Data Quality and Reporting Research Report

In Medicaid, reports and data submissions drive federal claiming, payment recovery, eligibility determinations, managed-care oversight, and program-integrity measurement. A missing case file, an invalid procedure-code combination, or a late report can therefore have consequences beyond a flawed spreadsheet: it can obscure a recovery, sustain inaccurate eligibility, or prevent an agency from validating what it paid.

The audits reviewed here show several ways the risk appears in practice. Source service logs may not reconcile to claims; a system may accept incomplete or inaccurate eligibility inputs; a pharmacy benefit manager (PBM) may aggregate Medicaid and non-Medicaid data in a way that prevents validation; or an identified overpayment may not reach the reporting process promptly or in the correct form.

This review uses 18 Medicaid audit reports and 26 supplied findings published from 2018 through 2025. The detailed findings come from 11 of the 18 scoped reports and include state audits, U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) reviews, and a U.S. Government Accountability Office (GAO) review.

Direct evidence consists of the auditors’ documented findings and recommendations. Dollar figures are presented only where the underlying analysis classifies them as identified improper amounts or payments reviewed. Broader Medicaid program conditions and unquantified downstream effects are not treated as financial losses.

This is the broadest pattern, supported by three reports across Kansas, New York, and Illinois. The common weakness was failure to reconcile operational records to the data used for payment or oversight.

The Kansas Office of the Medicaid Inspector General’s School-Based Fee-for-Service Medicaid Reimbursements audit found 203 missing claims across two local education agencies (LEAs). One LEA missed 10 months of claims, or 40% of the audit period, while another missed seven months, or 28%. The audit linked the omissions to under-billing and called for reconciliation of logs, claims, and individualized education programs. [Report 82]

New York’s Comptroller found that electronic visit verification (EVV) records were not consistently copied from the EVV History Table to the EVV Crosswalk Table and included procedure-code/modifier mismatches and invalid combinations. Illinois’s Auditor General separately found that the state agency had not performed on-site reviews or verified the accuracy of reported managed-care organization (MCO) payment data. [Report 103] [Report 23] Together, these audits show that submitted data cannot be assumed complete merely because it exists in a reporting system.

Supported by two reports in Illinois and Oregon, this theme shows how data-quality defects can originate during eligibility processing and persist into management reporting. The key risk is that systems may capture required fields without ensuring that the underlying values are accurate, current, or fully reflected in reports.

The Oregon Secretary of State’s The Oregon Eligibility System Appropriately Determines Eligibility, But Input Errors Continue to Occur found that automated controls did not adequately govern input accuracy outside required-field checks. Testing identified residency and income errors, including 156 residency-related instances in which a change should have ended eligibility and 29 cases in which workers did not rerun eligibility after a residency change. [Report 87]

Illinois’s Auditor General found internal-control and data-completeness issues in the Integrated Eligibility System, including incomplete tracking of extensions and disability status. Its Performance Audit of Medicaid Eligibility Determinations for Long-Term Care also found inaccurate and incomplete long-term-care reports, missing elements, and posting delays. [Report 35] The combined lesson is that eligibility-data reliability depends on both transaction edits and controls that ensure report production is complete and timely.

This is a two-report, state-and-national body of evidence: one Utah audit and one national GAO review. It does not establish a uniform national condition, but both reports point to weaknesses in the governance needed to make oversight information reliable and usable.

The Utah Office of the Legislative Auditor General’s A Performance Audit of the Office of Inspector General of Medicaid Services found that elements of external reporting lacked accuracy and transparency. The audit called for formalized reporting processes, accurate and complete metrics, and documented assumptions and methodology for any cost-avoidance measure. [Report 125]

GAO’s national Medicaid Managed Care Improvements Needed to Better Oversee Payment Risks identified challenges in program-integrity oversight involving resource allocation, data quality, and policy adequacy. [Report 28] Taken together, the reports suggest that agencies should examine not only data fields and calculations, but also who owns a metric, how its methodology is approved, and whether oversight functions have sufficient audit access.

This detailed, single-state audit contained five findings and material noncompliance. The principal weakness was the absence of a controlled reconciliation between MFCU-determined overpayment cases and the agency’s Form CMS-64 reporting and federal-share return process.

HHS-OIG’s North Carolina Did Not Report and Return All Medicaid Overpayments for the State’s Medicaid Fraud Control Unit Cases found that the agency relied on the MFCU to provide case files and overpayment information but lacked procedures to ensure all files were transmitted. The MFCU was also unaware that reporting could be required even if no payment occurred. [Report 55]

For fiscal years 2020 and 2021, the agency should have reported MFCU-determined overpayments totaling $41,383,314 for 12 cases, including a $27,495,987 federal share. Seven cases totaling $30,352,630 were not reported and returned; five cases totaling $11,003,651 were not reported and returned within required timeframes, with one case counted in both categories. [Report 55] This is a clear example of how an incomplete handoff process can create both completeness and timeliness failures.

Based on one detailed Texas managed-care audit, this theme concerns transparency rather than a documented improper-payment total. When reported pharmacy expenses do not reflect final amounts retained by providers, agencies cannot readily validate data used for rate setting and rebates.

The Texas State Auditor’s Office found that Blue Cross Blue Shield of Texas reported $26.4 million in fiscal-year 2018 pharmacy expenses that did not reflect funds pharmacies were required to return to the PBM. The return-of-funds approach used an effective-rate methodology that aggregated Medicaid and non-Medicaid claims, limiting price transparency and complicating validation. [Report 7]

The same audit found that encounter data omitted returned funds and that the PBM methodology did not identify the portion attributable to STAR Kids or other Medicaid programs. Although the audit reported $109.1 million in accurately supported STAR Kids medical expenses, that amount is payment volume, not a loss estimate. [Report 7] The risk is that financial reporting may appear complete while the data needed to validate final pharmacy payments is unavailable.

This is one federal review with a broad multi-state sample, rather than a repeat finding across separate reports. It is important because the error arose from calculation logic—incorrect federal medical assistance percentage (FMAP) application and calculation errors—rather than from missing documentation alone.

HHS-OIG’s Twelve Selected States Did Not Accurately Calculate the Federal Share of Medicaid Collections Subject to the Increased COVID-19 Federal Medical Assistance Percentages found that 12 of 13 selected states underreported the federal share by a net $61,792,714 during the increased COVID-19 FMAP period. Wyoming overreported, while Wisconsin reported the correct federal share. [Report 44]

The audit recommended corrections through recoupments from underreporting states and a refund to the overreporting state. [Report 44] The broader control implication is straightforward: agencies need a reproducible calculation, validation of the selected FMAP, and evidence that submitted amounts were reconciled to source collections before reporting.

This single Colorado audit found several linked process failures: incorrect reporting of the federal share, improper feeder-form selection, inadequate policies, and uncalculated interest. The issue was not simply that information was late; the workflow did not reliably translate recovery status into correct reporting treatment.

HHS-OIG’s Colorado’s Program Integrity Section Reporting of Medicaid Overpayments found that Colorado did not report and refund the correct federal share of overpayments identified from October 2014 through December 2020. For 80 of 403 reviewed cases, the audit identified $673,686 in associated federal share that was not reported. [Report 98]

The audit also found that overpayments were not consistently reported on the required CMS-64 feeder forms and that policies and procedures did not ensure staff understood correct form usage. Interest on late or unreported federal-share amounts had not been calculated or reported. [Report 98] The finding illustrates why audits should trace a case from identification through recovery, classification, reporting, and final federal return.

This is a distinct single-report Colorado finding. It matters because eventual reporting does not eliminate the compliance and financial consequences of reporting outside required timeframes.

The Colorado HHS-OIG audit found that $12,711,166 in Medicaid overpayments was reported, but not reported timely, during the October 2014 through December 2020 review period. The associated federal share was $8,465,227. [Report 98]

This finding is analytically separate from the $673,686 federal-share amount associated with unreported cases and should not be added to it without an overlap assessment. [Report 98] It reinforces the need for aging reports, escalation thresholds, and documented resolution of overdue reporting items.