Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

STATE AND CMS OVERSIGHT OF 

THE MEDICAID MANAGED CARE 

CREDENTIALING PROCESS 

Daniel R. Levinson 

Inspector General 

November 2013 

OEI-09-10-00270 
 

EXECUTIVE SUMMARY: State and CMS Oversight of the Medicaid 

Managed Care Credentialing Process 

OEI-09-10-00270 

WHY WE DID THIS STUDY 

The Centers for Medicare & Medicaid Services (CMS) issued regulations that States 

must comply with to ensure the delivery of quality health care to Medicaid beneficiaries 

under managed care. To do so, States must establish uniform provider credentialing 

policies and include Federal credentialing provisions in contracts with Medicaid 

Managed Care Entities (MCEs). States must also monitor MCEs’ compliance with these 

Federal provisions and any additional State credentialing requirements in contracts. 

HOW WE DID THIS STUDY 

We purposively sampled 6 States and 234 MCEs that included the 3 types of MCEs 

subject to the Federal credentialing regulations. To determine the extent to which States 

complied with the Federal regulations, we reviewed State documents, such as laws, 

administrative codes, State-issued policy letters, and 32 State contracts with MCEs. To 

determine whether States monitored MCE compliance with contracts, we reviewed 

States’ auditing documents and interviewed State staff. To examine CMS’s oversight of 

States’ contracts, we reviewed 32 checklists used by CMS regional office staff to 

evaluate compliance of the 32 State contracts with the Federal credentialing provisions. 

WHAT WE FOUND 

All six States’ credentialing policies and MCE contract provisions met Federal standards. 

However, five of six States did not monitor MCEs’ compliance with the Federal provider 

nondiscrimination contract provision. This provision requires that MCEs not 

discriminate against providers that serve high-risk populations or that specialize in 

conditions requiring costly treatment. Also, CMS oversight to ensure the compliance of 

State contracts was inconsistent. Our review of 32 checklists showed that CMS regional 

office staff did not indicate whether 25 percent of contracts met all Federal credentialing 

provisions and many checklists were missing other required contract information. 

WHAT WE RECOMMEND 

We recommend that CMS issue guidance to States on monitoring MCE compliance with 

the Federal provider nondiscrimination contract provision. We also recommend that 

CMS regional office staff accurately complete the checklist to ensure State compliance 

with the Federal credentialing provisions. 
 

TABLE OF CONTENTS 

Objectives .................................................................................................. 1 

Background................................................................................................ 1 

Methodology.............................................................................................. 5 

Findings.................................................................................................... 10 

All six States’ credentialing policies and MCE contract 

provisions met Federal standards ................................................. 10 

Five of six States did not monitor MCEs’ compliance with the 

Federal provider nondiscrimination contract provision ............... 10 

CMS oversight of the compliance of State contracts was 

inconsistent .................................................................................. 11
 

Conclusion and Recommendations .......................................................... 14 

Agency Comments and Office of Inspector General Response ... 15 

Appendixes .............................................................................................. 16 

A: The Centers for Medicare & Medicaid Services’ Checklist 
 

for Review of States’ Contracts With Managed Care Entities ..... 16 

B: Types of Medicaid Managed Care Enrollment by Selected 

States............................................................................................ 17 

C: Selected Criteria for Six States’ Uniform Credentialing and 

Recredentialing Policies............................................................... 18 

D: Additional State Credentialing and Recredentialing 

Requirements ............................................................................... 19 

E: Agency Comments ................................................................. 21 

Acknowledgments.................................................................................... 23 
 

 

 

 

 

 

 

 

 

OBJECTIVES 

1.	 To determine the extent to which States establish uniform 

credentialing policies and include the Federal credentialing provisions 

in contracts with Medicaid Managed Care Entities (MCEs). 

2.	 To determine the extent to which States monitor MCEs’ compliance 

with the Federal credentialing contract provisions and State 

credentialing requirements. 

3.	 To examine the Centers for Medicare & Medicaid Services’ (CMS) 

oversight of the compliance of State contracts with the required 

Federal credentialing provisions. 

BACKGROUND 

Medicaid Managed Care 

States are increasingly adopting managed care as a response to growing 

Medicaid expenditures.1, 2 Nationally, Medicaid enrollment grew from 

36.5 million3 in 2001 to 57.1 million in 2011.4 Of these 57.1 million 

Medicaid beneficiaries, 74 percent were enrolled in managed care.5 

During a similar period, State Medicaid expenditures increased from 

$89 billion to an estimated $156 billion, accounting for an estimated 

24 percent of States’ expenditures in 2011.6 Total Medicaid expenditures 

more than doubled from approximately $200 billion in 2000 to 

$432 billion in 2011.7 

MCEs 

States contract with MCEs to provide or arrange for health care services 

on a Statewide or community basis. On the basis of these contracts, an 

MCE is paid a fixed prospective payment for each beneficiary enrolled 

1 Robert Wood Johnson Foundation, Medicaid Managed Care: Cost, Access, and Quality 

of Care, Research Synthesis Report No. 23, September 2012. pp. 1-4.
 2

 Managed care is a health care delivery system that aims to maximize efficiency by 

negotiating rates, coordinating health care, and managing the use of services.
 3

 CMS, National Summary of Medicaid Managed Care Programs and Enrollment as 

July 2010. Accessed at http://www.cms.gov on April 30, 2013. 4

 CMS, National Summary of Medicaid Managed Care Programs and Enrollment as
 

July 2011. Accessed at http://www.cms.gov on April 30, 2013. 5

 CMS, 2011 Medicaid Managed Care Enrollment. Accessed at https://www.cms.gov/ 

on April 23, 2012. 

6

 National Association of State Budget Officers, 2010 State Expenditure Report, pp. 

44-45. Accessed at http://www.nasbo.org/publications-data/state-expenditure-report on
 

March 28, 2012. 

7

 CMS, 2011 Actuarial Report on the Financial Outlook for Medicaid, 2012. Accessed at 

http://www.cms.gov on June 22, 2012.
 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 1 
 

 

 

 

 

with the MCE. This fixed payment amount is referred to as the 

“capitated rate.” 

There are various types of MCEs, including Managed Care Organizations 

(MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory 

Health Plans (PAHPs).8, 9

 An MCO provides health care services through 

a comprehensive risk contract with the State.10, 11 PIHPs and PAHPs 

provide health care services under a managed care contract with the State, 

but those entities do not have comprehensive risk contracts. PIHPs 

generally provide inpatient or institutional services (e.g., mental health 

services), and PAHPs generally provide outpatient services (e.g., dental 

services). For purposes of this report, we refer to MCOs, PIHPs, and 

PAHPs collectively as MCEs. 

Federal Credentialing Contract Provisions 

The Balanced Budget Act (BBA)12 provided a framework for CMS and 

States to improve the oversight of managed care. (In 2002, consistent with 

the BBA, CMS issued a final rule that mandated new Federal provisions 

that States must include in their contracts with MCEs.13) These provisions 

address provider selection standards that States must follow to ensure the 

delivery of quality health care.14 

Federal regulations give States considerable latitude to create their own 

uniform credentialing and recredentialing policies and procedures (which 

we refer to in this report collectively as “credentialing policies”). 

However, these Federal regulations established provider selection 

standards that require States to (1) establish uniform credentialing policies 

8

 The other four types of MCEs identified by CMS for purposes of tracking enrollment 

include: (1) Primary Care Case Management Providers, (2) Health Insuring 

Organizations, (3) Programs for All-Inclusive Care for the Elderly, and (4) Other. 9

 MCOs, PIHPs, and PAHPs are subject to the Federal requirements for provider 

credentialing. 42 CFR § 438.214.
 10 Comprehensive risk contracts cover inpatient hospital services and three or more of the 

following services: outpatient hospital services; rural health clinic services; federally 

qualified health center services; laboratory and x-ray services; nursing facility services; 

early and periodic screening, diagnostic, and treatment services; family planning services; 

physician services; and home health services. 

11 MCOs are defined in Federal regulations as entities that meet certain Federal 

requirements and have a comprehensive risk contract with the State. In a risk contract, 

the MCE assumes risk for the cost of the services covered under the contract and incurs
 

loss if the cost exceeds the payments. 42 CFR § 438.2. 12 BBA, P.L. 105-33, §§ 4701-4710. 13 67 Fed. Reg. 40989-40990 (June 14, 2002). Accessed at 

https://www.federalregister.gov on April 23, 2012. 14 67 Fed. Reg. 40989, 41031 (June 14, 2002). 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 2 
 

 

 

 

 

 

 

 

and (2) in State contracts with MCEs, require that MCEs do the 

following:15, 16, 17 

	 follow the States’ uniform credentialing policies,18 

	 follow a documented process for credentialing providers that have 

signed contracts or participation agreements with MCEs,19 

	 not discriminate against providers that serve high-risk populations 

or specialize in conditions that require costly treatment,20, 21 and 

	 follow any additional requirements established by the State.22 

Provider Credentialing and Recredentialing 

Although Medicaid regulations do not define credentialing or 

recredentialing, for the purposes of this report, we define credentialing as 

an evaluation of the qualifications of health care providers (providers) that 

seek contracts or participation agreements with an MCE.23 The 

credentialing process typically includes steps such as the verification of 

information on provider applications, site reviews of provider offices, and 

determination of eligibility for payment under Medicaid. Recredentialing 

is the periodic update of credentialing information and may also include 

provider performance data, such as beneficiary complaints, and 

pay-for-performance and value-driven health care outcomes24 to ensure 

that providers furnish quality health care. 

State Monitoring of MCEs 

States are responsible for monitoring MCE compliance with contract 

provisions, including the Federal provider selection standards and any 

credentialing requirements established by the State.25 States decide how 

15 42 CFR §§ 438.200 and 438.204(g).
 16 42 CFR § 438.214(a) and (b).
 17 One additional requirement is that MCEs may not employ or contract with providers 

excluded from participation in Federal health care programs. 42 CFR § 438.214(d).
 18 42 CFR § 438.214(b)(1). 

19 42 CFR § 438.214(b)(2). 

20 42 CFR § 438.214(c). 21 High-risk populations include, but are not limited to, adults and children with special 

needs, such those with: mental illness, substance abuse problems, developmental 

disabilities and functional disabilities, or complex problems involving multiple medical 

and social needs like HIV/AIDS and homelessness.
 22 Federal regulations authorize the States to establish additional standards for their 

credentialing policies. 42 CFR § 438.214(e). 

23 We based our definition of credentialing on CMS’s Medicare Managed Care Manual, 

Pub. No. 100-16, ch. 6, § 60.3. 

24 Pay-for-performance links health care spending to quality and effectiveness. The 

Commonwealth Fund, Pay-For-Performance in State Medicaid Programs: A Survey of 

State Medicaid Directors and Programs, April 2007.
 25 42 CFR §§ 438.8(b)(6), 438.202(c), and 438.12. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 3 
 

 

 

 

 

 

 

they monitor MCEs.26 For example, States may conduct compliance 

audits of MCEs. Typically these audits include the use of compliance 

tools, such as procedural documents and checklists. Federal regulations 

require States with certain types of MCE contracts to conduct external 

quality reviews (EQRs) to ensure the delivery of quality health care.27, 28 

These regulations mandate that States conduct three types of EQR 

activities, one of which includes a review to determine MCE compliance 

with the Federal provider selection standards.29, 30, 31 

CMS Oversight of States 

Federal regulations specify that CMS regional offices must review and 

approve State contracts with MCEs.32, 33 CMS implemented the use of a 

Checklist for Managed Care Contract Approval (checklist) that regional 

office staff use when evaluating State contracts with MCEs.34 Figure 

1 illustrates this review process. 

26 States do not perform credentialing functions. States, in their contracts with MCEs, 

include all credentialing requirements for MCEs to perform. States must monitor how 

MCEs comply with contract provisions. 

27 MCOs and PIHPs are subject to EQR regulation. 42 CFR pt. 438.
 28 States may choose an external quality review organization (EQRO), a qualified nonEQRO organization, or may designate another State department to perform the EQR.
 

However, an independent agency, such as an EQRO, must draft the final EQR report. 

42 CFR § 438.354.
 29 The review to determine compliance with Federal standards, State requirements, and 

other applicable contract provisions includes the previous 3-year period. 42 CFR pt. 438.
 30 The other two mandatory activities include validation of performance measures 

outlined by the State during the previous 12 months and validation of performance 

improvement projects required by the State. 42 CFR §§ 438.240(b)(1) and
 

438.240(b)(2).
 31 There are five optional EQR activities to assess MCO and PIHP performance. 

42 CFR pt. 438.
 32 In some cases, CMS may review and approve model contracts. Model contracts exist 

where there are multiple types of health care plans that a State contracts with MCEs for, 

such as acute-care and long-term-care plans. After being approved by CMS, the model
 

contract serves as the template for States to write individual MCE contracts. For 

example, a model contract may exist for all acute-care MCOs within a county or for all 

MCOs in the entire State. 

33 Federal regulations specify that CMS must review and approve all MCO, PIHP, PAHP, 

and PCCM contracts. 42 CFR § 438.6(a). 

34 Although there is no regulatory requirement for CMS to use a checklist in the review 

process, CMS has an internal policy that staff must use the checklist for the contract to be
 

approved and released to the State. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 4 
 

 

 

Figure 1: CMS Review Process 

CMS regional

offices receive 

the State's 

contracts. 

These 

contracts 

contain 

Federal 

provider

selection 

standards. 

CMS 

regional

office staff 

use the 

checklist to 

evaluate 

contract 

provisions

for 

compliance

with 

Federal 

provider

selection 

standards.

Any instances

of blank or 

insufficient 

contract 

documentation 

are addressed 

with the State 

by CMS

regional office. 

Upon

approval of

the 

contracts, 

the State 

writes 

individual 

contracts 

with MCEs. 

Source: OIG analysis of 32 CMS checklists and interviews with CMS regional office staff, 2011–2012. 

The checklist is intended to assist CMS regional office staff in 

determining whether the contracts comply with all Federal statutory and 

regulatory requirements, including the Federal provider selection 

standards.35 When completing the checklist, CMS regional staff are 

required to cite evidence from the contract (e.g., section and page number 

from the contract or supporting documentation) to support their 

assessment that the contract was compliant with each requirement. 

Regional office staff address any instances of absent or insufficient 

contract documentation with State staff during contract reviews. 

The checklist also requires the contract to include the following: the name 

of the CMS reviewer, the name of the State, the contract period, the name 

of the MCE, the type of program, the type of MCE (e.g., MCO, PIHP, or 

PAHP), the type of review (e.g., initial contract or contract renewal), and 

the date that CMS staff reviewed the contract. (See Appendix A for 

credentialing checklist items.) Multiple CMS reviewers may complete 

portions of the checklist during contract review. CMS is revising the 

checklist and expects to complete the revisions in 2013. 

METHODOLOGY 

Scope 

Our evaluation determined the extent to which the six selected States 

established uniform credentialing policies and included the required 

35 Statutory references and regulatory requirements include applicable sections of the 

Code of Federal Regulations, the State Medicaid Manual, State Medicaid Directors 

Letters, and the Social Security Act (SSA). 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 5 
 

 

 

Federal credentialing provisions in contracts with MCEs.36 All of the 

State policy documents and contracts with MCEs that we collected were in 

effect during 2011. We also determined the extent to which States 

monitored MCE compliance with Federal credentialing contract 

provisions and any State-established credentialing requirements. We 

collected States’ most recent compliance audits of MCEs,37 which were 

from 2010; States’ most recent compliance tools, which were from 

2011 and 2012; and States’ most recent EQRs, which were from 2010 and 

2011.38 

We examined CMS’s oversight of the compliance of State contracts with 

Federal credentialing provisions. We focused on the credentialing section 

of the checklist and collected checklists for active contracts with States. 

Finally, we analyzed data from interviews we conducted with CMS and 

State staff during 2011 and 2012. 

Sample Selection 

We purposively selected six States—Arizona, California, Florida, 

New York, Pennsylvania, and Texas. We selected Arizona because it has 

some of the oldest contracts with MCEs in the United States. We selected 

five additional States to include those with the greatest total numbers of 

MCEs per State and the largest percentages of Medicaid beneficiaries 

enrolled in these MCEs as of July 2010 (see Table 1).39, 40 Collectively, 

these six States represented 37 percent of total Medicaid managed care 

enrollment and 46 percent of the total number of Medicaid MCEs 

nationwide.41 

Within the six States, we included only the three types of MCEs that are 

subject to the Federal credentialing provisions: MCOs, PIHPs, and 

PAHPs. These totaled 234 MCEs. Collectively, these three types of 

MCEs represent 86 percent of Medicaid beneficiaries enrolled in managed 

care in the six States. (See Appendix B for details about the number of 

Medicaid beneficiaries enrolled in all types of MCEs.) 

36 For the purposes of this report, we did not assess compliance with the provider 

selection standard relating to excluded providers. A February 2012 OIG report—
 

Excluded Providers in Medicaid Managed Care Entities, OEI-07-09-00630—focused on
 

this requirement.
 37 Some States conduct compliance audits annually, whereas other States conduct them at 

intervals ranging from 1 to 3 years. 

38 EQRs are conducted every 3 years. 

39 CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 40 For sampling purposes, we included all seven types of MCEs that CMS identifies for 

purposes of tracking enrollment: (1) Medicaid and Commercial MCOs, (2) PIHPs, 

(3) PAHPs, (4) Primary Care Case Management Providers, (5) Health Insuring 

Organizations, (6) Programs for All-Inclusive Care for the Elderly, and (7) Other. 41 CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 6 
 

 

 

 

 

 

 

 

The 6 States are under the oversight of 5 of the 10 CMS regional offices. 

As part of our evaluation, we interviewed staff from these five regional 

offices. 

Table 1: Medicaid Managed Care Enrollment in Six Sampled States 

State 

Total 

Number 

of MCEs 

in State 

Medicaid Beneficiaries 

Total Number 

Enrolled in 

Medicaid 

Total Number 

Enrolled in 

Medicaid 

Managed Care 

Percent Enrolled in 

Medicaid Managed 

Care 

California 47 7,326,862 4,033,378 55% 

New York 61 4,740,518 3,226,755 68% 

Texas 25 3,763,896 2,520,307 67% 

Florida 69 2,853,392 1,839,940 64% 

Pennsylvania 67 2,029,591 1,658,059 82% 

Arizona 30 1,322,359 1,196,192 90% 

Purposive 

Sample of Six 

States 

29942 22,036,618 14,474,631 66% 

All Other 

States 356 32,575,775 24,545,244 75%

 Total 655 54,612,393 39,019,875 71% 

Source: CMS, 2010 Medicaid Managed Care Enrollment Report, 2011. 

Data Sources and Data Collection 

State establishment of uniform policies and inclusion of the required 

Federal credentialing provisions in contracts with MCEs. From the six 

States, we collected State contracts with MCEs and other State documents, 

such as State laws, administrative codes, and State-issued policy letters. 

We grouped the contracts into 32 types; each type corresponded to a 

contract or model contract that the States used for writing individual MCE 

contracts. 

State monitoring of MCE compliance with contract provisions. To 

determine whether States monitored MCEs, we conducted onsite and 

followup telephone interviews with State staff who were responsible for 

contract oversight and MCE monitoring. We collected documents that 

substantiate States’ monitoring of MCEs, including compliance audits; 

audit compliance tools, such as procedures and checklists; and EQRs. 

From these six States, we collected only the credentialing sections of 

audits from 2010. In addition, the six States provided us with their 

credentialing policy documents, such as manuals, for all MCEs. 

42 Although there was a total of 299 MCEs among the 6 sampled States, we included only 

the 3 types of MCEs subject to the Federal credentialing provisions. These totaled 

234 MCEs. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 7 
 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 

  

CMS oversight of the compliance of State contracts with required Federal 

credentialing provisions. We collected 32 checklists from the 5 CMS 

regional offices that had oversight of the 6 sampled States. These 

32 checklists were used by CMS to review the 32 contracts used by the 

States to write individual MCE contracts. We conducted telephone 

interviews with CMS staff in the five CMS regional offices and in the 

central office about their use of the checklists to review and approve 

managed care contracts. We also asked CMS central office staff whether 

they provided guidance to regional offices about checklist use. 

Data Analysis 

State establishment of uniform policies and inclusion of the required 

Federal credentialing provisions in contracts with MCEs. We reviewed 

State documents, such as State laws, administrative codes, and Stateissued policy letters, to determine whether States established uniform 

credentialing policies. We then reviewed the 32 contracts to verify that the 

States required MCEs to: 

	 follow the States’ uniform credentialing policies, 

	 follow a documented process for credentialing providers that have 

signed contracts or participation agreements with MCEs, 

	 not discriminate against providers that serve high-risk populations 

or specialize in conditions that require costly treatment, and 

	 follow any additional requirements established by the State. 

State monitoring of MCE compliance with contract provisions. We 

analyzed our interview responses from State staff to understand how the 

six States monitored MCEs’ compliance with Federal contract provisions 

and any State-established credentialing requirements. We then reviewed 

compliance audits and audit compliance tools provided by the six States 

and EQRs provided by two States to substantiate our onsite interview 

responses.43 In addition, we reviewed all the MCEs’ credentialing policy 

documents to verify that each MCE had written credentialing policies. To 

determine whether these documents complied with the Federal 

credentialing provisions, we compared them to the State contracts with 

MCEs. 

CMS oversight of the compliance of State contracts with required Federal 

credentialing provisions. We reviewed the 32 CMS checklists to 

determine whether regional office staff completed the checklists 

accurately when reviewing the contracts. To determine whether staff 

43 We excluded EQRs from four of our six States because their most recent EQRs were 

conducted prior to 2010. 

8 
 

 

 

verified that the contracts complied with the Federal credentialing 

requirements, we compared the checklists with the contracts. We analyzed 

our interviews with CMS regional and central office staff to supplement 

and validate our understanding of how regional office staff evaluate 

compliance of State contracts and complete the checklists. 

Limitations 

The results of our analyses are limited to the purposive sample of the 

6 States we selected and their 234 MCEs. We do not project these results 

on a national basis. 

Standards 

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 9 
 

FINDINGS 

All six States’ credentialing policies and MCE contract 

provisions met Federal standards 

All six States established uniform credentialing policies, such as State 

laws, administrative codes, and State-issued policy letters. (See 

Appendix C for the criteria that these States required in their uniform 

policies.) In addition, all six States included the required Federal 

credentialing provisions in their contracts with MCEs, which required 

MCEs to: 

	 follow the States’ uniform credentialing polices, 

	 follow a documented process for credentialing providers that have 

signed contracts or participation agreements with MCEs, 

	 not discriminate against providers that serve high-risk populations 

or specialize in conditions that require costly treatment, and 

	 follow additional requirements established by the State. 

With respect to the additional requirements established by the States, all 

six States required that MCEs: use a peer review credentialing committee 

to evaluate provider credentialing files, conduct onsite reviews of 

physician offices, use provider performance data during recredentialing, 

and notify the State if a provider is suspended or terminated from the 

MCE network. (See Appendix D for more information about the States’ 

additional requirements.) 

Five of six States did not monitor MCEs’ compliance 

with the Federal provider nondiscrimination contract

provision 

All six States monitored MCE compliance with three of the four Federal 

credentialing contract provisions and all State-established credentialing 

requirements. However, five of six States did not monitor MCEs’ 

compliance with the Federal contract provision to not discriminate against 

providers that serve high-risk populations or that specialize in conditions 

that require costly treatment. These five States’ 2011 and 2012 auditing 

tools (e.g., procedures and checklists) did not address MCE compliance 

with this requirement, nor did their 2010 compliance audits or the 

2010 and 2011 EQRs. In addition, during our initial onsite interviews and 

followup interviews, staff from the five States could not indicate how they 

monitored this requirement. During followup interviews with staff from 

the five States, some staff reported that MCEs complied because it was 

required in contracts. Other States’ staff reported that MCEs would not 

need to comply because the MCEs would not discriminate against 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 10 
 

providers. In those instances, the MCEs had contracts or participation 

agreements only with providers that served specialized populations (i.e., 

children under 21 with social and behavioral problems). 

In addition, in three of the five States that did not monitor MCE 

compliance with the provider nondiscrimination contract provisions, nine 

MCEs lacked the nondiscrimination requirement in their policies. Our 

interviews with State staff and our review of MCE credentialing policy 

documents showed that staff in these three States were unaware that the 

nine MCEs lacked this requirement in their policies. 

CMS oversight of the compliance of State contracts 

was inconsistent 

CMS regional office staff are required to indicate on the checklist whether 

State contracts with MCEs comply with all Federal credentialing 

provisions. However, CMS staff did not always indicate whether 

contracts with MCEs met Federal credentialing provisions, and many 

checklists were missing other required information. 

CMS regional office staff did not indicate whether 25 percent 

of State contracts with MCEs met Federal credentialing 

provisions 

In 25 percent of CMS’ reviews (8 of 32 checklists), we found that regional 

office staff did not indicate whether contracts were compliant with all 

Federal credentialing provisions. Our review of the checklists identified 

three ways in which staff did not indicate whether contracts were 

compliant: 

(1) Checklists were incomplete. Staff in two CMS regional offices 

only partially completed State contract reviews of six checklists. 

Although staff indicated that they reviewed State contracts, they 

did not indicate whether these contracts complied with all Federal 

credentialing provisions on the checklists. 

(2) Checklist documentation was contradictory. Staff in one CMS 

regional office indicated on a checklist that a State’s contract with 

an MCE was both compliant and noncompliant with the Federal 

credentialing provisions. For example, on one section of the 

checklist, staff indicated that the contract included the Federal 

provider nondiscrimination provision; on another section of the 

checklist, staff indicated that this contract provision was missing. 

In this instance, CMS regional office staff could not explain this 

internal contradiction. 

(3) Checklist incorrectly indicated compliance with Federal provision. 

Staff in one CMS regional office incorrectly indicated on the 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 11 
 

 

checklist that the Federal provider nondiscrimination provision 

was not an applicable contract requirement. In this instance, staff 

indicated that these were contracts with MCEs that, upon 

enrollment, served high-risk populations and thus did not need to 

comply with this Federal provision. However, all State contracts 

are subject to the Federal credentialing provisions and must be 

evaluated for compliance by CMS. Failure to indicate on the 

checklist whether contracts comply with all Federal credentialing 

provisions may lead to inconsistent oversight by staff within the 

CMS regional offices. 

Many checklists were missing other required contract 

information 

All 5 CMS regional offices approved 15 of the 32 contracts (47 percent) 

with checklists that were missing required information other than whether 

the MCEs met Federal credentialing provisions. The 4 most common 

types of information missing from the 15 checklists were the name of the 

CMS reviewer, the contract period, the date of contract review, and the 

type of review (see Table 2). 

Table 2: Required Information Missing on CMS Checklists 

for Reviews of State Contracts With MCEs 

Required Items on the Checklist 

Number of 

Checklists 

Missing Items 

(n=32) 

Name of CMS reviewer 11 

Period of State contract with MCE 6 

Date of CMS review of State contract with MCE 5 

Type of review (e.g., initial, renewal, amendment) 5 

Type of program44 (e.g., waiver type or State plan 

amendment) 3 

Name of State 1 

Name of MCE 1 

Type of entity (e.g., PIHP, PAHP, MCO) 0 

Source: OIG analysis of 32 CMS checklists, 2011. 

44 States provide services to eligible Medicaid beneficiaries through MCEs under State 

plan amendments or waiver programs. Amendments and waivers must conform to the 

Medicaid program requirements specified in the SSA. Waivers allow States more 

flexibility and also control Medicaid spending. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 12 
 

Five of the fifteen checklists were missing two or more types of 

information. For example, one checklist did not include the name of the 

CMS reviewer who completed the contract review, the dates of contract 

review, and the name of the State. These 15 checklists were used to 

review and approve contracts between all 6 States and MCEs. The lack of 

required contract information on the checklist could contribute to 

ineffective oversight. For example, when a State amends its contracts 

with MCEs, CMS regional office staff will reference the checklists and the 

contracts. In one instance, a new staff member from one CMS regional 

office could not identify a previously approved State contract because 

information was missing from the corresponding checklist. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 13 
 

CONCLUSION AND RECOMMENDATIONS 

All six States’ credentialing policies and provisions for contracts with 

MCEs met Federal standards. However, States are also required to 

monitor MCEs’ compliance with these contracts. Five of six States did 

not monitor MCEs’ compliance with the Federal provider 

nondiscrimination contract provision. This provision requires that MCEs 

not discriminate against providers that serve high-risk populations or that 

specialize in conditions requiring costly treatment. Also, CMS oversight 

of the compliance of State contracts was inconsistent. Our review of 

32 checklists showed that CMS regional office staff did not indicate 

whether 25 percent of contracts met all Federal credentialing provisions, 

and many checklists were missing other required contract information. 

We recommend that CMS: 

Issue Guidance to States on Monitoring MCE Compliance With 

the Federal Provider Nondiscrimination Contract Provision 

CMS could issue a State Medicaid Directors’ letter emphasizing States’ 

obligation to monitor MCEs’ compliance with the provider 

nondiscrimination provision. Guidance could include methods for 

monitoring compliance with this provision. In addition, CMS could work 

with States to help identify methods for monitoring compliance with this 

provision. CMS could also require that States include the provider 

nondiscrimination requirement as part of their existing monitoring 

activities, such as compliance audits, compliance tools, or protocols. 

Have CMS Regional Office Staff Accurately Complete the 

Checklist To Ensure State Compliance With the Federal 

Credentialing Provisions 

To ensure that regional offices oversee the compliance of State contracts 

with the Federal credentialing provisions, CMS could implement a process 

to ensure that its regional office staff complete the checklist when 

evaluating compliance with the Federal credentialing requirements. CMS 

could also provide additional education and training to all regional office 

staff on how to document whether State contracts with MCEs are 

compliant with all Federal credentialing provisions. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 14 
 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with both of OIG’s recommendations and will implement 

changes to address them. 

CMS concurred with our first recommendation, that it issue guidance to 

States on monitoring MCE compliance with the Federal provider 

nondiscrimination contract provision. CMS stated that it is preparing such 

guidance, which may be issued as soon as mid-2014. 

CMS concurred with our second recommendation, that it have regional 

office staff accurately complete the checklist to ensure State compliance 

with the Federal credentialing provisions. CMS stated that to better ensure 

that regional office staff complete the checklist accurately and thoroughly 

when evaluating compliance with the Federal credentialing provisions, it 

is developing an electronic checklist. This improved checklist template is 

expected to be operational in early 2014. CMS will train regional office 

staff on the purpose and use of the template. In the interim, CMS will 

reiterate the importance of fully completing the checklist to each of its 

10 regional offices. 

We did not make any changes to the report based on CMS’s comments. 

The full text of CMS’s comments is provided in Appendix E. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 15 
 

 

 

APPENDIX A 

The Centers for Medicare & Medicaid Services’ Checklist for 

Review of States’ Contracts With Managed Care Entities 

The Centers for Medicare & Medicaid Services’ (CMS) regional offices 

must review and approve States’ contracts with Medicaid Managed Care 

Entities’ (MCEs).45 The Checklist for Managed Care Contract Approval 

(checklist) is intended for use by regional office staff to evaluate these 

contracts. The checklist instructions indicate that CMS regional office 

staff are to compare the “Subject” column in the checklist with the 

language in the contract to determine whether the contract contains the 

required language. CMS regional office staff are to enter in the “Where 

Found” column the location of the required language in the contract or 

other State documents. If the language is present and fulfills the 

requirement, CMS regional office staff should place a check in the “Met” 

column. If the language is absent, CMS regional office staff should leave 

the column blank or indicate “no.” Table A-1 shows the provider 

selection items we reviewed for this study. 

Table A-1: Provider Selection Checklist Items for States’ Contracts with MCEs 

Checklist 

Item Regulatory Basis Subject Entity Type 

Where 

Found Met Comments 

D.2.01 

42 CFR 

438.12(A)(2); 

42 CFR 438.214 

Contracts with Health Care Providers. 

In all contracts with health care 

professionals, an MCE must comply with 

the requirements specified in 

42 CFR 438.214, which include: 

selection and retention of providers, 

credentialing and recredentialing 

requirements, and nondiscrimination. 

MCE 

D.2.02 

42 CFR 

438.214(a); 

42 CFR 

438.214(b)(1); 

42 CFR 

438.214(b)(2) 

Selection and Retention of Health Care 

Providers. 

Each contract must require the entity to 

have written policies and procedures and 

a description of its policies and 

procedures for selection and retention of 

providers following the State’s policy for 

credentialing and recredentialing. 

MCE 

D.2.04 42 CFR 

438.214(c) 

Nondiscrimination. 

The contract must require that the 

entity’s provider selection policies and 

procedures not discriminate against 

particular providers that serve high-risk 

populations or specialize in conditions 

that require costly treatment. 

MCE 

Source: Office of Inspector General analysis of 32 selected CMS checklists, 2011. 

45 42 CFR § 438.6(2). 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 16 
 

 

 

 

 

 

APPENDIX B 

Types of Medicaid Managed Care Enrollment by Selected 

States 

States may contract with up to seven different types of Medicaid managed 

care entities (MCEs). For sampling purposes, we included only the three 

types of MCEs subject to the Federal credentialing requirements: 

Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans 

(PIHPs), and Prepaid Ambulatory Health Plans (PAHPs). Table B-1 

shows the number of Medicaid beneficiaries enrolled in the three types of 

MCEs in our sample and the number of beneficiaries in the other four 

types of MCEs, as of June 2010. 

Table B-1: Number of Medicaid Beneficiaries Enrolled in MCEs by Entity Type46 

State 

MCO47 

PIHP PAHP 

Four other 

types of 

MCEs48 Commercial Medicaid- Total

only 

Arizona 0 1,196,192 116,014 0 0 1,312,206 

California 3,211,912 8,201 106 556,741 782,485 4,559,445 

Florida 756,125 334,754 846,885 331,953 590,594 2,860,311 

New York 881,942 2,293,891 28,574 0 22,348 3,226,755 

Pennsylvania 1,094,568 0 1,629,152 479,596 293,005 3,496,321 

Texas 240,119 1,430,435 365,127 62,980 849,756 2,948,417 

Total of six 

States 6,184,666 5,263,473 2,985,858 1,431,270 2,538,188 18,403,455 

All Other 

States 5,013,645 9,433,306 6,378,372 10,014,871 7,612,348 38,452,542 

Total of 50 

States 11,198,311 14,696,779 9,364,230 11,446,141 10,150,536 56,855,997 

Source: Office of Inspector General analysis of the Centers for Medicare & Medicaid Services’ 2010 Medicaid Managed Care 

Enrollment Report, 2011. 

46 Total number of enrollees includes those who were enrolled in more than one managed 

care plan. Figures also include individuals enrolled in State health care reform programs 

that expand eligibility beyond traditional Medicaid eligibility standards. 

47 A commercial MCO provides comprehensive services both to commercial enrollees 

and to Medicaid beneficiaries and/or Medicare beneficiaries. A Medicaid-only MCO 

provides comprehensive services only to Medicaid beneficiaries, not to commercial 

enrollees or Medicare beneficiaries. 

48 The other four types of MCEs include: Health Insuring Organization, Program for 

All-Inclusive Care for the Elderly, Primary Care Case Management Provider, and Other. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 17 
 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 18 

 

APPENDIX C 

Selected Criteria for Six States’ Uniform Credentialing and 

Recredentialing Policies 

Although States are required to establish uniform credentialing and 

recredentialing (credentialing) policies and include these policies in 

contracts with Medicaid managed care entities, States have the authority to 

determine the specific criteria for their policies. Table C-1 shows the 

credentialing criteria for each of the six States in our study. States do not 

necessarily limit their requirements to the criteria reflected in the table. 

We grouped together common requirements for all provider types (e.g., 

physicians and nonphysicians); however, some States specify other 

requirements for each provider type. 

Table C-1: Selected Credentialing Criteria for Six Sampled States 

Provider Credentialing 

Arizona

California

Florida

Pennsylvania

New York

Texas 

Verification of the following: 

1. Current license, certifications (or practitioner number), degree(s), and residency 

or specialty training Y49 Y Y Y Y Y 

2. Status with Medicare and Medicaid Programs, including sanctions and the 

Health and Human Services Office of Inspector General list of excluded 

individuals/entities 

Y Y Y Y Y Y 

3. Evidence of malpractice/liability insurance and pending lawsuits or litigations Y Y N Y Y Y 

4. Sanctions or limitations from State agencies or licensing boards Y Y Y Y Y Y 

5. A valid Drug Enforcement Administration certification or number Y Y Y Y Y Y 

6. Present in the National Provider/Practitioner Databank. In lieu of this, verify the 

following: any disciplinary action with regulatory board, State sanctions, or 

disciplinary claims resulting in a judgment or settlement. 

Y Y Y Y Y Y 

7. Adherence to the ethics of the appropriate professional organization (e.g., 

American Medical Association) N N N Y N Y 

8. Work history Y Y Y Y N Y 

Attestation of the following: 

9. Any limitations in ability to perform essential position functions Y Y Y N N Y 

10. History of loss of license or felony convictions Y Y Y N N Y 

11. Lack of loss or limitation of privileges or disciplinary activity Y Y Y N N Y 

12. Lack of present illegal drug use Y Y Y N N Y 

Provider Recredentialing 

13. Occurs at least every 3 years Y Y Y Y Y Y 

14. Involves verifying/updating information obtained during credentialing Y Y Y Y Y Y 

15. Is a documented process that includes provider performance data, such as 

complaints, quality of care issues, and results of medical record reviews Y Y N Y Y Y 

Source: Office of Inspector General analysis of State documents, 2011–2012. 

49 “Y” indicates that the State requires this credentialing criterion. “N” indicates that the 

State did not require this credentialing criterion. 
APPENDIX D 

Additional State Credentialing and Recredentialing 

Requirements 

Federal regulations authorized States to establish additional standards for 

their credentialing and recredentialing policies.50 Our review of six 

States’ credentialing and recredentialing policies for Medicaid managed 

care entities (MCEs) showed that all six States established additional 

credentialing and recredentialing requirements and included them in their 

contracts with MCEs. We developed four categories to describe these 

requirements: 

(1) Credentialing committee. All six States specified that MCEs must 

designate a credentialing committee that uses a peer review 

process to evaluate provider credentialing files (including 

recredentialing files). These States typically required that a 

medical director (a physician) oversee the credentialing committee. 

One State’s policy required that the medical director delineate the 

credentialing roles within the committee. The credentialing 

committee, including the medical director, is responsible for 

credentialing decisions and is required to document its steps in the 

decision process and maintain individual provider files. 

(2) Onsite reviews. All six States required onsite reviews of physician 

offices during initial credentialing; however, only two of the six 

States required onsite reviews during recredentialing. One of these 

six States required onsite reviews during recredentialing for dental 

providers only. In addition, in four States, MCEs may conduct 

onsite reviews of physician offices for any reason, including 

complaints from Medicaid beneficiaries. During this site review, the 

MCEs evaluate medical records and confidentiality practices and 

investigate any type of complaints (e.g., complaints from 

beneficiaries, the public, or providers). 

(3) Provider performance data during recredentialing. All six States 

required MCEs to have a documented process for monitoring 

provider performance. In addition, all six States required MCEs to 

have procedures that consider provider performance data during 

the recredentialing process. Examples of provider performance 

data included complaints from Medicaid beneficiaries; quality of 

50 42 CFR § 438.214(e). 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 19 
 

care issues; pay-for-performance data;51 and utilization 

management information, such as emergency room use and 

beneficiaries’ lengths of stay in hospitals. 

(4) Notification requirement. All six States required MCEs to have a 

documented process for reporting to appropriate authorities—such 

as the State and the State medical board—serious issues or quality 

deficiencies that result in suspension or termination of a provider. 

For example, MCEs in one State were required to document their 

disciplinary actions against providers, including suspension or 

termination of a provider’s privileges. In such a case, the MCE 

must notify the provider and the State. 

51 Pay-for-performance links health care spending to quality and effectiveness. The 

Commonwealth Fund, Pay-For-Performance in State Medicaid Programs: A Survey of 

State Medicaid Directors and Programs, April 2007. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 20 
APPENDIX E 

Agency Comments 

,.........,


( tf_ DEPARTMENT OF HEALTH & HUMAN SERVICES Centers for Medicare & Medicaid Serviceo ,::tz'­

DATE: 

TO: 

FROM: 

SUBJECT: 

Administrator 

Washington, DC 20201 

AUG • S Z01l 

Daniel R. Levinson 

Inspector General 

Marilyn Tavenner 

Administrator 

Office of Inspector General (OIG) Draft Report: "State and CMS Oversight of 

the Medicaid Managed Care Credentialing Process" (OEI-09-1 0-00270) 

Thank you for the opportunity to review and comment on the subject OTG draft report. The 

Centers for Medicare & Medicaid Services (CMS) has reviewed this report and offers the 

following comments. 

Federal regulations require states to ensure the delivery ofquality health care to Medicaid 

beneficiaries under managed care. The purpose of this study was to determine the extent to 

which states comply with the federal regulations to establish uniform provider credentialing 

policies and include federal credentialing provisions in contracts with Medicaid Managed Care 

Entities (MCEs). States must also monitor MCEs' compliance with these federal provisions and 

any additional state credentialing requirements in contracts. 

The OIG sampled six states (Arizona, California, Florida, New York, Pennsylvania, and Texas) 

and 234 MCEs that included the three types ofMCEs subject to the federal credentialing 

regulations (Managed Care Organizations, Prepaid Inpatient Health Plans, and Prepaid 

Ambulatory Health Plans). To determine the extent to which states complied with the federal 

regulations, OIG reviewed state documents such as laws, administrative codes, state-issued 

policy letters, and 32 contracts. To determine whether states monitored MCE compliance with 

contracts, OIG reviewed states' auditing documents and conducted interviews with state staff. 

To examine CMS's oversieht ofstates' contracts, OIG reviewed 32 checklists used by CMS 

regional office staff to evaluate compliance ofthe 32 state contracts with the federal 

credentialing provisions. 

All six states' credentialing policies and provisions for contracts with MCEs met federal 

standards. However, states are also required to monitor MCEs' compliance with these contracts. 

The OIG found that five of six states did not monitor MCEs' compliance with the federal 

provider nondiscrimination contract provision. This provision requires that MCEs not 

discriminate against providers that serve high-risk populations or specialize in conditions 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 21 
 

 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 22 
ACKNOWLEDGMENTS 

This report was prepared under the direction of Timothy Brady, Regional 

Inspector General for Evaluation and Inspections in the San Francisco 

regional office, and Michael Henry, Deputy Regional Inspector General. 

Anthony Guerrero-Soto served as the team leader for this study. Other 

Office of Evaluation and Inspections staff from the San Francisco regional 

office who conducted the study include Marcia Wong. Central office staff 

who provided support include Kevin Farber, Meghan Kearns, and 

Christine Moritz. Leah Bostick of the Dallas regional office also provided 

support. 

State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) 23 
 

Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.