U.S. Department of Health and Human Services 
Office of Inspector General 
 
 
Problems Remain 
for Ensuring That 
All High-Risk 
Medicaid Providers 
Undergo Criminal 
Background Checks    
 
   
OEI-05-18-00070 
Suzanne Murrin 
July 2019  
Deputy Inspector General for 
 
Evaluation and Inspections 
oig.hhs.gov  Report in Brief  U.S. Department of Health and Human Services 
July 2019 
Office  of Inspector General 
OEI-05-18-00070 
 
 
Problems Remain for Ensuring That All 
Why OIG Did This Review 
High-Risk Medicaid Providers Undergo  An effective provider enrollment 
screening process is an important tool 
Criminal Background Checks 
for preventing Medicaid fraud.  It 
plays a vital role in identifying 
What OIG Found 
unscrupulous providers and 
We found flaws with States implementation  Key Takeaway 
preventing them from enrolling in 
of fingerprint-based criminal background  Medicaid is still vulnerable 
Medicaid.  The Federal Government 
checks for high-risk Medicaid providers.   to being defrauded by 
requires States to conduct risk-based 
Eighteen States missed the implementation  high-risk providers that 
screening activities as part of their 
deadline that the Centers for Medicare &  were not properly screened.     
processes for enrolling providers in 
Medicaid Services (CMS) had set, and 13 of 
Medicaid.  The Office of Inspector 
those 18 States had not implemented these checks as of January 1, 2019.  
Generals (OIG) evaluation of the 
Unscrupulous providers could exploit two loopholes in the provider enrollment 
Medicaid provider enrollment 
process to enroll in Medicaid without undergoing these checks.  The first 
screening process in 2016 found that 
loophole involves CMSs allowing States toin certain circumstancesforgo 
States were struggling to implement 
conducting these checks for high-risk providers that Medicare has already 
the required screening activities.  
enrolled, even though Medicare has not conducted checks on some providers.  
Many States had yet to implement 
The second loophole involves States reliance on providers to accurately report 
fingerprint-based criminal 
their ownership information.   
background checksa screening 
Thirteen States had not implemented criminal background checks.  
activity required for providers that 
the Federal Government deems to be 
at high risk for fraud, waste, and 
abuse. 
If not all high-risk providers undergo 
criminal background 
checks, the Federal and State 
Governments are vulnerable to 
unscrupulous providers intent on 
defrauding the Medicaid program.    
How OIG Did This Review 
We based this study on data from 
three sources: (1) a survey of 50 States 
Source: OIG analysis of State survey and interview responses, 2019.  and the District of Columbia (States) 
What OIG Recommends and How the Agency Responded  requesting information on their 
We recommend that CMS (1) ensure that all States fully implement  implementation of criminal 
fingerprint-based criminal background checks for high-risk Medicaid providers,  background checks and 
(2) amend its guidance so that States cannot forgo conducting criminal  the challenges they faced; 
background checks on high-risk providers applying for Medicaid that have   (2) interviews with officials from 14 of 
already enrolled in Medicare unless Medicare has conducted the checks, and  the 18 States that had not 
(3) compare high-risk Medicaid providers self-reported ownership information  implemented criminal background 
to Medicares provider ownership information to help States identify  checks by CMSs July 2018 deadline 
discrepancies.  CMS concurred with the first recommendation.  CMS did not  for implementing this requirement; 
concur with the second and third recommendations.    and (3) an interview with officials from 
Full report can be found at oig.hhs.gov/oei/reports/oei-05-18-00070.asp  CMS.     
TABLE OF CONTENTS 
BACKGROUND  1 
Methodology  5 
   
FINDINGS   
Thirteen States had not implemented fingerprint-based criminal background checks for  6 
high-risk Medicaid providers as of January 2019  
Loopholes enable high-risk providers to enroll in Medicaid without undergoing criminal  9 
background checks  
   
CONCLUSION AND RECOMMENDATIONS   
Ensure that all States fully implement fingerprint-based criminal background checks for  12 
high-risk Medicaid providers  
Amend its guidance so that States cannot forgo conducting criminal background checks on  13 
high-risk providers applying to Medicaid that have already enrolled in Medicare unless 
Medicare has conducted the checks 
Compare high-risk Medicaid providers self-reported ownership information to Medicares  13 
provider ownership information to help States identify discrepancies        
   
AGENCY COMMENTS AND OIG RESPONSE  15 
   
APPENDICES   
A:  Detailed Methodology  17 
B.  Agency Comments   20 
   
ACKNOWLEDGMENTS  23 
 
   
BACKGROUND 
Objectives 
1.  To determine the extent to which States have implemented 
fingerprint-based criminal background checks for high-risk 
providers in Medicaid, and  
2.  To describe the remaining challenges to the implementation of 
criminal background checks in Medicaid. 
An effective provider enrollment screening process is an important tool for 
preventing Medicaid fraud.  To protect Medicaid against fraudulent and 
abusive providers, Federal laws require that States screen Medicaid 
providers according to the risk that the providers pose of committing fraud, 
waste, or abuse.1 , 2  State Medicaid agencies conduct risk-based screening 
activities for all providers at the time of enrollment and periodically 
throughout providers enrollment in Medicaid.3  If States do not fully 
implement provider enrollment screening activities, Medicaid is at increased 
risk of enrolling fraudulent or abusive providers.    
In 2016, the Office of Inspector General (OIG) found that many States 
struggled to implement the screening activities that the Federal 
Government requires them to perform as part of the Medicaid provider 
enrollment process.  Specifically, OIG found that 37 of the 47 States 
surveyed had not yet implemented fingerprint-based criminal background 
checks, a screening activity that Federal rules require for all providers 
deemed to be high-risk.4  Because criminal background checks are required 
for screening only the riskiest providers, full implementation of these checks 
is vital to safeguarding the Medicaid program.  This report provides 
information on the progress that States have made in implementing 
criminal background checks since OIGs 2016 review.   
Screening requirements for Medicaid provider enrollment  
For the purposes of Medicaid provider enrollment, States must assign 
providers to one of three risk categories: high-risk, moderate-risk, or 
limited-risk.  The screening activities that States must conduct vary 
according to the risk category to which a provider is assigned.  For all 
providers, States must verify licenses and any provider-specific requirements 
as well as conduct checks of numerous databases.  States also must 
conduct a site visit for any high-risk or moderate-risk provider, and 
a criminal background check for any high-risk provider.5  Federal rules 
require that States conduct fingerprint-based criminal background checks 
because fingerprintsas uniquely personal identifying informationare 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     1 
OEI-05-18-00070   
necessary for complete access to criminal history records held by State 
criminal history repositories and the Federal Bureau of Investigation.6, 7  
CMS guidance on implementing criminal background checks 
The Centers for Medicare & Medicaid Services (CMS) has provided guidance 
to States as to which provider types States must consider high-risk, 
although States may classify additional provider types as high-risk at their 
discretion.  For provider types that exist both in Medicare and Medicaid, 
CMS requires  States to use either the same risk level that Medicare assigns, 
or a higher level.8, 9  Accordingly, State Medicaid agencies must classify as 
high-risk (1) newly enrolling home health agencies (HHAs) and (2) newly 
enrolling suppliers of durable medical equipment, prosthetics, orthotics, and 
supplies (DMEPOS), because CMS considers these provider types as 
susceptible to engaging in fraud, waste, and abuse.10   
In addition to screening newly enrolling HHAs and newly enrolling DMEPOS 
suppliers as high-risk, States must also screen as high-risk some providers 
that are already enrolled in Medicaid.  States must retroactively screen as 
high-risk any HHAs and DMEPOS suppliers that they enrolled between 
August 2015when CMS required States to begin implementing criminal 
background checksand when their respective State processes for criminal 
background checks became operational.11  For the purposes of this report, 
OIG refers to providers that States must retroactively screen as lookback 
providers.  States must also screen as high-risk any providers with existing 
overpayments or payment suspensions.12  All of these providers must 
undergo criminal background checks.    
Finally, CMS has provided guidance to States as to which individuals 
associated with high-risk providers must undergo criminal background 
checks.  Any person with 5 percent or more direct or indirect ownership 
interest in a high-risk provider must undergo a criminal background check.13  
Providers must disclose all individuals with an ownership or control 
interest when submitting their applications for Medicaid enrollment.14  They 
must also report any changes in ownership that occur after Medicaid enrolls 
them.15 
According to CMS guidance, implementation of criminal background 
checks for high-risk providers means that a State has conducted criminal 
background checks on each high-risk provider and owner.  Specifically, CMS 
stated the following: Implementation means that the State Medicaid 
agency has conducted [a fingerprint-based criminal background check] with 
respect to each provider that the agency has designated as high risk.16   
CMS monitoring of States implementation of criminal background 
checks 
CMS ultimately required States to implement criminal background checks 
for high-risk providers in 2018.  CMSs initial deadline for implementation 
was June 2016, butbecause of feedback from States to CMS on their 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     2 
OEI-05-18-00070   
difficulties in implementing this requirementCMS delayed the deadline 
until July 2017 and then again until July 1, 2018.17  When CMS extended 
the deadline the second time in 2017, as many as 40 States had yet to 
implement criminal background checks.18 
One tool that CMS uses to monitor State compliance with the Medicaid 
provider enrollment requirements is the Payment Error Rate Measurement 
(PERM) program.  CMS uses the PERM program to measure improper 
payments on a sample of Medicaid claims for 17 different States every year, 
with CMS reviewing each State once every 3 years.19, 20  The PERM program 
may identify as improper any sampled claims that States paid in error and 
any sampled claims that did not meet all requirements, including 
the requirements for Medicaid provider enrollment.21  Importantly, within 
a single year, the PERM program identifies only improper payments 
that 17 States made to providers that are within the sample of claims.  
After July 1, 2018, the PERM program began reviewing whether providers 
within the sample of claims had undergone criminal background checks.22 
The PERM program may identify as overpayments any payments within 
the sample that States made to providers that had not undergone criminal 
background checks.23  States must return to CMS the Federal portion of 
overpayments.24  The first PERM review that could include findings on 
States implementation of criminal background checks would be in 2020.25   
Steps for implementing criminal background checks 
To implement criminal background checks at the State level, States should 
complete the steps in Exhibit 1, below.26 
Exhibit 1: States should complete these steps to implement criminal 
background checks.   
Source: OIG review of CMS, 2016 Sub Regulatory Guidance on Fingerprint-based Criminal Background 
Checks and the Medicaid Provider Enrollment Compendium, 2018.27  
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     3 
OEI-05-18-00070   
Implementing criminal background checks at the State level entails some 
preliminary work by States.  States may need to do some or all 
of the following: 
  pass State legislation, 
  determine the criminal convictions and histories that will 
disqualify a provider from enrolling in Medicaid,28, 29 and 
  develop a system for submitting fingerprints to State law 
enforcement and obtaining the results of criminal background 
checks. 
Criminal background checks on providers enrolled in Medicare    
To help States achieve implementation and to reduce the administrative 
burden on States and on providers, CMS permits States to simplify 
the enrollment process for high-risk providers that Medicare has already 
enrolled.30, 31  For providers enrolled in Medicare, CMS permits States to rely 
on Medicares enrollment screening results instead of duplicating the 
criminal background check at the State level.  However, in certain 
circumstances, CMS permits States to forgo conducting the criminal 
background check on high-risk providers enrolled in Medicare, regardless of 
whether Medicares enrollment records show a result for the background 
check.32, 33  This means that States can forgo conducting a criminal 
background check for a high-risk provider that is already enrolled in 
Medicare, even when Medicare has not yet conducted a background check 
for that provider.34   
Related OIG work  
This report builds on OIGs extensive body of work on provider enrollment.  
Although enhancements to the provider enrollment screening process have 
strengthened Medicaid program integrity, OIG has found that outstanding 
vulnerabilities have persisted.   
  In 2013, OIG found that CMSs system for Medicare enrollment data 
was incomplete and often inaccurate.35 
  In 2016, OIG found that implementation of enhanced screening 
activities for provider enrollment in Medicaid and Medicare  
including site visits and criminal background checkswas 
incomplete.36, 37 
  In 2016, OIG found that CMSs data and State Medicaid agencies 
data on provider ownershiprecorded for provider enrollment
often did not match.38, 39 
  In 2016, OIG found that 43 State Medicaid agencies did not collect 
all ownership information and 33 States did not verify the accuracy 
of ownership information.40  
Since OIGs 2016 work on provider enrollment, CMS has taken several steps 
to assist States in implementing criminal background checks in Medicaid.  
Specifically, CMS has provided updated guidance, technical assistance, and 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     4 
OEI-05-18-00070   
training, and has offered onsite visits to review procedures.  However, CMS 
has not fully implemented any of OIGs recommendations from 
the 2016 report on Medicaid provider enrollment.41  Further, CMS has not 
implemented one recommendation from OIGs 2016 report on provider 
ownership information: the recommendation for it to require State Medicaid 
programs to verify the completeness and accuracy of the ownership 
information that providers self-report.42    
Methodology 
For this status update, we collected and analyzed information from CMS, 
all 50 States, and the District of Columbia.  We included all States and 
the District of Columbia in our study to ensure that we had the most current 
status on States implementation of criminal background checks and 
the most up-to-date information about States challenges with 
implementation.  The data for this study came from three sources: a survey 
to which 48 States responded; followup emails to the subset of States that 
had not implemented the checks at the time of our survey (May 2018), and 
structured interviews with 14 of the 18 States that had not implemented 
the checks by the deadline for them to do so (July 2018).  We conducted 
one final round of followup in December 2018 to update States 
implementation status as of January 1, 2019.  We also conducted 
a structured interview with CMS in July 2018.   
Appendix A provides a detailed methodology. 
Standards  We conducted this study in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General on 
Integrity and Efficiency. 
   
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     5 
OEI-05-18-00070   
FINDINGS 
Thirteen States had  Not all States have implemented fingerprint-based criminal background 
checks for high-risk providers in Medicaid.  As of July 1, 2018CMSs 
not implemented 
ultimate deadline for implementation18 States reported that they had not 
fingerprint-based 
implemented these checks.  By January 1, 2019, 5 of those 18 States had 
criminal background  implemented criminal background checks, but the other 13 States had not.43  
checks for high-risk  Further, three States did not report their implementation status to OIG 
despite several OIG attempts to obtain this information, and their 
Medicaid providers 
implementation status is unknown.44   
as of January 2019  
After the July 2018 deadline for States to implement the required 
background checks, CMS could consider as overpayments any payments 
that States have made to high-risk providers that had not undergone 
a criminal background check.45, 46  States must return to CMS the Federal 
share of overpayments related to noncompliance with provider enrollment 
requirements, including the requirements related to criminal background 
checks.47  For each States specific status, see Exhibit 2, below.  
Exhibit 2: Thirteen States had yet to fully implement criminal 
background checks as of January 1, 2019  
 
Source: OIG analysis of State survey and interview responses, 2019. 
 
The 13 States that had not implemented criminal background checks by 
January 1, 2019, varied as to when they anticipated implementing them.  
Nine States reported that they anticipated doing so by the end of 2019, 
one State reported that it anticipated doing so in 2020, and three States 
reported that they did not know when they would implement the checks.  
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     6 
OEI-05-18-00070   
The 13 States that had not implemented the checks by January 1, 2019, also 
varied as to the progress they had made toward full implementation.  
Five of the 13 States had not collected fingerprints from any of their 
providers.  The remaining eight States had conducted criminal background 
checks for at least some of their high-risk providers.  For more details 
regarding States progress toward implementation, see Exhibit 3, below. 
Exhibit 3: Five States had not collected fingerprints, and eight States 
had not completed all required steps for implementation.  
  
Source: OIG analysis of State survey and interview responses, 2018.  
Startup challenges had prevented five States from collecting 
fingerprints 
The five States that had not collected fingerprints reported that they had 
not done so because they faced startup challenges.  The most common 
challenges that these five States reported included lack of authority; lack of 
resources; and delays in determining which criminal convictions and 
histories should disqualify providers from enrolling in Medicaid.  These 
startup challenges prevented States from collecting fingerprints from their 
high-risk providers.  
Challenge 1: Lack of authority at the State level.  Three of the five States 
reported that they needed executive or legislative authority before they 
could collect fingerprints.  In one case, the States Governor would not grant 
the necessary authority, preventing the State Medicaid agency from 
collecting fingerprints from providers.  In another case, the State was unable 
to proceed because State law enforcement could not collect and process 
fingerprints for Medicaid providers without State legislation.  
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     7 
OEI-05-18-00070   
Lack of authority also hindered these States in obtaining money for 
fingerprint collection and processing.  These States reported that to achieve 
implementation, they needed to hire new staff or contractors, and to make 
those hires, they needed legislation.  For example, one States staff reported 
that CMS had authorized funding for the State to implement criminal 
background checks, but the funding had been intended as matching 
funding and the State contribution did not yet exist because it required 
legislation.   
Challenge 2: Lack of resources.  One of the five States indicated that a lack 
of resources delayed or stopped it from developing a State process to 
collect fingerprints.  This State reported that it did not have enough staff to 
implement criminal background checks.    
Challenge 3: Delays in determining disqualifying criminal histories.  One 
of the five States had not collected fingerprints because of delays in 
determining which criminal convictions and histories should disqualify 
providers from enrolling in the States Medicaid program.  Before States can 
evaluate the results of providers criminal background checks and make 
enrollment determinations, they must first establish criteria for disqualifying 
criminal convictions and histories.48  According to staff in this State, provider 
concerns about beneficiary access to care forced the State to revise its 
criteria, causing this delay.   
The eight remaining States had moved beyond the startup phase, 
but they had not completed all required steps for implementing 
criminal background checks  
Eight States had completed the required steps for implementing criminal 
background checks for some providers, but not all providers.  In general, 
these States varied in the extent of their implementation.  Some States had 
providers that still needed to submit fingerprints, while others had nearly 
finished implementing criminal background checks but did not have results 
for some providers.  
Two of the eight States faced residual delays resulting from lack of 
resources and lack of authority.  One Stateinitially delayed because it 
lacked the necessary authorityhad collected fingerprints from its providers 
but had not received criminal background check results from the Federal 
Bureau of Investigation for some providers.  Another State reported that it 
had notified providers and had begun collecting fingerprints, but it faced 
delays because it is one of the largest Medicaid programs in the country 
and had approximately 600 providers that required criminal background 
checks.   
Three of the eight States had collected fingerprints for all high-risk providers 
that were newly enrolled in their respective Medicaid programs, but not for 
existing enrolled providers that needed a criminal background check.  Two 
of these three States had not conducted criminal background checks for 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     8 
OEI-05-18-00070   
lookback providers, while one State had not conducted criminal 
background checks for providers with overpayments.  These three States 
reported that they were in the process of obtaining the resources needed to 
conduct criminal background checks for these providers.   
Three of the eight States reported relying on Medicare enrollment results 
for all or most of their providers but also reported that they had not 
implemented background checks.  One State reported that it had high-risk 
providers that were not enrolled in Medicare and that it needed to conduct 
criminal background checks on these providers.  Another State reported 
that it was waiting for the Medicare enrollment results for seven providers 
and that it had not implemented background checks.  The third State 
reported that it had nearly completed all steps but had not documented 
the results of criminal background checks in its provider enrollment 
recordsa step that is necessary for demonstrating to Federal authorities, 
such as CMS, that a provider has undergone a criminal background check.49   
Loopholes enable     States reported that even when they have fully implemented 
fingerprint-based criminal background checks, high-risk providers can enroll 
high-risk providers 
in Medicaid without undergoing the required criminal background checks.  
to enroll in 
This results from two loopholes in the provider enrollment process:  
Medicaid without  (1) CMSs permitting States to forgo conducting criminal background 
checks, in certain circumstances, for high-risk providers applying to 
undergoing criminal 
Medicaid that Medicare has already enrolled, regardless of whether 
background checks   
Medicare has conducted a fingerprint-based criminal background check; 
  and (2) the ease with which high-risk providers can conceal owners who 
must undergo fingerprint-based criminal background checks.  For the 
provider enrollment screening process to function as a fully effective 
program integrity safeguard, all high-risk providers should submit 
fingerprints and undergo criminal background checks.  Unscrupulous 
providers could exploit these enrollment loopholes to enroll in Medicaid 
without undergoing criminal background checks and defraud the program.    
CMS permits States to forgo conducting criminal background 
checks on high-risk providers applying to Medicaid that Medicare 
has already enrolled, regardless of whether Medicare has 
conducted a background check   
In its guidance to States, CMS permits States to forgo conducting criminal 
background checks on providers that Medicare has already enrolled.  As this 
report has previously mentioned, this is meant to reduce the administrative 
burden on States and on providers.  However, CMS permits States to do this 
for providers that Medicare has enrolled as high-risk, even when Medicare 
has not conducted a criminal background check on the provider as part of 
its enrollment screening.50, 51  CMS staff reported that Medicare has yet to 
conduct criminal background checks on approximately 1,000 high-risk 
providers, and that Medicare will not conduct criminal background checks 
for these high-risk providers until 2020 or later.   
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     9 
OEI-05-18-00070   
CMS staff reported that although Medicare has not conducted 
fingerprint-based criminal background checks for these providers, CMS uses 
its Advanced Provider Screening (APS) system to monitor a variety of 
databases that might indicate whether a provider has a criminal history.  
APS is a useful tool; however, it is not equivalent to a criminal background  
check that uses a fingerprintuniquely personal identifying information
and APS may not catch instances in which a provider with a criminal history 
alters his or her name or other personal information.  Fingerprints are 
necessary for the positive identification of providers with criminal history 
records in repositories maintained by States and the Federal Bureau of 
Investigation.52  Name-based background checks are subject to errors
false negativesthat could permit a provider with a disqualifying criminal 
history to enroll.53  The use of fingerprints eliminates these errors.54   
Forty-four States reported that they rely on Medicare enrollment results for 
providers that Medicare has already enrolled.  These States may have 
enrolled any of the approximately 1,000 high-risk Medicare providers
without either Medicaids or Medicares having conducted fingerprint-based 
criminal background checksbecause CMS gave States permission to rely 
on Medicare enrollment results, regardless of whether Medicare has 
conducted the criminal background check.  This loophole could result in 
unscrupulous high-risk providers being able to enroll in Medicaid without 
undergoing fingerprint-based criminal background checks, posing a threat 
to the program.   
High-risk providers can conceal owners who require criminal 
background checks  
States rely on providers to truthfully disclose all owners so that States know 
which individuals should undergo a criminal background check.  The Federal 
rules require providers to discloseand require States to collect fingerprints 
fromindividuals whose ownership interest, either direct or indirect, in 
high-risk providers is 5 percent or greater.55, 56  The Federal rules also 
require States to deny or terminate the enrollment of any provider that has 
an owner with a disqualifying criminal conviction.57  Providers disclose their 
owners to States when submitting their enrollment applications and must 
report any changes in ownership that occur throughout their enrollment.58  
In past work, OIG found that 43 States did not collect on their enrollment 
applications information on all individuals with an ownership interest in their 
providers and that 32 States did not verify the accuracy of providers 
self-reported ownership information, making it possible for unscrupulous 
providers to conceal owners with criminal histories and avoid detection by 
States.59  If high-risk providers conceal owners and States have no way to 
detect these owners, a provider with an owner who has a disqualifying 
criminal history could enroll in Medicaid.   
States and CMS have worked together to correct gaps on States 
applications for Medicaid provider enrollment, but they face limits in 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     10 
OEI-05-18-00070   
verifying the accuracy of providers self-reported ownership information.  
Specifically, States and CMS lack an independent system for detecting 
whether providers self-reported ownership information is accurate, and 
thus they cannot be certain that they have conducted criminal background 
checks on all individuals with an ownership interest in high-risk providers.  In 
past work, OIG found that the States that did verify accuracy of ownership 
information used a variety of data to do so, including Federal and State 
databases, business documents, online searches, and site visits.60  However, 
these separate activities do not represent a shared solution to this problem, 
and nine States reported in 2018 that they still lack the capability to identify 
owners whom providers failed to report on their enrollment applications or 
purposefully concealed.  In July 2018, CMS staff stated that CMS also lacks 
the capability to verify the accuracy of ownership information that providers 
self-report, revealing that this problem extends beyond those nine States.  
Because States and CMS lack this capability and because provider 
ownership information is self-reported, States and CMS have no way to 
conclusively verify that providers are being truthful in their disclosures of 
their owners.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     11 
OEI-05-18-00070   
CONCLUSION AND RECOMMENDATIONS 
CMS and States have made progress in implementing fingerprint-based 
criminal background checksincreasing from the 10 States in our 2016 
report to the 35 States that reported implementation for this reviewbut 
despite this progress, 13 States had still not fully implemented these checks 
as of January 1, 2019.  In addition, loopholes in the provider enrollment 
process exist that enable high-risk providers to enroll in Medicaid without 
first undergoing criminal background checks because (1) CMS permits 
States, in certain circumstances, to forgo conducting the criminal 
background check on high-risk providers applying to Medicaid that 
Medicare has already enrolled, regardless of whether Medicare has 
conducted criminal background checks on these providers; and (2) high-risk 
providers could conceal owners who must undergo criminal background 
checks, and States and CMS might be unable to detect this concealment.  
Until these concerns are addressed, unscrupulous providers and their 
owners might avoid undergoing criminal background checks as part of their 
enrollment in Medicaid, posing a threat to the program.     
OIG reiterates its unimplemented recommendations that CMS should assist 
States in implementing provider enrollment screening activities for all 
Medicaid providers.61, 62  In particular, OIG reiterates its unimplemented 
recommendations that CMS should ensure the accessibility and 
completeness of the results of Medicares provider enrollment screenings so 
that States can rely on these screening results rather than duplicating them 
at the State level.63  In addition, OIG recommends that CMS:  
Ensure that all States fully implement fingerprint-based 
criminal background checks for high-risk Medicaid providers 
CMS should ensure that all States fully implement criminal background 
checks, and CMS should use the authorities at its disposalincluding 
financial disallowancesto prompt compliance.  By full implementation, 
OIG means that all States would have conducted criminal background 
checks for all high-risk providers according to the definition of 
implementation that CMS has articulated.64   
CMS should use all available compliance tools, as necessary, to ensure 
compliance.  OIG understands that CMSs plan is to use the PERM review
which examines a sample of claimsas a method of monitoring the degree 
of States compliance with the provider enrollment requirements.  CMS 
should also use the PERM review to designate as overpayments any 
sampled payments made to high-risk providers that did not undergo 
criminal background checks, and CMS should recover the Federal share of 
those payments.  However, the PERM review operates on a cycle, and it 
examines only 17 States each year.  Because the PERM program will not 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     12 
OEI-05-18-00070   
effectively gauge compliance for all States in a timely way, CMS could also 
use other tools to ensure compliance.  For example, CMS could require 
a State to develop a corrective action plan if CMS deems the State to be 
substantially out of compliance with the requirements for Medicaid provider 
enrollment screening.  
Amend its guidance so that States cannot forgo conducting 
criminal background checks on high-risk providers applying to 
enroll in Medicaid that are already enrolled in Medicare unless 
Medicare has conducted the checks 
CMS should amend its guidance to States so that they cannot forgo 
conducting criminal background checks on prospective high-risk providers 
that are already enrolled in Medicare unless the provider record in 
Medicares enrollment system shows a result for a criminal background 
check.  Failure to conduct such checks leaves Medicaid vulnerable to 
unscrupulous providers that may use Medicares delay in fully implementing 
criminal background checks as an opportunity to avoid detection and 
defraud the Medicaid program.   
OIG recognizes that CMS uses the APS system to monitor Medicare 
providers for criminal histories.  However, the APS system is a name-based 
background check, and unscrupulous providers and their owners could alter 
their names or other personal information to avoid detection by it.  
In contrast, a fingerprint-based criminal background check relies on 
fingerprintsuniquely personal identifying informationand thus 
eliminates the errors associated with name-based background checks.  
Further, fingerprints are necessary for complete access to the criminal 
history records held by State criminal history repositories and the Federal 
Bureau of Investigation. 
Compare high-risk Medicaid providers self-reported ownership 
information to Medicares provider ownership information 
to help States identify discrepancies  
CMS should work with States to determine whether the self-reported 
ownership information from high-risk providers is consistent across 
Medicaid and Medicare.  CMS should do this by requesting that States 
submit to CMS the ownership information for their high-risk Medicaid 
providers.  CMS should then systematically compare this State-provided 
ownership information to the ownership information that CMS has on file 
for providers enrolled in Medicare.  When CMS finds discrepancies 
between the two for a provider, it should report back to the relevant State(s) 
and both CMS and the State(s) should work together to resolve 
discrepancies.   
To do this comparison, CMS would need to obtain from States 
the self-reported ownership information for their high-risk Medicaid 
providers.  However, CMS has indicated that it may not have the authority 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     13 
OEI-05-18-00070   
to compel States to submit such information.  If that is the case, OIG 
recommends that CMS consider seeking legislative authority, to the extent 
necessary.  However, even if CMS lacks the authority to compel States to 
submit such information, OIG recommends thatas a prudent program 
integrity practiceCMS ask States to provide it with this information.  
Implementing this recommendation would create a shared system for States 
and CMS to systematically identify high-risk providers that falsify or omit 
owners on their enrollment applications, effecting greater consistency of 
providers self-reported ownership information across both Medicaid and 
Medicare.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     14 
OEI-05-18-00070   
AGENCY COMMENTS AND OIG RESPONSE 
CMS concurred with our first recommendation.  CMS noted that its technical 
assistance and guidance to States has resulted in most States 
implementing fingerprint-based criminal background checks.  CMS stated 
that it is working with the remaining States to implement these checks.  We 
commend CMS for this progress and support its continued efforts to work 
with States on implementing these checks. 
CMS did not concur with our second recommendation.  CMS noted that it 
allows States to forgo conducting fingerprint-based criminal background 
checks on providers that Medicare has enrolled as high-risk even when 
Medicare has not completed those background checks.  CMS stated that it 
is in the process of procuring a contractor to conduct criminal background 
checks on all remaining Medicare providers.  CMS believes this approach is 
the most effective and least burdensome strategy it can use to ensure that 
providers are appropriately screened.  
OIG and CMS share the same program integrity goal of ensuring that all 
high-risk providers enrolled in Medicare and Medicaid have undergone 
criminal background checks.  With this common goal in mind, we continue 
to recommend that CMS amend its guidance as a temporary measure until 
all Medicare providers are being fully screened, including undergoing 
criminal background checks.  If CMS does not make changes to its 
guidance, the loophole discussed in this reportallowing high-risk 
Medicare providers to enroll in Medicaid without a fingerprint-based 
criminal background check in either programwill persist at least until 
2020, when CMS will procure the contract to conduct criminal background 
checks on the remaining Medicare providers.   
CMS did not concur with our third recommendation.  CMS stated that many 
States collect providers self-reported ownership information using paper 
records.  CMS believes exchanging paper records to implement this 
recommendation would be a burden both on States and on CMS.  However, 
CMS said that it would request that States with electronic records take 
advantage of the data matching service that CMS offers, which can identify 
discrepancies in providers self-reported ownership information between 
Medicare and Medicaid.     
We continue to recommend that CMS compare the self-reported ownership 
information for high-risk Medicaid providers to the ownership information 
that Medicare has on file, but we also acknowledge CMSs concerns about 
doing so for States that maintain paper records.  To address the intent of 
the recommendation in a way that does not lead to undue burden for 
States and CMS, CMS could start by doing these comparisons for all States 
that maintain electronic records and add States as they convert from paper 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     15 
OEI-05-18-00070   
to electronic records.  CMS could also direct States with paper records that 
it is their responsibility to compare their records against the ownership 
information that Medicare has on file, which they can access through 
CMSs Provider Enrollment Chain and Ownership System.    
   
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     16 
OEI-05-18-00070   
APPENDIX A: Detailed Methodology 
Methodology  Scope 
We included all 50 States and the District of Columbia in our study to 
ensure that we had accurate numbers on implementation and the most 
up-to-date information about States challenges.   
Data Sources and Collection 
The results for this study came from three data sources: a survey to all 
States, followup emails and phone calls to a subset of States, and structured 
interviews with 14 of the 18 States that had not implemented 
fingerprint-based criminal background checks by the required deadline 
(July 2018). We also conducted a structured interview with CMS in July 2018.     
Survey to States.  We used the survey (a) to ask States the extent to which 
they had implemented criminal background checks and (b) to identify 
remaining challenges that were preventing them from implementing 
criminal background checks and any solutions to these challenges.  We 
sent the survey to States in May 2018.  Forty-eight States responded.  The 
three States that did not respond could not complete the survey by the OIG 
submission deadline because (a) State staff in two of the States were not 
available, and (b) a statewide emergency in one of the States.  We followed 
up with at least two emails and two phone calls before considering these 
States as nonrespondents.   
In our survey, we asked States the extent to which they had implemented 
criminal background checks.  First, we asked States to indicate which 
of the four steps of implementation they had completed as of April 15, 2018, 
for newly enrolling high-risk providers.  We then asked States which steps 
they had completed as of April 15, 2018, for high-risk providers enrolled 
after August 1, 2015 (known as lookback providers).  When States indicated 
that they had not yet implemented criminal background checks for a group 
of providers, we prompted them to enter an anticipated implementation 
date for that group.   
Next, we asked States to report their challenges to implementation.  We 
asked States to selectfrom a closed-ended list that we providedthe best 
explanation for their challenges to implementation.  We created the list 
using challenges that States had reported in OIGs provider enrollment 
report from 2016.  States also had the opportunity to explain unique and/or 
new challenges that were preventing them from implementing background 
checks. 
Finally, we asked States about solutions to their challenges in implementing 
criminal background checks.  We requested this information both from 
States that had implemented the checks and those that had not.  We asked 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     17 
OEI-05-18-00070   
States to explain solutions they used (for those that had implemented 
the checks) or that they planned to use (for those that had not implemented 
the checks). 
Followup Emails to a Subset of 22 States.  To ensure we had the most 
recent data from States, we did two rounds of followup with the 22 States 
that had not implemented criminal background checks at the time of our 
survey in May 2018. We conducted our first round of followup generally 
within 7 business days of the July 1, 2018, deadline that CMS required for 
implementation of these checks.  At that time, 4 of the 22 States indicated 
that they had met the deadline, leaving 18 States that had not implemented 
criminal background checks by CMSs deadline.  
From November 29, 2018, to December 27, 2018, we conducted a second 
round of followup with the 18 States that had not met CMSs deadline.  We 
contacted States twice via email and twice by phone.  We asked States 
whether they had implemented criminal background checks.  If they had 
not, we asked for an update on their progress and for the approximate date 
when they would implement the checks.  We explained to States that if they 
did not respond, we would consider their reported implementation status 
from July 2018 to still be current as of January 1, 2019.  Of the 18 States, 
17 provided information on their implementation status, and 4 of these 
States had implemented criminal background checks.  One of the 17 States 
did not provide information, and we did not update the implementation 
status for that State.   
Structured Interviews with States.  We conducted structured interviews 
with 14 of the 18 States that had not implemented criminal background 
checks as of July 2018 to (a) clarify how many of the 4 required steps they 
had completed and (b) gain context and greater insight into the specific 
challenges these States faced and their planned solutions.  We selected 
States that reported in our survey an implementation date beyond CMSs 
deadline of July 1, 2018, and those States that we learned in our email 
followup had missed the deadline of July 1, 2018.  For four States that had 
not implemented background checks, we were unable to conduct interviews 
because they did not respond to our request for an interview or because of 
time constraints.  We conducted these interviews in May, June, and 
July 2018.  
Structured Interview with CMS.  To clarify CMSs guidance on requirements 
for criminal background checks, we conducted a structured interview with 
CMS staff responsible for provider enrollment.  We conducted this interview 
in July 2018.  
Data Analysis 
We analyzed survey and interview responses to understand States progress 
toward implementation.  First, we reviewed survey responses to understand 
States implementation status, challenges, and solutions.  To determine 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     18 
OEI-05-18-00070   
States implementation status, we evaluated States survey and interview 
responses to determine whether they would complete the four steps of 
implementation outlined in CMS guidance by the deadline of July 1, 2018.  
We also evaluated States survey and interview responses to determine 
whether they completed the four steps for the three groups of providers for 
which they were required to complete criminal background checks: newly 
enrolling high-risk providers, lookback high-risk providers enrolled after 
August 2015, and high-risk providers with existing overpayments.   
After determining States respective statuses for implementing criminal 
background checks, we reviewed CMSs and States interview responses to 
gain greater insight into the challenges faced by States that had not 
implemented the checks.  In some cases, we identified through our 
interviews additional challenges that States had not cited in their surveys.  In 
our analysis, we identified current challenges to implementation as well as 
issues that States and CMS raised as program integrity concerns going 
forward. 
Limitations 
It is possible thatas a result of our data collection methodswe 
underestimated the number of States that had not implemented 
fingerprint-based criminal background checks.  Our analysis relied on 
self-reported data, which we did not independently verify for each State; we 
corroborated our survey results only for States that reported not having 
implemented the checks. In addition, we may have underestimated 
the number of States struggling to identify providers with a high-risk status 
that resulted from existing overpayments.  We did not specifically request 
this information in our survey, but some States reported it on the survey 
as a barrier to implementation.    
 
 
 
 
   
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     19 
OEI-05-18-00070   
APPENDIX B:  Agency Comments 
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     20 
OEI-05-18-00070   
 
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     21 
OEI-05-18-00070   
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     22 
OEI-05-18-00070   
ACKNOWLEDGMENTS 
Jonathan Jones served as the team leader for this study.  Others 
in the Office of Evaluation and Inspections who conducted the study include 
Jonathan Carroll, Nicole Hrycyk, and Abigail Wydra.  Office of Evaluation 
and Inspections staff who provided support include Kevin Manley and 
Christine Moritz.  
This report was prepared under the direction of Thomas Komaniecki, 
Regional Inspector General for Evaluation and Inspections in the Chicago 
regional office, and Laura Kordish and Kelly Waldhoff, Deputy Regional 
Inspectors General.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
To obtain additional information concerning this report or to obtain copies, contact the Office of Public 
Affairs at Public.Affairs@oig.hhs.gov.  
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     23 
OEI-05-18-00070   
 
ENDNOTES 
1 The Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), as amended by the Health Care 
and Education Reconciliation Act of 2010, P.L. No. 111-152 (March 30, 2010).  
2 The Patient Protection and Affordable Care Act,  6401(a)(3), (b)(1)(B).   
3 Ibid.  
4 OIG, Medicaid Provider Enrollment Screenings Have Not Been Fully Implemented, OEI-05-13-00520, May 2016. 
5 42 CFR  455.450.  See also CMS, CMCS [Center for Medicaid and CHIP Services] Informational Bulletin: 
Medicaid/CHIP Provider Screening and Enrollment, December 23, 2011.  Accessed at 
https://www.medicaid.gov/federal-policy-guidance/downloads/cib-12-23-11.pdf on December 1, 2017.  
6 42 CFR  455.450 and 455.434.  See also Crime Identification Technology Act of 1998, P.L. No. 105-251 (October 9, 
1998).   
7 76 Fed. Reg. 5862, 5876 (Feb. 2, 2011).  Accessed at https://www.gpo.gov/fdsys/pkg/FR-2011-02-02/pdf/2011-
1686.pdf on December 1, 2017.  See also Recommendation 1.1 in SEARCH (The National Consortium for Justice 
Information and Statistics), Report of the National Task Force on the Criminal Backgrounding of America, 2005, p. 9.  
Accessed at http://www.search.org/files/pdf/ReportofNTFCBA.pdf on March 1, 2018.   
8 Social Security Act  1902(kk)(1); CMS, Medicaid Provider Enrollment Compendium, p. 21.  We accessed the 
2018 edition of the Medicaid Provider Enrollment Compendium at https://www.medicaid.gov/affordable-care-
act/downloads/program-integrity/mpec-7242018.pdf on August 20, 2018.  
9 CMS, CMCS [Center for Medicaid and CHIP Services] Informational Bulletin: Medicaid/CHIP Provider Screening and 
Enrollment and CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 6.  Accessed at 
http://www.medicaid.gov/federal-policy-guidance/downloads/SMD060115.pdf on December 1, 2017.   
10 76 Fed. Reg. at 5870-5872 (Feb. 2, 2011).  See endnote 7 for the URL.   
11 CMS, CMCS [Center for Medicaid and CHIP Services] Informational Bulletin: Medicaid/CHIP Provider Screening and 
Enrollment and CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL for 
SMD #15-002.  
12 42 CFR  455.450(e); CMS, Medicaid Provider Enrollment Compendium, p. 24.  See endnote 8 for the URL 
for the Medicaid Provider Enrollment Compendium.   
13 42 CFR  455.434; CMS, Medicaid Provider Enrollment Compendium, p. 61.  See endnote 8 for the URL 
for the Medicaid Provider Enrollment Compendium.   
14 42 CFR  455.104(c); CMS, Medicaid Provider Enrollment Compendium, p. 33.  See endnote 8 for the URL 
for the Medicaid Provider Enrollment Compendium.   
15 Ibid.  
16 CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL for SMD #15-002. 
17 CMS extended the deadline for implementing criminal background checks for 40 States to July 1, 2018.  CMS staff 
reported to OIG that this was a blanket extension for all 40 States for which CMS had approved compliance plans.  
This information came from a teleconference between OIG and CMS staff on December 18, 2017.  See also CMS, 
CMCS [Center for Medicaid and CHIP Services] Informational Bulletin: Medicaid/CHIP Provider Screening and 
Enrollment, December 23, 2011; CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002); CMS, Sub 
Regulatory Guidance for State Medicaid Agencies (SMA):  Fingerprint-based criminal background checks (2016-002), 
Accessed at https://www.medicaid.gov/affordable-care-act/provisions/downloads/fcbc-2016-002.pdf on December 1, 
2017.   
18 In June 2016, CMS approved compliance plans that extended the deadline for implementing criminal background 
checks from June 1, 2016, to July 1, 2017, for 40 States.  Because States submitted compliance plans voluntarily, OIG 
did not assume that the remaining 11 States had implemented criminal background checks.  Further, at least 
one State submitted its compliance plan past CMSs deadline and was not granted an extension.  This information 
came from a teleconference between OIG and CMS staff on December 18, 2017, and a CMS presentation  
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     24 
OEI-05-18-00070   
 
to the public.  See CMS, Medicaid Provider Enrollment: Building Partnerships, presentation by the Center for Program 
Integritys Provider Enrollment and Oversight Group at the 2017 National Association for Medicaid Program Integrity 
conference, August 17, 2017.  Accessed at 
https://nampi.net/images/2017/11am_Chong_Zabeen_Provider_Erollment_and_Screening_Compressed.pdf on 
December 20, 2018. 
19 CMS, Payment Error Rate Measurement.  Accessed at https://www.cms.gov/Research-Statistics-Data-and-
Systems/Monitoring-Programs/Medicaid-and-CHIP-Compliance/PERM/ on February 6, 2019.  
20 CMS, Payment Error Rate Manual Version 1.7, January 2018, p. 1.  Accessed at https://www.cms.gov/Research-
Statistics-Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/Downloads/FY17PERMManual.pdf on January 10, 2018. 
21 Ibid, pp. 43-48.   
22 Ibid., p. 45.   
23 CMS, Medicaid and CHIP 2016 Improper Payments Report.  Accessed at https://www.cms.gov/Research-Statistics-
Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/Downloads/2016MedicaidandCHIPImproperPaymentReport.pdf on July 19, 2018, pp. 19-20.   
24 42 CFR  431.1002; CMS, Payment Error Rate Manual Version 1.7, January 2018, p. 74.  See endnote 20 for the URL 
for Payment Error Rate Manual Version 1.7. 
25 The PERM program is reviewing Report Year (RY) 2020 States from July 1, 2018, to June 30, 2019.  Given the 
deadline of July 1, 2018, for implementation of criminal background checks, RY 2020 States are the first States for 
which CMS might find errors related to noncompliance with this requirement.  The RY 2020 States are Alabama, 
California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, 
North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, and West Virginia.  See CMS, Cycle 2 
(RY 2020) States.  Accessed at https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-
Programs/Medicaid-and-CHIP-Compliance/PERM/Cycle_2.html on January 7, 2019.  
26 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Fingerprint-based criminal background checks 
(2016-002).  See endnote 17 for the URL for Sub Regulatory Guidance.  See also CMS, Medicaid Provider Enrollment 
Compendium, p. 56.  See endnote 8 for URL for the Medicaid Provider Enrollment Compendium.   
27 Ibid. 
28 At a minimum, States must follow the Federal requirements but have discretion to create stricter criteria 
(i.e., additional disqualifying crimes).  See 42 CFR  455.101, 455.416, 424.530, and 424.535; CMS, Medicaid Provider 
Enrollment Compendium, pp. 74-80.  See endnote 8 for the URL for the Medicaid Provider Enrollment Compendium.   
29 CMS, Medicaid Provider Enrollment: Fingerprint-based criminal background checks (FCBC) 42 CFR  455.434 & 
455.450.  Accessed at https://www.medicaid.gov/affordable-care-act/provisions/downloads/fcbc-webinar.pdf on 
July 1, 2018.  
30 42 CFR  455.410; CMS, Medicaid Provider Enrollment Compendium, pp. 46, 4849.  See endnote 8 for the URL 
for the Medicaid Provider Enrollment Compendium.   
31 CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL for SMD #15-002. 
32 42 CFR  455.410(c)(1) and CMS, Medicaid Provider Enrollment Compendium, Scenario 1, p. 50.  In Scenario 1, CMS 
states the following:  State Medicaid Agencies can rely on the Medicare screening up to and included in a particular 
risk category, regardless of whether Medicares enrollment record reflects that a particular activity was completed.  
See endnote 8 for the URL for the Medicaid Provider Enrollment Compendium.  See also CMS, State Medicaid Director 
Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL for SMD #15-002. 
33 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): Instructions for relying on provider screening 
conducted by Medicare (42 CFR 455.410) or conducting additional screening when required, pp. 1-2.  Accessed at 
https://www.medicaid.gov/affordable-care-act/provisions/downloads/revalidation-2016-001.pdf on December 1, 2017. 
34 CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL for 
SMD #15-002. 
35 OIG, Improvements Needed To Ensure Provider Enumeration and Medicare Enrollment Data Are Accurate, Complete, 
and Consistent, OEI-07-09-00440, May 2013.  
36 OIG, Medicaid Provider Enrollment Screenings Have Not Been Fully Implemented, OEI-05-13-00520, May 2016. 
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     25 
OEI-05-18-00070   
 
 
37 OIG, Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results, OEI-03-13-00050, 
April 2016. 
38 OIG, Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure, OEI-04-11-00591, May 2016. 
39 OIG, Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure, OEI-04-11-00590, May 2016. 
40 Ibid, pp. 7-9. 
41 Recommendations cited pertain to the OIG report Medicaid Provider Enrollment Screenings Have Not Been Fully 
Implemented, OEI-05-13-00520, May 2016. 
42 Recommendation cited pertains to the OIG report Medicaid: Vulnerabilities Related to Provider Enrollment and 
Ownership Disclosure, OEI-04-11-00590, May 2016. 
43 These 13 States account for $177,513,967,055 (31 percent) of Medicaid costs for fiscal year 2017.  See Henry J. Kaiser 
Family Foundation, State Facts: Total Medicaid Spending, Timeframe FY 2017.  Accessed at 
https://www.kff.org/medicaid/state-indicator/total-medicaid-spending/ on February 2, 2019.   
44 The three States that did not respond could not complete the survey by the OIG submission deadline.  See detailed 
methodology for more information.   
45 CMS, Medicaid and CHIP 2016 Improper Payments Report, pp. 19-20.  See endnote 23 for URL for Medicaid and 
CHIP 2016 Improper Payments Report.   
46 42 CFR  431.1002; CMS, Payment Error Rate Manual Version 1.7, January 2018, p. 74.  See endnote 20 for the URL 
for Payment Error Rate Manual Version 1.7. 
47 Of the 13 States that have not implemented background checks, 2 StatesRhode Island and South Carolinaare 
in CMSs RY 2020 PERM review and could be subject to CMSs finding overpayment errors related to noncompliance.  
See endnote 25 for the source and URL for this information.   
48 These criteria are necessary for States to make an enrollment decision when a providers criminal background 
check reveals a criminal history, according to CMS, Medicaid Provider Enrollment: Fingerprint-based criminal 
background checks (FCBC) 42 CFR  455.434 & 455.450.  See endnote 29 for the URL.   
49 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Fingerprint-based criminal background checks 
(2016-002).  See endnote 17 for the URL for Sub Regulatory Guidance.  See also CMS, Medicaid Provider Enrollment 
Compendium, p. 56.  See endnote 8 for URL for the Medicaid Provider Enrollment Compendium.   
50 42 CFR  455.410; CMS, Medicaid Provider Enrollment Compendium, Scenario 1, p. 50.  See endnote 8 for the URL 
for the Medicaid Provider Enrollment Compendium.   
51 CMS, State Medicaid Director Letter, June 1, 2015 (SMD #15-002), p. 2.  See endnote 9 for the URL. 
52 76 Fed. Reg. 5862, 5876 (Feb. 2, 2011).  See endnote 7 for the URL for the Federal Register.  See also the Crime 
Identification Technology Act of 1998, P.L. No. 105-201 (October 9, 1998).   
53 Federal Bureau of Investigation, Criminal Justice Information Services, National Fingerprint Based Criminal 
Background Checks Steps for Success.  Accessed at https://www.fbi.gov/services/cjis/compact-council/national-
fingerprint-based-background-checks-steps-for-success on March 1, 2018.   
54 Ibid.  
55 42 CFR  455.104(b); CMS, Medicaid Provider Enrollment Compendium, pp. 26-27.  See endnote 8 for the URL for 
the Medicaid Provider Enrollment Compendium.   
56 42 CFR  455.434; CMS, Medicaid Provider Enrollment Compendium, p. 61.  See endnote 8  for the URL for 
the Medicaid Provider Enrollment Compendium.   
57 42 CFR 455.416; CMS, Medicaid Provider Enrollment Compendium, p. 78.  See endnote 8 for the URL for 
the Medicaid Provider Enrollment Compendium.   
58 42 CFR  455.104(c); CMS, Medicaid Provider Enrollment Compendium, p. 33.  See endnote 8 for the URL for 
the Medicaid Provider Enrollment Compendium.   
59 The 18 States that verified the accuracy of provider ownership information used a variety of mechanisms to do so, 
including State websites, Federal databases, online information about providers, and business documents from 
providers.  See OIG, Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure, 
OEI-04-11-00590, May 2016, pp. 7-9. 
60 Ibid.  
 
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     26 
OEI-05-18-00070   
 
61 OIG, Enhanced Enrollment of Medicare Provider Screenings: Early Implementation Results, OEI-03-13-00050, 
May 2016. 
62 OIG, Medicaid Provider Enrollment Screenings Have Not Been Fully Implemented, OEI-05-13-00520, May 2016. 
63 Ibid.  
64 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA):  Fingerprint-based criminal background checks 
(2016-002).  See endnote 17 for the URL for Sub Regulatory Guidance. See also CMS, Medicaid Provider Enrollment 
Compendium, p. 56.  See endnote 8 for URL for the Medicaid Provider Enrollment Compendium.   
Problems Remain for Ensuring That All High-Risk Medicaid Providers Undergo Criminal Background Checks     27 
OEI-05-18-00070   
ABOUT THE OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public 
Law 95-452, as amended, is to protect the integrity of the Department of 
Health and Human Services (HHS) programs, as well as the health and 
welfare of beneficiaries served by those programs.  This statutory mission is 
carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit  The Office of Audit Services (OAS) provides auditing services for HHS, either 
by conducting audits with its own audit resources or by overseeing audit 
Services 
work done by others.  Audits examine the performance of HHS programs 
and/or its grantees and contractors in carrying out their respective 
responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, 
abuse, and mismanagement and promote economy and efficiency 
throughout HHS. 
Office of Evaluation  The Office of Evaluation and Inspections (OEI) conducts national evaluations 
to provide HHS, Congress, and the public with timely, useful, and reliable 
and Inspections 
information on significant issues.  These evaluations focus on preventing 
fraud, waste, or abuse and promoting economy, efficiency, and 
effectiveness of departmental programs.  To promote impact, OEI reports 
also present practical recommendations for improving program operations.   
Office of  The Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of fraud and misconduct related to HHS programs, 
Investigations 
operations, and beneficiaries.  With investigators working in all 50 States 
and the District of Columbia, OI utilizes its resources by actively 
coordinating with the Department of Justice and other Federal, State, and 
local law enforcement authorities.  The investigative efforts of OI often lead 
to criminal convictions, administrative sanctions, and/or civil monetary 
penalties. 
Office of Counsel to  The Office of Counsel to the Inspector General (OCIG) provides general 
legal services to OIG, rendering advice and opinions on HHS programs and 
the Inspector 
operations and providing all legal support for OIGs internal operations.  
General 
OCIG represents OIG in all civil and administrative fraud and abuse cases 
involving HHS programs, including False Claims Act, program exclusion, and 
civil monetary penalty cases.  In connection with these cases, OCIG also 
negotiates and monitors corporate integrity agreements.  OCIG renders 
advisory opinions, issues compliance program guidance, publishes fraud 
alerts, and provides other guidance to the health care industry 
concerning the anti-kickback statute and other OIG enforcement authorities.