The Next Evolution of Medicaid Program Integrity Has Arrived
Why Integrity Compliance Success Requires an Integrated Payer-and-Provider Dual Perspective
-
October 13, 2026
-
Federal oversight of Medicaid managed care is entering a new phase. As the Centers for Medicare & Medicaid Services (“CMS”) expands Unified Program Integrity Contractor (“UPIC”) audit activity across Medicaid managed care programs, both health plans and providers face a dramatically changing regulatory landscape. What was once viewed primarily as a Medicare-focused audit function focused on providers is now becoming a significant component of Medicaid program integrity oversight.
The implications of this change extend far beyond compliance. Medicaid managed care organizations (“MCOs”) and providers must now prepare for an audit environment in which federal investigators are increasingly evaluating not only claims and payments, but also MCO compliance programs, network adequacy, prior authorization and access to preventive services.1
Yet one challenge consistently emerges: Payers and providers are often preparing for the same regulatory scrutiny from their own perspectives.
When approaching a Medicaid UPIC audit, organizations can benefit from an approach that takes both the payer and provider perspectives into consideration. Having advisors who have worked with both payers and providers can offer additional visibility into how risks emerge, how regulators evaluate them, and how they can be effectively mitigated before they become audit findings.
Why the Medicaid UPIC Expansion Matters
CMS’ Comprehensive Medicaid Integrity Plan (Fiscal year 2024-2028) outlines a substantial increase in Medicaid managed care oversight, including the expansion of UPIC audits beyond the small number of states initially participating in managed care reviews.2 Additionally, the U.S. Health and Human Services Office of Inspector General (“HHS OIG”) found that states have weak and inconsistent monitoring of MCO fraud, waste and abuse reporting, including lack of consistent MCO fraud case referral timelines and reporting requirements. The HHS OIG recommended a federal initiative for nationally driven oversight. In its response, CMS cited the expanded use of UPIC audits to conduct oversight.3
Organizations can no longer view Medicaid program integrity solely through a payer lens or solely through a provider lens. The findings identified by regulators often originate in the interaction between both parties, creating risk that neither side can fully understand in isolation. For example:
- Health plans may design robust program integrity programs but struggle demonstrating operational effectiveness during audits.
- Providers may maintain compliance programs yet lack visibility into how claims data appears from a risk-perspective to payer analytics teams.
- Both parties may unknowingly create vulnerabilities that become apparent only when federal investigators evaluate the complete ecosystem.
This growing intersection is precisely where an outside advisor’s dual-perspective model can be invaluable.
What Medicaid MCOs Should Be Doing Now
The expanding UPIC environment requires MCOs to transition from reactive compliance toward proactive risk management. The most effective organizations are asking:
- Can our program integrity activities withstand external scrutiny?
- Can we demonstrate prevention, detection, and correction activities?
- Are our special investigations unit operations producing measurable results?
- Do our analytics identify risks before regulators do?
- Is our provider education reducing systemic vulnerabilities?
This is the right time to engage with experts to answer these questions and start planning how to operationalize compliance. A dual-audience, outside perspective frequently uncovers gaps that would otherwise remain undetected until an audit occurs.
What Providers Should Be Doing Now
Providers face a similar challenge. Historically, many provider organizations focused on responding to audits after receiving requests. Increasingly, that approach creates unnecessary risk. Today’s providers need:
- Predictive compliance monitoring
- Continuous risk assessments
- Data-driven audit readiness programs
- Clearly defined response protocols
- Executive visibility into regulatory exposure
Most importantly, providers need to understand how they appear through the eyes of health plans and regulators. Having the payer perspective in an advisor helps providers understand the methodologies, analytics, and investigative approaches increasingly used to identify potential compliance risks and concerns. This allows providers to proactively address vulnerabilities before external stakeholders identify them.
Looking Ahead: A New Model for Audit Readiness
The Medicaid UPIC expansion represents more than a regulatory change. It represents a shift toward ecosystem-level accountability. As oversight expands, organizations that continue operating within payer-only or provider-only silos may face increasing challenges when they need to prepare for audits, strengthen their integrity programs, demonstrate proactive fraud prevention activities, and respond confidently when regulatory scrutiny arises. In an environment where payers, providers, and regulators are becoming increasingly interconnected, those that understand the interconnected nature of program integrity risk will be significantly better positioned to adapt.
Footnotes:
1: Centers for Medicare & Medicaid Services, “Medicaid Program Integrity Manual” (Dec. 23, 2025), Chapter 3.
2: Medicaid.gov, “Program Integrity” (n.d.).
3: U.S. Department of Health and Human Services, Office of Inspector General, “States Have Missed Some Opportunities to Improve Medicaid Managed Care Organizations’ Provider Fraud Referrals,” OEI-03-23-00340 (July 16, 2026).
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Published
October 13, 2026
Key Contacts