CMS Administrator Oz Issues Nationwide Medicaid Fraud Warning to All 50 Governors

On April 21, 2026, CMS Administrator Dr. Mehmet Oz announced that his agency would require all 50 states to submit plans within 30 days to revalidate their Medicaid providers, marking the broadest federal intervention into state-administered Medicaid programs in the program's 60-year history [1]. Governors were given 10 business days to confirm whether they would commit to a "swift revalidation" of high-risk providers and provide a proposed timetable [2]. The move follows months of escalating confrontation between the Trump administration and individual states — most prominently Minnesota — over allegations of systemic fraud.

"Corrupt individuals and organizations masquerading as health care providers are defrauding Medicaid, and American taxpayers, of billions of dollars each year," Oz wrote in his letter to governors, "placing valuable resources out of reach for those the program was intended to serve: low-income senior citizens, children, and disabled individuals" [1].

The Scale of the Problem: Improper Payments vs. Fraud

The administration's case rests on headline figures that require careful parsing. In fiscal year 2025, CMS estimated Medicaid improper payments at $37.4 billion, or 6.12% of total program spending — up from $31.1 billion (5.09%) in FY 2024 [3]. These numbers are large, but the term "improper payment" is a technical designation that encompasses far more than fraud.

Source: CMS PERM Data

Data as of Apr 1, 2026CSV

According to KFF, 77.2% of Medicaid improper payments in FY 2025 resulted from insufficient documentation — a provider failing to submit paperwork, or an eligibility form missing a signature — rather than from intentional deception [4]. Eligibility-related documentation errors alone accounted for 68.1% of the total [4]. The White House has repeatedly cited improper payment figures as evidence of fraud without drawing this distinction, a conflation that KFF Health News and the Georgetown Center for Children and Families have criticized [5][4].

The GAO's broader estimate of government-wide improper payments reached approximately $162 billion across 68 programs in FY 2024, with Medicare and Medicaid among the largest contributors [6]. But the GAO itself has cautioned that improper payments "are not a measure of fraud" and that conflating the two undermines the credibility of enforcement efforts [6].

Prior OIG and GAO reports have flagged specific fraud typologies: provider billing schemes (billing for services never rendered), eligibility fraud (individuals or states misclassifying enrollees), and kickback arrangements between providers and referral sources [7]. The Paragon Institute, a conservative think tank, has argued that CMS's reported improper payment rates likely undercount the true figure, estimating actual improper payments could be double the official number due to methodological limitations in the Payment Error Rate Measurement (PERM) program [8]. These claims remain contested by other analysts who note the PERM system has been repeatedly refined.

Minnesota: The Test Case

The 50-state audit grew out of the administration's confrontation with Minnesota, which became a national flashpoint after the "Feeding Our Future" fraud scheme — a $250 million scam involving federal nutrition funds — surfaced in 2022 and led to dozens of convictions [1]. Though that case involved USDA nutrition programs rather than Medicaid specifically, it provided political momentum for broader scrutiny of Minnesota's social program oversight.

In January 2026, CMS notified Minnesota that it would begin withholding $515 million in quarterly federal Medicaid payments, alleging the state was "operating its program in substantial noncompliance" with federal requirements to prevent, detect, and address fraud [9]. Vice President J.D. Vance separately announced the temporary halt of $259 million in federal matching payments [9].

The Georgetown Center for Children and Families called this "the nuclear option" — the first time in Medicaid's history that CMS had proposed withholding the entire federal match across multiple service categories rather than a small percentage of administrative costs [9]. Over the prior 15 years, CMS had initiated compliance actions against only five states, and in nearly all cases, the withhold amounted to 1%, 4%, or 10% of administrative costs [9].

Minnesota pushed back in court. The state's PERM audit results showed that 97.8% of its Medicaid payments in the most recent reporting year were proper, with 98.7% accuracy in fee-for-service payments [9]. A federal district court has since weighed in on the dispute, though the litigation remains ongoing [10].

CMS Legal Authority and Historical Enforcement

The CMS administrator's power to compel state compliance operates through several mechanisms established under the Social Security Act and strengthened by the Consolidated Appropriations Act of 2023. These include requiring corrective action plans, imposing civil money penalties of up to $100,000 per day of noncompliance (starting at $25,000/day for the first 30 days), reducing the Federal Medical Assistance Percentage (FMAP), and deferring payments [11].

Historically, these tools have been used sparingly. Prior administrations typically negotiated corrective action plans with states before escalating to financial penalties. The current administration's approach — threatening payment withholding as a first-order response — represents a significant departure from precedent [9].

States that fail to submit satisfactory revalidation plans within the 30-day window face the prospect of deferred payments, where CMS holds federal matching funds in escrow until the state addresses "program integrity shortcomings" [12]. Oz has signaled that if states "don't take it seriously," the administration may pursue audits "more aggressively" [12].

Who Bears the Cost of Compliance?

The 50-state audit requires states to immediately inventory their current provider lists and identify anyone who hasn't been revalidated in the last three years [12]. High-risk categories singled out for scrutiny include home health care, durable medical equipment suppliers, and hospice providers [12].

For state Medicaid agencies already operating with strained budgets and limited staff, the compliance burden is substantial. Provider revalidation involves verifying licenses, conducting site visits, running background checks, and cross-referencing federal databases. CMS has announced plans to increase its medical coder workforce from 40 to 2,000 and expand individual audit reviews from 35 records to 200 per health plan per year [13]. Whether similar federal resources will be made available to states — or whether states must absorb the cost from general revenue — remains unclear from the announcement.

The question of who pays is not academic. Federal matching funds typically cover 50% to 90% of state Medicaid administrative costs depending on the activity. If revalidation falls under existing program integrity functions, states can claim enhanced federal matching rates. If CMS classifies it as a new compliance requirement without corresponding funding, states face an unfunded mandate.

The Track Record of Fraud Enforcement

Source: HHS OIG MFCU Annual Reports

Data as of Apr 1, 2026CSV

State Medicaid Fraud Control Units (MFCUs), which operate in all 50 states and the District of Columbia, reported 1,185 convictions in FY 2025 — 856 for fraud and 329 for patient abuse or neglect — with combined recoveries of nearly $2 billion [14]. That represented $3.46 recovered for every $1 spent on enforcement, a ratio that has remained relatively stable over recent years [3].

The existing enforcement infrastructure includes MFCUs, the Medicaid Integrity Program, Recovery Audit Contractors (RACs), the HHS Office of Inspector General, and Department of Justice prosecution. The DOJ reported prosecuting half a billion dollars in healthcare and COVID fraud schemes in recent years [15]. Whether a gubernatorial letter campaign will produce measurable fraud reduction beyond what these established mechanisms already achieve is an open question. No peer-reviewed study has demonstrated that executive-level notices to governors — as distinct from targeted audits, prosecutions, or payment suspensions — independently reduce fraud rates.

Collateral Damage: Legitimate Providers and Beneficiaries

Legal advocates and health policy researchers have raised alarms about the consequences of aggressive enforcement for legitimate providers and their patients. Attorneys representing Medicaid providers report that CMS has been "revoking and suspending, but asking questions later," with many providers having payments suspended or being removed from programs before investigations are complete [12].

The downstream effects on beneficiaries are direct. When a hospice provider's payments are suspended, the provider cannot keep its doors open, and patients lose access to care [12]. Reports have documented disruptions including loss of access to HIV medication, opioid dependence treatment, and mental health services for individuals enrolled in affected programs [7].

The academic literature on fraud prevention and access consistently identifies a tension between aggressive enforcement and coverage continuity. Fraud crackdowns that cast wide nets — suspending providers based on statistical outliers or geographic patterns rather than individualized evidence — inevitably sweep in legitimate providers alongside bad actors. The resulting chilling effect can deter providers from serving Medicaid populations at all, exacerbating access problems in communities that already face provider shortages.

Geographic Patterns and Political Context

The Georgetown Center for Children and Families has documented that the administration's fraud enforcement has "focused almost exclusively on Democratic-led states, even though fraud involving government benefits isn't any more prevalent in Democratic-led states than in Republican-led ones according to federal data" [7].

Data on state-level fraud rates does not clearly track with Medicaid expansion status, urban density, or specific managed-care models. New York leads in absolute numbers of flagged providers (159), while smaller states like Vermont (1.08 per 100,000 residents) and Washington, D.C. (1.03 per 100,000) lead in per-capita rates — though small populations make per-capita comparisons unreliable [16]. The Paragon Institute has identified four Medicaid service categories particularly vulnerable to fraud nationally — personal care services, home and community-based services, applied behavioral analysis, and adult day care — which cut across expansion and non-expansion states alike [17].

The political dimension is difficult to ignore. Minnesota, the highest-profile target, is governed by Tim Walz, who ran as the Democratic vice-presidential nominee in 2024. The administration's decision to expand the crackdown to all 50 states may partly reflect an effort to counter accusations of selective enforcement.

The Managed Care Blind Spot

A notable gap in the 50-state audit announcement is the absence of specific accountability measures for private managed-care organizations (MCOs), which now administer the majority of Medicaid benefits in most states. The HHS OIG designated managed care oversight as a priority area, noting that payments from MCOs to providers for services not delivered or lacking documentation represent a significant program integrity risk [13].

The December 2025 MACPAC (Medicaid and CHIP Payment and Access Commission) meeting focused specifically on accountability and oversight gaps in Medicaid managed care [18]. CMS's existing authority over MCOs includes identifying conflicts of interest, verifying contractors, approving state-MCO contracts, and reviewing actuarial rate certifications [13]. When MCOs violate federal requirements, CMS may withhold federal matching funds or refer cases to the OIG for monetary penalties [13].

Yet the Oz letter to governors focuses on provider revalidation — a process that primarily affects individual providers and small practices — rather than on the large managed-care corporations that control billions in Medicaid spending. Critics argue this creates an accountability asymmetry, placing the compliance burden on states and individual providers while leaving the corporate intermediaries that process and pay claims largely unaddressed.

Oz's Credentials and the Credibility Question

Dr. Oz was confirmed as CMS Administrator on April 3, 2025, in a 53-45 party-line vote [19]. His qualifications for the role have been debated since his nomination. He holds an M.D. from the University of Pennsylvania School of Medicine, an M.B.A. from Wharton, completed surgical training in cardiothoracic surgery at New York Presbyterian Hospital, and served as a Professor of Surgery at Columbia University until 2018 [20].

His defenders, including former CMS Administrator Mark McClellan (who served under George W. Bush), have praised his selection [19]. Oz himself has credited his joint M.D.-M.B.A. with providing the managerial skills needed to run a large organization [20]. Senator Susan Collins called him "well respected" [19].

Critics point to the gap between clinical expertise and the bureaucratic, regulatory, and actuarial knowledge required to manage a $1.6 trillion agency. Senator Patty Murray argued that Oz "has zero qualifications, pushes alarming pseudoscience, and holds extreme anti-abortion views" [19]. Health policy scholars have noted that prior CMS administrators typically came from backgrounds in health policy, insurance regulation, or government administration — not television and surgery. Oz has no prior experience running a federal bureaucracy, and his tenure on "The Dr. Oz Show" included repeated promotion of supplements and treatments that lacked robust clinical evidence [20].

The credibility question matters for enforcement. A fraud crackdown requires sustained, technically sophisticated engagement with state Medicaid directors, actuaries, and program integrity staff. Whether Oz's team can execute the 50-state audit at the operational level — processing revalidation plans, conducting follow-up audits, and making defensible enforcement decisions — will determine whether the initiative produces results or remains a high-profile announcement without lasting impact.

What Comes Next

The 30-day clock for state revalidation plans began on April 21, 2026. States must decide whether to comply, negotiate, or resist. Republican governors may find it politically difficult to push back against a Republican administration's anti-fraud initiative, even if the compliance costs are burdensome. Democratic governors face the opposite calculus: resistance risks being framed as defending fraud, while compliance validates an enforcement approach they view as politically motivated.

The Minnesota litigation will likely set important precedents for how far CMS can go in withholding funds. If courts uphold broad withholding authority, the 50-state audit gains real teeth. If courts constrain CMS to proportional, targeted enforcement, the initiative may amount to a documentation exercise with limited consequences for noncompliance.

Meanwhile, the 72 million Americans who depend on Medicaid for health coverage [4] — including low-income children, pregnant women, elderly nursing home residents, and people with disabilities — face the most immediate stakes. The gap between rooting out genuine fraud and disrupting legitimate care is measured in bureaucratic decisions that rarely make headlines but determine whether vulnerable people keep their doctors, their medications, and their coverage.