DEPARTMENT OF HEALTH AND HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, MD 21244-1850 
 
 
 
SMD# 15-002 
ACA# 33 
 
  
June 01, 2015 
 
  Re:  Medicaid/CHIP Provider 
Fingerprint-Based Criminal Background 
Check 
 
Dear State Medicaid Director:  
 
This guidance is part of a series relating to the implementation of Section 6401 of the 
Affordable Care Act, Provider Screening and Other Enrollment Requirements under 
Medicare, Medicaid, and the Childrens Health Insurance Program (CHIP).    
 
Section 6401(a) of the Affordable Care Act amended section 1866(j) (2) of the Social 
Security Act (the Act) to require the Secretary, in consultation with the Office of the 
Inspector General, to establish procedures for screening providers and suppliers under 
Medicare, Medicaid, and CHIP.  The Secretary was directed to determine the level of 
screening to be conducted according to the level of risk for fraud, waste, and abuse for 
each category of provider. 
 
Section 6401(b) of the Affordable Care Act amended section 1902 of the Act to require 
states to comply with the procedures established by the Secretary for screening providers 
and suppliers.  The Centers for Medicare & Medicaid Services (CMS) implemented these 
requirements with federal regulations at 42 CFR Part 455 subpart E.   These regulations 
were published as a final rule in the Federal Register, Vol. 76, February 2, 2011, and were 
effective March 25, 2011.   
 
On December 23, 2011, CMS issued an Informational Bulletin to offer further information 
to states regarding the requirements of these regulations. The Informational Bulletin, 
which may be found at http://www.medicaid.gov/Federal-Policy-
Guidance/downloads/CIB-12-23-11.pdf, referenced additional sub regulatory guidance on 
fingerprint-based criminal background checks (FCBCs).  This letter represents that 
guidance. 
 
Implementation of Fingerprint-Based Criminal Background Checks 
 
42 CFR 455.410(a) provides that a state Medicaid agency must require all enrolled 
providers to be screened according to the provisions of Part 455 subpart E. Under 42 CFR 
455.450,  a state Medicaid agency is required to screen all applications, including initial 
applications, applications for a new practice location, and applications for re-enrollment or  Page 2  State Medicaid Director 
 
revalidation, based on a categorical risk level of limited, moderate, or high.  Under 
42 CFR 455.434, a  state Medicaid agency must establish categorical risk levels for 
providers and provider categories who pose an increased financial risk of fraud, waste or 
abuse to the Medicaid program.  When the agency determines that a providers categorical 
risk level is high, or when the agency is otherwise required to do so under State law, the 
agency must require providers to consent to criminal background checks, including 
fingerprinting. 
 
42 CFR 455.450(c) requires that when a state Medicaid agency designates a provider as a 
high categorical risk, the agency must do all of the following:  
 
  Perform the limited and moderate screening requirements specified at 42 CFR 
455.450(a) and (b);  
  Require the submission of a set of fingerprints in accordance with 42 CFR 455.434; 
and 
  Conduct a criminal background check. 
 
Under 42 CFR 455.434(b), the requirement to submit fingerprints applies to both the 
high risk provider and any person with a 5 percent or more direct or indirect ownership 
interest in the provider, as those terms are defined in 455.101. 
 
FCBCs are part of the enhanced screening and enrollment provisions included in the Provider 
Screening and Enrollment State Plan Amendment.  This guidance implements the timeframe 
discussed in the preamble to the February 2011 final rule and in the December 2011 
Informational Bulletin. States have 60 days from the date of this letter to begin implementation 
of the FCBC requirement. States must complete implementation of the FCBC requirement within 
12 months of the date of this letter.  Implementation means that the state Medicaid agency has 
conducted an FCBC with respect to each provider that the agency has designated as high risk.  
This includes all  high risk providers newly enrolling in Medicaid, high risk providers 
seeking re-enrollment in Medicaid, and currently enrolled high risk providers at the time of 
revalidation required under 42 CFR 455.414.   
 
To avoid unnecessary cost and burden, a state Medicaid agency is not required to conduct an 
FCBC on a high risk provider if that provider is considered a high risk provider by Medicare 
and the provider has been enrolled by Medicare. (Under 42 CFR 424.518(c), Medicare considers 
newly-enrolling home health agencies and suppliers of DMEPOS to be high categorical risk). 
Under 42 CFR 455.410(c), states may rely on a providers Medicare enrollment even if Medicare 
has not conducted an FCBC with respect to that provider. States should confirm through the 
Provider Enrollment, Chain, and Ownership System (PECOS) whether a provider is currently 
enrolled in Medicare, whether an FCBC has been conducted with respect to the provider, and 
whether the provider passed or failed the FCBC.  A state Medicaid agency may also rely on the 
results of an FCBC conducted by another state Medicaid or CHIP agency if the provider is 
enrolled in the other state Medicaid or CHIP program and has met the revalidation requirement 
of 42 CFR 455.414.  
  Page 3  State Medicaid Director 
 
The state Medicaid agency may determine the form and manner for submission of 
fingerprints. It may require a high risk provider to pay the costs associated with 
obtaining fingerprints. States also have discretion to decide the type and extent of their 
criminal background checks.  We recommend conducting a FBI criminal history record 
check, which provides information that is national in scope. States may wish to leverage 
existing protocols for obtaining FCBCs that are used in the state for other purposes, such 
as hiring, licensing, or screening employees.  States may also wish to leverage activities 
and procedures implemented under the CMS National Background Check Program for 
Long-Term Care Facilities and Providers. The specific procedures a state Medicaid agency 
elects to follow will determine the applicable security and privacy requirements under state 
or federal law.    
 
Under 42 CFR 455.416, a state Medicaid agency must terminate or deny enrollment of a 
provider if the provider, or any person with a 5% or greater direct or indirect ownership 
interest, who is required to submit fingerprints: 
 
  fails to submit them within 30 days of the Medicaid agencys request; 
  fails to submit them in the form and manner requested by the Medicaid agency; or   
  has been convicted of a criminal offense related to that persons involvement with 
the Medicare, Medicaid or CHIP program in the last 10 years. 
 
In all three cases, the agency may allow the provider to enroll if the agency determines that 
termination or denial of enrollment is not in the best interests of the Medicaid program and 
documents that determination in writing.   
 
Please contact Christine Gerhardt, Deputy Director, Division of State Systems, at 410-786-
0693, or by email at Christine.Gerhardt@cms.hhs.gov if you have any questions. We look 
forward to continuing our work together as we implement this important provision of the 
Affordable Care Act. 
 
Sincerely, 
 
     /s/ 
 
Victoria Wachino 
Director 
 
Enclosure: Frequently Asked Questions: Medicaid/CHIP Provider Fingerprint-Based 
Background Checks 
 
             
 
cc: 
 
National Association of Medicaid Directors 
  Page 4  State Medicaid Director 
 
National Academy for State Health Policy 
 
National Governors Association 
 
American Public Human Services Association 
 
Association of State and Territorial Health Officials 
 
Council of State Governments  DEPARTMENT OF HEALTH AND HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, MD 21244-1850 
 
 
Medicaid/CHIP Provider Fingerprint-Based Criminal Background Checks (FCBCs) 
Frequently Asked Questions 
June 1, 2015 
 
 
Q1:  Is provider and supplier screening in Medicaid and CHIP required by statute? 
 
A1:  Yes.  Section 6401(a) of the Affordable Care Act amended section 1866(j) (2) of the 
Social Security Act (the Act) to require the Secretary, in consultation with the HHS Office 
of Inspector General, to establish procedures for screening providers and suppliers 
under Medicare, Medicaid, and CHIP.  The Secretary was directed to determine the level 
of screening to be conducted according to the level of risk  for fraud, waste, and abuse 
for each category of provider. Section 6401(b) of the Affordable Care Act amended 
section 1902 of the Act to require state Medicaid programs to comply with the 
procedures established by the Secretary for screening providers and suppliers. Section 
6401(c) of the Affordable Care Act amended section 2107(e) of the Act to make the 
provider and supplier screening requirements under section 1902 applicable to CHIP.  
 
Q2:  Has CMS implemented this statutory requirement by regulation? 
 
A2:  Yes.  CMS implemented provider screening requirements with federal regulations at 42 
CFR Part 455 subpart E and at 42 CFR 457.990, which makes Part 455 subpart E 
applicable to CHIP.  These regulations were published as a final rule in the Federal 
Register, Vol. 76, February 2, 2011, and were effective March 25, 2011. 
 
Q3:  Has CMS issued any previous guidance related to these regulations? 
 
A3:  Yes.  CMS issued an Informational Bulletin on December 23, 2011, which may be found 
at http://www.medicaid.gov/Federal-Policy-Guidance/downloads/CIB-12-23-11.pdf. 
 
Q4:  Why is CMS releasing this guidance on Fingerprint-based Criminal Background Checks 
(FCBCs)? 
 
A4:  The December 23, 2011 Informational Bulletin, as well as the preamble to the February 
2011 final rule, made clear that states would not be required to implement the FCBC 
requirements until 60 days following the publication of sub regulatory guidance.  These 
FAQs, and the accompanying state Medicaid Director letter, constitute that guidance. 
The Medicare program began conducting FCBCs for providers and suppliers designated 
to be in the high risk category in September, 2014.  See Implementation of 
Fingerprint-based Background Checks, https://www.cms.gov/Outreach-and-
Education/Medicare-Learning-Network-
MLN/MLNMattersArticles/Downloads/SE1417.pdf.  Page 2 
 
CMS intends for Medicaid and CHIP programs to make sure high risk providers are 
subject to   screening procedures that are equally as effective as those applied to  high 
risk providers in Medicare.    
 
Q5:  Why does a state Medicaid agency have to conduct FCBCs? 
 
A5:  The federal regulation at 42 CFR 455.410(a) provides that a state Medicaid agency must 
require all enrolled providers to be screened according to the provisions of Part 455 
subpart E.  These provisions require the agency to screen all provider applications for 
enrollment, including initial applications, applications for a new practice location, and 
applications for re-enrollment or revalidation, based on a categorical risk level of 
limited, moderate, or high (42 CFR 455.450).  The agency must establish 
categorical risk levels for providers and provider categories who pose an increased 
financial risk of fraud, waste or abuse to the Medicaid program. When the agency 
determines that a providers categorical risk level is high, or when the agency is 
otherwise required to do so under state law, the agency must require providers to 
consent to criminal background checks, including fingerprinting (42 CFR 455.434).   
 
Q6:   How should a state Medicaid agency determine whether a provider or a category of 
providers is high risk? 
 
A6:  In general, state Medicaid agencies should make their own determinations as to which 
providers, and which categories of providers, pose a high risk of fraud, waste, or abuse 
to the Medicaid program.  However, there are certain providers and categories of 
providers that an agency must designate as high risk.  
 
If a provider or provider category is designated as high risk by Medicare, the agency 
must apply the same high risk designation for Medicaid purposes. (If Medicare 
designates a provider or provider category as moderate or limited risk, the agency 
must, at a minimum apply that Medicare screening level to the provider or provider 
category; the agency may, however, apply a higher screening level than that applied by 
Medicare).   
 
Under Medicare regulations at 42 CFR 424.518(c), newly enrolling home health agencies 
and newly enrolling Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS) suppliers are designated as high risk.  In addition, CMS adjusts a providers 
screening level to high under certain circumstances (for example, the provider or 
supplier has been subject to a payment suspension or has  had billing privileges revoked 
at any time in the last 10 years).  
 
Under 42 CFR  455.450(e), a Medicaid agency is required to adjust a providers screening 
level to high risk in the following circumstances: (1) the agency imposes a payment 
suspension; (2) the provider has an existing overpayment; (3) the provider has been 
excluded by the OIG or another states Medicaid program; (4) the agency or CMS in the 
 
  Page 3 
 
previous 6 months lifted a temporary moratorium for the particular provider type and a 
provider prevented from enrolling during the moratorium applies for enrollment within 
6 months from the date the moratorium was lifted.  
 
In the case of provider types that exist only in Medicaid or CHIP and do not have a 
Medicare screening designation, state Medicaid agencies must determine the risk posed 
by a particular provider or provider type.  In general, state agencies should use similar 
criteria to those used in Medicare in making this screening designation.  As outlined in 
the preamble to the final rule, 76 Fed. Reg. at 5895-5896 (February 2, 2011), physicians 
and non-physician practitioners, medical groups, and clinics that are state-licensed 
would generally be categorized as limited risk; provider types that are highly 
dependent on Medicare, Medicaid and CHIP to pay salaries and other operating 
expenses and are not subject to additional governmental or professional oversight 
would be considered moderate risk; and those identified as being especially 
vulnerable to improper payments would be considered high risk.   
 
Q7:  When a state Medicaid agency designates a provider or provider category as high 
risk, what is required by the agency? 
 
A7:  Under 42 CFR 455.450(c), when a state Medicaid agency designates a provider as a 
high categorical risk, the agency must:  
 
  Perform the limited and moderate screening requirements specified at 42 
CFR 455.450(a) and (b);  
  Require the submission of a set of fingerprints in accordance with 42 CFR 
455.434; and 
  Conduct a criminal background check. 
 
The screening requirements for limited risk providers, found at 42 CFR 455.450(a), 
are: (1) verify that the provider meets all federal and state requirements applicable to 
the provider type; (2) verify licensure; and (3) conduct federal database checks.  The 
screening requirements for moderate risk providers, found at 42 CFR 455.450(b), are:  
(1) perform limited screening; and (2) conduct an on-site visit. 
 
Note that high risk providers, like any other providers who enroll in Medicaid, must 
enter into a provider agreement with the state Medicaid agency.  Under 42 CFR 
431.107(b) (5), the provider must furnish its National Provider Identifier (NPI) and 
include the NPI on all claims submitted to the Medicaid program.    
 
Q8:  Who is required to submit fingerprints? 
 
A8:  If a state Medicaid agency designates a provider as a high risk, the provider, and any 
person with 5 percent or more direct or indirect ownership interest in the provider, 
must submit fingerprints and undergo a criminal background check, per 42 CFR 
 
  Page 4 
 
455.434(b).  An ownership interest is defined in 42 CFR 455.101 as the possession of 
equity in the capital, the stock, or the profits of the provider.  An indirect ownership 
interest means an ownership interest in an entity that has an ownership interest in the 
provider. 
 
Q9:  How should a state Medicaid agency collect fingerprints? 
 
A9:   The agency may determine the form and manner for submission of fingerprints.  State 
agencies interested in learning about the process that providers must follow for 
Medicare screening purposes should refer to http://www.cmsfingerprinting.com. 
 
Q10:  How should a state Medicaid agency conduct criminal background checks? 
   
A10:  Each state Medicaid agency may decide the type and extent of its criminal background 
check.  CMS recommends conducting a FBI criminal history record check, which provides 
information that is national in scope and therefore would be more complete than a 
state-specific background check. This is the approach used by Medicare, as described in 
https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-
MLN/MLNMattersArticles/Downloads/SE1417.pdf.  A Medicare contractor, Accurate 
Biometrics, receives the fingerprint submission from the provider and 5 percent or 
greater owners, collects the associated fee(s), electronically forwards the fingerprint 
submissions to the FBI Criminal Justice Information Services (CJIS) Division for a national 
Identity History Summary check, and receives the electronic summary check results and 
transmits them to the Medicare Administrative Contractor (MAC).  See 
http://www.fbi.gov/about-us/cjis/identity-history-summary-checks/fbi-approved-
channelers. 
 
Some aspects of the Medicare approach, such as use of MACs or Medicares 
fingerprinting contractor, will not be relevant to state agencies.  CMS does, however, 
recommend that state agencies implement the following elements of the Medicare 
process: 
 
(1) Notify high risk providers in writing of the requirement to submit fingerprints, 
listing all individuals required to be fingerprinted, and the steps they will need to 
follow.  The notification should identify 3 convenient locations where individuals 
can be fingerprinted; provide the Medicaid agencys point of contact to address 
provider questions, and set a  deadline for compliance no later than 30 days of 
the request for fingerprints. 
 
(2) Once the fingerprints have been received by the state agency or by its contractor, 
electronically transmit the fingerprints to the FBI or state law enforcement for 
processing. 
 
 
  Page 5 
 
(3) Upon receipt of the criminal background check results, make an enrollment, 
denial, or termination determination with respect to the provider. 
 
(4) Store all fingerprint data consistent with applicable security and privacy 
requirements under state or federal law and with state records retention laws 
and procedures.  
  
State Medicaid agencies may wish to leverage existing protocols for obtaining FCBCs 
that are used in the state for other purposes, such as hiring, licensing, or screening 
employees.  States may also wish to leverage procedures implemented under the CMS 
National Background Check Program for Long-Term Care Facilities and Providers, 
http://www.cms.gov/Medicare/Provider-Enrollment-and-
Certification/SurveyCertificationGenInfo/BackgroundCheck.html.  The specific 
procedures a state Medicaid agency elects to follow will determine the applicable 
security and privacy requirements under state or federal law. 
 
Q11:  In the case of a high risk provider that is enrolled in Medicare, is the state Medicaid 
agency required to conduct an FCBC if the provider wants to enroll (or re-enroll) in 
Medicaid or seeks to revalidate its current enrollment? 
 
A11:  No.  To avoid unnecessary cost and burden, a state Medicaid agency is not required to 
conduct an FCBC on a high risk provider if that provider is considered a high risk 
provider by Medicare and the provider has been enrolled by Medicare. Under 42 CFR 
455.410(c), state agencies may rely on a providers Medicare enrollment even if 
Medicare has not conducted an FCBC with respect to that provider.  State agencies 
should confirm through the Provider Enrollment, Chain, and Ownership System (PECOS) 
whether a provider is currently enrolled in Medicare. 
 
Q12:   How can a state Medicaid agency confirm a Medicare FCBC using PECOS? 
 
A12:  Access to the PECOS Application Interface (AI) can be granted by contacting Peggy Haire 
at (410) 786-6944 or Peggy.Haire@cms.hhs.gov to obtain the needed application forms 
for submission to CMS.  Once access is granted, the PECOS AI can be accessed via the 
following link:  https://pecosai.cms.hhs.gov/.   Within the PECOS AI, state agencies can 
view Medicare provider information that identifies whether or not a background check 
was conducted and whether the provider is enrolled.  An individuals criminal history, if 
any, is not available for review in PECOS.   
 
Q13:  In the case of a high risk provider that is enrolled in another states Medicaid or 
CHIP program, may the state Medicaid agency rely on the FCBC conducted by the 
other states Medicaid or CHIP agency?  
 
 
  Page 6 
 
A13:  Under 42 CFR 455.410(c), a state Medicaid agency may rely on the results of the 
provider screening performed by Medicaid agencies or CHIP programs of other states, 
including the screening of high risk providers using a FCBC.   
 
Q14:  What if a provider or a 5 percent owner doesnt submit fingerprints when requested 
to do so by a state Medicaid agency?  
 
A14:  Under 42 CFR 455.416, a state Medicaid agency must terminate or deny enrollment of a 
provider if  the provider, or any person with a 5 percent or greater direct or indirect 
ownership interest, who is required to submit fingerprints: 
 
  fails to submit them within 30 days of the Medicaid agencys request; or  
  fails to submit them in the form and manner requested  the Medicaid agency.  
 
In both cases, the agency may allow the provider to enroll if the agency determines that 
termination or denial of enrollment is not in the best interests of the Medicaid program 
and documents that determination in writing.   
 
Q15:  What if the results of a FCBC indicate that a provider or 5 percent owner has a criminal 
record? 
 
A15:  Under 42 CFR 455.416, a state Medicaid agency must terminate or deny enrollment of a 
provider if the provider, or any person with a 5 percent or greater direct or indirect 
ownership interest, who is required to submit fingerprints has been convicted of a 
criminal offense related to that persons involvement with the Medicare, Medicaid or 
CHIP program in the last 10 years.  The types of convictions that warrant denial of 
enrollment are at the discretion of the agency.  The agency may allow the provider to 
enroll if the agency determines that termination or denial of enrollment is not in the 
best interests of the Medicaid program and documents that determination in writing 
that is available to CMS or OIG upon request.  
 
Q16:  When must state Medicaid agencies implement the fingerprint-based criminal 
background checks? 
 
A16:  This guidance implements the timeframe discussed in the preamble to the February 
2011 final rule and in the December 2011 Informational Bulletin. States have 60 days 
from the date of this letter to begin implementation of the FCBC requirement. States 
must complete implementation of the FCBC requirement within 12 months of the date 
of this letter.  Implementation means that the state Medicaid agency has conducted an 
FCBC with respect to each provider that the agency has designated as high risk.  This 
includes all high risk providers newly enrolling in Medicaid, high risk providers 
seeking re-enrollment in Medicaid, and currently enrolled high risk providers at the 
time of revalidation required under 42 CFR 455.414.   
 
 
  Page 7 
 
While the state agency must complete an FCBC with respect to each high risk provider 
(and any person with a 5 percent or more direct or indirect ownership interest) during 
the 12 month implementation period, the agency may do so using its own timeframe.  If 
a high risk provider seeks to enroll in Medicaid for the first time before the agency has 
its FCBC process in place, the agency may enroll the provider (assuming the provider is 
otherwise  qualified) without completing an FCBC at the time of initial enrollment.  The 
agency would, however, have to conduct the FCBC on that provider prior to the 
expiration of the 12-month implementation period.  Similarly, if a high risk provider 
seeks revalidation of enrollment before the state FCBC process is operational, the 
agency may revalidate the providers Medicaid enrollment without completing an FCBC 
at that time, so long as the agency completes the FCBC for that provider before the end 
of the 12-month implementation period.     
 
Q17:  Who is responsible for the cost of conducting FCBCs for high risk providers?   
 
A17:  Under 42 CFR 455.460(a), state Medicaid agencies must collect application fees prior to 
executing a provider agreement with a prospective or re-enrolling institutional provider, 
unless the provider is enrolled in Medicare or another states Medicaid or CHIP 
program. In addition, 42 CFR 455.414 requires that states revalidate the enrollment of 
all providers, regardless of provider type, every 5 years.  As explained in the preamble to 
the final rule, 76 Fed. Reg. at 5908 (February 2, 2011), revalidation includes rescreening 
as well as the collection of updated disclosure information, so institutional providers 
seeking revalidation are subject to an application fee. The application fee is intended to 
cover the costs associated with a states Medicaid provider screening program, including 
the costs of conducting an FCBC on high risk providers.   
 
However, state Medicaid agencies may require the high risk provider to pay the costs 
associated with obtaining fingerprints. As explained in the preamble to the final rule, 76 
Fed. Reg. at 5915 (February 2, 2011), CMS expects that the costs associated with 
processing the fingerprints and conducting the criminal background checks will be 
funded by the amounts collected by the state agency from the imposition of the 
application fee that applies to all institutional providers that are newly enrolling, are re-
enrolling, or are revalidating their enrollment in Medicaid or CHIP, regardless of the 
providers screening risk level.  If the cost of a states provider screening program 
exceeds the amount of the application fees collected, then the state Medicaid agency 
can claim federal financial participation for the excess cost. 
 
In the case of high risk providers enrolled in Medicare, or in another states Medicaid 
or CHIP program, the state Medicaid agency should not be incurring costs relating to 
conducting FCBCs because it will be able to rely on the screening conducted by these 
other programs. 
 
Q18:  Do the FCBC requirements that apply to state Medicaid programs also apply to CHIP 
programs? 
 
  Page 8 
 
 
A18:  Yes.  Under 42 CFR 457.990(a), the Medicaid provider screening and enrollment rules at 
Part 455, subpart E, including the FCBC requirements discussed in these FAQs, apply to a 
state CHIP program just as they apply to the states Medicaid program