Articles

Client Alert: Federal Pressure on State Medicaid Fraud Units and What It Means for Providers

Healthcare organizations in Virginia and beyond may need to prepare for a period of more aggressive criminal Medicaid enforcement.

In June 2026, federal officials cut off funding to two state Medicaid Fraud Control Units, in Hawaii and New York, for failing to bring enough criminal cases. Weeks later, HHS deferred more than one billion dollars in Medicaid payments to California and Minnesota while it reviews high-risk claims. The common thread is money: the units that keep their funding are the ones that produce indictments and convictions, and the quickest way to raise those numbers is to open more investigations and file more charges.

If your organization bills Medicaid or Medicare, the federal shift seen here may raise your exposure, and it is worth understanding now rather than after a records request arrives. Whiteford’s healthcare defense group works with providers across Virginia and beyond on Medicaid fraud defense, government investigations, audits, and licensure matters.

What the government did, and what it signaled

In May 2026, the Department of Health and Human Services Office of Inspector General (OIG) notified 50 state Medicaid Fraud Control Units (MFCUs) that it would review each one before its annual recertification. Recertification controls the money. Under federal law, a state unit can draw federal matching funds only if OIG certifies each year that it is effectively investigating and prosecuting Medicaid fraud and patient abuse and neglect.

On June 4, OIG denied recertification to the Hawaii unit, the first time the federal government has ever decertified a state Medicaid Fraud Control Unit, ending roughly three million dollars a year in support. The stated reason was output. Between 2022 and 2025, the unit reported no fraud convictions and no fraud indictments, despite receiving about twelve million federal dollars in that window.

On June 30, OIG denied recertification to the New York unit and suspended its grant of about sixty million dollars a year, alongside putting out a press release regarding their decision. New York runs one of the largest Medicaid programs in the country and staffs its unit with more than 270 people, yet OIG found it produced the fewest criminal results of any comparably sized state, reporting 53 fraud convictions from 2023 to 2025 against a next-lowest peer figure of 129. The corrective conditions OIG imposed are the clearest signal. The New York unit was ordered to adopt a written strategy to increase indictments, hold investigator caseloads to about ten open matters, and justify any case left open longer than 36 months.

The federal funding squeeze for providers is widening

The recertification denials are not the only way the administration is using money to drive Medicaid enforcement. On July 21, 2026, HHS and the Centers for Medicare and Medicaid Services (CMS) deferred more than one billion dollars in federal Medicaid payments to two states, about $867.5 million to California and $199 million to Minnesota, while the states produce documentation that certain high-risk claims meet federal requirements. HHS framed the move as part of the administration’s crackdown on fraud, waste, and abuse, and was careful to call it a deferral rather than a permanent cut: the states can free the money by supporting the claims.

The reviews behind the deferrals were driven by data in the same way the unit assessments were. CMS said it flagged California’s in-home care spending because its growth far outpaced national trends, and it singled out 14 high-risk service areas in Minnesota, including expenditures tied to providers already flagged through program integrity reviews. The action was reported by outlets including the Wall Street Journal as a signal that the administration intends to withhold federal dollars before they are paid rather than chase them afterward.

A payment deferral is not a decertification, and it is aimed at states rather than individual providers. It points in the same direction, though: analytics identify outliers, funding pressure follows, and the providers who submitted the flagged claims are where a state’s review ultimately lands. HHS paired the announcement with a reminder that it will keep using its exclusion authority to bar bad actors from Medicare and Medicaid, which is the point at which this kind of program-integrity pressure reaches an individual provider directly.

Why this points toward more, and smaller, criminal cases

OIG’s own reasoning explains what comes next. Its central criticism of New York was a leadership choice to concentrate on complex, largely civil fraud cases. OIG was not satisfied that the unit’s civil recoveries roughly matched its peers. It concluded the unit had traded away criminal enforcement to obtain civil settlements that were no better than average. Read alongside the order to increase indictments, the message to every state unit is that criminal volume is what protects funding.

When an enforcement office is measured on the number of charges it brings, the cases at the margin change. A billing dispute that might once have been handled through an overpayment demand or a civil settlement becomes a candidate for criminal referral.

Solo practitioners, small groups, behavioral health programs, and long-term care operators become more attractive targets, not because their conduct is worse, but because their cases are faster to build and resolve than large institutional matters.

The practical result is that an ordinary documentation gap or a billing pattern flagged in a data run is more likely to be treated as potential criminal conduct, and the strength of the government’s evidence will not always match the severity of the accusation.

The same logic is visible in the California and Minnesota deferrals. CMS flagged California’s in-home care spending because it outran national trends, and it singled out Minnesota providers that program integrity reviews had already marked. That is the state-level version of the data run that can put an individual practice on a list, and it is how a routine billing profile becomes the starting point for a closer look.

This pattern is already visible in Virginia. In the Justice Department’s June 2026 National Health Care Fraud Takedown, the largest it has ever announced, 50 state Medicaid Fraud Control Units took part, the most ever assembled for a single action, and the sweep carried record Medicaid figures of 295 defendants and more than $518 million in alleged false claims.

One of the cases was filed in the Eastern District of Virginia, where the part-owner of a Richmond mental health agency was charged in connection with roughly $49.6 million billed to Virginia Medicaid for Community Stabilization and Mobile Crisis services. The allegations describe the kind of conduct that data-driven review now surfaces quickly: a higher-paying team-treatment modifier applied when only one clinician was present, progress notes said to have been altered after audit requests, and beneficiaries recruited through paid hotel stays. It is a preview of where this is heading: a mid-sized behavioral health provider whose documentation and coding practices were challenged in an audit that ultimately escalated into a federal criminal charge.

We examined that case and its lessons for Virginia and Maryland providers in our client alert on the 2026 Health Care Fraud Takedown.

Why a criminal case is different from a civil one

For a healthcare organization, the move from civil to criminal enforcement is not a change of degree. A civil matter typically ends in monetary damages and penalties. A criminal conviction for a program-related offense, or for patient abuse or neglect, triggers mandatory exclusion from Medicare, Medicaid, and other federal health care programs for at least five years under federal law.

For most providers, exclusion is an existential event, because it cuts off the payer that sustains the practice. That is why a unit’s decision to pursue a matter criminally rather than civilly deserves a serious, early response, and why the current pressure to raise criminal numbers matters so much to legitimate providers who could be swept in.

More scrutiny on whistleblowers

Both funding decisions pointed to the same gap: too few good referrals. Hawaii leaned on settlements developed by other agencies. New York was faulted for receiving too few viable fraud referrals from the managed care organizations (MCOs) that run most of its Medicaid program. A unit that needs cases but lacks a strong internal pipeline turns to outside sources, and the most productive source is usually an insider.

Federal policy is reinforcing that turn. The March 2026 executive order establishing the White House Task Force to Eliminate Fraud directs the Attorney General to promote private citizens’ False Claims Act suits and to speed the government’s review of them. Federal False Claims Act recoveries reached a record $6.8 billion in fiscal 2025, with whistleblowers filing close to 1,300 qui tam suits and the Justice Department opening more than 400 new investigations, most of the recoveries coming from healthcare.

For a provider, this means a former employee, a billing contractor, or a competitor now sits closer to the center of enforcement, and internal complaints are more likely to become qui tam filings or referrals to a state fraud unit.

Part of a wider anti-fraud campaign

The Medicaid unit reviews are one piece of a broader effort that reaches past healthcare. The Task Force to Eliminate Fraud coordinates enforcement across the Treasury, Justice, Health and Human Services, Labor, the Small Business Administration, and other agencies. Pandemic relief is a current focus.

Congress set a ten-year statute of limitations for Paycheck Protection Program (PPP) fraud, the 2025 One Big Beautiful Bill Act extended the IRS assessment window for Employee Retention Credit (ERC) claims to six years, and the Justice Department’s COVID-19 Fraud Enforcement Task Force, which runs a strike force based in the District of Maryland, has charged thousands of defendants.

Healthcare organizations that received PPP loans or claimed the ERC remain within the enforcement window, a point our team has addressed in a separate alert on COVID relief enforcement.

What this means in Virginia and Maryland

These decisions are not confined to Hawaii and New York. Every state runs a Medicaid Fraud Control Unit under the same annual recertification, OIG is reviewing all of them, and it has begun publishing the results.

The Virginia and Maryland units both sit within their state Attorney General’s office, and both can bring criminal prosecutions for Medicaid fraud, not only civil actions. They face the same pressure to show criminal output, and they operate in a region with heavy federal enforcement infrastructure, including the U.S. Attorney’s Offices for the Eastern District of Virginia and the District of Maryland, and HHS-OIG field agents who work healthcare matters jointly with state investigators.

Providers in Virginia and beyond should treat these recent Medicaid fraud investigation decisions as a preview of how their own state units are likely to behave.

Why Whiteford

Whiteford’s healthcare defense group defends providers at the point where an audit, a data flag, or a whistleblower complaint turns into a government investigation. The group’s experience runs on both sides of these cases, which matters when a unit is under pressure to move quickly.

Members of the team have worked healthcare fraud matters from the government side, including a first-of-its-kind federal prosecution under the health care fraud and aggravated identity theft statutes that was later upheld by the Fourth Circuit, and what was reported at the time as the largest fraud case against a home health agency in Virginia. That vantage point informs how the group reads a unit’s next move and where a case is weak.

On the defense side, the group has represented Virginia and Maryland providers across the range of enforcement and administrative proceedings, including:

• A Virginia behavioral health provider whose Medicaid audit findings were reversed in full.
• A Virginia Medicaid overpayment appeal in which the hearing officer recommended dismissal of the retraction claims and an award of attorneys’ fees.
• A Virginia provider reinstated to Medicare after an HHS-OIG exclusion.
• A durable medical equipment supplier reinstated after a Medicare enrollment revocation, with retroactive billing privileges.
• A Medicare Part B coverage appeal decided in the provider’s favor before an administrative law judge.
• A Maryland dental practice in a contested Medicaid audit before the state Office of Administrative Hearings.

The group represents physicians, dentists, behavioral health and addiction treatment providers, home health and long-term care operators, and medical practice owners in investigations, audits and appeals, licensure proceedings, and related litigation, in Virginia and Maryland and in federal matters. Involving a Whiteford attorney early, before an informal response shapes an inquiry, lets a provider respond to a government contact on informed footing.

Frequently asked questions

Why are federal officials cutting funding to state Medicaid Fraud Control Units?

Because those units brought too few criminal cases. Under federal law, a state unit can receive federal funding only if OIG recertifies each year that it is effectively investigating and prosecuting Medicaid fraud and patient abuse and neglect. In June 2026, OIG denied recertification to the Hawaii and New York units, citing years of low criminal indictments and convictions relative to comparable states.

Will this lead to more criminal charges against healthcare providers?

It points that way. OIG is judging units on criminal output and has ordered at least one unit to adopt a written strategy to increase indictments. When funding depends on the number of criminal cases, units have reason to bring more of them, including smaller cases that are quicker to charge, and matters that might once have been resolved civilly or administratively may be pursued criminally instead.

Is Medicaid fraud a felony?

It can be. Medicaid fraud is prosecuted under both state and federal law, and many charges are felonies. A felony conviction for a health care program offense also triggers mandatory exclusion from Medicare and Medicaid for at least five years, which is often more damaging to a provider than the criminal sentence itself.

What should we do if a Medicaid Fraud Control Unit contacts us?

Treat any contact as significant, even an informal call or a records request. Preserve the records at issue, avoid ad hoc explanations from staff, and involve defense counsel before responding, because early responses can shape the direction of an investigation. Retaining counsel is not an admission of wrongdoing; it is the ordinary step for a provider that takes compliance seriously.

How does this affect whistleblower and False Claims Act risk?

It raises it. Units short on referrals rely more on insiders, and federal policy is actively encouraging qui tam suits under the False Claims Act. A former employee, contractor, or competitor can file a sealed complaint that prompts a state or federal investigation, so internal complaints and compliance concerns should be addressed promptly.

Are Virginia and Maryland providers affected?

Yes. Both states run Medicaid Fraud Control Units within their Attorney General’s office, both can bring criminal prosecutions, and both are subject to the same federal recertification pressure. Providers across Virginia and Maryland should expect their state units to face the same push toward criminal cases.

Talk with our healthcare defense team

If your organization has received a records request, a civil investigative demand, or an interview request, or if a compliance concern has surfaced internally, the time to involve counsel is before the next response goes out. Whiteford’s healthcare defense group advises providers throughout Virginia and Maryland, and in federal matters, on Medicaid fraud investigations, audits, and licensure proceedings.

Contact Eric Atkinson to arrange a confidential consultation about your organization’s situation.