Continuing the Trump Administration’s healthcare anti-fraud efforts, on October 26, 2026 CMS released the Medicaid and CHIP Program Integrity Pillars. The Pillars are a framework organizing new and existing guidance for state Medicaid agencies, managed care plans, and law enforcement partners. Before the Pillars, CMS progressively increased its pressure on states to prevent Medicaid fraud, waste, and abuse through eligibility data-matching, new statutory requirements, and initiatives to prevent overpayments and identify risk.
In July 2025, CMS found that people were enrolled in two or more states and committed to eliminating duplicate Medicaid coverage. Under the One Big Beautiful Bill Act (Pub. L. No. 119-21), states have additional Medicaid integrity requirements including checking for deceased enrollees and implementing community engagement (work) requirements. On April 23, 2026, CMS launched the Medicaid Fraud War Room to leverage data analytics to identify high-risk providers, develop investigative leads, and coordinate action. CMS reports, in its first 88 days, the War Room coordinated federal and state actions against 50 high-risk providers, including 42 HHS-OIG notices of intent to exclude.
I. CMS Six Program Integrity Pillars for Medicaid and CHIP
CMS’s six Program Integrity Pillars are set up to use data to identify and respond to health care fraud, waste, and abuse in Medicaid and CHIP. CMS describes the Pillars as its expectations for the oversight mechanisms that state Medicaid agencies, managed care plans, and law enforcement partners should have in place. The Pillars do not themselves create new regulatory requirements; instead, the linked guidance and toolkits address existing program integrity requirements. The six pillars are:
- Claims Editing & Data Analytics.
- Provider Enrollment.
- Targeted Reviews & Audits.
- Managed Care Oversight.
- Investigations & Law Enforcement Referrals.
- Robust Administrative Actions.
Claims Editing and Data Analytics: This pillar focuses on using early detection to prevent improper payments before they are made. CMS highlights three tools: the National Correct Coding Initiative (NCCI), Healthcare Fraud Prevention Partnership (HFPP), and the Medicaid Emerging Vulnerability Intelligence and Actions (MEVIA) dashboard.
Provider Enrollment: CMS’s guidance includes best practices for screening providers, including the Medicaid Provider Enrollment Compendium (MPEC), CMS’s reference for building a compliant enrollment and screening program; data-compare processes that check providers and owners against federal and state exclusion, sanction, and licensure sources at enrollment and on an ongoing basis; and the use of National Provider Identifiers (NPIs) for Medicaid Personal Care Attendants (PCAs).
Targeted Reviews and Audits: Reviews and audits, conducted on either a prepayment or post-payment basis, will draw on claims editing and data analytics to identify where risk is concentrated and whether fraud, waste, or abuse is involved.
Managed Care Oversight: CMS calls this one of the most consequential pillars of program integrity and notes that additional guidance is forthcoming. CMS’s best-practice guidance covers five areas: compliance, overpayment recoveries, payment suspensions, program integrity staffing ratios, and contract language.
Investigations and Law Enforcement Referrals: This pillar turns the detection of suspected fraud into action by outlining best practices for coordination between the state Medicaid agency and the Medicaid Fraud Control Unit and for implementing Medicaid Fraud War Rooms at the state level.
Robust Administrative Actions: States should have a full set of administrative authorities to respond to fraud, waste, and abuse, including payment suspensions, overpayment recoveries, provider terminations, and exclusions, grounded in statutory and regulatory support.
II. Managed Care Oversight
In most states, managed care now covers the majority of Medicaid enrollees. Managed care program integrity requires additional layers of oversight because the state pays the plan, which in turn pays providers. Oversight responsibility extends to both the plan’s conduct and its ability to detect fraud. Under federal rules and their state contracts, plans are responsible for identifying and reporting suspected provider fraud and improper billing. Although capitation may give plans a financial incentive to prevent improper provider payments, it does not eliminate program integrity risk. Inaccurate encounter data, inadequate oversight, and undetected fraud can affect plan payments and the integrity of the broader Medicaid program.
While CMS notes oversight guidance is still forthcoming, the Pillars offer plans a preview of where oversight is heading. CMS is placing greater emphasis on data analytics across the Pillars, including managed care oversight, and we expect the forthcoming managed care guidance to follow suit. In practice, plans should expect states to translate these best practices into contract requirements, such as program integrity staffing ratios and payment suspension and overpayment recovery procedures. Plans should review CMS’s managed care guidance against their own compliance programs now and watch for the forthcoming guidance and state contract amendments.
III. What Plans Should Do Now
Regulators view plans as both subjects of oversight and partners in fighting fraud, so the Pillars cut both ways. Even before CMS issues its managed care guidance, plans can use them to pressure-test their programs:
- Map the Pillars to your state contracts: Compare CMS’s five managed care focus areas against each contract’s program integrity, reporting, and staffing provisions, and identify gaps before the state does. States may incorporate these expectations through contract amendments, procurement documents, guidance, or oversight processes.
- Keep exclusion screening current: Confirm that network screening against federal and state exclusion lists runs on a regular cadence and keeps pace with state enrollment and revalidation requirements.
- Stress-test referral and overpayment processes: Confirm that suspected fraud is escalated and referred to the state on the timelines your contracts require, and that overpayment identification, recovery, and reporting are documented.
- Prepare for payment suspensions: Have a playbook for how the plan will handle suspensions directed by the state, including effects on network and member access and communications with affected providers.
- Run and document your own analytics: CMS’s emphasis on data analytics and information sharing makes it increasingly important for plans to document their own detection and response capabilities. Plans that show independent detection of outlier billing, and act quickly once a provider is flagged, will be better positioned in audits and state reviews.
- Plan for investigations: When an internal review surfaces potential misconduct, determine early who will conduct the investigation and consider how applicable privileges should be preserved. Findings may feed referrals to the state, a Medicaid Fraud Control Unit, or HHS-OIG.
Plans should also watch for state-level follow-through, including state Medicaid Fraud War Rooms, where plans may be asked to share data and referrals. Groom Law Group advises managed care organizations on program integrity compliance, state contract issues, and government investigations. To discuss how the Pillars affect your organization, please contact the Health Services Group at Groom.
Copyright © 2026 Groom Law Group, Chartered. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. With permission, excerpts and links may be used, provided that full and clear credit is given to Groom Law Group, Chartered and www.groom.com with appropriate and specific direction to the original content. For assistance, you may contact us.
