Federal law mandates that every U.S. state operate a dedicated Medicaid Fraud Control Unit (MFCU) tasked with investigating and prosecuting provider fraud alongside patient abuse and neglect in medical settings. Typically housed within state Attorney General offices, these units function independently from the state agencies that administer day-to-day Medicaid operations. MFCUs form a critical pillar of the broader Medicaid program integrity system—a complex network of shared state and federal responsibilities designed to safeguard public funds. While these units primarily focus on enforcement and recovery, evaluating their performance through raw financial data alone remains difficult. Recovery figures capture only a fraction of total program integrity efforts, omitting the immense financial value of stopped payments, proactive fraud prevention, and crimes that escape detection entirely.
Against the backdrop of a continuing federal push by the Trump Administration to root out waste, fraud, and abuse across public programs, state-level MFCUs are encountering unprecedented levels of federal scrutiny. In May 2026, the Centers for Medicare & Medicaid Services (CMS) announced that the Department of Health and Human Services Office of the Inspector General (HHS-OIG) would launch a comprehensive review of every state’s MFCU prior to granting annual recertifications. The consequences of this heightened oversight materialized swiftly. By June 2026, the HHS-OIG denied recertification and suspended federal funding for the Medicaid Fraud Control Units in both Hawaii and New York, igniting a fierce debate over enforcement metrics, state autonomy, and program integrity standards.
What are MFCUs and how do they work?
Operating primarily as specialized law enforcement entities, MFCUs possess the jurisdiction to investigate, prosecute, or refer for prosecution instances of provider fraud across all healthcare settings, alongside complaints of patient abuse and neglect in facilities such as nursing homes and hospitals receiving Medicaid funds. Crucially, MFCUs do not target beneficiary fraud, which remains the responsibility of state Medicaid agencies, though evidence suggests beneficiary-level fraud constitutes a very small share of overall improper payments.
To maintain objectivity, MFCUs operate separately from state Medicaid administration, employing multidisciplinary teams composed of investigators, attorneys, and financial auditors. The HHS-OIG maintains strict federal oversight by conducting annual recertifications, evaluating performance, measuring compliance with federal mandates, and administering federal grants that cover 75 percent of operational costs.
Investigations typically commence following referrals from state Medicaid agencies, managed care organizations (MCOs), or complaints filed by patients and former employees. State agencies frequently uncover suspicious billing anomalies through sophisticated data mining and analytics, spotting billing spikes, upcoding, double billing, or irregular service hours. While all state Medicaid agencies possess data-mining authority, the HHS-OIG historically required MFCUs to secure prior approval before conducting independent data mining. However, a policy waiver issued in August 2026 lifted this requirement, enabling more MFCUs to mine Medicaid data directly in search of irregularities.
The lifespan of an MFCU investigation varies significantly depending on the complexity of the allegations, the volume of records, and the number of agencies involved, but investigations generally follow a structured trajectory ending in potential financial recovery. During the investigative phase, teams pore over evidence to substantiate claims of fraud or abuse. If sufficient evidence emerges, units can bring criminal indictments, civil lawsuits, or both. Criminal convictions carry potential prison sentences, financial penalties, and criminal records, while civil judgments establish financial liability and court-ordered remedies.
Federal law mandates that any provider convicted of criminal fraud or patient abuse be excluded from participating in federally funded healthcare programs, a standard that HHS-OIG and state agencies can expand further. Financial recoveries represent funds defendants must pay via settlements, judgments, or prefiling agreements. Because companies occasionally dissolve before collections are completed, recovery figures do not always reflect actual cash collected. Throughout these proceedings, MFCUs frequently collaborate with state inspectors general, state health departments, the U.S. Department of Justice, the FBI, and the HHS-OIG.
Active MFCU investigations remain strictly confidential, but public announcements follow successful criminal convictions and civil judgments. Landmark cases illustrate the diverse scope of MFCU operations. For instance, the Virginia MFCU participated in a complex investigation involving the McKinsey consulting firm’s marketing advice to Purdue Pharmaceuticals regarding OxyContin sales. That lengthy probe culminated in a December 2024 resolution requiring McKinsey to pay $650 million in criminal and civil recoveries. Similarly, during the 2018 National Health Care Fraud Takedown, the Georgia MFCU investigated fraudulent claims involving non-emergency medical transportation and adult day health services, leading to a $10.1 million civil settlement under the False Claims Act. In another sphere of enforcement, the Massachusetts MFCU secured a criminal conviction in 2023 against a home health aide following a referral regarding the abuse of an elderly patient.
What data do MFCUs report?
MFCUs submit extensive annual reports detailing their investigative activities, enforcement actions, and financial recoveries to the HHS-OIG. In turn, the federal agency publishes comprehensive national summaries alongside individual state data sets.
At the close of fiscal year 2025, state MFCUs collectively maintained 15,810 open investigations, the vast majority of which centered on provider fraud rather than patient abuse. A subset of these investigations ultimately yielded 1,180 criminal convictions and 661 civil settlements and judgments during fiscal year 2025. These convictions served as the basis for 900 individual and corporate exclusions from federal healthcare programs—accounting for nearly one-third of all OIG exclusions that year.
On a national scale, MFCUs consistently recover more than $1 billion annually, hitting $1.97 billion in fiscal year 2025. While these recoveries represent vital restitutions, they constitute a small fraction of total nationwide Medicaid spending. Year-to-year recovery totals fluctuate significantly, driven by the timing of massive multi-year settlements. Over the decade spanning from 2016 to 2025, annual recoveries averaged $1.48 billion. A five-year rolling average reveals that recoveries dipped during the COVID-19 public health emergency before returning to pre-pandemic levels, remaining relatively steady even as overall Medicaid spending climbed. Roughly 64 percent of fiscal year 2025 recoveries stemmed from criminal convictions, with the remaining 36 percent originating from civil judgments and settlements.
Comparing performance metrics across different states remains challenging due to variations in state laws, investigative capacities, and case complexities. Furthermore, using recovery dollars as a direct yardstick for program integrity can be misleading. States that heavily invest in proactive fraud prevention and early detection may report lower recovery figures because fewer fraudulent claims slip through the cracks, whereas states with reactive "pay and chase" models may boast higher recovery totals alongside higher levels of illicit billing.
What are current issues involving MFCUs?
Even as MFCUs continue their collaborative enforcement work with state and federal partners, they are navigating an era of heightened federal oversight. On May 13, 2026, HHS Inspector General Bell dispatched a formal letter to every state Attorney General, emphasizing an uncompromising insistence on rigid compliance with federal performance standards enforced through rigorous federal reviews. MFCUs undergo recertification annually on a rolling schedule tied to their original certification dates. By September 2026, the HHS-OIG had issued standard recertifications to only three states while placing eleven state MFCUs under "conditional recertification," a designation requiring specific corrective action plans—a mechanism rarely deployed in prior years.
The tension peaked in June 2026 when the HHS-OIG formally notified the Medicaid Fraud Control Units in Hawaii and New York that their annual recertification applications were denied, effectively cutting off their federal funding streams. Federal letters pointed to insufficient case outcomes, specifically citing low numbers of criminal indictments and convictions, alongside recoveries that lagged behind administrative budgets in New York and failed to match the pace of Medicaid spending growth in Hawaii.
Both states swiftly pushed back against the federal penalties. Hawaii officials announced plans to seek reconsideration, while leadership in New York condemned the decision, vigorously reaffirming their commitment to Medicaid program integrity and highlighting ongoing fraud detection initiatives. While the broader impact on other state units remains uncertain, the sudden discontinuation of federal funding threatens to severely disrupt ongoing investigations and strain local resources designed to protect vulnerable patients and public funds.
