On April 21, 2026, CMS Administrator Dr. Mehmet Oz announced an initiative requiring all states to submit plans to audit and revalidate providers participating in their Medicaid programs. On April 23, 2026, Dr. Oz issued letters to Governors and state Medicaid Directors (collectively, the “CMS Letters”) formally requesting that each state develop and submit a comprehensive two-year provider revalidation (PR) strategy describing how the state will ensure the accuracy of provider enrollment data and verify that only legitimate, qualified providers are enrolled and participating in the program. Currently, federal regulations require state Medicaid agencies to revalidate Medicaid providers at least every five (5) years. CMS’s latest initiative requesting more frequent revalidations represents a significant escalation of the federal government’s Medicaid program integrity enforcement efforts and follows a series of federal enforcement actions targeting multiple states, including Minnesota, New York, California, Florida, and Maine.
Key requirements of the CMS Letters
The CMS Letters request state Medicaid Directors to notify CMS of their plans to undertake a revalidation of high-risk providers within ten (10) business days. While CMS leaves it to the states to define which providers are considered “high-risk” providers, it emphasizes that it expects the definition to include any provider without a National Provider Identifier (NPI) and recommends prioritizing providers who have not been screened within the past twelve (12) months for near-term evaluation.
The CMS Letters request that Medicaid Directors, within thirty (30) days of receipt of the CMS Letters, personally submit a comprehensive two-year PR strategy to CMS, describing how the state will ensure the accuracy of provider enrollment data and verify that only legitimate, qualified providers are enrolled and participating in the program. While each state retains discretion to define the specific scope and priorities of its PR strategy, CMS requires that the strategy address the following:
- A proposed methodology and timeline for conducting the off-cycle two (2)-year PRs, with a focus on high-risk providers, including providers without an NPI.
- The metrics the state will use to measure the efficacy and progress of its PR strategy, including links to any public-facing data or reporting.
- The state’s approach to verifying the accuracy of provider information and maintaining it on an ongoing basis.
- How the state will ensure consistency and accuracy of provider data across fee-for-service and managed care delivery systems, including oversight of managed care plan provider directories.
- How the state Medicaid agency coordinates, or will coordinate, with relevant law enforcement partners.
The CMS Letters similarly request each state governor, within ten (10) business days of receipt, to notify CMS of whether the state intends to carry out the proposed PR strategy and submit a proposed timetable. If a governor fails to notify CMS of its intent to undertake the state’s PR strategy, CMS has indicated it will consider that failure as it evaluates fraud and abuse in the state moving forward.
Recommended actions for Medicaid providers
To ensure compliance with CMS’s latest directive, Medicaid providers in New York should confirm that all enrollment data on file with the New York State Department of Health (NYSDOH) is accurate, complete, and up to date, including NPI information, practice locations, and ownership details. CMS has singled out providers without NPIs as a category of particular concern, and states are expected to include these providers in their high-risk designations regardless of other risk factors. Therefore, providers enrolled in Medicaid without an NPI should confirm that their enrollment is otherwise proper and complete in all respects, and that they are not required to obtain an NPI under their state's Medicaid laws and regulations.
New York Medicaid providers should also review and, as necessary, update their internal compliance programs to ensure they meet the requirements of 18 NYCRR Part 521-1. Providers should begin preparing now to meet the accelerated timelines and enhanced compliance expectations that CMS’s latest initiative demands.
Given the heightened enforcement environment, NP will continue to monitor this space and is available to assist providers requiring counsel for revalidation challenges, enrollment discrepancies, or responses to fraud allegations.