UNDERSTANDING THE ROLE OF MEDICAID FRAUD CONTROL UNITS (MFCUS)

The following information was released by the Henry J. Kaiser Family Foundation:

Authors: Jessica Mathers and Elizabeth Hinton

Federal law requires every state to operate a Medicaid Fraud Control Unit (MFCU) that investigates and prosecutes provider fraud and patient abuse and neglect. MFCUs are typically housed within the state Attorney General's office and are required to operate independently from the state Medicaid agency that runs the Medicaid program. MFCUs are one component in the Medicaid program integrity system, which includes many different state and federal agencies with shared and distinct responsibilities defined by state and federal law. Ensuring Medicaid program integrity (i.e., the appropriate use of federal and state Medicaid funds) involves a range of activities from fraud prevention to enforcement activitiesthe primary responsibility of MFCUs. While MFCUs are a key part of the program integrity system, it can be difficult to compare MFCU data across states or to put fraud recovery dollars into the context of overall Medicaid spending because recovery data only capture a portion of Medicaid program integrity efforts (e.g., leaving out the value of fraud prevention or stopped payments) and don't capture fraud that goes undetected.

As the Trump Administration continues to focus on addressing fraud, waste, and abuse in federal programs, including Medicaid, MFCUs are facing increased federal scrutiny. In May 2026, CMSannouncedthe HHS Office of the Inspector General (HHS-OIG) would be initiating areview of every state's MFCUbefore its next annual recertification. In June 2026, the HHS-OIG denied recertification and suspended federal funding for Hawaii's and New York's Medicaid Fraud Control Units. Within this context, this brief provides an overview of the role of MFCUs, examines caseload and case outcome data, and current issues facing MFCUs.

What are MFCUs and how do they work?

MFCUs are law enforcement entities that investigate and prosecute provider fraud and patient abuse and neglect. MFCUs investigate and prosecute, or refer to prosecution, provider fraud (in all settings) and complaints of patient abuse in certain health care settings, such as nursing homes and hospitals receiving Medicaid funds.1 MFCUs do not investigate fraud or program abuse committed by beneficiaries (these cases are the responsibility of the state Medicaid agency), although evidence of beneficiary fraud is low.2 MFCUs must operate independently from the state Medicaid agency and are often part of the State Attorney General's office, employing teams of investigators, attorneys, and auditors. The HHS-OIG oversees MFCUs, annually recertifying each MFCU, assessing performance and compliance with federal requirements, and administering federal grant awards (which cover 75% of MFCU operating costs).

MFCUs open investigations after receiving referrals of suspected provider fraud or complaints involving patient abuse or neglect. A MFCU case typically begins with a referral from the state Medicaid agency (including program integrity or auditing offices), managed care organization (MCO), or from a complaint filed by a patient or former employee. The state Medicaid agency or MCO may initially detect fraud through monitoring Medicaid data and using data mining or analytics to identify billing pattern anomalies (e.g., billing spikes, upcoding, double billing, or unusual hours). All state Medicaid agencies have authority to conduct data mining, but some MFCUs have also specifically been granted permission by HHS-OIG to mine Medicaid data directly for evidence of fraud as part of their regular activities. More MFCUs may begin to conduct data mining or analytics as HHS-OIG in August 2026 waived the requirement that MFCUs obtain prior approval for these activities to identify suspected Medicaid fraud. While patient abuse or neglect may fall under the jurisdiction of several different law enforcement agencies, MFCUs may investigate patient abuse or neglect in health care facilities receiving Medicaid funds.3

MFCU cases vary in duration and scope, but investigations generally follow a standard process starting with an investigation and ending with potential financial recoveries (Figure 1).

Investigation. When a case is opened, the investigative team researches the alleged fraud or abuse by analyzing the evidence. Investigations may take months or years before charges are filed against providers.

Criminal Indictments and Civil Cases. Fraud and abuse can violate state and/or federal criminal law, civil law, or both. If a MFCU's investigation team determines there is sufficient evidence of wrongdoing, the MFCU can bring criminal charges and/or civil lawsuits against the provider.

Criminal Convictions and Civil Judgments. Criminal convictions can result in a criminal record, financial penalties, and/or incarceration. Civil judgments can establish liability and/or impose financial penalties and other court-ordered remedies. Providers who are convicted or liable for criminal fraud or patient abuse/neglect (along with other crimes) legally must be excluded from participating in federally funded health care programs. HHS-OIG or state Medicaid agencies may also decide to exclude providers beyond these minimum standards.

Recoveries. HHS-OIG defines recoveries as the amount of money that defendants are required to pay as a result of a settlement, judgment, or prefiling settlement in criminal and civil cases. Recoveries may not reflect the amounts actually collected from defendants (e.g., if the defendant is a company that dissolved before collections could be obtained). MFCUs work with state Medicaid agencies to return the state and federal share of any recovered Medicaid payments.

Note: Throughout the lifecycle of a case, MFCUs may collaborate with other state and federal program integrity and law enforcement partners. State entities include state inspectors general and state health departments and federal entities include the U.S. Department of Justice (DOJ) (including Federal Bureau of Investigation (FBI)) and the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). Some investigations or cases may be transferred to (or handled by) federal law enforcement agencies.

Box 1. Example Cases

Active MFCU investigations are typically confidential. When MFCUs secure criminal convictions and civil judgments or settlements, the case is described in an announcement published by the state or the DOJ. To illustrate the variety of cases that may be processed by a MFCU, this box describes examples from a range of states, types of wrongdoing, and recovery amounts.

Criminal Fraud: Between 2004 and 2019, the McKinsey consulting firm provided OxyContin sales and marketing advice to Purdue Pharmaceuticals. The Virginia MFCU participated in a lengthy and complex investigation into alleged criminal wrongdoing resulting in false or fraudulent OxyContin prescriptions paid by Medicaid and other health insurers. The December 2024 resolution of criminal charges against McKinsey resulted in $650 million in recoveries, which contribute to the high total MFCU recoveries reported in FY 2025 (as seen in Figure 4).

Civil Fraud: As part of the 2018 National Health Care Fraud Takedown, the Georgia MFCU investigated false claims for non-emergency medical transportation (NEMT) and adult day health services. More than $1 million in Medicaid payments were implicated in the investigation. The case was decided in 2019, with state and federal civil judgments resulting in a $10.1 million settlement paid to Georgia and the federal government.

Patient Abuse and Neglect: In 2021, the Massachusetts MFCU received a referral into alleged patient abuse by a home health aide. In 2023 the MFCU obtained a criminal conviction of abuse, neglect, or mistreatment of an elder by a caretaker.

summary report of MFCU activities that provides an annual snapshot of aggregated case outcomes from all MFCUs and certain case outcome trends. In addition to the summary report, HHS-OIG releases individual (state) MFCU case activity and outcomes data.

At the end of FY 2025, there were 15,810 open investigations across all state MFCUs. While MFCUs investigate both provider fraud and patient abuse and neglect, data show most MFCU investigations are related to provider fraud (Figure 2). A subset of investigations leads to criminal indictments or civil cases / complaints. MFCU investigations can take months to years, depending on various factors, including the types of allegations involved, volume of records, and agencies involved.

Most Investigations Were Cases of Suspected Fraud

Investigations open at the end of FY 2025, by type of case.

FY = fiscal year. Includes 50 states and the District of Columbia. Excludes territories.

HHS-OIG MFCU Statistics, 2025

In FY 2025, MFCUs obtained 1,180 criminal convictions and reached 661 civil settlements and judgements (Figure 3). Most criminal convictions were for provider fraud. HHS-OIG uses information it receives from MFCUs to exclude individuals and entities from participating in federal health programs. In FY 2025, 900 individuals or entities were excluded because of criminal convictions obtained by MFCUsaccounting for nearly one-third (32%) of all OIG exclusions that year (data not shown).

MFCUs Obtained 1,841 Case Resolutions in FY 2025

Criminal convictions (by type of case) and civil judgments and settlements.

The share of civil judgments/settlements by type of case is not publicly available. FY = fiscal year. Includes 50 states and the District of Columbia. Excludes territories.

HHS-OIG MFCU Statistics, 2025

On average, MFCUs recover more than $1 billion each year from fraud investigations. Nationally, MFCUs recovered $1.97 billion in FY 2025. While recoveries include other financial penalties in addition to Medicaid funds recouped from providers due to MFCU investigations (and may not reflect amounts actually collected4), the total amount of recoveries is small compared to total Medicaid spending. Recoveries vary each year and can be skewed by factors, including timing of settlements and large multi-year cases. Recoveries typically vary substantially from year to year and have averaged $1.48 million per year over the period 2016 to 2025. A 5-year rolling average accounts for periodic variation and shows that recoveries decreased during the COVID-19 Public Health Emergency and are returning to pre-COVID levels. Recoveries, after accounting for year-to-year variation, have remained generally steady over time while total Medicaid spending has increased. Recoveries are not a comprehensive measure of enforcement (because they may not include Medicaid-related enforcement actions that occurred outside of MFCU actions) and do not include the possible financial impacts of other program integrity efforts, such as preventing fraud before it occurs. Of the $1.97 billion in recoveries, two-thirds (64%) were due to criminal convictions and one-third (36%) were due to civil judgments or settlements (data not shown). This is proportionate to the share of criminal and civil case resolutions in FY 2025 (Figure 3).

Annual Recoveries Vary, but on Average MFCUs Recover More than $1 Billion in Medicaid Funds Each Year Through Fraud Investigations

Total MFCU recoveries, annually.

Recoveries are the sum defendants must pay as a result of a civil settlement, criminal judgment, or prefiling settlement. Recoveries may not reflect actual collected dollars. 5-year average recoveries are a rolling average of the last 5-years of annual recoveries. Includes 50 states and the District of Columbia. Excludes territories.

HHS-OIG MFCU Statistics, 2016-2025

Comparing data across states or considering recovery dollars in the context of overall Medicaid spending can be challenging. Comparing MFCU data across states or years can be difficult due to differences in state law (that impact the handling of cases) and varying duration, scope, or complexity of cases, among other factors. Comparing MFCU recoveries to overall Medicaid spending can also be challenging to interpret as a hypothetical indicator of MFCU performance because these data only capture a portion of Medicaid program integrity efforts and include amounts other than recouped Medicaid payments. States can also make policy decisions that might impact state spending and MFCU recoveries differently. For example, states that spend more on prevention or early detection may see fewer recoveries (if these activities are successful), while states that invest less in fraud prevention may see higher levels of enforcement action and recoveries. There are no estimates of fraud that may have been successfully prevented or fraud that went undetected/unrecovered; however, over time there has been a shift in focus from efforts to recover misspent funds ("pay and chase") to prevention and early detection. A higher level of MFCU recoveries could indicate more fraud, more aggressive enforcement, or less effective prevention.

What are current issues involving MFCUs?

MFCUs continue to work with state and federal agencies to stop fraud and abuse but also face increased federal scrutiny. On May 13, 2026, HHS Investigator General Bell sent aletterto every state Attorney General communicating a stance of "insistence on rigid MFCU compliance" with requirements and performance standards that will be enforced through "robust review" by the HHS-OIG. MFCUs are recertified annually on a rolling schedule, based on each specific state or territory's original certification date.5 As of September 17, 2026, HHS-OIG has followed release of the May 2026 letter by issuing standard recertifications to 3 states and "conditionally recertifying" 11 state MFCUs, a designation which accompanies a set of corrective actions recommended by HHS-OIG. It does not appear that HHS-OIG regularly issued conditional recertifications prior to 2026.

In June 2026, Hawaii's and New York's MFCUs were notified that HHS-OIG was denying their annual recertification in letters citing insufficient case outcomes in both states. HHS announced that it wasdenyingHawaii's and New York's annual MFCU recertifications, discontinuing federal funding for the fraud control units.In each state's recertification denial letter, HHS cites insufficient case outcomes (particularly low production of criminal indictments and convictions) and recoveries that are disproportionately low relative to the staffing and budget of the state MFCU (New York) or relative to the growth in the state's Medicaid spending (Hawaii).States that have their MFCU recertification denied can appeal the decision and request that HHS-OIG reconsider; Hawaii indicated they intended to seek reconsideration. Hawaii and New York have responded to their denied MFCU certifications by reiterating their states' commitment to Medicaid program integrity and highlighting ongoing actions to prevent and detect suspected Medicaid fraud. It is unclear if HHS-OIG may deny the recertification of other state MFCUs, but the discontinuation of federal funding could hamper states' ability to continue ongoing operations and bolster support for new investigations.

MFCUs can also elect to investigate and prosecute patient abuse and neglect in non-institutional settings (e.g., home and community-based settings). ↩'

While states may have their own laws defining responsibilities around investigating beneficiary fraud or program abuse, MFCUs cannot use federal funding to investigate alleged beneficiary fraud unless it is in relation to suspected provider fraud. ↩'

Ibid. ↩'

Recoveries may not reflect the amounts actually collected from defendants (e.g., if the defendant is a company that dissolved before collections could be obtained). MFCUs work with state Medicaid agencies to return the state and federal share of any recovered Medicaid payments. ↩'

Federal requirements and performance standards serve as the basis for MFCU annual recertification by HHS-OIG. When a MFCU applies for annual recertification, the MFCU submits performance and budget data, including staffing, costs, case numbers and outcomes, and other information requested by HHS-OIG. HHS-OIG may conduct an onsite review of the MFCU. ↩'