CMS’s Push for Medicaid Provider Revalidation: What Providers Need to Know

On April 23, 2026, Dr. Mehmet Oz, in his capacity as Administrator of the Centers for Medicare & Medicaid Services ("CMS"), launched a sweeping federal initiative aimed at eliminating fraud, waste, abuse, and corruption amongst Medicaid health providers. Under Oz’s signature, CMS issued two significant communications to the Governors and Medicaid Directors in all 50 states. In the correspondence addressed to each Governor CMS requested each state's Medicaid program to perform a swift revalidation of high risk Medicaid providers as part of the state's program integrity obligations under federal law. The second, a companion letter addressed to each State’s Medicaid Director, formally requested that each state develop and submit a comprehensive two-year provider revalidation ("PR") strategy describing how the state ensures the accuracy of its provider enrollment data through revalidation and related approaches such as provider directory validation. Read together, these communications make clear that CMS is pursuing an aggressive, multi-track approach to Medicaid program integrity, and that providers should expect heightened scrutiny in the months ahead. 

Background and Federal Expectations

CMS frames the revalidation effort as an urgent response to “corrupt individuals and organizations masquerading as healthcare providers are defrauding Medicaid and American taxpayers of billions of dollars each year”. While in the State Medicaid Director letter CMS acknowledges that the majority of Medicaid providers are legitimate, CMS warns that national trends "strongly suggest[] a persistent and growing Medicaid threat posed by sophisticated actors knowingly exploiting these complex systems for financial gain." 

These communications clearly set forth CMS’s expectation that states maintain accurate and regularly updated provider enrollment information as a "critical foundation" of the agency's efforts to safeguard Medicaid program integrity.  Importantly, the letters indicate that CMS’s is expecting states to go above and beyond the typical revalidation cycles for Medicaid providers that states already have in place. 

What CMS Is Requiring of States

In the Governor letter, CMS requests that states notify CMS within 10 business days of receipt of the letter regarding whether they intend to carry out a swift revalidation of high-risk providers, along with a proposed timetable. CMS cautioned failure to respond “will be considered as [the agency] evaluates the likelihood of fraud in each state going forward.”

The State Medicaid Director letter requires each state to submit a comprehensive two-year PR strategy within 30 days of receipt. CMS specifies that this strategy must be submitted by the State Medicaid Director personally, not a designee. The strategy must address several enumerated elements, including: the state's proposed methodology and timeline for conducting off-cycle provider revalidation with a focus on high-risk providers (including providers without an NPI and those categories of providers noted below); the metrics the state will use to measure the effectiveness and progress of its PR strategy; the state's approach for verifying that provider information is kept accurate and up to date on an ongoing basis; how the state ensures consistency and accuracy of provider data across fee-for-service and managed care delivery systems, including oversight of managed care plan provider directories; and how the state Medicaid agency coordinates, or will coordinate, with relevant law enforcement partners. 

CMS also urges states to increase oversight of provider types designated in the "high" categorical risk level under 42 C.F.R. § 455.450 by adopting off-cycle or more frequent revalidation intervals than the minimum five-year requirement under 42 C.F.R. § 455.414. States may also wish to prioritize high-risk providers who have not been screened within the past 12 months for near-term revalidation. Regardless of how a state defines "high risk," (which CMS notes is up to the state) CMS expects that every state's plan will address how it assesses provider enrollment for providers without a National Provider Identifier. All correspondence related to these requests must be submitted to programintegrity@cms.hhs.gov.  

Practical Guidance for Medicaid-Enrolled Providers

In light of these federal directives, providers currently enrolled in state Medicaid programs, and in particular those providers that are considered to be “high risk”, including home health agencies, hospices, durable medical equipment suppliers, and skilled nursing facilities, should take proactive steps to ensure they are positioned to withstand heightened revalidation scrutiny going forward. The following measures are recommended:

Confirm and Maintain National Provider Identifier (NPI) Status. Both the Governor letter and the State Medicaid Director letter single out providers without NPIs as a priority for revalidation. Any provider that has not obtained an NPI should do so swiftly. Providers who already hold NPIs should verify that their NPI information is current and accurate with the National Plan and Provider Enumeration System ("NPPES").

Audit Enrollment Records for Accuracy. CMS identifies the accuracy of provider enrollment data as a "critical foundation" of its program integrity efforts. Providers should review their Medicaid enrollment files with their respective state Medicaid agencies to ensure that all information on record, including ownership, address, licensure, and contact details, is complete and up to date. Discrepancies or outdated information can trigger additional scrutiny or delays during revalidation. Given CMS's stated intent to "suspend or terminate clearly abusive actors from the program," accuracy in enrollment records is essential.

Review Billing Practices and Compliance Programs. CMS's letters highlight that providers with less rigorous billing requirements are particularly vulnerable to fraud and are a focus of the revalidation effort. Providers should conduct internal audits of their billing practices to identify and correct any irregularities. This includes verifying that all claims submitted to Medicaid accurately reflect services rendered, are properly documented, and comply with applicable state and federal billing rules. Providers should also review and, if necessary, strengthen their compliance programs to ensure they have adequate safeguards against fraud, waste, and abuse. CMS has made clear that screening alone may not detect all forms of fraud, "including schemes involving technically qualified individuals," signaling that even providers who pass initial revalidation may face ongoing scrutiny. 

Monitor State-Level Revalidation Timelines and Requirements. Because states were required to notify CMS of their high-risk revalidation plans within 10 days and to submit full two-year PR strategies within 30 days, providers should expect state Medicaid agencies to begin implementing revalidation activities on an accelerated timeline. Providers should (i) ensure that they are receiving updates from their state Medicaid agency, as these items are sometimes lost as providers move or their information becomes outdated, and then (ii) closely monitor communications from their state Medicaid agencies regarding upcoming revalidation deadlines and requirements. Failure to timely respond to a revalidation request can result in termination from the Medicaid program. 

While few states appear to have published official responses to date, Missouri’s Governor, Mike Kehoe, has confirmed its intent to begin an off-cycle revalidation of Medicaid providers. Missouri’s Department of Social Services, via its Missouri Medicaid Audit and Compliance division (“MMAC”), has published next steps for its off-cycle revalidation. Consistent with CMS’s concerns, MMAC is requiring high-risk providers, including those without NPIs, to re-validate during its Phase I, which ends on October 1, 2026.  We expect other states may follow similar frameworks by prioritizing revalidation of high-risk providers earlier on in their off-cycle revalidation processes. 

Engage Legal Counsel. Providers who have questions about their enrollment status, who have received notices of revalidation, or who have concerns about potential exposure to fraud allegations should consult with experienced healthcare regulatory counsel promptly. The consequences of a failed revalidation, including suspension or termination from Medicaid, can be severe and may also trigger collateral consequences under federal and state fraud and abuse laws.

Conclusion

The twin CMS communications of April 23, 2026, underscore a heightened federal commitment to Medicaid program integrity and signal that aggressive revalidation efforts, backed by specific regulatory authority and defined timelines, are forthcoming at the state level. Providers enrolled in Medicaid should not wait for formal revalidation notices to begin preparing. By taking immediate steps to verify their enrollment information, ensure NPI compliance, audit billing practices, confirm managed care directory accuracy, and engage counsel where appropriate, providers can position themselves to navigate the revalidation process efficiently and minimize the risk of adverse action.

Katten will continue to monitor and report on developments related to state revalidation efforts.