AND THE PROVIDERS SHOULD PREPARE NOW
On March 3, 2026, the Centers for Medicare & Medicaid Services (“CMS”) sent a pointed and detailed letter to Governor Hochul, the New York State Department of Health (“DOH”), and the Office of the Medicaid Inspector General (“OMIG”) demanding responses to a long list of questions directed at the state’s program integrity efforts. On that same date, the U.S. Congress’ Committee on Energy and Commerce (the “Committee”) sent a similar letter to the Governor and the Commissioner of DOH. The message is clear: the federal government is asserting that there are structural vulnerabilities in New York’s Medicaid program creating “a high-risk environment for fraud, waste and abuse” that require immediate corrective action.
The target of the scrutiny is equally clear: personal care providers, home health agencies, adult day care centers, non-emergency medical transportation (“NEMT”) providers, laboratories, Applied Behavioral Analysis (“ABA”) services, behavioral health providers, substance use disorder (SUD) treatment, hospice, and others that use time-unit billing, are a community-based delivery model without facility oversight, or that rely on direct support staff documentation, are considered particularly vulnerable to fraud, waste and abuse. Providers working in these service categories should treat the CMS and Committee letters as an early warning signal, because what happens next at the state level will almost certainly reverberate downstream to the provider community.
What the Federal Government Is Alleging, And Why It Matters
CMS and the Committee point to spending data as evidence of structural vulnerability, noting that New York spends over $90 billion annually on Medicaid with per-beneficiary spending 36% above the national average and per-resident spending nearly 80% higher. CMS’s focus is on five service categories: personal care services, home health, adult day care, NEMT, and behavioral health. The Committee letter highlights these providers as well as laboratories, ABA services, SUD treatment and hospice providers. The data cited, including $44.6 billion in personal care services payments from 2023 through 2025, a 106% spike in adult day care billing, a 65% year-over-year increase in home health payments, $2.82 billion in NEMT spending, over $2.4 billion in behavioral health psychotherapy claims, and high-profile federal prosecutions, is being used to justify a demand for answers from the state. CMS alleges these figures are not simply a product of New York’s higher cost of care, but are indicative of “a high-risk environment for fraud, waste, and abuse.”
That characterization stands in sharp contrast to the reality on the ground for providers who are acting responsibly, doing their best to comply with a myriad of regulations and oversight bodies, and struggling with inadequate reimbursement rates and increasing labor and other costs. New York Medicaid providers already operate under some of the most rigorous oversight in the country, subject to OMIG audits, MFCU investigations, DOH surveys, managed care plan audits, and Comptroller reviews, often simultaneously. The CMS and Committee letters add a layer of federal pressure that will likely intensify and accelerate enforcement activity that already exists.
The Downstream Impact on Providers
When the state responds to CMS and the Committee, it will be compelled to demonstrate the adequacy of its program integrity infrastructure. That means articulating how it monitors providers, how it detects and investigates fraud, and what corrective action it takes when problems are found.
The implications are significant. When CMS describes New York’s oversight failures in structural terms, it is signaling an expectation that the state’s response will be equally structural in scope. Historically, federal audits, investigations and scrutiny on the State’s Medicaid program are often followed by a realignment of or intensification of audit and investigation priorities and focus.
Practically speaking, the ultimate result of the CMS and Committee inquiries will likely mean an increase in OMIG audits and investigations, MFCU referrals and prosecutions, and increased pressure on managed care plans to investigate and recover overpayments from their provider networks. Plans that are already under DOH scrutiny have every incentive to demonstrate robust internal controls, and one of the clearest ways to do that is to show active investigation and recovery from providers.
The service categories CMS and the Committee identified are likely to see increased audit activity, more aggressive pre-payment review, increased investigative activity, and greater scrutiny of billing patterns that deviate from peer norms. Other provider categories not expressly named in the CMS and Committee letters, but that share some of the characteristics identified as creating a high-risk profile (time-unit billing structures, community-based delivery without facility oversight, and high reliance on direct support staff documentation) may also find themselves the subject of increased scrutiny. The state’s obligation to demonstrate program integrity to CMS and Congress will increase pressure on OMIG to broaden audit activity, and other providers with these characteristics should not assume that the letter’s silence on their services means they are outside the scope of what follows.
Providers with related entities, common ownership, or shared management across service lines, especially those with potential for referral relationships or interrelated services, should also be on alert for future anti-kickback investigations and increased scrutiny. CMS expressed pointed concern about common ownership between adult day care centers and non-emergency medical transportation providers, and the potential for coordinated fraud between these related entities including “beneficiary recruitment schemes, inflated mileage claims, phantom rides, or billing for transportation to adult day care sessions that never occurred.”
What Providers Should Do Now
For providers already facing a myriad of government oversight surveys and audits by multiple agencies, increasing cost pressures and inadequate rates, and rising labor and other costs, the potential for an uptick in enforcement efforts is alarming. Providers operating in any of the service categories identified by CMS and the Committee, and others that fit the identified risk profile, should not wait for an audit or investigation to assess their exposure. The time to act is before scrutiny arrives, not after.
The single most important thing a provider can do right now is ensure that its compliance program is real, operational, and documented. New York State requires Medicaid providers to have a compliance program as a condition of enrollment and continued participation. One of the defining characteristics of providers that have positive audit outcomes is that they have an effective compliance program that catches noncompliance early and proactively addresses the consequences, including reporting and returning overpayments. A compliance program that exists on paper but is not implemented, not trained on, not monitored, and not updated is not a compliance program, it is a liability.
The stakes of non-compliance extend well beyond audit recoupment. Under the Affordable Care Act, providers are required to report and return identified overpayments within 60 days of identifying them. Failure to do so can convert what was a billing error into a False Claims Act violation, a federal statute that carries treble damages, civil penalties, and criminal charges in appropriate cases. The absence of a compliance program (or a program so inadequate that it cannot detect the very irregularities CMS and the Committee have now publicly identified as systemic risks) exposes providers to the argument that they should have known about an overpayment but failed to do so because they did not have a functioning compliance program. In an environment where auditors and investigators are actively looking for systemic failures, the absence of a functioning compliance program is itself evidence of the kind of structural vulnerability CMS is alleging.
Providers should conduct an honest internal review of billing practices and documentation against the specific risk factors CMS and the Committee identified, as well as OMIG audit protocols in general. The questions CMS and the Committee posed to the state offer a direct preview of likely audit and investigation activity, but once an audit is initiated all of the topics typically reviewed by OMIG are on the table as potential drivers of audit recoupment. Providers who understand what is coming and prepare for it now will be in a fundamentally better position than those who are caught off guard.
If you have questions about your organization’s compliance program, billing practices, or exposure to OMIG or MFCU audit activity, please contact Meliora Law_._
