How much of each state's Medicaid dollar can still be traced to a service, a provider and a price — and what happened to the rest.
40.3% of all Medicaid spending now sits in jurisdictions that are both heavily capitated and carry above-median data-quality concerns in their federal claims submissions. In those states the money has moved into managed care faster than the data infrastructure that would let anyone see where it went.
Sixteen jurisdictions fall in that quadrant. The exposure is concentrated: California, Texas, New Jersey, Virginia and Washington alone account for $261.5B of it.
CMS-64 quarterly expenditures by state — 2,622 records across 46 quarters, FY2014 through mid-FY2025. Total computable and federal share for every jurisdiction.
Managed Care Enrollment Summary — comprehensive managed care enrollment as a share of total enrollment, 2016 through 2024, every state.
DQ Atlas — 101,565 individual quality assessments across 12 topic areas, 120 topics, 54 jurisdictions and 11 data years, parsed from the full published release set.
Where both exist — FY2016, 52 jurisdictions — managed-care enrollment share and capitation dollar share correlate at r = 0.866. Enrollment share is the current proxy; the dollar series stops in 2016.
Everything here is public and reproducible. No data use agreement, no restricted file, no purchase. The one thing that cannot be built from public data is the thing the study is about: what the capitated dollar actually bought.
Weighted by enrollment, 78.2% of Medicaid beneficiaries were in comprehensive managed care in 2024. North Carolina went from essentially zero to 79.1% in a single program launch; Oklahoma from zero to 54.6%; Michigan from 49.9% to 98.0%; Missouri from 50.3% to 83.6%. A state that moves this fast acquires an encounter-data problem before it acquires encounter-data infrastructure.
CMS assesses each state's managed-care encounter completeness in four claim files — inpatient, long-term care, other services and pharmacy. This is the 2023 assessment, the most recent complete year.
Nine jurisdictions out of 54 earn a clean bill on managed-care encounter completeness. Twenty-one carry medium concern, nine high concern, one is rated unusable, and fourteen are unclassified — which in practice means there was not enough to assess. Massachusetts, which runs 45.8% of enrollees through comprehensive managed care, is the one jurisdiction whose encounter data CMS marks unusable outright.
Horizontal: share of enrollees in comprehensive managed care, 2024. Vertical: share of all DQ Atlas measures rated high concern or worse, 2023. Bubble area is FY2024 total computable spending. Lines are the medians.
Read this map as exposure, not blame. It shows where the most money sits behind the weakest verification. It does not say managed care caused the weakness — the next section tests that directly, and it does not hold.
Breaking all 2023 assessments down by topic area separates two very different failure modes. The transaction-level checks pass almost everywhere. The reference data — who the provider is, which plan was paid, and whether the dollars reconcile — is where states fail.
Service use information, file linking and claim completeness are nearly clean nationally — 3.3%, 3.3% and 4.8%. Expenditure benchmarking sits at 34.1% and managed-care plan information at 30.6%. A state can tell you that a service happened on a date at a place. It often cannot tell you, to CMS's satisfaction, which plan was paid for it or whether the total adds up to what it drew down.
The single most consequential line for anyone doing provider-level work: 26 of 54 jurisdictions carry high concern or worse on the National Provider Identifier in their Medicaid provider file. Half the country cannot reliably identify a Medicaid provider in its own submission. Active enrollment status fails in 47 of 54, facility characteristics in 46 of 52. Provider-level Medicaid analysis is hard not only because the data is restricted, but because the provider dimension itself does not hold.
26 of 54 jurisdictions is 48% by headcount but 65.5% of national Medicaid spending — $601.8B, because the failures include California, New York, Texas, Ohio, Illinois, North Carolina, Michigan, Washington, Arizona, Indiana, Minnesota and Maryland. Eight jurisdictions are rated unusable on provider identifiers outright. Pennsylvania, Florida, Massachusetts, New Jersey, Kentucky, Louisiana, Missouri and Georgia are among the 22 rated low concern.
This tilt is specific to certain checks rather than a general rule: across all 116 topics the dollar-weighted concern rate is 14.3% against 13.3% unweighted, and only 32 of 116 topics skew toward larger states at all. Provider identity happens to be one of the ones that does.
Four candidate explanations, tested across the 52 jurisdictions with both measures. Correlation with the share of quality measures at high concern or worse.
This is the finding that changes what a state should do. Managed-care penetration explains essentially none of the variation in data quality, and neither does how fast a state moved into it. High-penetration states average a 13.4% concern rate; low-penetration states average 13.1%. Idaho runs 6.4% of enrollees through comprehensive managed care and has the second-worst data quality in the country. Kentucky runs 89.9% and has the second-best. The delivery model determines how much is at stake when the data is bad. It does not determine whether the data is bad.
The national average concern rate fell from 17.7% in 2019 to 13.3% in 2023. Of 53 jurisdictions with both years, 47 improved. The six that slipped — Mississippi, Hawaii, Ohio, South Dakota, Utah and Minnesota — slipped by less than 4.3 points each, and three of them started from an unusually clean base.
The lever is expenditure reconciliation. Across the seven largest improvers, the share of expenditure-benchmarking measures at high concern fell from 71.6% to 28.8% — a 42.8-point drop, more than twice the movement in any other area. Making TAF dollars tie out to the CMS-64 draw is what separated the turnaround states from everyone else. Provider information was the second lever, down 20.7 points in the same group.
Nationally the same two areas moved: provider information fell 13.6 points, the largest national improvement of any area. Managed-care plan information fell 1.3 points and is effectively stuck — in the seven turnaround states it actually got worse, by 11.1 points. No state has solved the plan dimension.
Cleanest submission in the country and a heavily capitated program. Came from 16.5% in 2019 — an 11.2-point improvement, second-largest nationally. Proof that the two are not in tension.
Second cleanest, and one of the most heavily capitated programs in the country. Improved 9.0 points from 2019. The combination the quadrant map treats as high-risk, executed well.
The only state that was already clean in 2019 (5.6%) and stayed there. Small program, long-standing managed care, and the highest capitation dollar share on record in FY2016 at 85.6%.
Still the worst concern rate in the country, and the largest improvement in it — from 38.7% in 2019. Worth studying as a trajectory rather than a snapshot: whatever it is doing is working faster than anywhere else.
Almost every state sits in the upper-left quadrant: fewer people, more money. Colorado shed 29.1% of its enrollment and spent 9.4% more. Michigan shed 24.0% and spent 15.7% more. The correlation between enrollment change and spending change is r = 0.255 — weak enough that knowing how many people a state disenrolled tells you almost nothing about what happened to its budget.
The mechanism is selection. Redeterminations remove the people who are cheapest to cover — healthy adults and children who generate few claims — while the high-cost population stays. A state that planned its budget around a headcount reduction was planning around the wrong variable. Four jurisdictions grew: North Carolina (+3.0%) and South Dakota (+14.8%) on expansion launches, Maryland (+2.8%), and the Northern Mariana Islands. Mississippi's +68.4% spending change is far outside the pattern and reads as a reporting or supplemental-payment artifact rather than program growth; treat it as unverified.
The standard explanation for why some states spend far more per enrollee is that they cover an older and more disabled population. Testing it against the TAF-derived eligibility panels for 2022, the last full year those panels cover, it does not hold.
Spending per enrollee ranges from $2,382 to $12,135 across states, and the share of enrollees who are aged or disabled explains essentially none of it. The clearest illustration sits at the two ends: Mississippi carries the highest aged-and-disabled share in the country at 29.4% and spends $5,254 per enrollee. Minnesota carries 15.3% — barely half — and spends $11,181. Pennsylvania at 23.4% spends $10,473; Georgia at 22.1% spends $5,087.
What is left is policy: how broad eligibility is, what the state pays providers, which optional benefits it covers, and how much flows through supplemental payments that raise total computable spending without serving an additional person. Those are decisions, and a state that attributes its cost position to demographics is arguing against its own numbers. Federal match rate — a proxy for state income, since poorer states draw a higher share — correlates at r = −0.289, the strongest of anything tested and still weak.
If population mix does not set a state's cost position, something else does. Testing the policy variables that are publicly measurable — income eligibility thresholds, how much of the program is long-term care, and how much runs through supplemental payments — against spending per enrollee. FY2016, the only year with service-category detail, 51 jurisdictions.
Population mix explained 3.3% of the variation. These three policy variables together explain 32.8%, adjusted 28.5% — roughly ten times as much. Each ten percentage points of long-term care in the spending mix adds about $584 per enrollee. Each ten points of parent and caretaker income eligibility adds about $163. Each ten points of supplemental payment share subtracts about $572 — states leaning on supplemental payments run lower base spending per person, which is a real financing choice rather than a smaller program.
Adding managed-care share and the institutional-versus-community balance to the model moves R² from 0.328 to 0.339 and lowers the adjusted figure. Neither is doing work. Rebalancing toward home and community-based care correlates with total spending per enrollee at r = 0.057 — essentially zero. That is an argument for rebalancing on its own merits: it changes where care happens without changing what the program costs per person. Expansion states averaged $7,760 per enrollee against $6,944 for non-expansion states, an 11.7% gap.
Parent eligibility at 133% FPL, 35.3% of spending in long-term care, almost no supplemental payments at 1.7%. A rich program paid for through base rates rather than financing mechanisms.
Parent eligibility at 15% FPL — among the narrowest in the country — and 20.6% of spending in supplemental payments, the second-highest share. Narrow coverage financed heavily through supplements.
Parent eligibility at 13% FPL, no expansion, and the highest supplemental payment share in the country at 18.5%. The lowest-cost structure in the study, built from the narrowest eligibility.
Parent eligibility at 19% FPL with expansion through HIP, 35.8% of spending in long-term care, and 12.4% in supplemental payments. Mid-pack cost built on narrow categorical eligibility plus a broad expansion.
Provider and product rates are the policy lever nobody publishes — except in pharmacy, where every state reports what it actually paid. Comparing two of the most commonly dispensed generics in America across fee-for-service Medicaid, first quarter of 2024.
Gabapentin ranged from $0.107 to $0.597 per unit — a 5.6-fold spread. Lisinopril ranged from $0.145 to $0.955, a 6.6-fold spread. These are the same molecules, the same quarter, the same program type. Minnesota paid 2.94 times the median state across both; Maine paid 0.66 times. Indiana sat at 0.979, almost exactly at the median.
New Mexico is excluded. It reported $3.03 per gabapentin unit and $8.94 per lisinopril unit — 18 and 40 times the median — which reads as a unit-of-measure reporting problem rather than a price. That is itself the point: this screen surfaces both real rate differences and submission errors, and a state can run it against its own file in an afternoon.
Treat the index as a method rather than a verdict. Two molecules, one quarter, fee-for-service only — and fee-for-service is a shrinking slice of pharmacy as states carve benefits into managed care. The correlation with overall spending per enrollee is r = 0.239: rate policy is visible in the data and moves cost, but it is one lever among several.
The Hospital Provider Cost Report is the only free, provider-level source of Medicaid dollars in the country. 4,333 hospitals reported both what they charged Medicaid and what they were paid.
Maryland at 90% is the control group. It is the only state that sets hospital rates for all payers, so its hospitals bill close to what they are paid. Everywhere else the gap between charge and payment is mostly chargemaster inflation, not a measure of how generous a state is. Nevada's hospitals collect 4.5 cents per dollar billed; Florida's 5.7; Montana's 37.
Read the ratio as a measure of how far a state's hospital charges have drifted from the money, not as a payment-adequacy score. The useful question it answers is the one the charge data cannot answer on its own: in which states does a billed dollar mean anything at all?
Indiana's hospitals collect 18.3% of Medicaid charges, just under the 19.3% median. Medicaid is 16.7% of their total charges and 5.9% of patient days.
For-profit hospitals collect 8.5% of what they bill Medicaid, against 16.9% for nonprofits and 20.1% for government hospitals. They also run the lowest Medicaid share of total charges at 14.4% against 20.4% for government facilities. The ratio gap is mostly a charge-setting difference rather than evidence that one owner type is paid less per unit of care — which is exactly why charge data needs the payment side attached before anyone reasons from it.
Breaking the Provider Information area into its 22 individual checks separates two things that get discussed as one problem. 2023 assessments, 54 jurisdictions.
The identifiers on claims are in good shape. Billing provider NPI fails in 1 jurisdiction out of 54 on inpatient claims, 1 on pharmacy, 1 on long-term care. Billing provider type and taxonomy on inpatient, long-term care and institutional outpatient claims fails in none.
The registry those identifiers point to is a different story. Facility characteristics fail in 46 of 52 jurisdictions, and 41 of them are rated unusable outright. Active enrollment status fails in 47 of 54. The provider file's own National Provider Identifier field fails in 26 of 54, 8 of them unusable. Pharmacy billing specialty and taxonomy fails in 15, with 13 unusable.
So a state can count what a provider did and cannot reliably say who that provider is. That breaks four things specifically: network adequacy measured from real utilization rather than directory listings; spending analysis by provider type; screening claims against exclusion lists, which needs a dependable enrollment status; and any ownership or chain analysis, which needs facility characteristics that 41 jurisdictions cannot supply.
It also narrows the fix. The problem is not claims processing — that part works. It is the provider enrollment file and the pipeline that carries it into federal reporting, which is a smaller, more tractable system than the claims pipeline, and the one area where states have already shown the most improvement: provider information fell 13.6 points nationally between 2019 and 2023, more than any other area.
Everything in this study came from open-data APIs. That is not where the rest of it lives. Federal managed-care rules require states to post a specific list of documents on their own websites, and those documents carry plan-level detail that no API exposes.
Indiana fined two health plans for encounter-data problems in the same report that lists its encounter-data compliance rate as "N/A" for every plan. The 2023 Managed Care Program Annual Report for the Healthy Indiana Plan records liquidated damages of $98,400 against MDwise and $49,200 against CareSource for inaccurate or late encounter reporting. In the plan-level indicator table directly above, the share of encounter submissions meeting timeliness and HIPAA standards is reported as N/A for all four plans.
The state knew enough to penalize and did not publish a measurement. That gap between enforcement and measurement is the single most useful thing found in this study's final pass, and it took one PDF, not a data use agreement.
Four plans in one program, one year, normalized per thousand members. MDwise recovered $5,130 per thousand; CareSource recovered $367 — a fourteenfold difference. The investigation counts do not line up with the recoveries either: MDwise opened 23 cases and resolved 6 while recovering the most, and MHS resolved 120 while recovering less than a third as much per member. These are the numbers a program-integrity baseline is built from, and they sit in a PDF that no catalog indexes.
Required to be posted under 42 CFR 438.602(g). Managed care program annual reports, external quality review technical reports, plan contracts and amendments, network adequacy standards and secret-shopper results, directed-payment evaluation reports, provider directories and formularies. No request, no agreement, no fee — only a scraper.
T-MSIS Analytic Files through ResDAC under a CMS data use agreement: claim header and line records with provider identifiers, procedure codes, submitted charges and paid amounts, plus the annual provider and plan files. The long pole, and the only route to claim-level Medicaid data.
Capitation rate certifications and rate cells, encounter submission and rejection logs, the provider enrollment file with ownership disclosures, machine-readable fee schedules, program-integrity case data, and the upper payment limit demonstrations behind supplemental payments. None of these appear in the federal posting list.
The regulatory citation matters when asking. An item on the 438.602(g) list is something the state already owes the public, so the ask is "where is it posted" rather than "may we have it." Everything in Tier 3 needs a records request, a data use agreement, or — the cheapest channel — a question filed during an open solicitation's Q&A window, where the answer becomes part of the public record for every bidder.
Working through four years of Indiana's managed care program annual reports, one program, one report at a time. The trajectory is more interesting than any single year.
The encounter-data metric first appears in the report covering 2025 — three years after the state began fining plans for encounter failures. The CY2022 report lists timeliness and HIPAA compliance as N/A for all four plans while recording $98,400 and $49,200 in liquidated damages for encounter reporting. The CY2024 report still says N/A. The CY2025 report finally reports numbers, and they are 98.98% to 99.84% timely and 100% HIPAA-compliant across every plan. Hoosier Healthwise reports the same picture: 98.33% to 99.89% timely, 100% HIPAA.
CY2025, both major programs, every plan above 98%.
DQ Atlas assessed Indiana's managed-care encounter completeness as medium concern for 2023, and only 9 of 54 jurisdictions nationally earn a clean rating.
Both are true. Timeliness measures whether a file arrived by Wednesday at 5 p.m. HIPAA compliance measures whether it parsed. Neither measures whether the services a plan paid for are actually in it, or whether the amounts are right. A plan can hit 100% on both and still omit a category of claims entirely.
The second pattern is a regression. The CY2022 report carried plan-level program integrity staffing, investigations opened and resolved, referrals to the state, overpayments recovered, and nineteen sanctions with dollar amounts. The CY2024 and CY2025 reports carry none of that at plan level. Medical loss ratio moved the other way and then stopped: CY2022's report showed 2019 ratios, CY2024's showed 2022 ratios of 90–95%, and CY2025's reports no ratio at all — data received, not validated, with validation expected in June 2027. The most detailed report of the four is the oldest one.
This sharpens the Tier 3 ask. Do not request encounter timeliness — the state publishes it and it will say 99%. Request the completeness reconciliation: the quarterly encounter-to-claims completeness check the contract already requires at 98%, the rejection and resubmission logs behind it, and the volume reconciliation against capitation paid. That is the measurement that would move Indiana's federal rating, and it is the one no public report contains.
Click a column to sort. Spending in millions of dollars, total computable.
Encounter-data column shows the worst assessment across the four claim files. "Unclassified" means CMS could not assess it. Capitation dollar share is FY2016 and is a floor: expansion-group payments to managed-care plans are reported on a separate line and are not included in it.
The encounter file is the only record of what was bought, and it is not trustworthy. Fix submission before buying analytics: enforce plan-level completeness against capitation payment, reconcile encounter volume to enrollment month by month, and make a clean DQ Atlas assessment a contract term with the plans rather than a federal reporting afterthought. Program-integrity tools run on this data produce confident wrong answers until it is fixed.
The infrastructure is there, so the question is whether anyone is using it. Encounter-level outlier detection, plan-to-plan price variation, and network adequacy measured from actual utilization rather than directory listings are all available now. This is where payment-integrity investment returns the most.
Spending still flows through fee-for-service claims, which are directly observable — but the quality marks say the submissions have problems anyway. Fix the fee-for-service pipeline now, while it is still the main channel. A state that carries these problems into a managed-care transition inherits a far harder version of them.
The most observable programs in the country, and the smallest share of national spending. If a managed-care transition is on the table, the encounter-data requirements belong in the procurement, not in a later corrective action plan. This is the only quadrant that gets to design the problem out in advance.
National Medicaid gross drug spend, 4,774 distinct products, 2020–2024. One hundred of them hold 55.4% of the money, so a screen aimed at a few hundred products covers most of the exposure. CMS flagged 1,738 products as price outliers in 2024, up from 1,085 in 2020.
Steepest per-dosage-unit price escalation, 2020–2024, among products above $50M of 2024 spend. The multi-manufacturer rows are the ones worth a look: commodity generics with real competition should not price like this.
This screen runs on a file any state can download today. It will not tell a state which of its own providers is an outlier — that needs the encounter data this study is about — but it does set a national price baseline a state can measure its own pharmacy spend against.
Spending. CMS-64 quarterly file, 2,622 records. Quarters are rolled into federal fiscal years (October start). The National Totals pseudo-state is excluded before aggregation. FY2024 is the last complete year; FY2025 holds three of four quarters and is not used in rankings.
Managed care share. Comprehensive managed care enrollment divided by total enrollment, from the Managed Care Enrollment Summary. Indiana and several other states have no 2020 row; those years are left blank rather than interpolated.
Data quality. DQ Atlas publishes one assessment file per jurisdiction per TAF release. All 1,026 files were parsed, yielding 101,565 assessments. Where a jurisdiction-year appears in multiple releases, the latest release is used. The concern rate is the share of classified measures rated high concern or unusable; unclassified and excluded measures are dropped from the denominator rather than counted as passes.
Quadrants. Split at the medians of the 54 jurisdictions with both measures: 79.3% managed care enrollment and a 13.2% concern rate.
Enrollment share is a proxy for dollar share. It is a good one — r = 0.866 where both can be measured — but it is still a proxy, and it will understate capitation dollars in states whose managed-care population skews toward higher-cost groups.
The dollar-level capitation series stops in 2016. The only public CMS-64 file with service category detail covers FY2016 and was last refreshed in December 2024. Nothing current replaces it.
Data quality is not the same as fraud. A high concern rating means CMS could not validate the submission, not that money was misspent. The claim here is narrower and harder to argue with: in those states, nobody outside the plan can tell either way.
Per-enrollee figures mix period definitions. Federal-fiscal-year spending is divided by a calendar-labeled enrollment snapshot. Use them to compare states, not as a precise rate.
Three counting traps. The data portal caps pages at 500 rows and returns HTTP 200 with an empty result above that. The drug file repeats each product per manufacturer plus an Overall roll-up. CMS-64 service categories mix line items with roll-ups. All three inflate totals silently rather than raising an error.