Every state is being told it has a Medicaid fraud problem. The federal government's own measurement says most of the problem is missing paperwork — and the channel that carries three in four enrollees is scored at zero.
Medicaid improper payments for FY2025 — 6.12% of federal spending. But CMS attributes 77.17% of that to insufficient documentation, not to money proven to have gone to the wrong place. The year's increase tracks the post-pandemic return of eligibility redeterminations. The measured failure is largely an evidence-and-records failure.
Source: CMS FY2025 Improper Payments Fact Sheet (January 15, 2026). In CMS's own words, "improper payment measurement is not a measure of fraud, and not all improper payments are attributable to fraud or abuse."
On May 13, 2026, CMS deferred $1.3 billion in federal Medicaid funds from California — which it called the largest deferral in its history — and has since taken a series of deferral actions against Minnesota as well. CMS describes the posture as a shift from "pay and chase" toward holding funds up front.
Integrity stopped being a recovery-return argument and became a protect-your-federal-draw argument. Sources: CMS announcements; KFF federal-action tracker. Deferrals are temporary holds, not findings of wrongdoing.
The 2025 reconciliation law (H.R. 1) requires states to check enrollees against the federal Death Master File at least quarterly from January 1, 2027, extends death checks to provider enrollment from January 1, 2028, and moves most expansion adults to six-month eligibility redeterminations beginning in 2027.
Each is a dated federal deadline attached to eligibility and provider-record work. Sources: H.R. 1 (OBBBA) health provisions; CMS six-month redetermination guidance, March 11, 2026.
PERM — the Payment Error Rate Measurement — is the federal government's annual audit of Medicaid payment accuracy, built from roughly 17 states per year across a three-year rolling cycle.
| Component | Rate | What it checks |
|---|---|---|
| Fee-for-service | 4.60% | Claims paid directly by the state |
| Managed care | 0.00% | Whether the state paid the plan correctly |
| Eligibility | 4.42% | Whether the enrollee qualified, documented |
These are three separate measures on different bases, not three numbers that add up to the 6.12% total. CHIP ran 7.05% ($1.37B) the same year.
A payment flagged because a renewal form is missing and a payment sent for a service never delivered both land in the same $37.39B headline. They are not the same problem, and they do not call for the same fix.
The documentation share is the dominant one, and it points at eligibility evidence and provider records — the exact work the 2027 and 2028 federal deadlines are about.
GAO explained why the zero is not the whole picture, in June 2025. CMS checks only whether a state paid its managed-care plans correctly — not what those plans then paid providers. So, in GAO's account, payments for services that were not delivered, and duplicate capitation for a beneficiary carried under multiple ID numbers, fall outside the estimate. In 2022, just over 75% of Medicaid beneficiaries — about 74 million people — were in managed care (GAO-25-107770).
Through audits between October 2021 and February 2025, CMS identified over $33 million in managed-care overpayments, of which nearly $23 million is the federal share it is working to recover — against a channel that moves hundreds of billions a year. Medicaid has been on GAO's high-risk list since 2003 and kept that status in the 2025 update. The strength of this point is that it is GAO's, not a vendor's.
Whether a state can afford this work is shaped by the federal match, and the match rate is not uniform — it depends on how the spending is classified.
The 90% and 75% enhanced rates for mechanized claims systems are set in 42 CFR 433.15; a 2015 rule extended enhanced matching to eligibility and enrollment systems. So the same capability can draw very different federal support depending on whether it is classified as development, operation, or general administration — which is part of why program-integrity work is procured as its own system module rather than bolted onto something else.
In June 2026 Indiana FSSA entered a 90-day AI Medicaid fraud-detection pilot with Oracle, launched by CMS, at no cost to the state. It analyzes claims for suspect billing — upcoding and ghost services — and tests claims-edit suggestions and prior-authorization triggers; Indiana's assigned role is to assess whether other states could use Oracle's models and report back to CMS.
Source: Indiana Capital Chronicle, June 24, 2026. The pilot sits in claims-anomaly detection — the fee-for-service lane PERM already scores at 4.60%. It does not touch the eligibility, redetermination and provider-record evidence where most of the measured error sits, or the managed-care channel where, per GAO, the unmeasured error sits. That is the gap the 2027 and 2028 deadlines actually land on.
Read end to end, the federal record says something narrower and more useful than "Medicaid has a fraud problem." Most of the measured error is missing eligibility evidence and provider records — a documentation and data problem with federal deadlines attached. Much of the program's spending runs through a managed-care channel the current measurement does not fully see, which GAO has said plainly. The work that matches the evidence is eligibility and redetermination integrity, provider-record accuracy, and making managed-care encounter data real — not another claims-anomaly engine pointed at the 4.60% that is already watched.