Managed Care Research Report

In Medicaid managed care, states generally pay managed care organizations (MCOs) a periodic capitation payment for enrolled beneficiaries. That arrangement makes enrollment accuracy a payment control: an unprocessed death record, incarceration notice, address change, third-party coverage update, or interstate enrollment match can trigger continuing payments even when the enrollee’s status has changed.

The risk is not only whether a payment was made. Agencies must also determine whether plan-reported costs are properly classified, whether rates are based on valid data, whether claims and supplemental payments are supported, and whether beneficiaries can obtain covered services. Audits show that a control may exist on paper but still fail in the handoff between data matching, review, system updates, payment processing, recovery, and supervisory follow-up.

This review covers 36 reports published from 2018 through 2025, with 183 findings. It includes federal reviews by the U.S. Department of Health and Human Services Office of Inspector General (OIG), the Government Accountability Office (GAO), and the Centers for Medicare & Medicaid Services (CMS), alongside state audit reports.

The evidence distinguishes among direct findings of improper or unallowable payments, estimated or potentially improper amounts requiring verification, and contextual program-spending figures. Those categories are not interchangeable and are not combined into a single total.

Supported by 52 findings in 12 reports; this is the broadest theme in the review. The recurring problem was less about a lack of data than failure to act reliably on available data. New York’s Comptroller found that the Department of Health began reviewing New York State of Health Public Assistance Reporting Information System (PARIS) matches more than five years after enrollments began; premiums were paid for members who may have lived outside the state [Report 124]. Missouri’s State Auditor found that manual eligibility bypasses prevented normal deactivation controls from ending eligibility, including for beneficiaries who moved out of state or became incarcerated [Report 79].

National reviews demonstrate the pattern is not isolated. The OIG’s multistate concurrent-enrollment review found that all 47 states examined made capitation payments for beneficiaries concurrently enrolled in two states, while CMS did not actively monitor such enrollment or provide states national matching data [Report 40]. A separate OIG review found that death-date information was missing, unavailable in Medicaid systems despite being available elsewhere, or not used to update eligibility [Report 118]. Maryland identified approximately $14 million in improper capitation payments for incarcerated individuals during fiscal years 2019 through 2022 [Report 84].

The control failure is therefore end-to-end: match, investigate, update enrollment, stop payment, and pursue recovery.

Supported by 22 findings in seven reports across four jurisdictions. New York’s Comptroller identified $11.8 million in improper managed care premiums tied to untimely disenrollment for beneficiaries with comprehensive third-party insurance during October 2023 through March 2024 [Report 53]. In the following review period, the same issue produced $8.3 million in identified improper premiums, while fee-for-service inpatient payments continued for beneficiaries with managed care coverage [Report 54].

Other payment weaknesses involved specialized claims and reporting. Maryland’s Office of Legislative Audits found that the agency had not investigated or recovered $10.4 million in potentially improper newborn-delivery supplemental payments to MCOs [Report 84]. That amount requires claim-level investigation before being characterized as improper. In Texas, the State Auditor found that a pharmacy benefit manager’s methodology omitted returned funds from encounter reporting and did not isolate the Medicaid-specific share of transactions, impairing validation of reported pharmacy expenses [Report 7].

These findings show how enrollment defects, weak claim edits, incomplete documentation, and opaque plan reporting can compound one another.

Supported by 37 findings in eight reports examining six state programs—Washington, Ohio, Oregon, Illinois, Maryland, and Texas. Across these audits, inaccurate MLR classifications, incomplete encounter data, late reconciliations, and weak validation of MCO financial submissions reduced assurance over rate setting and remittance decisions.

CMS found that Washington’s MLR reporting inaccurately treated state-directed and special payments and inconsistently handled incentive payments, nonclaims costs, and payments outside the managed care contract [Report 121]. Ohio’s CMS MLR audit found reporting-template and submission errors involving taxes, quality-improvement activity expenses, and risk-corridor settlements [Report 11]. Oregon’s CMS audit similarly identified issues involving special payments, third-party vendor data, expense allocation, and quality-improvement expenditures [Report 18].

Rate-setting reviews exposed a related timing problem. Maryland lacked sufficiently comprehensive validation of MCO expenditure data used in capitation-rate calculations [Report 84]. Texas found that agreed-upon procedures and year-end reconciliations were not completed in time to inform rate setting, and results were not consistently communicated to actuarial staff [Report 114]. The risk is not necessarily a current improper payment; it is that unreliable financial inputs can embed error into future rates.

Supported by 28 findings in seven reports across four jurisdictions. Audits often found that agencies had oversight bodies, audit plans, or monitoring tools, but lacked consistent risk prioritization, ownership, documentation, and validation of corrective action.

The OIG assessed North Carolina’s Medicaid control environment as moderate risk overall and identified high risk in internal-control adoption and compliance monitoring [Report 56]. Washington’s State Auditor found that the Health Care Authority had not provided federally required oversight of sister agencies’ Medicaid program-integrity efforts and needed more risk-based audit selection [Report 33]. GAO found inconsistent CMS oversight of the Medicaid Recovery Audit Contractor program, including monitoring of state-plan-amendment expiration dates and effectiveness reporting [Report 17].

Texas illustrates the implementation gap: the State Auditor found that the Commission needed to improve execution of planned performance audits, corrective-action processes, and use of external quality review organization information [Report 26]. An audit program without documented closure testing is not a complete control.

Supported by 23 findings in six reports across five jurisdictions. These findings address beneficiary harm rather than only financial loss. New York’s Comptroller found inaccurate network-deficiency records, inconsistent status updates, and limited use of network-review data to identify recurring problems [Report 123]. The OIG found that all eight states in its parity review lacked required mental health and substance use disorder parity provisions in MCO contracts by the compliance date [Report 43].

In a New York prior-authorization audit, 35 of 70 sampled denials contained incorrect information in denial notices; resulting access delays had a median of 75 days and reached 282 days in one case [Report 9]. California’s State Auditor found that nonexclusive billing codes and incomplete data collection prevented meaningful measurement of comprehensive perinatal-service use [Report 39]. Florida also found incomplete documentation of supervisory review and inconsistent compliance-action forms for complaint and grievance oversight [Report 112].

The common issue is not merely missing reports. It is the inability to verify whether service obligations were met and deficiencies corrected.

Based on a single detailed Louisiana audit. Louisiana’s Legislative Auditor found that managed care incentive-payment funds supported activities not directly tied to measurable access, quality, or health-outcome improvement [Report 104]. The audit also found inconsistent quality-network structures and milestones, substantial use of funds for non-incentive activities, and insufficient monitoring of how MCOs and quality networks used funds.

Because this is a one-report theme, it should not be generalized as a cross-state pattern. Still, it provides a high-value audit model: test each incentive payment’s contractual purpose, measurable milestone, support for expenditure, and independently verified beneficiary outcome.

Supported by two federal reports. GAO reported that CMS’s managed-care improper-payment estimate had been at or near zero in recent years but did not capture all program-integrity risks, including services not provided, ineligible providers, and insufficient documentation [Report 12]. GAO also noted gaps in provider screening, prepayment review, and fraud-prevention implementation [Report 27].

The implication is practical: a favorable reported improper-payment rate does not substitute for targeted testing of enrollment, payment, provider, and documentation risks.