🔎︎
Centers for Medicare and Medicaid Services Administrator Mehmet Oz, MD, has directed all 50 governors and state Medicaid directors to develop plans for revalidating Medicaid providers operating in areas the agency considers high risk for fraud, waste, and abuse, according to a Reuters report carried by U.S. News & World Report and confirmed in formal CMS letters dated April 23, 2026.
The directive carries two deadlines. Governors have until May 7 to notify CMS whether their state will carry out a swift revalidation of high-risk providers and on what timetable. State Medicaid directors then have 30 days to submit a comprehensive two-year provider revalidation strategy. CMS told states they may define "high risk" themselves, but the agency expects every definition to include any provider operating without a National Provider Identifier.
Speaking at Politico's Health Care Summit on April 21, Oz characterized the audit as a program integrity exercise. He said states with low provider response rates to identity and licensure queries would draw closer federal attention, citing examples in which fewer than a fifth of listed providers responded when contacted to confirm credentials.
Under regulations adopted in 2011, state Medicaid programs already revalidate enrolled providers at least once every five years, using limited, moderate, or high categorical-risk screening. The new request compresses timelines for the highest-risk category, with priority given to providers who have not been screened within the past 12 months and to those without an NPI.
CMS has signaled that states declining to act may face heightened federal audits. In early 2026, the agency paused $259 million in deferred Medicaid payments to Minnesota following a state-specific audit; the case remains in litigation.
