with other Federal procurement systems into 
the System for Award Management (SAM).  Phase I consolidation included the Central 
Contractor Registration/Federal Agency Registration, the Online Representations and 
Certifications Application, and the EPLS.  What is SAM?  Accessed at 
https://www.sam.gov/sam/announce1.htm on September 1, 2015. 
20 OIG, List of Excluded Individuals and Entities Background Information.  Accessed at 
http://oig.hhs.gov/exclusions/background.asp on October 28, 2015. 
21 71 Fed. Reg. 7051570516 (Dec. 5, 2006). 
22 These 51 State Medicaid programs included all 50 States and the District of Columbia.   
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 4 
   
   
extent to which State Medicaid programs requested that providers disclose 
ownership information required by 42 CFR  455.104(b) and 455.106(a). 
Next, for selected providers, we collected and compared three sets of 
owner names:  (1) those on record with State Medicaid programs for 
Medicaid enrollment purposes, (2) those submitted by providers directly to 
OIG for this evaluation, and (3) those on record with CMS for Medicare 
enrollment purposes.23  We collected this information between 
December 2013 and April 2014.  We compared owner names on record 
with State Medicaid programs to those submitted to OIG for 62 providers 
enrolled in Medicaid.  We also compared owner names on record with 
State Medicaid programs to those on record with CMS for Medicare 
enrollment purposes for 58 of the 62 providers that were enrolled in both 
Medicaid and Medicare. 
We completed an additional analysis on owner names submitted to OIG 
that were not on record with State Medicaid programs.  Specifically, we 
analyzed the effective dates for a given owners ownership to determine 
whether the dates fell within the 35-day window during which providers 
are required to notify their respective State Medicaid programs of the 
change.  If dates fell within this window, providers still had time to notify 
the State Medicaid program of the change. 
See the Appendix A for a detailed description of the methodology.     
Limitations 
We did not attempt to collect information not reported or to verify 
information that providers submitted to OIG.  For example, providers did 
not always report the effective date for a given owners ownership.  We 
did not attempt to collect these dates if providers had not reported them, 
nor did we attempt to verify such dates if providers had reported them. 
Additionally, the matching of owner names across two or more sources did 
not necessarily mean that ownership information was complete and 
accurate.  Providers could have submitted information that was incomplete 
and/or inaccuratebut that matchedto multiple programs (i.e., CMS, 
OIG, and/or State Medicaid programs).  
Finally, the results of comparisons are not projected and pertain only to 
the providers in our review included in each comparison.   
____________________________________________________________ 
23 Provider types in our review are ambulatory surgical centers, ambulance services, 
independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 
health agencies, hospices, and renal disease facilities. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 5 
   
   
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 6 
   
   
FINDINGS 
Few State Medicaid programs requested that 
providers disclose all required ownership information 
Few State Medicaid programs (7 of 50)24 requested on their provider 
enrollment applications or ownership disclosure forms that providers 
disclose all required ownership information.25  By request, we mean that 
the application or form included language asking providers to supply the 
required information.  The remaining 43 State Medicaid programs did not 
request that providers disclose all required ownership information.  CMS 
has noted that although some required ownership information may not 
seem on the surface to be immediately relevant to provider enrollment, 
this information can be important in an investigation, and State Medicaid 
programs are required to collect it.26   
The required ownership information that State Medicaid programs most 
often did not request related to corporations, managing employees, and 
subcontractors.  For example, 38 State Medicaid programs did not request 
all applicable address information that is required for corporate owners.27  
Seventeen State Medicaid programs did not request managing employees 
address information, and 11 did not request their dates of birth.  
Additionally, 16 State Medicaid programs did not ask whether there were 
any relationships between the disclosing entity and the owners of any 
subcontractor.  Information on such relationships may be useful to 
investigators when family members who own different organizations are 
suspected of colluding to engage in fraudulent or abusive activities. 
Table 1 lists the information that State Medicaid programs most often did 
not request that providers disclose.  Appendix B shows the number of 
State Medicaid programs that did and did not request required ownership 
information.   
____________________________________________________________ 
24 We did not receive supporting documentation from 1 of the 51 State Medicaid 
programs and were therefore unable to determine whether it requested that providers 
disclose all required ownership information.  As a result, the denominator for this finding 
is 50 State Medicaid programs. 
25 For the purposes of this evaluation, we define required ownership information as the 
information providers are required to disclose pursuant to 42 CFR  455.104(b) and 
455.106(a). 
26 CMS, Medicaid Program Integrity Toolkits to Address Frequent Findings:  42 CFR 
455.104 Disclosures of Ownership and Control.  Accessed at 
https://www.cms.gov/Medicare-Medicaid-Coordination/Fraud-Prevention/ 
FraudAbuseforProfs/Downloads/fftoolkit-ownership-control.pdf on January 27, 2016. 
27 All applicable address information for corporate entities includes the primary business 
address, every business location, and P.O. Box address.  42 CFR  455.104(b)(1)(i). 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 7 
   
   
Table 1:  Required Ownership Information Most Often Not Requested by 
State Medicaid Programs, 2013 
Number of State 
Medicaid 
Required Ownership Information 
Programs That 
Did Not Request 
All applicable address information for corporate entities with an 
38 
ownership interest 
Tax identification number of a corporation with an ownership interest 
27 
in any subcontractor 
Address of any managing employee  17 
Whether the person with an ownership interest in any subcontractor 
is related to another person with an ownership interest in the  16 
disclosing entity 
Date of birth of any managing employee  11 
Address of any corporation with an ownership interest  11 
Source:  OIG analysis of State Medicaid programs supporting documentation, 2015. 
Nearly all (49 of 50) State Medicaid programs had providers disclose 
ownership information using the States provider enrollment application or 
a State-specific ownership disclosure form.  The one remaining State used 
the CMS-1513 form, an outdated form that requested only half of the 
required ownership information.  (CMS discontinued use and reproduction 
of this form in August 2003.28) 
Fourteen State Medicaid programs reported that they 
did not verify the completeness or accuracy of 
provider ownership information 
CMS recommends that State Medicaid programs verify the completeness 
and accuracy of provider ownership information.  As shown in Table 2, 
37 State Medicaid programs reported verifying the completeness and/or 
accuracy of provider ownership information.  The remaining 14 State 
Medicaid programs reported not verifying the completeness or accuracy of 
provider ownership information.   
   
____________________________________________________________ 
28 CMS, Discontinuance of Forms HCFA-1513, Ownership and Control Interest 
Disclosure Statement and HCFA-2572, Statement of Financial Solvency 
(S&C-03-29), August 14, 2003.  Accessed at https://www.cms.gov/Medicare/Provider-
Enrollment-and-Certification/SurveyCertificationGenInfo/Downloads/SCletter03-29.pdf 
on December 9, 2015. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 8 
   
   
Table 2:  Verification of Provider Ownership Information by State Medicaid 
Programs, 2013 
Number of 
Verification of Provider Ownership 
State Medicaid 
Information 
Programs 
Verified Completeness and/or Accuracy  37 
-  Verified Completeness  37 
-  Verified Accuracy  18 
Verified Neither Completeness Nor Accuracy  14 
     Total  51 
Source:  OIG analysis of State Medicaid programs responses to electronic questionnaire, 
2015. 
 
Of the 37 State Medicaid programs that reported that they verified the 
completeness of provider ownership information, nearly two-thirds 
(24 States) reported that they do so by reviewing the provider-submitted 
enrollment application or ownership disclosure form to confirm that no 
required information is missing.  Other ways in which State Medicaid 
programs reported verifying the completeness of provider ownership 
information include checking State Web sites or documentation related to 
corporate filings and licensure (7 States) and checking Federal databases, 
such as PECOS and the Social Security Administrations Death Master 
File (4 States). 
Of the 18 State Medicaid programs that reported verifying the accuracy of 
provider ownership information, most reported that they do so by 
checking State Web sites (8 States) and Federal databases (7 States).  
Other ways in which State Medicaid programs reported verifying the 
accuracy of provider ownership information include reviewing documents 
about the business type and structure of an entity (3 States); comparing the 
most recently disclosed ownership information to that previously 
submitted (3 States); searching online for the providers Web site and 
owners (2 States); and conducting site visits or reviewing their results 
(2 States). 
Of the 14 State Medicaid programs that reported not verifying the 
completeness or accuracy of provider ownership information, 9 reported 
not having the systems or resources to do so.  Four of the remaining 
programs reported that providers attest that the information they submit is 
complete and accurate.   
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 9 
   
   
Fourteen State Medicaid programs reported that they 
did not check all required exclusions databases, 
which could allow providers with excluded owners to 
enroll in Medicaid 
State Medicaid programs are required to check two databases as part of the 
Medicaid enrollment process to confirm that individuals or entities that 
providers disclose as owners are not excluded.  Specifically, States are 
required to determine the exclusion status of owners through routine 
checks of the LEIE and EPLS.   
As shown in Table 3, 37 of 51 State Medicaid programs reported that they 
check both the LEIE and EPLS to confirm that individuals or entities that 
providers disclosed were not excluded.  Twenty-three of the thirty-seven 
State Medicaid programs reported that they check both the LEIE and 
EPLS during the processes of initial enrollment, re-enrollment, 
revalidation, and change of ownership.  Seventeen reported that they 
check both the LEIE and EPLS at least monthly.   
Table 3:  Checks of Exclusions Databases by State Medicaid Programs, 
2013 
Number of 
Exclusions Databases Checked   State Medicaid 
Programs 
Both LEIE and EPLS  37 
Only LEIE  7 
Only EPLS   4 
Neither LEIE nor EPLS  3 
     Total  51 
Source:  OIG analysis of State Medicaid programs responses to electronic 
questionnaire, 2015. 
 
The remaining 14 State Medicaid programs reported that they do not 
check both exclusions databases as required.  Eleven of these State 
Medicaid programs reported that they check one exclusions database but 
not the other.  Specifically, seven State Medicaid programs reported 
checking the LEIE only and four reported checking the EPLS only.29  The 
remaining three State Medicaid programs reported that they do not check 
either exclusions database.30   
____________________________________________________________ 
29 Three of the four State Medicaid programs that reported checking the EPLS but not the 
LEIE did report checking CMSs Medicare Exclusion Databasea database equivalent 
to the LEIE. 
30 One of the three State Medicaid programs that reported that it does not check the LEIE 
or EPLS did report checking CMSs Medicare Exclusion Database. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 10 
   
   
The prevalence of nonmatching owner names raises 
concern about the completeness and accuracy of 
information about Medicaid providers ownership 
Overall, very few (4 of 58) providers in our review had owner names that 
matched across all three sources (i.e., State Medicaid programs, OIG, and 
CMS).  The prevalence of nonmatching owner names raises concern about 
the completeness and accuracy of information about Medicaid providers 
ownership.  
For most providers in our review, owner names on record with 
State Medicaid programs did not match those submitted to 
OIG 
When we compared the owner names on record with State Medicaid 
programs for Medicaid enrollment purposes to those that providers 
submitted to OIG for this evaluation, we found that 86 percent of 
providers in our review (53 of 62) had at least one nonmatching owner 
name.  For 43 providers, some owner names matched and some did not 
match.  For 10 providers, none of the owner names matched.  Table 4 
shows the extent to which owner names matched for the 62 providers in 
our review.     
Table 4:  Extent to Which Owner Names On Record With State Medicaid 
Programs Matched Those Submitted to OIG, 2013 
Number of  Percentage of 
Description 
Providers  Providers 
Not all owner names matched  53  85.5% 
- Somebut not allowner names matched     43  69.4% 
- No owner names matched  10  16.1% 
All owner names matched  9  14.5% 
     Total  62  100.0% 
Source:  OIG analysis of ownership information on record with State Medicaid programs and ownership information 
submitted to OIG, 2015. 
 
Additionally, it appears that some providers in our review did not notify 
State Medicaid programs of changes in ownership within the required 
timeframe.  Thirty-six providers in our review submitted owner names to 
OIG that were not on record with State Medicaid programs.  Of these 
36 providers, 29 reported the effective dates of ownership for 102 owners.  
For 96 percent of these owners (98 of 102), the effective dates fell outside 
the required 35-day window for providers to notify the State Medicaid 
program of the ownership changes. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 11 
   
   
For nearly all providers in our review, owner names on record 
with State Medicaid programs did not match those on record 
with CMS 
Although Medicaid and Medicare ownership information is collected and 
maintained separately, State Medicaid programs and CMS should have the 
same owner names for providers enrolled in both programs.  However, 
when we compared the owner names on record with State Medicaid 
programs for Medicaid enrollment purposes to those on record with CMS 
for Medicare enrollment purposes, we found that 90 percent of providers 
in our review (52 of 58) had at least one nonmatching owner name.  For 
44 providers, some owner names matched and some did not match.  For 
eight providers, none of the owner names on record with State Medicaid 
programs matched those on record with CMS.  Table 5 shows the extent to 
which owner names matched for the 58 providers in our review. 
Table 5:  Extent to Which Owner Names On Record With State Medicaid 
Programs Matched Those On Record With CMS, 2013 
Number of  Percentage of 
Description 
Providers  Providers 
Not all owner names matched  52  89.7% 
-  Somebut not allowner names matched     44  75.9% 
-  No owner names matched  8  13.8% 
All owner names matched  6  10.3% 
     Total  58  100.0% 
Source:  OIG analysis of ownership information on record with CMS and ownership information on record with State 
Medicaid programs, 2015. 
   
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 12 
   
   
CONCLUSION AND RECOMMENDATIONS 
States can prevent inappropriate payments, protect beneficiaries, and 
reduce time-consuming and expensive pay and chase activities by 
ensuring that providers that intend to engage in fraudulent or abusive 
activities are not allowed to enroll in Medicaid.  For States to identify 
potentially fraudulent providers, as well as those that may be associated 
with excluded individuals or entities, providers must disclose accurate and 
timely information about their owners. 
However, few State Medicaid programs requested that providers disclose 
all required ownership information.  In addition, 14 State Medicaid 
programs reported not verifying the completeness or accuracy of provider 
ownership information.  We also found that 14 State Medicaid programs 
reported that they do not check all required exclusions databases, which 
could allow providers with excluded owners to enroll in Medicaid.  
Additionally, we found that most providers in our review had names on 
record with State Medicaid programs that did not match those that 
providers submitted to OIG.  Further, nearly all providers in our review 
had names on record with State Medicaid programs that did not match 
those on record with CMS.  The prevalence of nonmatching owner names 
raises concern about the completeness and accuracy of information about 
Medicaid providers ownership.  It also suggests that providers may not be 
complying with the requirement to report ownership changes to State 
Medicaid programs.   
Taken together, these findings reveal vulnerabilities that could allow 
potentially fraudulent providers to enroll in State Medicaid programs and 
limit States ability to provide adequate oversight.  Therefore, we 
recommend that CMS: 
Work with State Medicaid programs to identify and correct 
gaps in their collection of all required provider ownership 
information 
CMS should ensure that State Medicaid programs are requesting that 
providers disclose all required ownership information through the provider 
enrollment application or an ownership disclosure form.  One way in 
which CMS could implement this recommendation is by creating a 
standard document that requests all required ownership information.  CMS 
could then encourage or require State Medicaid programs to use this 
document when requesting that providers disclose ownership information.   
In a separate memorandum, we will refer to CMS the 43 State Medicaid 
programs that did not request that providers disclose all required provider 
ownership information on the provider enrollment application or 
ownership disclosure form.   
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 13 
   
   
Provide guidance to State Medicaid programs on how to verify 
the completeness and accuracy of provider ownership 
information 
CMS has recommended that States verify the completeness and accuracy 
of ownership information disclosed by providers, but it has not provided 
guidance on how States should perform this verification.  As a result, we 
found States vary in their methods for conducting this verification.  CMS 
should determine which, if any, of these methods are best practices for 
verifying completeness and accuracy and provide guidance to State 
Medicaid programs on these best practices.  To help identify best 
practices, CMS could consider the methods that its contractors use to 
verify the ownership information that providers disclose when they enroll 
in Medicare. 
Require State Medicaid programs to verify the completeness 
and accuracy of provider ownership information  
CMS has recommendedbut does not requirethat States verify the 
completeness and accuracy of ownership information disclosed by 
providers.  As a result, we found that several States do not conduct this 
verification.  Therefore, CMS should require State Medicaid programs to 
verify the completeness and accuracy of provider ownership information.   
Ensure that State Medicaid programs check exclusions 
databases as required 
CMS should ensure that all State Medicaid programs check the LEIE and 
EPLS, as required, as part of the Medicaid enrollment process to confirm 
that individuals and entities that providers disclosed as owners are not 
excluded.  The checking of exclusions databases is an important safeguard 
that ensures that excluded individuals and entities are kept out of State 
Medicaid programs.  CMS could ensure that States conduct these required 
checks as part of its audits of State Medicaid programs and/or through 
some other process (e.g., by requiring the States to attest that they conduct 
the exclusions checks).   
In the aforementioned memorandum, we will refer to CMS the 14 State 
Medicaid programs that reported that they do not check the LEIE and/or 
the EPLS.   
Work with State Medicaid programs to educate providers on 
the requirement to report changes of ownership 
CMS should work with State Medicaid programs to educate providers on 
the requirement to report changes of ownership to State Medicaid 
programs within 35 days and the actions that States may take if providers 
do not comply with this requirement. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 14 
   
   
Work with State Medicaid programs to review providers that 
submitted nonmatching owner names and take appropriate 
action 
In the aforementioned memorandum, we will refer to CMS the 
53 providers that had owner names on record with State Medicaid 
programs that did not match those submitted to OIG.  CMS should work 
with State Medicaid programs to review these providers enrollment 
records.  After this review, State Medicaid programs should determine and 
take appropriate courses of action. 
Increase coordination with State Medicaid programs on 
collecting and verifying provider ownership information in 
Medicare and Medicaid 
CMS should coordinate with State Medicaid programs on the collection 
and verification of ownership information for providers enrolling or 
enrolled in Medicare and Medicaid.  For example, CMS could encourage 
State Medicaid programs to use their access to PECOS when verifying 
provider ownership information and to notify Medicare Administrative 
Contractors (MACs) when they identify nonmatching information.  State 
Medicaid programs and MACs could then collaborate to determine why 
provider ownership information does not match and address the issue. 
In the longer term, CMS should consider working towards consolidating 
ownership information for providers enrolling or enrolled in Medicare 
and/or Medicaid into one centralized system.  This would make processes 
more efficient.  Namely, this would reduce burden on providers and 
streamline the enrollment process because providers would no longer have 
to separately disclose ownership information both to CMS and State 
Medicaid programs. 
 
 
 
 
 
 
 
 
 
 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 15 
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with all seven of our recommendations.  In its comments, 
CMS stated that it is strongly committed to Medicaid program integrity 
efforts and is continuously working to enhance the process for provider 
enrollment and screening.  CMS stated that since 2011, when it finalized 
regulations to require the revalidation of Medicaid providers, it has taken 
several actions to help States fulfill this requirement.  For example, CMS 
has provided States with direct access to Medicares enrollment data and 
monthly data extracts that States can use to compare their records against 
Medicare enrollment information.  CMS also stated that it has provided 
extensive guidance and technical assistance to help States with their 
revalidation efforts. 
CMS stated that it will implement a number of actions to address OIGs 
recommendations.  For example, CMS will continue to work with States 
to ensure that they are requesting all required ownership information from 
providers.  CMS will also work with States to examine discrepancies 
identified in this report in which the State records for owner names of 
enrolled providers that do not match the owner names that providers 
submitted to OIG.  CMS will also determine whether regulations are 
needed to require States to verify the completeness and accuracy of 
provider ownership information.   
In addition, CMS stated that it will work with States and other relevant 
stakeholders to enhance processes for collecting and verifying provider 
ownership information.  As CMS enhances these processes, we encourage 
it to focus specifically on increasing coordination and reducing duplicative 
efforts between the Medicaid and Medicare programs, and to consider 
moving towards one consolidated system in the future. 
The full text of CMSs comments is provided in Appendix C.  We also 
made changes to the report based on technical comments that CMS sent 
separately.  
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 16 
   
   
APPENDIX A 
Detailed Methodology 
 
State Medicaid Program Electronic Questionnaire 
In April 2013, we sent an electronic questionnaire to 51 State Medicaid 
programs.31  The electronic questionnaire collected information on how 
each State Medicaid program collects and processes ownership 
information disclosed by providers.  By September 2013, we received 
responses to all applicable questions from each State Medicaid program.  
We reviewed and analyzed responses to determine whether each State 
Medicaid program verifies the completeness and/or accuracy of provider 
ownership information and what methods it uses to do so.  We also 
reviewed and analyzed responses to determine whether each State 
Medicaid program compared ownership information that providers 
disclosed to the two exclusions databasesi.e., the LEIE and EPLSthat 
State Medicaid programs are required to check as part of the Medicaid 
enrollment process. 
Additionally, we collected supporting documentation from State Medicaid 
programs, which included the forms used to request ownership 
disclosures.  We reviewed this documentatione.g., States provider 
enrollment applications, their State-specific ownership disclosure forms, 
and screenshots from their respective systems for provider enrollment
to determine the extent to which States requested that providers disclose 
ownership information required by 42 CFR  455.104(b) and 455.106(a). 
Provider Selection 
We selected a random sample of 170 providers that were enrolled in 
Medicare and/or Medicaid as of January 1, 2012, in specific provider 
types.32  We designed the sample such that the results of our review would 
be projectable.  However, as our data analysis progressed, it became clear 
that providers enrolled in two State Medicaid programs were 
____________________________________________________________ 
31 The 51 State Medicaid programs included all 50 States and the District of Columbia.  
We also sent an information request to Puerto Rico, which indicated that it does not 
provide fee-for-service Medicaid.  Because we limited our review to fee-for-service 
programs, Puerto Rico is not included in our results on the collection and verification of 
provider ownership information. 
32 Provider types in our review are ambulatory surgical centers, ambulance services, 
independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 
health agencies, hospices, and renal disease facilities. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 17 
   
   
overrepresented in the population because duplicate providers had not 
been removed before we selected our sample.33 
We selected the 170 providers using 2 population files in such a way that 
30 providers were enrolled in Medicare, 30 providers were enrolled in 
Medicaid, and 110 providers were enrolled in Medicare and Medicaid.   
  The first population file consisted of 34,984 records for providers 
enrolled in Medicare as of January 1, 2012, in our specified provider 
types.  To create this file, we extracted identification and contact 
information from PECOS.34  In particular, for each provider, we 
collected the name, provider type, address, phone number, national 
provider identifier (NPI), and tax identification number (TIN).  We 
then selected from this file 30 records that were associated with 
30 distinct providers enrolled in Medicare. 
  The second population file consisted of 35,394 providers enrolled in 
Medicaid as of January 1, 2012, in our specified provider types.  To 
create this file, we requested and received identification and contact 
information from each of the 52 State Medicaid programs on 
individual and nonindividual providers, including those in our 
specified provider types, enrolled as of January 1, 2012.35  In 
particular, for each provider, we requested the name, provider type, 
address, phone number, Medicaid provider identification number, NPI, 
TIN, Social Security number (SSN), and State license number.  To 
compile this file, we combined information received from each 
Medicaid program and created a separate record for each unique 
combination, by Medicaid program, of Medicaid provider 
identification number, NPI, TIN, SSN, and State license number.  
Once we compiled this information, we limited the file to our specified 
nonindividual provider types, thus reducing it from 2.86 million to 
35,394 providers.  From this subset, we selected 140 providers 
enrolled in Medicaid, of which at least 110 appeared to also be 
enrolled in Medicare. 
____________________________________________________________ 
33 To project the results of our analysis, we would have needed to remove duplicate 
providers from the population, sample providers again, and collect ownership information 
again.  Because we did not identify this duplication until our data were collected, we did 
not do this because of the time and resources it would require.  Therefore, we do not 
make projections in this report. 
34 We used a snapshot of PECOS to ensure that this population file consisted of providers 
enrolled in Medicare as of January 1, 2012. 
35 The 52 State Medicaid programs consist of all 50 States, the District of Columbia, and 
Puerto Rico.  We requested information on individual providers for separate OIG 
evaluations. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 18 
   
   
Collection of Provider Ownership Information 
We collected three sets of current (i.e., as of the date of our data 
collection) owner names and other information:  (1) those on record with 
State Medicaid programs for Medicaid enrollment purposes, (2) those 
submitted by providers directly to OIG for this evaluation, and (3) those 
on record with CMS for Medicare enrollment purposes.  
We first collected owner names directly from selected providers.  From 
November 2013 to January 2014, we sent electronic questionnaires to the 
170 selected providers and requested ownership information (e.g., owner 
names, dates each owners ownership took effect, TINs, and SSNs) as of 
the date the provider received the questionnaire.  We sent up to two 
written requests by mail and attempted to contact nonresponding providers 
by telephone and email, if this information was available.  We received 
responses from 119 providers and did not receive responses from 
29 providers.  The remaining 22 providers were considered ineligible 
because they did not meet our selection criteria regarding provider type 
and/or enrollment timeframe. 
As part of the questionnaire, we also asked providers whether they were 
enrolled in Medicaid and/or Medicare.  If providers indicated that they 
were not enrolled in one or both programs, we no longer classified them as 
being enrolled in the program(s).  Of the 119 responding providers, 
106 indicated they were enrolled in Medicaid.  Additionally, 100 of the 
106 providers also indicated that they were enrolled in Medicare.  
Next, we collected owner names on record with State Medicaid programs 
for Medicaid enrollment purposes.  From December 2013 to 
February 2014, we collected ownership information for selected providers 
from State Medicaid programs.  State Medicaid programs provided 
electronic and hardcopy documents showing ownership disclosures, as 
well as extracts from ownership-disclosure databases.  Of the 
106 providers enrolled in Medicaid, we received information for 
76 providers from State Medicaid programs.  Of the 100 providers 
enrolled in both Medicaid and Medicare, we received information for 
71 providers from State Medicaid programs. 
Finally, we collected owner names on record with CMS for Medicare 
enrollment purposes.  From December 2013 to April 2014, we extracted 
ownership information (e.g., owner names, ownership roles) from PECOS 
for selected providers. 
Analysis of Provider Ownership Information 
We conducted two comparisons of the three sets of owner namesthose 
on record with State Medicaid programs, those submitted by providers to 
OIG, and those on record with CMS.  Each comparison involved 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 19 
   
   
(1) confirming that information being compared was for the same provider 
and (2) evaluating the similarity of owner names. 
Comparison of Ownership Information on Record With State Medicaid 
Programs and Ownership Information Submitted to OIG.  The first 
comparison determined the extent to which owner names on record with 
State Medicaid programs for Medicaid enrollment purposes matched those 
submitted to OIG for this evaluation.   
We first manually compared each providers NPI, TIN, and/or name and 
address in the information on record with State Medicaid programs to 
those submitted to OIG.  We confirmed that 62 of these 76 providers were 
the same.  We removed the remaining 14 providers from our analysis 
because we were unable to confirm that the State Medicaid program 
records and the OIG records were for the same provider. 
Next, we compared owner names on record with State Medicaid programs 
to those that the 62 providers submitted to OIG.  We identified names that 
matched, meaning that the name was on record with the State Medicaid 
program and submitted to OIG.  We also identified names that did not 
matchmeaning that the name was on record with the State Medicaid 
program but not submitted to OIG or vice versaand called these names 
nonmatching.  When we compared names, if we found owner names 
that were not identical but were reasonably similar, we considered the 
names to match.  For example, if owner names were not identical but were 
reasonably similar (e.g., James Harris and Jim Harris), we considered 
the names to match.  See Figure 1 for an illustration of a provider that had 
two names that matched as well as both types of nonmatching names. 
Figure 1:  Illustration of Providers Owner Names That Did and Did Not 
Match 
Name Submitted by 
Name Submitted by 
Provider to State  Match Versus Nonmatch 
Provider to OIG  
Medicaid Program 
James Harris  Jim Harris  Match 
Jane Smith  Jane Smith  Match 
Business A    Nonmatch 
  Company B  Nonmatch 
Note:  Blanks illustrate that the individual or entitys name was not on record with the State Medicaid program 
or not submitted to OIG.  
 
Additionally, we completed two analyses on owner names submitted to 
OIG that were not on record with State Medicaid programs.  First, we 
analyzed the dates on which these owners ownership took effect to 
determine whether the dates fell within the 35-day window during which 
providers are required to notify their respective State Medicaid programs 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 20 
   
   
of such changes.  If dates fell within this window, providers still had time 
to notify their State Medicaid programs of the change.  Second, we 
searched the LEIE and EPLS for owner names submitted to OIG that were 
not submitted to State Medicaid programs to determine whether these 
individuals or entities were excluded.  Because these names were not in its 
ownership information, the State Medicaid program could not have 
previously searched for them in exclusions databases.  We did not find any 
of these names in the LEIE or EPLS at the time of our review. 
Comparison of Ownership Information on Record With State Medicaid 
Programs and Ownership Information on Record With CMS.  The second 
comparison determined the extent to which owner names on record with 
State Medicaid programs for Medicaid enrollment purposes matched those 
on record with CMS for Medicare enrollment purposes.   
We manually compared each providers NPI, TIN, and/or name and 
address in the information on record with State Medicaid programs to 
those on record with CMS.  We confirmed that 58 of these 71 providers 
were the same.  We removed the remaining 13 providers from our analysis 
because we were unable to confirm that the records from State Medicaid 
programs and the records from CMS were for the same providers. 
Next, we compared owner names on record with State Medicaid programs 
and CMS for each of the 58 providers.  For our comparison of these owner 
names, we used the same methodology as for our comparison of owner 
names on record with State Medicaid programs and owner names 
submitted to OIG.  
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 21 
   
   
APPENDIX B 
Extent to Which State Medicaid Programs Requested Required Ownership Information, 2013 
Number of State  Number of State 
Medicaid  Medicaid 
Citation  Required Information  Programs that  Programs that Did 
Requested  Not Request 
Information  Information 
42 CFR  455.104(b)(1)(i)  Name of any individual with an ownership or control interest  50  0 
Whether the person with an ownership or control interest in the disclosing entity is 
42 CFR  455.104(b)(2)  related to another person with ownership or control interest in the disclosing entity as a  47  3 
spouse, parent, child or sibling 
Identity of any person who has ownership or control interest and has been convicted of 
42 CFR  455.106(a)  a criminal offense related to that person's involvement in any program under Medicare,  46  4 
Medicaid, or the Title XX services program 
Identity of any person who is agent or managing employee and has been convicted of a 
42 CFR  455.106(a)  criminal offense related to that person's involvement in any program under Medicare,  46  4 
Medicaid, or the Title XX services program 
42 CFR  455.104(b)(1)(ii)  Social Security number of an individual with an ownership or control interest  45  5 
42 CFR  455.104(b)(1)(i)  Address of any individual with an ownership or control interest  44  6 
42 CFR  455.104(b)(1)(ii)  Date of birth of an individual with an ownership or control interest   41  9 
42 CFR  455.104(b)(1)(i)  Name of any corporation with an ownership or control interest  43  7 
42 CFR  455.104(b)(4)  Name of any managing employee   43  7 
The name of any other disclosing entity in which an owner of the disclosing entity has an 
42 CFR  455.104(b)(3)  41  9 
ownership or control interest 
42 CFR  455.104(b)(4)  Social Security number of any managing employee  41  9 
Tax Identification Number of a corporation with an ownership or control interest in the 
42 CFR  455.104(b)(1)(iii)  40  10 
disclosing entity 
42 CFR  455.104(b)(1)(i)  Address of any corporation with an ownership or control interest  39  11 
Continued on next page 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 22 
   
   
Number of State  Number of State 
Medicaid  Medicaid 
Citation  Required Information  Programs that  Programs that Did 
Requested  Not Request 
Information  Information 
42 CFR  455.104(b)(4)  Date of birth of any managing employee  39  11 
Whether the person with an ownership or control interest in any subcontractor in which 
42 CFR  455.104(b)(2)  the disclosing entity has a 5 percent or more interest is related to another person with  34  16 
ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling 
42 CFR  455.104(b)(4)  Address of any managing employee  33  17 
Tax Identification Number of a corporation with an ownership or control interest in any 
42 CFR  455.104(b)(1)(iii)  23  27 
subcontractor in which the disclosing entity has a 5 percent or more interest 
The address for corporate entities must include as applicable primary business address, 
42 CFR  455.104(b)(1)(i)  12  38 
every business location, and P.O. Box address 
Source:  OIG analysis of State Medicaid programs supporting documentation, 2015. 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 23 
   
   
APPENDIX C 
Agency Comments 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590)  24 
   
   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590)  25 
   
   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590)  26 
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Dwayne Grant, Regional 
Inspector General for Evaluation and Inspections in the Atlanta regional 
office, and Jaime Stewart, Deputy Regional Inspector General.  
Rachel Bessette served as the lead analyst for this study.  Other Office of 
Evaluation and Inspections staff from the Atlanta regional office who 
conducted the study include David Samchok and Janna Sayer.  Central 
office staff who provided support include Clarence Arnold; 
Eddie Baker, Jr.; Scott Horning; Kevin Manley; Scott Manley; and 
Christine Moritz.  
We would also like to acknowledge the contributions of other Office of 
Evaluation and Inspections regional office staff, including 
Deborah Cosimo and Vincent Greiber.   
 
 
 
 
 
 
 
 
 
 
 
 
 
Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590)  27 
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS) programs, as  well  as the health  and welfare of individuals served by those programs.  
This statutory mission is carried  out through a nationwide network of audits, investigations,  
and inspections conducted by the following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of fraud and misconduct  related to HHS programs, operations, and individuals.  With  
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and  abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.