Evidence record
Performance Audit Report July 2025 Medicaid Provider Enrollment Follow-Up Audit
- Jurisdiction
- North Carolina
- Publishing agency
- North Carolina Office of the State Auditor
- Publication date
- July 2025
- Source record
- Original document linked
Findings
4
Recommendations
6
Overall conclusion
The Division of Health Benefits did not fully implement prior audit recommendations during 2023, leaving ongoing risks to patient safety and Medicaid integrity from providers with suspended licenses, license limitations, unverified credentials (including DEA), and uncorroborated ownership information. The Division also faced governance concerns regarding the monitoring of the GDIT contract and did not consistently enforce measures intended to remove ineligible providers from the Medicaid program.
Scope
The audit examined the North Carolina Department of Health and Human Services (DHHS), Division of Health Benefits (DHB) provider enrollment processes for 2023. It evaluated whether the Division identified and removed Medicaid providers with suspended or terminated licenses, identified and removed providers with license limitations that pose threats to patient safety, verified provider accreditations and credentials, and corroborated ownership information during initial enrollment and the five-year reverification cycle. The scope includes enrollment activities (initial enrollment and reverification) and ongoing discipline checks for calendar year 2023, during which auditors tested 60 of 1,674 initial enrollment applications approved in 2023, reviewed all 4,860 reverification applications approved in 2023, and obtained lists of disciplined providers from four major NC licensing boards. It also considers the Division’s oversight of the NCTracks Medicaid Management Information System and the contract with General Dynamics Information Technology (GDIT) for provider enrollment activities, including SLAs and cost considerations. The audit period is January 1, 2023, through December 31, 2023.
Findings (4)
Each finding has a stable link.
- F-517
Did Not Fully Implement Recommendations to Identify and Remove Providers with Suspended or Terminated Licenses
- F-518
Did Not Fully Implement Recommendations to Remove Providers with Professional License Limitations That Pose Threats to Medicaid Patients
- F-519
Did Not Fully Implement Recommendations to Strengthen Provider Credential Verification
- F-520
Did Not Fully Implement Recommendation to Corroborate Provider Ownership Information
Recommendations (6)
- R-495
Remove all providers who have had their professional licenses suspended, terminated, or entered into Non-Practice Agreements from the Medicaid program.
Related finding F-517 - R-496
Develop written policies for the continued enrollment of providers with license limitations describing acceptable license limitations and the documentation required to support enrollment decisions.
Related finding F-518 - R-497
Verify that providers possess DEA certifications; ensure credential verification includes direct verification with credentialing agencies and do not rely solely on provider self-report or opt-out forms.
Related finding F-519 - R-498
Corroborate ownership information for Medicaid providers by comparing provider-disclosed ownership against data from state licensure boards or other authoritative sources and conduct background checks; remove ineligible providers.
Related finding F-520 - R-499
Fully implement prior audit recommendations in a timely manner to address identified internal control deficiencies.
- R-500
Strengthen provider credential verification by ensuring direct verification with credentialing authorities (including DEA) during enrollment and reverification.
Related finding F-519