Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

MEDICAID: 

VULNERABILITIES RELATED 

TO PROVIDER ENROLLMENT 

AND OWNERSHIP 

DISCLOSURE

Suzanne Murrin 

Deputy Inspector General for

Evaluation and Inspections

May 2016

OEI-04-11-00590
 

EXECUTIVE SUMMARY – MEDICAID: VULNERABILITIES RELATED TO PROVIDER 

ENROLLMENT AND OWNERSHIP DISCLOSURE

OEI-04-11-00590

WHY WE DID THIS STUDY 

States can prevent inappropriate payments, protect beneficiaries, and reduce time-consuming and expensive 

“pay and chase” activities by ensuring that providers that intend to engage in fraudulent or abusive activities are 

not allowed to enroll in Medicaid. For States to identify potentially fraudulent providers, as well as those that 

may be associated with excluded individuals or entities, providers must disclose accurate and timely

information about their owners (i.e., individuals or corporations with a 5-percent or more ownership or 

controlling interest; agents; or managing employees). According to the Centers for Medicare & Medicaid 

Services (CMS), the highest incidence of regulatory noncompliance among State Medicaid programs is in their

collection of ownership information from providers. 

HOW WE DID THIS STUDY 

We determined the extent to which States requested and verified provider ownership information and checked 

exclusions databases. Additionally, for selected providers, we collected and compared three sets of owner 

names: (1) those on record with State Medicaid programs for Medicaid enrollment purposes, (2) those 

submitted by providers directly to the Office of Inspector General (OIG) for this evaluation, and (3) those on 

record with CMS for Medicare enrollment purposes. We determined the extent to which owner names from 

these sources matched. When we compared names, if we found owner names that were not identical but were 

reasonably similar, we considered the names to match.

WHAT WE FOUND 

Few State Medicaid programs requested that providers disclose all federally required ownership information. In 

addition, 14 State Medicaid programs reported that they did not verify the completeness or accuracy of provider 

ownership information. We also found that 14 State Medicaid programs reported that they did not check all 

required exclusions databases, which could allow providers with excluded owners to enroll in Medicaid. 

Additionally, we found that most providers in our review had names on record with State Medicaid programs 

that did not match the names that providers submitted to OIG. Further, nearly all providers in our review had 

names on record with State Medicaid programs that did not match those on record with CMS. The prevalence 

of nonmatching owner names raises concern about the completeness and accuracy of information about 

Medicaid providers’ ownership. It also demonstrates that providers may not be complying with the requirement 

to report ownership changes to State Medicaid programs. Taken together, these findings reveal vulnerabilities 

that could allow potentially fraudulent providers to enroll in State Medicaid programs and that limit States’ 

ability to provide adequate oversight. 

WHAT WE RECOMMEND 

We recommend that CMS (1) work with State Medicaid programs to identify and correct gaps in their 

collection of all required provider ownership information, (2) provide guidance to State Medicaid programs on 

how to verify the completeness and accuracy of provider ownership information, (3) require State Medicaid 

programs to verify the completeness and accuracy of provider ownership information, (4) ensure that State 

Medicaid programs check exclusions databases as required, (5) work with State Medicaid programs to educate 

providers on the requirement to report changes of ownership, (6) work with State Medicaid programs to review 

providers that submitted nonmatching owner names and take appropriate action, and (7) increase coordination 

with State Medicaid programs on collecting and verifying provider ownership information in Medicaid and 

Medicare. CMS concurred with all of our recommendations.
 

TABLE OF CONTENTS

Objectives ....................................................................................................1

Rationale ......................................................................................................1

Background..................................................................................................2

Methodology................................................................................................4

Findings........................................................................................................7

Few State Medicaid programs requested that providers disclose 

all required ownership information..................................................7

Fourteen State Medicaid programs reported that they did not

verify the completeness or accuracy of provider ownership 

information.......................................................................................8

Fourteen State Medicaid programs reported that they did not 

check all required exclusions databases, which could allow 

providers with excluded owners to enroll in Medicaid..................10

The prevalence of nonmatching owner names raises concern 

about the completeness and accuracy of information about

Medicaid providers’ ownership......................................................11

Conclusion and Recommendations............................................................13

Agency Comments and Office of Inspector General Response.....16

Appendixes ................................................................................................17

A: Detailed Methodology .............................................................17

B: Extent to Which State Medicaid Programs Requested 

Required Ownership Information, 2013 ........................................22

C: Agency Comments...................................................................24

Acknowledgments......................................................................................27
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 1

OBJECTIVES

To determine the extent to which:

1. State Medicaid programs requested and verified provider ownership 

information and checked exclusions databases as part of the Medicaid 

enrollment process.

2. Owner names on record with State Medicaid programs matched the 

names submitted to the Office of Inspector General (OIG) for this 

evaluation and the names on record with the Centers for Medicare & 

Medicaid Services (CMS).

RATIONALE

States can prevent inappropriate payments, protect beneficiaries, and 

reduce time-consuming and expensive “pay and chase” activities by 

ensuring that providers that intend to engage in fraudulent or abusive 

activities are not allowed to enroll in Medicaid.1 For States to identify 

potentially fraudulent providers, as well as those that may be associated 

with excluded individuals or entities, providers must disclose information 

on owners and others with control interest in the business. 

However, State Medicaid programs may not be collecting complete 

ownership disclosures from providers. In August 2010, CMS reported that 

the highest incidence of regulatory noncompliance among State Medicaid 

programs is in the collection of provider ownership disclosures.2

 In 

particular, CMS noted problems with the forms used to collect provider 

ownership disclosures, such as the forms not requesting or including space 

for providers to disclose all required information.3

Additionally, in some health care fraud schemes, individuals have 

concealed providers’ true ownership from State Medicaid programs. For 

example, in May 2014, an individual was sentenced to 1 to 3 years in 

prison for his involvement in a multiyear fraud scheme that amounted to 

more than $16 million in fraudulent payments from the New York 

Medicaid program. The individual admitted to being the straw owner of 

____________________________________________________________ 

1

 In a Medicaid fee-for-service program, a “provider” is any individual or entity 

furnishing Medicaid services under an agreement with the Medicaid agency. For 

a Medicaid managed care program, a “provider” is any individual or entity that is 

engaged in the delivery of health care services and is legally authorized to do so by the 

State in which it delivers the services. 42 CFR § 400.203. 

2

 CMS, Best Practices for Medicaid Program Integrity Units’ Collection of Disclosures 

in Provider Enrollment, August 2010, p. 3. Accessed at 

https://www.cms.gov/FraudAbuseforProfs/Downloads/bppedisclosure.pdf on October 27, 

2015. 

3

 Ibid., p. 4. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 2

three pharmacies that were owned and controlled by his father, who had 

previously been excluded from participating in the New York Medicaid 

program.4

 

Concerns about provider ownership information are also prevalent in 

Medicare. In a companion report issued concurrently to this report, OIG 

found that 2 of 11 CMS contractors reported that they do not check 

required exclusions databases, which could allow providers with excluded 

owners to enroll in Medicare.5 Additionally, when we compared the 

owner names on record with State Medicaid programs with the owner 

names that providers submitted to OIG for this review, the names did not 

match for over three-quarters of the providers. 

BACKGROUND

Medicaid Ownership Disclosure

Providers enrolling in Medicaid must disclose—and States must collect—

specific information, including the name and address of any person 

(individual or corporation) that has an ownership or controlling interest of 

5 percent or more, or that is a managing employee. 6, 7 (In this report, we 

refer to all three types as “owners.”)8, 9 Providers enrolling in Medicaid or 

renewing their Medicaid agreements must also disclose whether any 

owners have been convicted of a criminal offense.10

____________________________________________________________ 

4

 New York State Office of the Attorney General, A.G. Schneiderman Announces Prison 

Term for Rogue Pharmacy Owner in $16 Million Medicaid Theft, May 5, 2014. 

Accessed at http://www.ag.ny.gov/press-release/ag-schneiderman-announces-prisonterm-rogue-pharmacy-owner-16-million-medicaid-theft on October 27, 2015. 

5

 OIG, Medicare: Vulnerabilities Related to Provider Enrollment and Ownership 

Disclosure (OEI-04-11-00591), May 2016.

6 42 CFR § 455.101. Medicaid providers, other than an individual practitioner or group 

of practitioners, are entities that must disclose ownership. 

7

 Social Security Act § 1124(a)(2)(B); 42 CFR §§ 455.104(b)(1)(i) and 455.106(a). 

In Medicare, providers that are enrolling must disclose specific information to CMS, 

must disclose specific information to CMS, including the identity of any person who has 

an ownership or controlling interest or is an agent or managing employee. 42 CFR 

§§ 420.204(a)(1)-(2) and 420.206(a)(3). 

8 42 CFR § 455.101. Medicaid providers, other than an individual practitioner or group 

of practitioners, are disclosing entities that must disclose ownership. 

9

 Social Security Act § 1124(a)(2)(B); 42 CFR §§ 455.104(b)(1)(i) and 455.106(a). 

In Medicare, providers that are enrolling must disclose specific information to CMS, 

including the identity of any person who has an ownership or controlling interest or is an 

agent or managing employee. 42 CFR §§ 420.204(a)(1)-(2) and 420.206(a)(3). 

10 42 CFR § 455.106(a). In Medicare, providers that are enrolling must disclose whether 

any owners have been convicted of a criminal offense, subjected to any civil monetary 

penalties, or excluded from participating in federally funded health care programs. 

42 CFR § 420.204. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 3

Once they are enrolled in Medicaid, providers must report changes of 

ownership to State Medicaid programs within 35 days of the change.11 In 

addition, State Medicaid programs must revalidate providers’ enrollment 

information at least every 5 years.12, 13 

The State Medicaid program must deny enrollment or terminate the 

enrollment of any provider if the provider or an owner does not submit 

timely and accurate information.14

Verification of Provider Ownership Information

Although there is no Federal requirement that State Medicaid programs 

verify the completeness and accuracy of ownership information disclosed 

by providers, CMS recommends that State Medicaid programs do so. In 

particular, CMS recommends, as a general rule, that:

States should not process a provider’s disclosure information that 

does not appear complete or does not include information on 

individuals with ownership or control interests in the provider 

entity, including managing employees, until the State verifies the 

accuracy and completeness of the information.15 

CMS does not describe how States should verify the completeness and 

accuracy of provider ownership information. 

Additionally, CMS provides State Medicaid programs with limited access 

to its Medicare enrollment system—the Provider Enrollment, Chain, and 

Ownership System (PECOS).

16

 States can use this access during provider 

screening to determine if a provider is currently enrolled in Medicare, is 

enrolling, or has been denied enrollment.

____________________________________________________________ 

11 42 CFR § 455.104(c)(1)(iv). In Medicare, enrolled providers must report changes of 

ownership or control to CMS within 30 days of the change. 42 CFR § 424.516(e)(1). 

12 42 CFR § 455.414. In Medicare, enrolled providers must submit and recertify 

enrollment information every 5 years. 42 CFR § 424.515. 

13 Section 6401(a) of the Patient Protection and Affordable Care Act requires all enrolled 

providers and suppliers to revalidate their enrollment information under new enrollment 

screening criteria. This requirement includes providers and suppliers that were enrolled 

prior to March 25, 2011. 76 Fed. Reg. 5969, 5865. The deadline for State Medicaid 

programs to complete this revalidation-of-enrollment process for all providers is 

September 25, 2016 (an extension from the original deadline of March 24, 2016). See 

CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, December 23, 2011, p. 2. Accessed at http://www.medicaid.gov/FederalPolicy-Guidance/downloads/CIB-12-23-11.pdf on October 28, 2015. 

14 42 CFR § 455.416(a). 

15 CMS, State Medicaid Director Letter #08-003, June 12, 2008, p. 3. Accessed at 

https://downloads.cms.gov/cmsgov/archived-downloads/SMDL/downloads/ 

smd061208.pdf on October 28, 2015. 

16 CMS, CMCS Informational Bulletin: Medicaid/CHIP Provider Screening and 

Enrollment, December 23, 2011, p. 3. Accessed at http://www.medicaid.gov/FederalPolicy-Guidance/downloads/CIB-12-23-11.pdf on October 28, 2015. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 4

Program Exclusions

As part of the process of enrolling Medicaid providers, State Medicaid 

programs are required to confirm that providers’ disclosed owners are not 

excluded.17 To do so, States must determine the exclusion status of 

providers and any owners through routine checks of Federal databases, 

including OIG’s List of Excluded Individuals/Entities (LEIE) and the 

General Services Administration’s Excluded Parties List System 

(EPLS).18, 19 The LEIE is a database that contains all individuals and 

entities currently excluded by OIG from participating in federally funded 

health care programs.20 The EPLS is a Governmentwide database with 

information on individuals and entities that have been suspended or 

excluded from receiving Federal financial assistance and benefits.21 A 

provider with excluded owners should not be allowed to enroll in 

Medicaid.

METHODOLOGY

We used multiple data collection activities and sources for this report. 

First, in April 2013, we sent an electronic questionnaire to 51 State 

Medicaid programs.22 The electronic questionnaire collected information 

on how each State Medicaid programs collects and processes ownership 

information disclosed by providers. In particular, we asked each State 

Medicaid program how it verifies the completeness and accuracy of 

provider ownership information. We also asked each State Medicaid 

program whether it compared the ownership information that providers 

disclosed with the ownership information in the LEIE and EPLS. 

Additionally, we collected supporting documentation from State Medicaid 

programs, which included the forms used to request ownership 

disclosures. We reviewed States’ documentation—e.g., their provider 

enrollment applications, their State-specific ownership disclosure forms, 

and screenshots from their provider enrollment systems—to determine the 

____________________________________________________________ 

17 42 CFR § 455.436. 

18Ibid.

19 In July 2012, the EPLS was consolidated with other Federal procurement systems into 

the System for Award Management (SAM). Phase I consolidation included the Central 

Contractor Registration/Federal Agency Registration, the Online Representations and 

Certifications Application, and the EPLS. What is SAM? Accessed at 

https://www.sam.gov/sam/announce1.htm on September 1, 2015. 

20 OIG, List of Excluded Individuals and Entities Background Information. Accessed at 

http://oig.hhs.gov/exclusions/background.asp on October 28, 2015.

21 71 Fed. Reg. 70515–70516 (Dec. 5, 2006). 

22 These 51 State Medicaid programs included all 50 States and the District of Columbia. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 5

extent to which State Medicaid programs requested that providers disclose 

ownership information required by 42 CFR §§ 455.104(b) and 455.106(a).

Next, for selected providers, we collected and compared three sets of 

owner names: (1) those on record with State Medicaid programs for 

Medicaid enrollment purposes, (2) those submitted by providers directly to 

OIG for this evaluation, and (3) those on record with CMS for Medicare 

enrollment purposes.23 We collected this information between 

December 2013 and April 2014. We compared owner names on record 

with State Medicaid programs to those submitted to OIG for 62 providers 

enrolled in Medicaid. We also compared owner names on record with 

State Medicaid programs to those on record with CMS for Medicare 

enrollment purposes for 58 of the 62 providers that were enrolled in both 

Medicaid and Medicare. 

We completed an additional analysis on owner names submitted to OIG 

that were not on record with State Medicaid programs. Specifically, we 

analyzed the effective dates for a given owner’s ownership to determine 

whether the dates fell within the 35-day window during which providers 

are required to notify their respective State Medicaid programs of the 

change. If dates fell within this window, providers still had time to notify 

the State Medicaid program of the change.

See the Appendix A for a detailed description of the methodology. 

Limitations

We did not attempt to collect information not reported or to verify 

information that providers submitted to OIG. For example, providers did 

not always report the effective date for a given owner’s ownership. We 

did not attempt to collect these dates if providers had not reported them, 

nor did we attempt to verify such dates if providers had reported them.

Additionally, the matching of owner names across two or more sources did 

not necessarily mean that ownership information was complete and 

accurate. Providers could have submitted information that was incomplete 

and/or inaccurate—but that matched—to multiple programs (i.e., CMS, 

OIG, and/or State Medicaid programs). 

Finally, the results of comparisons are not projected and pertain only to 

the providers in our review included in each comparison. 

____________________________________________________________ 

23 Provider types in our review are ambulatory surgical centers, ambulance services, 

independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 

health agencies, hospices, and renal disease facilities. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 6

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 7

FINDINGS

Few State Medicaid programs requested that 

providers disclose all required ownership information

Few State Medicaid programs (7 of 50)24 requested on their provider 

enrollment applications or ownership disclosure forms that providers 

disclose all required ownership information.

25

 By “request,” we mean that 

the application or form included language asking providers to supply the 

required information. The remaining 43 State Medicaid programs did not 

request that providers disclose all required ownership information. CMS 

has noted that although some required ownership information may not 

seem on the surface to be immediately relevant to provider enrollment, 

this information can be important in an investigation, and State Medicaid 

programs are required to collect it.26 

The required ownership information that State Medicaid programs most 

often did not request related to corporations, managing employees, and 

subcontractors. For example, 38 State Medicaid programs did not request 

all applicable address information that is required for corporate owners.27 

Seventeen State Medicaid programs did not request managing employees’ 

address information, and 11 did not request their dates of birth. 

Additionally, 16 State Medicaid programs did not ask whether there were

any relationships between the disclosing entity and the owners of any 

subcontractor. Information on such relationships may be useful to 

investigators when family members who own different organizations are 

suspected of colluding to engage in fraudulent or abusive activities.

Table 1 lists the information that State Medicaid programs most often did 

not request that providers disclose. Appendix B shows the number of 

State Medicaid programs that did and did not request required ownership 

information.

____________________________________________________________ 

24 We did not receive supporting documentation from 1 of the 51 State Medicaid 

programs and were therefore unable to determine whether it requested that providers 

disclose all required ownership information. As a result, the denominator for this finding 

is 50 State Medicaid programs. 

25 For the purposes of this evaluation, we define “required ownership information” as the 

information providers are required to disclose pursuant to 42 CFR §§ 455.104(b) and 

455.106(a). 

26 CMS, Medicaid Program Integrity Toolkits to Address Frequent Findings: 42 CFR 

455.104 Disclosures of Ownership and Control. Accessed at 

https://www.cms.gov/Medicare-Medicaid-Coordination/Fraud-Prevention/ 

FraudAbuseforProfs/Downloads/fftoolkit-ownership-control.pdf on January 27, 2016. 

27 All applicable address information for corporate entities includes the primary business 

address, every business location, and P.O. Box address. 42 CFR § 455.104(b)(1)(i). 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 8

Table 1: Required Ownership Information Most Often Not Requested by 

State Medicaid Programs, 2013

Required Ownership Information

Number of State 

Medicaid 

Programs That

Did Not Request

All applicable address information for corporate entities with an 

ownership interest 38

Tax identification number of a corporation with an ownership interest 

in any subcontractor 27

Address of any managing employee 17

Whether the person with an ownership interest in any subcontractor 

is related to another person with an ownership interest in the 

disclosing entity

16

Date of birth of any managing employee 11

Address of any corporation with an ownership interest 11

Source: OIG analysis of State Medicaid programs’ supporting documentation, 2015.

Nearly all (49 of 50) State Medicaid programs had providers disclose 

ownership information using the State’s provider enrollment application or 

a State-specific ownership disclosure form. The one remaining State used 

the CMS-1513 form, an outdated form that requested only half of the 

required ownership information. (CMS discontinued use and reproduction 

of this form in August 2003.28)

Fourteen State Medicaid programs reported that they 

did not verify the completeness or accuracy of 

provider ownership information

CMS recommends that State Medicaid programs verify the completeness 

and accuracy of provider ownership information. As shown in Table 2, 

37 State Medicaid programs reported verifying the completeness and/or 

accuracy of provider ownership information. The remaining 14 State 

Medicaid programs reported not verifying the completeness or accuracy of 

provider ownership information. 

____________________________________________________________ 

28 CMS, Discontinuance of Forms HCFA-1513, “Ownership and Control Interest 

Disclosure Statement” and HCFA-2572, “Statement of Financial Solvency” 

(S&C-03-29), August 14, 2003. Accessed at https://www.cms.gov/Medicare/ProviderEnrollment-and-Certification/SurveyCertificationGenInfo/Downloads/SCletter03-29.pdf

on December 9, 2015. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 9

Table 2: Verification of Provider Ownership Information by State Medicaid 

Programs, 2013 

Verification of Provider Ownership 

Information

Number of 

State Medicaid 

Programs

Verified Completeness and/or Accuracy 37

- Verified Completeness 37

- Verified Accuracy 18

Verified Neither Completeness Nor Accuracy 14

 Total 51

Source: OIG analysis of State Medicaid programs’ responses to electronic questionnaire, 

2015.

Of the 37 State Medicaid programs that reported that they verified the 

completeness of provider ownership information, nearly two-thirds

(24 States) reported that they do so by reviewing the provider-submitted 

enrollment application or ownership disclosure form to confirm that no 

required information is missing. Other ways in which State Medicaid 

programs reported verifying the completeness of provider ownership 

information include checking State Web sites or documentation related to 

corporate filings and licensure (7 States) and checking Federal databases, 

such as PECOS and the Social Security Administration’s Death Master 

File (4 States).

Of the 18 State Medicaid programs that reported verifying the accuracy of 

provider ownership information, most reported that they do so by 

checking State Web sites (8 States) and Federal databases (7 States). 

Other ways in which State Medicaid programs reported verifying the 

accuracy of provider ownership information include reviewing documents 

about the business type and structure of an entity (3 States); comparing the 

most recently disclosed ownership information to that previously 

submitted (3 States); searching online for the provider’s Web site and 

owners (2 States); and conducting site visits or reviewing their results 

(2 States).

Of the 14 State Medicaid programs that reported not verifying the 

completeness or accuracy of provider ownership information, 9 reported 

not having the systems or resources to do so. Four of the remaining 

programs reported that providers attest that the information they submit is 

complete and accurate.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 10

Fourteen State Medicaid programs reported that they 

did not check all required exclusions databases, 

which could allow providers with excluded owners to 

enroll in Medicaid

State Medicaid programs are required to check two databases as part of the 

Medicaid enrollment process to confirm that individuals or entities that 

providers disclose as owners are not excluded. Specifically, States are 

required to determine the exclusion status of owners through routine 

checks of the LEIE and EPLS. 

As shown in Table 3, 37 of 51 State Medicaid programs reported that they 

check both the LEIE and EPLS to confirm that individuals or entities that 

providers disclosed were not excluded. Twenty-three of the thirty-seven 

State Medicaid programs reported that they check both the LEIE and 

EPLS during the processes of initial enrollment, re-enrollment, 

revalidation, and change of ownership. Seventeen reported that they 

check both the LEIE and EPLS at least monthly. 

Table 3: Checks of Exclusions Databases by State Medicaid Programs, 

2013

Exclusions Databases Checked 

Number of 

State Medicaid 

Programs

Both LEIE and EPLS 37

Only LEIE 7

Only EPLS 4

Neither LEIE nor EPLS 3

 Total 51

Source: OIG analysis of State Medicaid programs’ responses to electronic 

questionnaire, 2015.

The remaining 14 State Medicaid programs reported that they do not 

check both exclusions databases as required. Eleven of these State 

Medicaid programs reported that they check one exclusions database but 

not the other. Specifically, seven State Medicaid programs reported 

checking the LEIE only and four reported checking the EPLS only.29 The 

remaining three State Medicaid programs reported that they do not check 

either exclusions database.30

____________________________________________________________ 

29 Three of the four State Medicaid programs that reported checking the EPLS but not the 

LEIE did report checking CMS’s Medicare Exclusion Database—a database equivalent 

to the LEIE. 

30 One of the three State Medicaid programs that reported that it does not check the LEIE 

or EPLS did report checking CMS’s Medicare Exclusion Database.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 11

The prevalence of nonmatching owner names raises 

concern about the completeness and accuracy of 

information about Medicaid providers’ ownership

Overall, very few (4 of 58) providers in our review had owner names that 

matched across all three sources (i.e., State Medicaid programs, OIG, and 

CMS). The prevalence of nonmatching owner names raises concern about 

the completeness and accuracy of information about Medicaid providers’ 

ownership.

For most providers in our review, owner names on record with 

State Medicaid programs did not match those submitted to 

OIG

When we compared the owner names on record with State Medicaid 

programs for Medicaid enrollment purposes to those that providers 

submitted to OIG for this evaluation, we found that 86 percent of 

providers in our review (53 of 62) had at least one nonmatching owner 

name. For 43 providers, some owner names matched and some did not 

match. For 10 providers, none of the owner names matched. Table 4

shows the extent to which owner names matched for the 62 providers in 

our review. 

Table 4: Extent to Which Owner Names On Record With State Medicaid 

Programs Matched Those Submitted to OIG, 2013

Description Number of 

Providers

Percentage of 

Providers

Not all owner names matched 53 85.5%

- Some—but not all—owner names matched 43 69.4%

- No owner names matched 10 16.1%

All owner names matched 9 14.5%

 Total 62 100.0%

Source: OIG analysis of ownership information on record with State Medicaid programs and ownership information 

submitted to OIG, 2015.

Additionally, it appears that some providers in our review did not notify 

State Medicaid programs of changes in ownership within the required 

timeframe. Thirty-six providers in our review submitted owner names to 

OIG that were not on record with State Medicaid programs. Of these 

36 providers, 29 reported the effective dates of ownership for 102 owners. 

For 96 percent of these owners (98 of 102), the effective dates fell outside 

the required 35-day window for providers to notify the State Medicaid 

program of the ownership changes. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 12

For nearly all providers in our review, owner names on record 

with State Medicaid programs did not match those on record 

with CMS

Although Medicaid and Medicare ownership information is collected and 

maintained separately, State Medicaid programs and CMS should have the 

same owner names for providers enrolled in both programs. However, 

when we compared the owner names on record with State Medicaid 

programs for Medicaid enrollment purposes to those on record with CMS 

for Medicare enrollment purposes, we found that 90 percent of providers 

in our review (52 of 58) had at least one nonmatching owner name. For 

44 providers, some owner names matched and some did not match. For 

eight providers, none of the owner names on record with State Medicaid 

programs matched those on record with CMS. Table 5 shows the extent to 

which owner names matched for the 58 providers in our review. 

Table 5: Extent to Which Owner Names On Record With State Medicaid 

Programs Matched Those On Record With CMS, 2013 

Description Number of 

Providers

Percentage of 

Providers

Not all owner names matched 52 89.7%

- Some—but not all—owner names matched 44 75.9%

- No owner names matched 8 13.8%

All owner names matched 6 10.3%

 Total 58 100.0%

Source: OIG analysis of ownership information on record with CMS and ownership information on record with State 

Medicaid programs, 2015.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 13

CONCLUSION AND RECOMMENDATIONS

States can prevent inappropriate payments, protect beneficiaries, and 

reduce time-consuming and expensive “pay and chase” activities by 

ensuring that providers that intend to engage in fraudulent or abusive 

activities are not allowed to enroll in Medicaid. For States to identify 

potentially fraudulent providers, as well as those that may be associated 

with excluded individuals or entities, providers must disclose accurate and 

timely information about their owners.

However, few State Medicaid programs requested that providers disclose 

all required ownership information. In addition, 14 State Medicaid 

programs reported not verifying the completeness or accuracy of provider 

ownership information. We also found that 14 State Medicaid programs 

reported that they do not check all required exclusions databases, which 

could allow providers with excluded owners to enroll in Medicaid. 

Additionally, we found that most providers in our review had names on 

record with State Medicaid programs that did not match those that 

providers submitted to OIG. Further, nearly all providers in our review 

had names on record with State Medicaid programs that did not match 

those on record with CMS. The prevalence of nonmatching owner names 

raises concern about the completeness and accuracy of information about 

Medicaid providers’ ownership. It also suggests that providers may not be 

complying with the requirement to report ownership changes to State 

Medicaid programs. 

Taken together, these findings reveal vulnerabilities that could allow 

potentially fraudulent providers to enroll in State Medicaid programs and 

limit States’ ability to provide adequate oversight. Therefore, we 

recommend that CMS:

Work with State Medicaid programs to identify and correct 

gaps in their collection of all required provider ownership 

information

CMS should ensure that State Medicaid programs are requesting that 

providers disclose all required ownership information through the provider 

enrollment application or an ownership disclosure form. One way in 

which CMS could implement this recommendation is by creating a 

standard document that requests all required ownership information. CMS 

could then encourage or require State Medicaid programs to use this 

document when requesting that providers disclose ownership information. 

In a separate memorandum, we will refer to CMS the 43 State Medicaid 

programs that did not request that providers disclose all required provider 

ownership information on the provider enrollment application or 

ownership disclosure form. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 14

Provide guidance to State Medicaid programs on how to verify 

the completeness and accuracy of provider ownership 

information

CMS has recommended that States verify the completeness and accuracy 

of ownership information disclosed by providers, but it has not provided 

guidance on how States should perform this verification. As a result, we 

found States vary in their methods for conducting this verification. CMS

should determine which, if any, of these methods are best practices for 

verifying completeness and accuracy and provide guidance to State 

Medicaid programs on these best practices. To help identify best 

practices, CMS could consider the methods that its contractors use to 

verify the ownership information that providers disclose when they enroll 

in Medicare.

Require State Medicaid programs to verify the completeness 

and accuracy of provider ownership information 

CMS has recommended—but does not require—that States verify the 

completeness and accuracy of ownership information disclosed by 

providers. As a result, we found that several States do not conduct this 

verification. Therefore, CMS should require State Medicaid programs to 

verify the completeness and accuracy of provider ownership information. 

Ensure that State Medicaid programs check exclusions 

databases as required

CMS should ensure that all State Medicaid programs check the LEIE and 

EPLS, as required, as part of the Medicaid enrollment process to confirm 

that individuals and entities that providers disclosed as owners are not 

excluded. The checking of exclusions databases is an important safeguard 

that ensures that excluded individuals and entities are kept out of State 

Medicaid programs. CMS could ensure that States conduct these required 

checks as part of its audits of State Medicaid programs and/or through 

some other process (e.g., by requiring the States to attest that they conduct 

the exclusions checks). 

In the aforementioned memorandum, we will refer to CMS the 14 State 

Medicaid programs that reported that they do not check the LEIE and/or 

the EPLS. 

Work with State Medicaid programs to educate providers on 

the requirement to report changes of ownership

CMS should work with State Medicaid programs to educate providers on 

the requirement to report changes of ownership to State Medicaid 

programs within 35 days and the actions that States may take if providers 

do not comply with this requirement.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 15

Work with State Medicaid programs to review providers that 

submitted nonmatching owner names and take appropriate 

action

In the aforementioned memorandum, we will refer to CMS the 

53 providers that had owner names on record with State Medicaid 

programs that did not match those submitted to OIG. CMS should work 

with State Medicaid programs to review these providers’ enrollment 

records. After this review, State Medicaid programs should determine and 

take appropriate courses of action.

Increase coordination with State Medicaid programs on 

collecting and verifying provider ownership information in 

Medicare and Medicaid

CMS should coordinate with State Medicaid programs on the collection 

and verification of ownership information for providers enrolling or 

enrolled in Medicare and Medicaid. For example, CMS could encourage 

State Medicaid programs to use their access to PECOS when verifying 

provider ownership information and to notify Medicare Administrative 

Contractors (MACs) when they identify nonmatching information. State 

Medicaid programs and MACs could then collaborate to determine why 

provider ownership information does not match and address the issue.

In the longer term, CMS should consider working towards consolidating 

ownership information for providers enrolling or enrolled in Medicare 

and/or Medicaid into one centralized system. This would make processes 

more efficient. Namely, this would reduce burden on providers and 

streamline the enrollment process because providers would no longer have 

to separately disclose ownership information both to CMS and State 

Medicaid programs.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 16

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE

CMS concurred with all seven of our recommendations. In its comments,

CMS stated that it is strongly committed to Medicaid program integrity 

efforts and is continuously working to enhance the process for provider 

enrollment and screening. CMS stated that since 2011, when it finalized 

regulations to require the revalidation of Medicaid providers, it has taken

several actions to help States fulfill this requirement. For example, CMS 

has provided States with direct access to Medicare’s enrollment data and 

monthly data extracts that States can use to compare their records against 

Medicare enrollment information. CMS also stated that it has provided 

extensive guidance and technical assistance to help States with their 

revalidation efforts.

CMS stated that it will implement a number of actions to address OIG’s 

recommendations. For example, CMS will continue to work with States 

to ensure that they are requesting all required ownership information from 

providers. CMS will also work with States to examine discrepancies

identified in this report in which the State records for owner names of 

enrolled providers that do not match the owner names that providers 

submitted to OIG. CMS will also determine whether regulations are 

needed to require States to verify the completeness and accuracy of 

provider ownership information. 

In addition, CMS stated that it will work with States and other relevant 

stakeholders to enhance processes for collecting and verifying provider 

ownership information. As CMS enhances these processes, we encourage 

it to focus specifically on increasing coordination and reducing duplicative

efforts between the Medicaid and Medicare programs, and to consider

moving towards one consolidated system in the future.

The full text of CMS’s comments is provided in Appendix C. We also 

made changes to the report based on technical comments that CMS sent 

separately. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 17

APPENDIX A

Detailed Methodology

State Medicaid Program Electronic Questionnaire

In April 2013, we sent an electronic questionnaire to 51 State Medicaid 

programs.31 The electronic questionnaire collected information on how 

each State Medicaid program collects and processes ownership 

information disclosed by providers. By September 2013, we received 

responses to all applicable questions from each State Medicaid program. 

We reviewed and analyzed responses to determine whether each State 

Medicaid program verifies the completeness and/or accuracy of provider 

ownership information and what methods it uses to do so. We also 

reviewed and analyzed responses to determine whether each State 

Medicaid program compared ownership information that providers 

disclosed to the two exclusions databases—i.e., the LEIE and EPLS—that 

State Medicaid programs are required to check as part of the Medicaid 

enrollment process.

Additionally, we collected supporting documentation from State Medicaid 

programs, which included the forms used to request ownership 

disclosures. We reviewed this documentation—e.g., States’ provider 

enrollment applications, their State-specific ownership disclosure forms, 

and screenshots from their respective systems for provider enrollment—

to determine the extent to which States requested that providers disclose 

ownership information required by 42 CFR §§ 455.104(b) and 455.106(a).

Provider Selection

We selected a random sample of 170 providers that were enrolled in 

Medicare and/or Medicaid as of January 1, 2012, in specific provider 

types.32 We designed the sample such that the results of our review would 

be projectable. However, as our data analysis progressed, it became clear 

that providers enrolled in two State Medicaid programs were 

____________________________________________________________ 

31 The 51 State Medicaid programs included all 50 States and the District of Columbia. 

We also sent an information request to Puerto Rico, which indicated that it does not 

provide fee-for-service Medicaid. Because we limited our review to fee-for-service 

programs, Puerto Rico is not included in our results on the collection and verification of 

provider ownership information.

32 Provider types in our review are ambulatory surgical centers, ambulance services, 

independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 

health agencies, hospices, and renal disease facilities. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 18

overrepresented in the population because duplicate providers had not 

been removed before we selected our sample.33

We selected the 170 providers using 2 population files in such a way that 

30 providers were enrolled in Medicare, 30 providers were enrolled in 

Medicaid, and 110 providers were enrolled in Medicare and Medicaid. 

 The first population file consisted of 34,984 records for providers 

enrolled in Medicare as of January 1, 2012, in our specified provider 

types. To create this file, we extracted identification and contact 

information from PECOS.34 In particular, for each provider, we 

collected the name, provider type, address, phone number, national 

provider identifier (NPI), and tax identification number (TIN). We 

then selected from this file 30 records that were associated with 

30 distinct providers enrolled in Medicare.

 The second population file consisted of 35,394 providers enrolled in 

Medicaid as of January 1, 2012, in our specified provider types. To 

create this file, we requested and received identification and contact 

information from each of the 52 State Medicaid programs on 

individual and nonindividual providers, including those in our 

specified provider types, enrolled as of January 1, 2012.35 In 

particular, for each provider, we requested the name, provider type, 

address, phone number, Medicaid provider identification number, NPI, 

TIN, Social Security number (SSN), and State license number. To 

compile this file, we combined information received from each 

Medicaid program and created a separate record for each unique 

combination, by Medicaid program, of Medicaid provider 

identification number, NPI, TIN, SSN, and State license number. 

Once we compiled this information, we limited the file to our specified 

nonindividual provider types, thus reducing it from 2.86 million to 

35,394 providers. From this subset, we selected 140 providers 

enrolled in Medicaid, of which at least 110 appeared to also be 

enrolled in Medicare.

____________________________________________________________ 

33 To project the results of our analysis, we would have needed to remove duplicate 

providers from the population, sample providers again, and collect ownership information 

again. Because we did not identify this duplication until our data were collected, we did 

not do this because of the time and resources it would require. Therefore, we do not 

make projections in this report. 

34 We used a snapshot of PECOS to ensure that this population file consisted of providers 

enrolled in Medicare as of January 1, 2012. 

35 The 52 State Medicaid programs consist of all 50 States, the District of Columbia, and 

Puerto Rico. We requested information on individual providers for separate OIG 

evaluations. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 19

Collection of Provider Ownership Information

We collected three sets of current (i.e., as of the date of our data 

collection) owner names and other information: (1) those on record with 

State Medicaid programs for Medicaid enrollment purposes, (2) those 

submitted by providers directly to OIG for this evaluation, and (3) those 

on record with CMS for Medicare enrollment purposes. 

We first collected owner names directly from selected providers. From 

November 2013 to January 2014, we sent electronic questionnaires to the 

170 selected providers and requested ownership information (e.g., owner 

names, dates each owner’s ownership took effect, TINs, and SSNs) as of 

the date the provider received the questionnaire. We sent up to two 

written requests by mail and attempted to contact nonresponding providers 

by telephone and email, if this information was available. We received 

responses from 119 providers and did not receive responses from 

29 providers. The remaining 22 providers were considered ineligible 

because they did not meet our selection criteria regarding provider type 

and/or enrollment timeframe.

As part of the questionnaire, we also asked providers whether they were 

enrolled in Medicaid and/or Medicare. If providers indicated that they 

were not enrolled in one or both programs, we no longer classified them as 

being enrolled in the program(s). Of the 119 responding providers, 

106 indicated they were enrolled in Medicaid. Additionally, 100 of the 

106 providers also indicated that they were enrolled in Medicare. 

Next, we collected owner names on record with State Medicaid programs 

for Medicaid enrollment purposes. From December 2013 to 

February 2014, we collected ownership information for selected providers 

from State Medicaid programs. State Medicaid programs provided 

electronic and hardcopy documents showing ownership disclosures, as 

well as extracts from ownership-disclosure databases. Of the 

106 providers enrolled in Medicaid, we received information for 

76 providers from State Medicaid programs. Of the 100 providers 

enrolled in both Medicaid and Medicare, we received information for 

71 providers from State Medicaid programs.

Finally, we collected owner names on record with CMS for Medicare 

enrollment purposes. From December 2013 to April 2014, we extracted 

ownership information (e.g., owner names, ownership roles) from PECOS 

for selected providers.

Analysis of Provider Ownership Information

We conducted two comparisons of the three sets of owner names—those 

on record with State Medicaid programs, those submitted by providers to 

OIG, and those on record with CMS. Each comparison involved 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 20

(1) confirming that information being compared was for the same provider 

and (2) evaluating the similarity of owner names.

Comparison of Ownership Information on Record With State Medicaid 

Programs and Ownership Information Submitted to OIG. The first 

comparison determined the extent to which owner names on record with 

State Medicaid programs for Medicaid enrollment purposes matched those 

submitted to OIG for this evaluation. 

We first manually compared each provider’s NPI, TIN, and/or name and 

address in the information on record with State Medicaid programs to 

those submitted to OIG. We confirmed that 62 of these 76 providers were 

the same. We removed the remaining 14 providers from our analysis 

because we were unable to confirm that the State Medicaid program 

records and the OIG records were for the same provider.

Next, we compared owner names on record with State Medicaid programs

to those that the 62 providers submitted to OIG. We identified names that 

matched, meaning that the name was on record with the State Medicaid 

program and submitted to OIG. We also identified names that did not 

match—meaning that the name was on record with the State Medicaid 

program but not submitted to OIG or vice versa—and called these names 

“nonmatching.” When we compared names, if we found owner names 

that were not identical but were reasonably similar, we considered the 

names to match. For example, if owner names were not identical but were 

reasonably similar (e.g., “James Harris” and “Jim Harris”), we considered 

the names to match. See Figure 1 for an illustration of a provider that had 

two names that matched as well as both types of nonmatching names.

Figure 1: Illustration of Provider’s Owner Names That Did and Did Not 

Match

Name Submitted by 

Provider to State 

Medicaid Program

Name Submitted by 

Provider to OIG Match Versus Nonmatch

James Harris Jim Harris Match

Jane Smith Jane Smith Match

Business A Nonmatch

Company B Nonmatch

Note: Blanks illustrate that the individual or entity’s name was not on record with the State Medicaid program 

or not submitted to OIG. 

Additionally, we completed two analyses on owner names submitted to 

OIG that were not on record with State Medicaid programs. First, we 

analyzed the dates on which these owners’ ownership took effect to 

determine whether the dates fell within the 35-day window during which 

providers are required to notify their respective State Medicaid programs 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 21

of such changes. If dates fell within this window, providers still had time 

to notify their State Medicaid programs of the change. Second, we 

searched the LEIE and EPLS for owner names submitted to OIG that were 

not submitted to State Medicaid programs to determine whether these 

individuals or entities were excluded. Because these names were not in its 

ownership information, the State Medicaid program could not have 

previously searched for them in exclusions databases. We did not find any 

of these names in the LEIE or EPLS at the time of our review.

Comparison of Ownership Information on Record With State Medicaid 

Programs and Ownership Information on Record With CMS. The second 

comparison determined the extent to which owner names on record with

State Medicaid programs for Medicaid enrollment purposes matched those 

on record with CMS for Medicare enrollment purposes. 

We manually compared each provider’s NPI, TIN, and/or name and 

address in the information on record with State Medicaid programs to 

those on record with CMS. We confirmed that 58 of these 71 providers 

were the same. We removed the remaining 13 providers from our analysis 

because we were unable to confirm that the records from State Medicaid 

programs and the records from CMS were for the same providers.

Next, we compared owner names on record with State Medicaid programs 

and CMS for each of the 58 providers. For our comparison of these owner 

names, we used the same methodology as for our comparison of owner 

names on record with State Medicaid programs and owner names 

submitted to OIG. 
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 22

APPENDIX B

Extent to Which State Medicaid Programs Requested Required Ownership Information, 2013

Citation Required Information

Number of State 

Medicaid 

Programs that 

Requested 

Information

Number of State 

Medicaid 

Programs that Did 

Not Request 

Information

42 CFR § 455.104(b)(1)(i) Name of any individual with an ownership or control interest 50 0

42 CFR § 455.104(b)(2)

Whether the person with an ownership or control interest in the disclosing entity is 

related to another person with ownership or control interest in the disclosing entity as a 

spouse, parent, child or sibling

47 3

42 CFR § 455.106(a)

Identity of any person who has ownership or control interest and has been convicted of 

a criminal offense related to that person's involvement in any program under Medicare, 

Medicaid, or the Title XX services program

46 4

42 CFR § 455.106(a)

Identity of any person who is agent or managing employee and has been convicted of a 

criminal offense related to that person's involvement in any program under Medicare, 

Medicaid, or the Title XX services program

46 4

42 CFR § 455.104(b)(1)(ii) Social Security number of an individual with an ownership or control interest 45 5

42 CFR § 455.104(b)(1)(i) Address of any individual with an ownership or control interest 44 6

42 CFR § 455.104(b)(1)(ii) Date of birth of an individual with an ownership or control interest 41 9

42 CFR § 455.104(b)(1)(i) Name of any corporation with an ownership or control interest 43 7

42 CFR § 455.104(b)(4) Name of any managing employee 43 7

42 CFR § 455.104(b)(3) The name of any other disclosing entity in which an owner of the disclosing entity has an 

ownership or control interest 41 9

42 CFR § 455.104(b)(4) Social Security number of any managing employee 41 9

42 CFR § 455.104(b)(1)(iii) Tax Identification Number of a corporation with an ownership or control interest in the 

disclosing entity 40 10

42 CFR § 455.104(b)(1)(i) Address of any corporation with an ownership or control interest 39 11

Continued on next page
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 23

Citation Required Information

Number of State 

Medicaid 

Programs that 

Requested 

Information

Number of State 

Medicaid 

Programs that Did 

Not Request 

Information

42 CFR § 455.104(b)(4) Date of birth of any managing employee 39 11

42 CFR § 455.104(b)(2)

Whether the person with an ownership or control interest in any subcontractor in which 

the disclosing entity has a 5 percent or more interest is related to another person with 

ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling

34 16

42 CFR § 455.104(b)(4) Address of any managing employee 33 17

42 CFR § 455.104(b)(1)(iii) Tax Identification Number of a corporation with an ownership or control interest in any 

subcontractor in which the disclosing entity has a 5 percent or more interest 23 27

42 CFR § 455.104(b)(1)(i) The address for corporate entities must include as applicable primary business address, 

every business location, and P.O. Box address 12 38

Source: OIG analysis of State Medicaid programs’ supporting documentation, 2015.
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 24

APPENDIX C

Agency Comments
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 25
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 26
 

Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00590) 27

ACKNOWLEDGMENTS

This report was prepared under the direction of Dwayne Grant, Regional 

Inspector General for Evaluation and Inspections in the Atlanta regional 

office, and Jaime Stewart, Deputy Regional Inspector General. 

Rachel Bessette served as the lead analyst for this study. Other Office of 

Evaluation and Inspections staff from the Atlanta regional office who 

conducted the study include David Samchok and Janna Sayer. Central 

office staff who provided support include Clarence Arnold; 

Eddie Baker, Jr.; Scott Horning; Kevin Manley; Scott Manley; and 

Christine Moritz. 

We would also like to acknowledge the contributions of other Office of 

Evaluation and Inspections regional office staff, including 

Deborah Cosimo and Vincent Greiber. 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of individuals served by those programs. 

This statutory mission is carried out through a nationwide network of audits, investigations, 

and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and individuals. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.