States would review Medicaid fraud risks and address weaknesses

States would assess Medicaid fraud risks, make plans to address identified weaknesses, and report their findings to federal officials. These requirements apply to each state's Medicaid plan and any waiver of that plan. Each assessment must cover the state Medicaid plan and any waiver, including fee-for-service care, managed care, and eligibility and enrollment systems. States must use existing federal and state program integrity data when practicable. Assessments must rank major risks, estimate possible improper spending, review current safeguards, and identify gaps in data sharing, oversight, or enforcement. The first assessment would be due within one year after enactment, with assessments at least annually after that. A corrective plan would be due within 90 days after each assessment. The first report to the Secretary would be due within one year after the first assessment is completed, with annual reports after that.

The Secretary of Health and Human Services would set shared guidelines for state risk reviews and report national findings to Congress. These duties concern state Medicaid fraud risk reviews and reports. The guidelines would set common risk categories and ways to score and rank them so assessments from different states can be compared. The Secretary's report would analyze state reports, identify national trends, review state corrective plans, and recommend legislative or administrative steps. The Secretary would issue guidelines by January 1, 2027. The first report to Congress would be due within one year after the first state report is submitted to the Secretary, with annual reports after that.