Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

MEDICAID ENHANCED 

PROVIDER ENROLLMENT 

SCREENINGS HAVE NOT 

BEEN FULLY IMPLEMENTED

Daniel R. Levinson

Inspector General

May 2016

OEI-05-13-00520
 

EXECUTIVE SUMMARY: MEDICAID ENHANCED PROVIDER ENROLLMENT 

SCREENINGS HAVE NOT BEEN FULLY IMPLEMENTED 

OEI-05-13-00520 

WHY WE DID THIS STUDY 

To bill for items and services provided to beneficiaries, providers must enroll, and 

periodically revalidate this enrollment, in Medicaid. Effective provider enrollment 

screening is an important tool in preventing Medicaid fraud. To protect Medicaid against 

ineligible and fraudulent providers, the Affordable Care Act requires States to screen 

Medicaid providers according to their risk for fraud, waste, and abuse using enhanced 

screening procedures. These can include fingerprint-based criminal background checks 

and site visits. To help States meet the demands of applying enhanced screening to all 

new and existing providers, the Centers for Medicare & Medicaid Services (CMS) allows 

States to substitute Medicare or other State Medicaid agency or Children’s Health 

Insurance Program screening results for their own. Ensuring that States screen all 

providers in accordance with the new requirements is vital to protecting Medicaid, 

especially as it grows to serve more beneficiaries. 

HOW WE DID THIS STUDY 

To determine the extent to which States have screened high- and moderate-risk providers 

using risk-based screening, we surveyed States and requested data about their progress as 

of August 2014. We also asked States whether they used screening results from 

Medicare or other State Medicaid agencies as substitutes for their own activities. In 

addition, we asked States to provide data on the number of new and existing high- and 

moderate-risk providers requiring screening. 

WHAT WE FOUND 

State implementation of risk-based screening is incomplete. Most States reported not 

having fingerprint-based criminal background checks while waiting for the requirement 

to take effect. Although CMS did not initially require States to conduct these checks, 

pending additional guidance, CMS did issue this guidance in June 2015, albeit more than 

4 years after the other enhanced screening activities went into effect. In addition, 

11 States reported that they have not implemented site visits. Meanwhile, most States 

reported challenges and concerns regarding substitution of screening results from 

Medicare or other States for their own. These included difficulties accessing external 

screening data and ensuring the quality of other State and/or Medicare screening efforts. 

Some States that did not have all screening activities in place still enrolled and 

revalidated thousands of providers categorized as posing a high or moderate risk to 

Medicaid. Finally, 14 States reported that they would not finish revalidating existing 

high- and moderate-risk providers by the September 2016 deadline. 
 

WHAT WE RECOMMEND 

To ensure full implementation of Medicaid enhanced provider screening, we recommend 

that CMS (1) assist States in implementing fingerprint-based criminal background checks 

for all high-risk providers, and (2) assist States in overcoming challenges in conducting 

site visits. To facilitate substitution of screening results and minimize variation between 

Medicare and Medicaid, we recommend that CMS (3) enable States to substitute 

Medicare screening data by ensuring the accessibility and quality of Medicare data,

(4) develop a central system where States can submit and access screening results from 

other States, and (5) strengthen minimum standards for fingerprint-based criminal 

background checks and site visits. Finally, to ensure that States conduct enhanced 

screening of existing Medicaid providers, we recommend that CMS (6) work with States 

to develop a plan to complete their revalidation screening in a timely way. CMS 

concurred with all six of our recommendations.
TABLE OF CONTENTS

Objective ......................................................................................................1

Background..................................................................................................1

Methodology................................................................................................7

Findings........................................................................................................9

Most States reported not having fingerprint-based criminal 

background checks while waiting for the requirement to take 

effect ................................................................................................9

Eleven States reported not conducting required site visits ............12

Screening substitution is challenging for many States ..................12

Fourteen States reported that they would not finish revalidating 

existing high- and moderate-risk providers by the 

September 2016 deadline...............................................................15

Conclusion and Recommendations............................................................17

Agency Comments and Office of Inspector General Response.....20

Appendix....................................................................................................21

A: Detailed Methodology .............................................................21

B: Agency Comments...................................................................23

Acknowledgments......................................................................................26
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 1

OBJECTIVE

To determine the extent to which States have implemented risk-based 

screening activities for high- and moderate-risk providers.

BACKGROUND

Providers and suppliers, hereinafter referred to as “providers,” must enroll 

in Medicaid and periodically revalidate their enrollment to be eligible to 

bill Medicaid.1 The Centers for Medicare & Medicaid Services (CMS) has 

stated that “provider enrollment is the gateway” to Medicaid.2 If this 

gateway is not adequately safeguarded, Medicaid is at increased risk of 

enrolling ineligible providers or providers with intent to defraud the 

program. Effective enrollment screening is an important tool in 

preventing Medicaid fraud, waste, and abuse. Ensuring that States screen 

all providers in accordance with the new requirements is vital to protecting 

Medicaid, especially as it grows to serve more beneficiaries.

Beginning in 1997, the Office of Inspector General (OIG) has identified 

numerous vulnerabilities regarding provider enrollment and has made 

recommendations for improvement. In an effort to combat fraud, waste, 

and abuse resulting from vulnerabilities in the enrollment process, the 

Affordable Care Act (ACA) called for the establishment of risk-based 

provider enrollment screening procedures.3, 4 To this end, the ACA gave 

CMS the authority to enhance provider enrollment screening with a set of 

new enrollment tools.5

 

In contrast to past screening standards, which varied by State, the ACA 

requires States to more uniformly screen providers according to the risk 

for fraud, waste, and abuse that they pose to Medicaid.6 The ACA also 

requires risk-based screening for all providers in Medicare and the 

Children’s Health Insurance Program (CHIP).7 In the ACA, Congress 

mandated that States use risk-based screening for all providers seeking 

 ____________________________________________________________ 

1

 42 CFR § 455.410. 

2

 Shantanu Agrawal, M.D., Medicaid Program Integrity: Screening Out Errors, Fraud, 

and Abuse, Testimony before the United States House Committee on Energy and 

Commerce, Subcommittee on Oversight and Investigations, June 2, 2015. 

3

 The Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), as 

amended by the Health Care and Education Reconciliation Act of 2010, P.L. No. 111-152 

(March 30, 2010), is known as the Affordable Care Act. 

4

 ACA, § 6401. 

5

 ACA § 6401.

6

 ACA, § 6401(a)(3), (b)(1)(B). 

7

 ACA § 6401(a), (c). 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 2

enrollment as participating providers in Medicaid.8 However, the ACA 

granted CMS discretion to determine which screening activities, other than 

licensure checks, would be required and to establish screening 

procedures.9 CMS issued the risk-based screening requirements, effective 

March 25, 2011.10

Provider Screening

States must screen all providers using risk-based screening upon initial 

enrollment, re-enrollment, or revalidation of enrollment.11 “Enrolling” 

providers are those either newly enrolling or re-enrolling in Medicaid. 

“Revalidating” providers are those enrolled in Medicaid as of 

March 25, 2011. Initially, in 2011, CMS directed States to complete the 

revalidation of existing providers under the risk-based screening by March 

24, 2016.12

 Then, in January 2016, CMS issued additional subregulatory 

guidance that revised its earlier direction. At that time, CMS required

States to (1) notify all affected providers of the revalidation requirement 

by March 24, 2016 and (2) complete all revalidations by 

September 25, 2016.13 CMS also required States to revalidate all 

providers’ enrollment at least every 5 years from the date of initial 

enrollment.14 

Screening Activities by Risk Category 

States must screen providers according to the risk category to which providers 

are assigned. States must assign providers to one of three risk categories: 

high, moderate, or limited. 

The screening activities that States must use vary, depending on the risk 

category to which a provider is assigned. The screening activities become 

more extensive as the risk level increases. For example, States must conduct 

six screening activities for high-risk providers, while they need conduct only 

three screening activities for limited-risk providers. Newly enrolling providers 

and revalidating providers are subject to the same screening activities, 

 ____________________________________________________________ 

8

 ACA, § 6401(b). 

9

 ACA, § 6401(a)(3), (b)(1)(B). 

10 76 Fed. Reg. 5862 (February 2, 2011). 

11 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, December 23, 2011, p. 2. Accessed at http://www.medicaid.gov/FederalPolicy-Guidance/downloads/CIB-12-23-11.pdf on June 13, 2014. 

12 Ibid. 

13 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): Revalidation 

(2016-001). Accessed at 

https://www.medicaid.gov/affordablecareact/provisions/downloads/revalidation-2016-

001.pdf on January 20, 2016. 

14 42 CFR § 455.414. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 3

depending on their risk category. See Table 1 for the screening activities 

required by risk category. 

Table 1: Screening Activities Required by Risk Category

Screening Activities High Moderate Limited

Verification of any provider/supplier-specific requirements established by 

Medicaid/CHIP X X X

Verification of licenses (may include licensure checks across State lines) X X X

Database checks (to verify: SSN, NPI, the NPDB, licensure, HHS OIG 

exclusion, taxpayer identification, tax delinquency, death of individual 

practitioner, and persons with an ownership or control interest or who are 

agents or managing employees of the provider)*

X X X

Site visits X X

Criminal background checks X

Fingerprinting X

Source: OIG analysis of 76 FR, p. 5896 and CMS guidance.

*SSN = Social Security Number, NPI = National Provider Identifier, NPDB = National Practitioner Data Bank, HHS OIG = 

U.S. Department of Health and Human Services, Office of Inspector General.

Initially, CMS did not require States to conduct the criminal background 

checks or fingerprinting (hereinafter referred to as fingerprint-based criminal 

background checks) for high-risk providers.15 In its Final Rule and its initial 

December 2011 guidance, CMS instructed States that fingerprint-based 

criminal background checks for high-risk providers were not required until 

CMS issued additional guidance.16 However, CMS indicated that States had 

discretion to implement fingerprint-based criminal background checks in the 

absence of guidance.17 Similarly, CMS did not require fingerprint-based 

criminal background checks for Medicare providers until August 2014, after it 

finalized an agreement with a contractor to conduct these checks for 

Medicare.18

 ____________________________________________________________ 

15 In general usage among CMS and States, criminal background checks and 

fingerprinting are commonly referred to as “fingerprint-based criminal background 

checks.” CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002). Accessed 

at http://www.medicaid.gov/federal-policy-guidance/downloads/SMD060115.pdf on 

June 4, 2015. 

16 76 Fed. Reg. 5862, 5902; CMS, CMCS Informational Bulletin: Medicaid/CHIP 

Provider Screening and Enrollment, p. 9. In the CMCS Informational Bulletin, CMS did 

not indicate when it planned to issue the additional guidance. 

17 76 Fed. Reg. 5862, 5902. 

18 CMS, The Basics of Internet-based Provider Enrollment Chain and Ownership System 

(PECOS) for Physicians and Non-Physician Practitioners. Accessed at 

https://www.cms.gov/Outreach-and-Education/Medicare-Learning-NetworkMLN/MLNMattersArticles/downloads/SE1417.pdf on November 20, 2015. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 4

CMS issued the additional guidance requiring fingerprint-based criminal 

background checks in a letter to State Medicaid Directors on June 1, 2015.19

 

This guidance offered States some insight into how to conduct these checks 

and what to do with the results of these checks. For instance, CMS 

recommended that States conduct a Federal Bureau of Investigation (FBI) 

criminal history check and follow some elements of Medicare’s process for 

fingerprint-based criminal background checks. CMS also suggested that States 

may leverage any existing protocols for obtaining fingerprint-based criminal 

background checks (such as in hiring employees or under CMS’s National 

Background Check Program for Long-Term Care Facilities and Providers).20, 21 

However, CMS did not require these activities and indicates that each State 

may decide the type and extent of its checks. CMS also left to States’ 

discretion the form and manner for fingerprint submission. CMS also provided 

some instruction as to when States must terminate or deny enrollment, 

including if a provider fails to submit fingerprints within 30 days of request, 

fails to submit them in the form and manner requested by the State, or has a 

conviction related to his or her involvement with Medicare, Medicaid, or CHIP 

in the last 10 years. 

Then, in January 2016, CMS issued further guidance providing States with 

two methods for complying with the fingerprint-based criminal background 

check requirement.22 

Risk Category Assignments 

States are required to assign a provider to a risk category according to the 

types of health services the provider offers. State assignment of provider 

 ____________________________________________________________ 

19 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002). 

20 CMS’s National Background Check Program for Long-Term Care Facilities and 

Providers is a voluntary program. See ACA § 6201. A 2016 OIG report of this program 

found that 13 of 25 States participating at the time of our review had not obtained 

legislation that would enable them to conduct background checks and that 10 of 25 States 

did not yet have the ability to collect fingerprints. See OIG, National Background Check 

Program for Long-Term-Care Employees: Interim Report, OEI-07-10-00420, 

January 2016.

21 In a 2015 OIG report on background checks for home health employees, we 

recommended that CMS promote minimum standards for background checks by 

encouraging State participation in the National Background Check Program for 

Long-Term Care Facilities and Providers. See OIG, Home Health Agencies Conducted 

Background Checks of Varying Types, OEI-07-14-00130, May 2015. 

22 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): 

Fingerprint-based criminal background checks (FCBC) (2016-002). Accessed at 

https://www.medicaid.gov/affordablecareact/provisions/downloads/fcbc-2016-002.pdf on 

January 20, 2016. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 5

types to the various risk categories also depends on whether the provider 

type is recognized by both Medicare and Medicaid or by Medicaid only.23

Medicare-recognized provider types. When Medicare recognizes a 

provider type, CMS requires States to use the risk category Medicare 

assigns.24, 25 The Medicare-recognized provider types and their assigned 

risk categories are:

 High risk: newly enrolling home health agencies (HHAs) and 

newly enrolling durable medical equipment, prosthetics, orthotics, 

and supplies (DMEPOS) providers; 

 Moderate risk: ambulance service suppliers, community mental 

health centers, comprehensive outpatient rehabilitation facilities, 

hospice organizations, independent diagnostic testing facilities, 

independent clinical laboratories, physical therapists enrolling as 

individuals or group practices, portable x-ray suppliers, 

revalidating HHAs, and revalidating DMEPOS providers;

 Limited risk: all other Medicare provider types.26

Medicaid-only provider types. When only Medicaid recognizes a provider 

type (e.g., personal care attendants), States must assess the provider type’s 

risk for fraud, waste, and abuse and assign the appropriate risk category. 

In making these decisions, States must use criteria similar to those used to 

determine risk categories for the Medicare-recognized provider types.27 

Screening Substitution

CMS gives States the option of using the results of screening activities 

conducted by Medicare and other States’ Medicaid or CHIP agencies as 

substitutes for conducting their own screening.28 According to CMS, such 

substitutions could save States time and money. Previously, in its 

December 2011 bulletin, CMS indicated that States could substitute 

 ____________________________________________________________ 

23 In States that administer CHIP separately from Medicaid, the regulations indicate that 

all screening provisions that apply to Medicaid apply to CHIP. See 76 Fed. Reg. 5862, 

5895 (February 2, 2011). 

24 76 Fed. Reg. 5862, 5895 (February 2, 2011). 

25 States may establish provider screening methods in addition to, or more stringent than, 

those required by 42 CFR 455, subpart E. See CMS, CMCS Informational Bulletin: 

Medicaid/CHIP Provider Screening and Enrollment, p. 2. 

26 42 CFR § 424.518. 

27 76 Fed. Reg. 5862, 5895 (February 2, 2011). 

28 42 CFR § 455.410. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 6

screening results only if Medicare or another State’s Medicaid or CHIP 

agency has completed all applicable screening activities.29

In its June 2015 letter to State Medicaid Directors and subsequent 

November 2015 subregulatory guidance, CMS modified its original 

instruction about what States can use to substitute a screening to avoid 

unnecessary cost and burden on States. 30, 31 CMS indicated that States 

may rely on the results of Medicare’s provider screening for approved 

providers without verifying each screening activity. States may rely on 

Medicare’s screening up to and including a particular risk category, 

regardless of whether the Medicare record indicates that a particular 

screening activity was completed. This could mean that States do not 

have to conduct a fingerprint-based criminal background check if a 

provider is enrolled in Medicare, even if Medicare has not conducted such 

a check for that provider. 

States obtain external screening information in different ways, depending 

on the entity that completed the screening. To obtain the results of 

screening activities conducted by Medicare, States may access screening 

information contained in the Medicare Provider Enrollment, Chain, and 

Ownership System (PECOS).32 PECOS stores CMS’s Medicare provider 

screening results. States can access PECOS information either through a 

Web-based portal or, as of October 2013, through an extract file that 

contains basic Medicare enrollment information. To obtain results of 

screening activities conducted by other States’ Medicaid or CHIP 

agencies, States must contact other States individually. No national 

database exists to facilitate the sharing of Medicaid or CHIP screening 

results among States.

Related Reports 

This evaluation builds on a body of OIG work related to provider 

enrollment in both Medicaid and Medicare that dates to 1997. Most 

recently, OIG reviewed the implementation of ACA’s risk-based screening 

 ____________________________________________________________ 

29 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, p. 9. 

30 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002), Q&A 11. 

31 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): Instructions for 

relying on provider screening conducted by Medicare (42 CFR 455.410) or conducting 

additional screening when required. Accessed at 

http://www.medicaid.gov/affordablecareact/provisions/sub-reg-guidance.html on 

December 3, 2015. 

32 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, p. 3. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 7

in Medicare and found vulnerabilities in the screening process.33 We 

discuss the implications of these vulnerabilities for Medicaid’s screening 

process in our findings. 

In addition, an April 2016 Government Accountability Office (GAO) 

report examined the screening of Medicaid managed care providers.34 

GAO reviewed 10 States and 16 plans from those States. It found that 

States and Medicaid managed care plans faced significant challenges in 

screening managed care providers.

METHODOLOGY

This review evaluated the status of States’ progress with enhanced 

provider screening as of August 31, 2014. See Appendix A for a detailed 

methodology.

Scope 

This inspection was national in scope and focused on Medicaid’s ACA 

risk-based screening. We included all 50 States and the District of 

Columbia in this review (hereinafter referred to as States). 

We limited our review to high- and moderate-risk providers because they 

pose the most risk to Medicaid. In previous reports, OIG and GAO have 

raised concerns about many of the high- and moderate-risk provider types. 

Data Collection and Analysis 

Data Collection Instrument. We sent a data collection instrument to all 

51 States in October 2014. We followed up with States twice by phone 

and twice by email. We obtained responses from 48 States. We counted 

as nonrespondents the three States that, despite our followup efforts, did 

not submit survey results.

The instrument had two sections—a survey and a data request. 

Survey. The survey focused on States’ progress in implementing 

the ACA screening requirements. We conducted most of our 

analysis on multiple-choice questions with response rates of 48. 

We counted the number of States per response item. A few 

questions had responses ranging from 43 to 47. Where appropriate 

in the text, we indicated when the number of States responding was 

fewer than 48. We also analyzed responses to open-ended 

questions primarily designed to develop themes concerning 

 ____________________________________________________________ 

33 OIG, Enhanced Enrollment Screening of Medicare Providers: Early Implementation 

Results, OEI-03-13-00050, April 2016. 

34 GAO, Medicaid Program Integrity: Improved Guidance Needed to Better Support 

Efforts to Screen Managed Care Providers, GAO-16-402, April 2016. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 8

challenges States face with the risk-based screening activities. 

Forty-five of the 48 States responded to the question about 

challenges they face. 

Data Request. We asked States for data on the number of 

high- and moderate-risk providers applying to enroll after 

March 25, 2011, and the number of high- and moderate-risk 

providers enrolled prior to March 25, 2011. We also asked States 

for data on the number of providers that were subject to all 

screening activities and the number of providers approved to enroll 

in Medicaid. Only 27 of the 48 responding States provided data 

sufficient for use in our analysis. Our work further summed across 

States the number of providers approved to enroll in Medicaid. 

Limitations 

Our analysis relied on self-reported data, which we did not independently 

verify. However, as part of our data collection, we asked States to identify 

their limitations and concerns with self-reported data. 

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 9

FINDINGS

CMS issued the risk-based screening requirements in February 2011 with 

all but the fingerprint-based criminal background check requirement 

effective March 25, 2011.35 CMS issued initial guidance related to these 

requirements in December 2011.36 In both the Final Rule and initial 

guidance, CMS did not require States to conduct fingerprint-based 

criminal background checks until it issued additional guidance.37 

According to CMS, these checks pose unique operational and privacy 

concerns.38 CMS issued this additional guidance in June 2015, more than 

4 years after the effective date of the other screening requirements.39 It 

issued further guidance in January 2016.40 

Most States reported not having fingerprint-based 

criminal background checks while waiting for the 

requirement to take effect 

At the time of our review in August 2014, CMS did not require States to 

implement fingerprint-based criminal background checks. In total, 37 of 

47 responding States reported that they had not implemented

fingerprint-based criminal background checks for new and existing 

providers. This means that these States did not screen high-risk providers 

using fingerprint-based criminal background checks.

The delays in requiring fingerprint-based criminal background checks 

potentially exposed Medicaid to increased risks related to fraud, waste, 

and abuse. Of the 37 States without fingerprint-based criminal 

background checks in place, 27 reported allowing approximately 

25,000 high-risk providers to enroll in Medicaid without completing 

fingerprint-based criminal background checks between March 2011 and 

August 2014. Of these 25,000 high-risk providers, nearly two-thirds were 

newly enrolling providers not known to State Medicaid agencies. The 

remaining 10 States could not provide information on the number of 

 ____________________________________________________________ 

35 76 Fed. Reg. 5862 (February 2, 2011). 

36 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment. 

37 76 Fed. Reg. 5862, 5902; CMS, CMCS Informational Bulletin: Medicaid/CHIP 

Provider Screening and Enrollment, p. 9. 

38 76 Fed. Reg. 5871. 

39 CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 15-002). 

40 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): 

Fingerprint-based criminal background checks (FCBC) (2016-002). Accessed at 

https://www.medicaid.gov/affordablecareact/provisions/downloads/fcbc-2016-002.pdf on 

January 20, 2016. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 10

high-risk providers enrolled or revalidated since the other risk-based 

screening activities went into effect. 

States faced challenges with fingerprint-based criminal 

background checks, including the need for guidance 

States faced challenges implementing fingerprint-based criminal checks. 

Most States reported the need for guidance, in general, and some States 

specifically noted as a challenge the need for guidance to implement this 

screening activity. States may also face additional challenges to timely 

implementation. 

Need for CMS guidance. At the time of our review, most States without 

this screening activity in place reported that they needed guidance. 

Specifically, 29 of the 37 States without fingerprint-based criminal 

background checks reported needing guidance to resolve challenges with 

the ACA screening activities. Although most States did not specify the 

subject of the guidance needed, three States specifically offered that they 

did not implement fingerprint-based criminal background checks while 

waiting for guidance from CMS on this screening activity. One of the 

three States reported that it was uncertain how to comply with the 

fingerprinting and criminal background checks. The second State reported 

that it did not implement “so as to avoid incorrect implementation.” The 

third State indicated that waiting for CMS to issue guidance was a 

“barrier” to implementation. 

Challenges to timely implementation. States may struggle to conduct 

fingerprint-based criminal background checks because of limited 

experience with these checks and the effort that this screening activity 

entails. 

Implementing these checks requires States to collect and transmit 

fingerprints to the FBI or State law enforcement for processing in a secure 

manner. Overall, 34 of the 37 States without fingerprint-based criminal 

background checks indicated that they did not have experience conducting 

these checks for Medicaid enrollment. 

In addition, the effort entailed in fingerprint-based criminal background 

checks may make implementation difficult. Because most States have not 

implemented these checks, we cannot determine how widespread 

implementation problems may be. However, five States identified specific 

challenges that other States may also face as they move forward. These 

include operational concerns—such as not having authority from their 

State to review results of fingerprint-based criminal background checks—

and logistical concerns about integrating this check into their enrollment 

systems. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 11

CMS no longer requires full implementation by June 2016

CMS issued guidance in June 2015 and January 2016 about 

fingerprint-based criminal background check implementation. Although 

CMS initially instructed States to comply with completing these checks, it 

later offered States an alternative path to compliance. This alternative 

path could mean that full implementation of these checks by States will 

not occur until after 2016. According to CMS, implementation means that 

the State has conducted a fingerprint-based criminal background check 

with respect to each provider designated as high risk, including those 

newly enrolling in Medicaid, those seeking re-enrollment in Medicaid, and 

those enrolled at the time of revalidation.41

June 2015 guidance. CMS did not provide States with guidance on 

fingerprint-based criminal background checks for more than 4 years. In 

June 2015, subsequent to our review, CMS provided its first guidance in a 

State Medicaid Director Letter.42

 CMS instructed States that, from the 

date of the letter, they had (1) 60 days to begin implementing 

fingerprint-based criminal background checks and (2) 1 year to complete 

implementation of fingerprint-based criminal background checks. 

January 2016 guidance. In January 2016, CMS issued additional 

guidance acknowledging the challenges that States may face but no longer 

requiring full implementation by June 2016. CMS acknowledged its June 

2015 recommendation that States conduct FBI criminal history checks and 

stated that it continues to work with the FBI to facilitate State access to the 

infrastructure necessary to conduct such checks. Because of this 

continued work, CMS offered an alternate path to compliance and asked 

States when they anticipated fully implementing fingerprint-based 

criminal background checks. 

This guidance provides States with two ways to comply with the 

fingerprint-based criminal background check requirement by June 1, 2016: 

(1) implement fingerprint-based criminal background checks as initially 

required in the June 2015 State Medicaid Director letter or (2) have a 

fingerprint-based criminal background check compliance plan approved 

by CMS by June 1, 2016.43 

States submitting compliance plans had to do so by April 15, 2016. As 

part of a compliance plan, CMS asked States to describe the barriers they 

face to full implementation. Submitting a compliance plan does not equal 

 ____________________________________________________________ 

41 CMS, State Medicaid Director Letter, June 1, 2015 (SMD# 15-002). 

42 Ibid. 

43 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): 

Fingerprint-based criminal background checks (FCBC) (2016-002). 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 12

compliance; only receipt of a CMS approval letter on or before 

June 1, 2016, will do so.

However, having an approved compliance plan does not ensure timely 

implementation, as CMS did not require a deadline for States. Instead, 

CMS asked States to indicate when they anticipate fully implementing the 

fingerprint-based criminal background check requirement. 

Eleven States reported not conducting required site 

visits 

Although most of the States indicated that they have implemented required 

site visits, 11 of 47 responding States reported, at the time of our review, 

that they did not have this screening activity in place for high- and 

moderate-risk providers. Six of these States indicated that the primary 

reason for not implementing site visits was insufficient resources,

including too few staff and financial constraints. Further, one State noted 

that its large geographical size made site visits difficult to implement 

because staff would have to travel hundreds of miles to visit a provider in 

a small town. The remaining five States did not offer reasons why they 

did not have required site visits in place. 

Between March 2011 and August 2014, 6 of these 11 States reported 

allowing approximately 21,000 high- and moderate-risk providers to 

enroll in Medicaid without site visits. The remaining five States could not 

provide the number of high- and moderate-risk providers enrolled or 

revalidated since risk-based screening went into effect. See Table 2 for a 

breakdown of the number of high- and moderate-risk providers allowed to 

enroll in Medicaid without site visits.

Table 2: High- and moderate-risk providers allowed to enroll in Medicaid without site 

visits 

Number of States High-risk providers Moderate-risk providers Total

Newly enrolled providers 5 5,896 9,505 15,401

Revalidated providers 3 600 4,946 5,546

Source: OIG analysis of State survey responses, 2014.

Screening substitution is challenging for many States

Although CMS allows (but does not require) States to substitute screening 

results from Medicare and other State Medicaid agencies in place of 

conducting their own, many States do not do so.44 In fact, 18 States 

reported that they do not substitute screening results from Medicare, and 

 ____________________________________________________________ 

44 42 CFR § 455.410(c). 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 13

an additional 13 States reported that they substitute few screening results 

from Medicare. Although the remaining 17 States reported that they 

substitute screening results from Medicare, most could not report the 

extent to which they did so. Similarly, 30 States reported that they do not 

substitute screening results from other State Medicaid agencies. An 

additional seven States reported that they substitute few screening results 

from other State Medicaid agencies. The remaining 11 States reported 

substituting screening results, yet 10 of these States could not determine 

the extent to which they did so. 

States could benefit by using substituted screening results, but challenges 

associated with substitution exist. Use of substituted screening results 

could help States reduce the costs and burden associated with screening 

activities, especially as they work to meet the demands of screening all 

new and existing providers according to the ACA requirements. However, 

operational challenges, coupled with issues regarding the quality of 

Medicare and other State screening data, hinder States’ ability to benefit 

from this option. 

States face challenges substituting screening results from 

Medicare 

States reported challenges to obtaining data from PECOS, the CMS data 

system that stores Medicare’s provider screening results. Specifically, 

11 of 45 States reported such challenges. The challenges included

difficulty accessing PECOS, such as password problems, and/or difficulty 

navigating the system. Moreover, PECOS does not allow States to run an 

automated match of their providers against the system. Instead, States 

have to enter individual provider information into PECOS to retrieve 

screening results for that provider, which can be time intensive. 

Even if States overcome the challenges to obtaining PECOS data, using 

Medicare screening results or enrollment data may open the door to other 

vulnerabilities for Medicaid and the States because Medicare screening 

data may not be complete or thorough. 

States may not benefit from substituting Medicare screening results 

because PECOS may contain incomplete information. An April 2016 OIG 

report on the implementation of Medicare enhanced provider screening 

found that PECOS did not contain all the information needed for effective 

oversight.45 PECOS was missing risk category designations in 10 percent 

 ____________________________________________________________ 

45 OIG, Enhanced Enrollment Screening of Medicare Providers: Early Implementation 

Results. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 14

of cases and application submission reasons (e.g., new enrollment or 

change of information) in 12 percent of cases. 

Further, GAO and OIG have raised concerns about the thoroughness of 

Medicare’s screening process. In a June 2015 report, GAO identified 

weaknesses in CMS’s procedure for verifying a provider’s practice 

location and licensure status.46 The April 2016 OIG report on Medicare 

enhanced provider screening raised similar concerns, finding that 

Medicare contractors did not verify key provider information, such as 

identification numbers and criminal convictions, during the enrollment 

process.47 OIG also found that Medicare contractors were inconsistent in 

applying site visit procedures and using site visit results for enrollment 

decisions.

CMS’s decision to allow States to substitute incomplete Medicare 

screening results may leave States vulnerable to fraud, waste, or abuse. 

CMS guidance indicates that States can skip a fingerprint-based criminal 

background check if a provider is enrolled in Medicare, even if Medicare 

has not conducted such a check for that provider.48 Although this direction 

applies only to newly enrolling HHAs and DMEPOS providers, OIG and 

GAO have identified these provider types as problematic. As a result, if 

Medicare has not conducted fingerprint-based criminal background checks 

for these providers and States use proof of Medicare enrollment as a 

substitute for their own screening, States are vulnerable to fraud, waste, 

and abuse because these providers have not undergone a fingerprint-based 

criminal background check and may have no history with the State 

Medicaid agency.

Similarly, States face challenges substituting screening 

results from other States 

States may not be able to substitute screening results from other States 

because of difficulties obtaining the results of other States’ screening 

activities. Specifically, 9 of 45 States reported challenges obtaining 

screening results. Generally, these States reported that the lack of a single 

database for recording the results of screening activities means that States 

 ____________________________________________________________ 

46 GAO, Medicare Program: Additional Actions Needed to Improve Eligibility 

Verification of Providers and Suppliers, GAO-15-448, June 2015. 

47 OIG, Enhanced Enrollment Screening of Medicare Providers: Early Implementation 

Results. 

48 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): Instructions for 

relying on provider screening conducted by Medicare (42 CFR 455.410) or conducting 

additional screening when required. Accessed at 

http://www.medicaid.gov/affordablecareact/provisions/sub-reg-guidance.html on 

December 3, 2015. See also CMS, State Medicaid Director Letter, June 1, 2015, (SMD# 

15-002), Q&A 11. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 15

must contact each other on a case-by-case basis. This requires significant 

resources and time. States reported that State-to-State substitution is 

further complicated because there is no consistent or easy means of 

State-to-State communication regarding substitution. 

Even if States could readily obtain other States’ screening data, those 

results may not meet a particular State’s standards because screening 

practices may not be complete and are not consistent across States. 

Similar to concerns about Medicare substitution, States may not be able to 

benefit from substituting other States’ Medicaid or CHIP screening results 

because they may be incomplete. If a State is not conducting one or more 

of the required screening activities, such as site visits or fingerprint-based 

criminal background checks, others may not want to substitute the 

screening results. Two States reported that they do not substitute 

screening data from other States because they have found that States are at 

various stages of compliance with risk-based screening.

In addition, States may be reluctant to use each other’s screening results 

because each State creates its own standards for screening providers, 

particularly for fingerprint-based criminal background checks and site 

visits. CMS allows States discretion on the type and extent of their 

criminal background checks.49 While CMS recommends that States adopt 

elements of Medicare’s screening process and conduct an FBI criminal 

history check, which provides national information, it does not require 

them to do so. CMS allows similar discretion for site visits, stating that 

States have the flexibility to determine the activities that constitute a site 

visit.50 This means that States can create their own standards for 

conducting these screening activities. States that have stricter standards 

may be unwilling to use results from another State with less strict 

standards. In fact, two States cited this variation as a concern. 

Fourteen States reported that they would not finish 

revalidating existing high- and moderate-risk 

providers by the September 2016 deadline

Although 34 States reported that they would finish revalidating all 

providers, 14 indicated they would not finish by the September 2016 

 ____________________________________________________________ 

49 76 Fed. Reg. 5862, 5902-03. 

50 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, p. 10. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 16

deadline.51 These States expected to complete their revalidation screening 

between later in 2016 and 2019.52

Some of the States reporting that they would not meet the revalidation 

deadline provided various reasons for this. For example, six States 

attributed the delay to their data management systems. These States 

variously indicated that they were updating their systems, that their 

systems needed to be updated, or that they had a paper-based, manual 

process. Four States cited resource issues, such as the number of 

providers to be revalidated, or having to hire more staff. Lastly, two States 

mentioned the delay in CMS guidance. One discussed the 10-month delay 

in initial guidance after the regulations became effective. The other cited 

the delayed guidance for fingerprint-based criminal background checks for 

high-risk providers. 

The remaining 34 States reported that they were on schedule to meet the 

deadline. However, 26 of these States reported, at the time of our review, 

not having fingerprint-based criminal background checks, and 9 reported 

not conducting site visits. Thus, although these States reported that they 

were on schedule, our findings suggest that their revalidation screening 

may not include all required screening activities.53 

 ____________________________________________________________ 

51 Initially, CMS directed States to complete risk-based screening for revalidating 

providers by March 24, 2016. However, CMS changed this date to September 25, 2016. 

See CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): Revalidation 

(2016-001). 

52 One of the States expecting to be finished in 2019 reported that it had an approved 

alternate compliance date with CMS. 

53 According to CMS, the screening requirements for revalidating existing high- and 

moderate-risk providers are the same as for new providers. To meet the deadline for 

screening existing high- and moderate-risk providers, States would need to complete all 

required screening activities, including site visits and the now-required fingerprint-based 

criminal background checks. See CMS, CMCS Informational Bulletin: Medicaid/CHIP 

Provider Screening and Enrollment, p. 12. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 17

CONCLUSION AND RECOMMENDATIONS

OIG’s past work found vulnerabilities in the Medicaid provider enrollment 

process. To reduce enrollment vulnerabilities, the ACA required that 

States screen providers according to their risk for fraud, waste, and abuse 

to Medicaid. Implementing the ACA screening activities is critical to 

safeguarding Medicaid as it grows to serve more beneficiaries. 

However, our findings indicate that State implementation of ACA 

screening activities is incomplete for high- and moderate-risk providers. 

Notably, CMS did not require fingerprint-based criminal background 

checks for high-risk providers for more than 4 years. States with 

incomplete screening activities enrolled thousands of providers 

categorized as posing a high- or moderate-risk to Medicaid. The option to 

substitute screening results from Medicare or other States could help 

States to meet the demands of screening all new and existing providers 

according to the ACA requirements. However, States reported challenges 

associated with substituting screening results from both Medicare and 

other States. Further, substituting screening results, especially incomplete 

or inconsistent screening results, from Medicare or other States may leave 

States open to fraud, waste, and abuse by risky providers. 

Not implementing the required enhanced provider screening activities 

poses risks to Medicaid and its beneficiaries that the ACA intended to 

prevent. Regardless of the challenges that prevented States from 

implementing enhanced provider screening and CMS’s decision not to 

enforce fingerprint-based criminal background checks, not implementing 

the screening activities leaves Medicaid vulnerable to providers who may 

be ineligible or intent on defrauding the program and harming patients in 

the process. Preventing fraudulent and abusive providers from enrolling 

in Medicaid is critical to ensuring the integrity of the program, especially 

as it grows to serve more beneficiaries. Therefore, to strengthen 

Medicaid’s provider enrollment screening process, we recommend that 

CMS:

Assist States in implementing fingerprint-based criminal 

background checks for all high-risk providers 

CMS should assist States in implementing fingerprint-based criminal 

background checks within a reasonable timeframe. CMS’s assistance 

could include technical support to States or dissemination of best practices 

from States that are further along in the process. CMS should also 

consider the feasibility of making Medicare’s fingerprint-based criminal 

background checks contractor available to States for these checks.
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 18

Assist States in overcoming challenges in conducting site 

visits

CMS should ensure that all States implement required site visits. CMS 

should work with the 11 States that have not implemented site visits to

address the challenges that those States identified. CMS could provide 

technical assistance or share practices from other States that overcame 

similar challenges. 

Separately, we referred to CMS for appropriate followup information for 

the 11 States that indicated that they did not have the required site visits in 

place. CMS should consider the number of high- and moderate-risk 

providers enrolled in each State when prioritizing its followup. 

Enable States to substitute Medicare screening data by 

ensuring the accessibility and quality of Medicare data 

States could save time and money by substituting Medicare screening 

results or enrollment for their own. However, many States reported that 

they did not take advantage of this option because of difficulties accessing 

and using Medicare data and concerns about the completeness and 

accuracy of that data. CMS should resolve these concerns and could do so 

in various ways. For instance, CMS could enhance PECOS, its national 

data repository for Medicare provider enrollment information, to resolve 

States’ password problems and inability to obtain enrollment-screening 

results for multiple providers in a timely way. To ensure that PECOS data 

are complete and accurate, CMS should improve the completeness and 

accuracy of the Medicare enhanced provider screening, including ensuring 

implementation of complete fingerprint-based criminal background checks 

for high-risk providers, to protect Medicare and Medicaid. 

Develop a central system where States can submit and access 

screening results from other States

CMS should develop a central system that allows States to submit and 

access provider enrollment screening results from other States to make it 

easier for States to substitute screening results from other States. Such a 

system should also allow States to search for multiple providers at once. 

As the Federal partner for all States, CMS is uniquely positioned to 

provide and oversee a central system to which all States can contribute 

their screening results. Toward that end, CMS could work with States to 

develop core, consistent submission requirements so States have common 

data elements across screening results. CMS could consider incorporating 

State information into PECOS. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 19

Strengthen minimum standards for fingerprint-based criminal 

background checks and site visits

CMS’s existing minimum standards for fingerprint-based criminal 

background checks and site visits could produce variations across States 

such that States do not want to substitute each other’s screening results. 

While States can determine the type and extent of their criminal 

background checks and the activities that constitute their site visits, CMS 

could facilitate substitutions by working with States to strengthen 

minimum standards for these checks. Doing so could alleviate States’ 

concerns about variation in screening standards. For fingerprint-based 

criminal background checks, CMS could consider requiring States to 

conduct national background checks. CMS could consider requiring a 

shared standard for site visits conducted by both Medicare and States that 

promotes consistency. 

Work with States to develop a plan to complete their 

revalidation screening in a timely way 

CMS should ensure that all States complete the necessary revalidation 

screening. CMS should work with the 14 States that reported they would 

not meet the September 2016 deadline and help them to develop plans to 

complete their revalidation screening. CMS should add to the list of 

14 States any State that it identifies as unable to meet the deadline. 

Separately, we referred to CMS for appropriate followup the 14 States that 

indicated they would not complete their revalidation screening by the 

September 2016 deadline. Again, CMS could consider the number of 

high- and moderate-risk providers enrolled in each State when prioritizing 

its followup.
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 20

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE

CMS concurred with all six of our recommendations. In its comments, 

CMS highlighted its most recent efforts to improve the Medicaid enhanced 

provider screening process. For example, CMS indicated that it has 

worked with the FBI to issue guidance in January 2016 to help States 

implement fingerprint-based criminal background checks.54 CMS also 

indicated that, in March 2016, it published the Medicaid Provider 

Enrollment Compendium, a consolidated resource for guidance on 

Medicaid enhanced provider screenings.55 With regard to screening 

substitution from Medicare, CMS indicated that it has provided States 

with direct access to Medicare’s enrollment database, PECOS, as well as 

monthly PECOS data extracts that States can systematically compare to 

their enrollment records. Finally, with regard to States’ revalidation 

efforts, CMS indicated that it has taken several steps to help States fulfill 

the requirement to revalidate Medicaid providers, including the 

assignment of CMS staff to work with States. 

We look forward to receiving updates on CMS’s progress but have 

concerns. We look forward to efforts by CMS to strengthen minimum 

standards for fingerprint-based criminal background checks and site visits 

and its efforts to assist States in sharing screening results with one another. 

However, we have concerns that CMS’s January 2016 guidance on 

fingerprint-based criminal background checks could mean full 

implementation of these checks will not occur until after 2016. CMS has 

asked States submitting a compliance plan to indicate when they 

anticipated full implementation. Further, we have concerns about CMS’s 

response to our recommendation on States’ substituting screening results 

from Medicare. We encourage CMS to think broadly about this 

recommendation and to consider what steps are necessary to ensure that 

States have access to complete and accurate Medicare provider enrollment 

screening data. Implementing our related recommendations in OIG’s 

report on Medicare enhanced provider screenings (OEI-03-13-00050) may 

assist States in substituting screening results from Medicare. 

For the full text of CMS’s comments, see Appendix B.

 ____________________________________________________________

54 CMS, Sub Regulatory Guidance for State Medicaid Agencies (SMA): 

Fingerprint-based criminal background checks (FCBC) (2016-002). 

55 CMS, Medicaid Provider Enrollment Compendium, March 21 2016. Accessed at 

https://www.medicaid.gov/affordablecareact/provisions/downloads/mpec-032116.pdf on 

May 12, 2016. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 21

APPENDIX A

Detailed Methodology

Data Collection and Analysis

Data Collection Instrument. Forty-eight of 51 States responded to the data 

collection instrument. Arkansas, Florida, and Rhode Island did not 

respond.

The instrument had two sections—a survey and a data request. 

Survey. The survey had two types of questions, multiple-choice 

questions that required States to select from a set of responses and 

open-ended questions that allowed States to comment and provide 

additional information. 

In general, the multiple-choice questions asked how States conduct 

their screening activities, whether States substitute screening 

results from other sources, and what the status of States’ 

revalidation screening was. All 48 States responded to nearly all 

of the multiple-choice questions. For two questions, 43 and 47 

States responded, respectively. Where appropriate in the text, we 

indicate when the number of States responding was fewer than 48. 

The open-ended questions generally asked some States to elaborate 

on their responses to the multiple-choice questions, depending on 

their answers, and about any challenges States faced in 

implementing the ACA screening activities. For questions that 

asked States to elaborate on a response to a multiple-choice 

question, in all but one case, all of the States that had an 

opportunity to respond to the question did so. For the remaining 

question, only one State did not respond. 

Data Request. We requested data on States’ high- and 

moderate-risk providers. We relied on States’ determination of risk 

for their providers. 

We did not receive all of the requested data from all of the 

48 responding States. Eight States did not provide any of the 

requested data. The remaining 40 States provided some or all of 

the requested data. However, only 27 States provided sufficient 

data for our analysis. To determine which States’ data we could 

use in our analysis, we reviewed each States’ data for internal 

consistency and verified that each State provided the specific data 

fields we planned to use.

Our analysis summed across States the number of providers that 

they approved to enroll in Medicaid. One State indicated that it 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 22

could not distinguish between newly enrolling providers and 

revalidating providers. In our analysis, we included this State in 

our count of revalidating providers because we deemed that 

category as less risky to Medicaid because revalidating providers 

already had been screened under States’ previous enrollment 

standards. This State accounted for approximately 

3,000 providers, which means that we could be undercounting the 

newly enrolling providers by up to 3,000 and overcounting the 

revalidating providers by up to 3,000. 

CMS Documentation. We also reviewed CMS documents related to the 

ACA screening requirements, including subregulatory guidance, an 

informational bulletin, and a State Medicaid Director Letter. 
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 23

APPENDIX B

Agency Comments
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 24
 

Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 25
Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-13-00520) 26

ACKNOWLEDGMENTS

This report was prepared under the direction of Thomas F. Komaniecki, 

Regional Inspector General for Evaluation and Inspections in the Chicago

regional office, and Laura T. Kordish, Deputy Regional Inspector General. 

Nicole Hrycyk served as team leader for this study, and Jonathan Jones

served as lead analyst. Other Office of Evaluation and Inspections staff 

from the Chicago regional office who conducted the study include Jane 

Ahn. Central office staff who provided support include Kevin Farber, 

Joanne Legomsky, and Kevin Manley.
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of individuals served by those programs. 

This statutory mission is carried out through a nationwide network of audits, investigations, 

and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and individuals. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.