Understanding the Role of Medicaid Fraud Control Units (MFCUs)

Federal law requires every state to operate a Medicaid Fraud Control Unit (MFCU) that investigates and prosecutes provider fraud and patient abuse and neglect. MFCUs are typically housed within the state Attorney General’s office and are required to operate independently from the state Medicaid agency that runs the Medicaid program. MFCUs are one component in the Medicaid program integrity system, which includes many different state and federal agencies with shared and distinct responsibilities defined by state and federal law. Ensuring Medicaid program integrity (i.e., the appropriate use of federal and state Medicaid funds) involves a range of activities from fraud prevention to enforcement activities—the primary responsibility of MFCUs. While MFCUs are a key part of the program integrity system, it can be difficult to compare MFCU data across states or to put fraud recovery dollars into the context of overall Medicaid spending because recovery data only capture a portion of Medicaid program integrity efforts (e.g., leaving out the value of fraud prevention or stopped payments) and don’t capture fraud that goes undetected.

As the Trump Administration continues to focus on addressing fraud, waste, and abuse in federal programs, including Medicaid, MFCUs are facing increased federal scrutiny. In May 2026, CMS announced the HHS Office of the Inspector General (HHS-OIG) would be initiating a review of every state’s MFCU before its next annual recertification. In June 2026, the HHS-OIG denied recertification and suspended federal funding for Hawaii’s and New York’s Medicaid Fraud Control Units. Within this context, this brief provides an overview of the role of MFCUs, examines caseload and case outcome data, and current issues facing MFCUs.

What are MFCUs and how do they work?

MFCUs are law enforcement entities that investigate and prosecute provider fraud and patient abuse and neglect. MFCUs investigate and prosecute, or refer to prosecution, provider fraud (in all settings) and complaints of patient abuse in certain health care settings, such as nursing homes and hospitals receiving Medicaid funds.¹ MFCUs do not investigate fraud or program abuse committed by beneficiaries (these cases are the responsibility of the state Medicaid agency), although evidence of beneficiary fraud is low.² MFCUs must operate independently from the state Medicaid agency and are often part of the State Attorney General’s office, employing teams of investigators, attorneys, and auditors. The HHS-OIG oversees MFCUs, annually recertifying each MFCU, assessing performance and compliance with federal requirements, and administering federal grant awards (which cover 75% of MFCU operating costs).

MFCUs open investigations after receiving referrals of suspected provider fraud or complaints involving patient abuse or neglect. A MFCU case typically begins with a referral from the state Medicaid agency (including program integrity or auditing offices), managed care organization (MCO), or from a complaint filed by a patient or former employee. The state Medicaid agency or MCO may initially detect fraud through monitoring Medicaid data and using data mining or analytics to identify billing pattern anomalies (e.g., billing spikes, upcoding, double billing, or unusual hours). All state Medicaid agencies have authority to conduct data mining, but some MFCUs have also specifically been granted permission by HHS-OIG to mine Medicaid data directly for evidence of fraud as part of their regular activities. More MFCUs may begin to conduct data mining or analytics as HHS-OIG in August 2026 waived the requirement that MFCUs obtain prior approval for these activities to identify suspected Medicaid fraud. While patient abuse or neglect may fall under the jurisdiction of several different law enforcement agencies, MFCUs may investigate patient abuse or neglect in health care facilities receiving Medicaid funds.³

MFCU cases vary in duration and scope, but investigations generally follow a standard process starting with an investigation and ending with potential financial recoveries (Figure 1).

Investigation. When a case is opened, the investigative team researches the alleged fraud or abuse by analyzing the evidence. Investigations may take months or years before charges are filed against providers.

Criminal Indictments & Civil Cases. Fraud and abuse can violate state and/or federal criminal law, civil law, or both. If a MFCU’s investigation team determines there is sufficient evidence of wrongdoing, the MFCU can bring criminal charges and/or civil lawsuits against the provider.

Criminal Convictions & Civil Judgments. Criminal convictions can result in a criminal record, financial penalties, and/or incarceration. Civil judgments can establish liability and/or impose financial penalties and other court-ordered remedies. Providers who are convicted or liable for criminal fraud or patient abuse/neglect (along with other crimes) legally must be excluded from participating in federally funded health care programs. HHS-OIG or state Medicaid agencies may also decide to exclude providers beyond these minimum standards.

Recoveries. HHS-OIG defines recoveries as the amount of money that defendants are required to pay as a result of a settlement, judgment, or prefiling settlement in criminal and civil cases. Recoveries may not reflect the amounts actually collected from defendants (e.g., if the defendant is a company that dissolved before collections could be obtained). MFCUs work with state Medicaid agencies to return the state and federal share of any recovered Medicaid payments.

Note: Throughout the lifecycle of a case, MFCUs may collaborate with other state and federal program integrity and law enforcement partners. State entities include state inspectors general and state health departments and federal entities include the U.S. Department of Justice (DOJ) (including Federal Bureau of Investigation (FBI)) and the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). Some investigations or cases may be transferred to (or handled by) federal law enforcement agencies.     

What data do MFCUs report?

Annually, MFCUs report investigation, enforcement, and financial recoveries data to HHS-OIG. Each year, HHS-OIG releases a summary report of MFCU activities that provides an annual snapshot of aggregated case outcomes from all MFCUs and certain case outcome trends. In addition to the summary report, HHS-OIG releases individual (state) MFCU case activity and outcomes data.

At the end of FY 2025, there were 15,810 open investigations across all state MFCUs. While MFCUs investigate both provider fraud and patient abuse and neglect, data show most MFCU investigations are related to provider fraud (Figure 2). A subset of investigations leads to criminal indictments or civil cases / complaints. MFCU investigations can take months to years, depending on various factors, including the types of allegations involved, volume of records, and agencies involved.

In FY 2025, MFCUs obtained 1,180 criminal convictions and reached 661 civil settlements and judgements (Figure 3). Most criminal convictions were for provider fraud. HHS-OIG uses information it receives from MFCUs to exclude individuals and entities from participating in federal health programs. In FY 2025, 900 individuals or entities were excluded because of criminal convictions obtained by MFCUs—accounting for nearly one-third (32%) of all OIG exclusions that year (data not shown).

On average, MFCUs recover more than $1 billion each year from fraud investigations. Nationally, MFCUs recovered $1.97 billion in FY 2025. While recoveries include other financial penalties in addition to Medicaid funds recouped from providers due to MFCU investigations (and may not reflect amounts actually collected⁴), the total amount of recoveries is small compared to total Medicaid spending. Recoveries vary each year and can be skewed by factors, including timing of settlements and large multi-year cases. Recoveries typically vary substantially from year to year and have averaged $1.48 million per year over the period 2016 to 2025. A 5-year rolling average accounts for periodic variation and shows that recoveries decreased during the COVID-19 Public Health Emergency and are returning to pre-COVID levels. Recoveries, after accounting for year-to-year variation, have remained generally steady over time while total Medicaid spending has increased. Recoveries are not a comprehensive measure of enforcement (because they may not include Medicaid-related enforcement actions that occurred outside of MFCU actions) and do not include the possible financial impacts of other program integrity efforts, such as preventing fraud before it occurs. Of the $1.97 billion in recoveries, two-thirds (64%) were due to criminal convictions and one-third (36%) were due to civil judgments or settlements (data not shown). This is proportionate to the share of criminal and civil case resolutions in FY 2025 (Figure 3).

Comparing data across states or considering recovery dollars in the context of overall Medicaid spending can be challenging. Comparing MFCU data across states or years can be difficult due to differences in state law (that impact the handling of cases) and varying duration, scope, or complexity of cases, among other factors. Comparing MFCU recoveries to overall Medicaid spending can also be challenging to interpret as a hypothetical indicator of MFCU performance because these data only capture a portion of Medicaid program integrity efforts and include amounts other than recouped Medicaid payments. States can also make policy decisions that might impact state spending and MFCU recoveries differently. For example, states that spend more on prevention or early detection may see fewer recoveries (if these activities are successful), while states that invest less in fraud prevention may see higher levels of enforcement action and recoveries. There are no estimates of fraud that may have been successfully prevented or fraud that went undetected/unrecovered; however, over time there has been a shift in focus from efforts to recover misspent funds (“pay and chase”) to prevention and early detection. A higher level of MFCU recoveries could indicate more fraud, more aggressive enforcement, or less effective prevention.

What are current issues involving MFCUs?

MFCUs continue to work with state and federal agencies to stop fraud and abuse but also face increased federal scrutiny. On May 13, 2026, HHS Investigator General Bell sent a letter to every state Attorney General communicating a stance of “insistence on rigid MFCU compliance” with requirements and performance standards that will be enforced through “robust review” by the HHS-OIG. MFCUs are recertified annually on a rolling schedule, based on each specific state or territory’s original certification date.⁵ As of September 17, 2026, HHS-OIG has followed release of the May 2026 letter by issuing standard recertifications to 3 states and “conditionally recertifying” 11 state MFCUs, a designation which accompanies a set of corrective actions recommended by HHS-OIG. It does not appear that HHS-OIG regularly issued conditional recertifications prior to 2026.

In June 2026, Hawaii’s and New York’s MFCUs were notified that HHS-OIG was denying their annual recertification in letters citing insufficient case outcomes in both states. HHS announced that it was denying Hawaii’s and New York’s annual MFCU recertifications, discontinuing federal funding for the fraud control units. In each state’s recertification denial letter, HHS cites insufficient case outcomes (particularly low production of criminal indictments and convictions) and recoveries that are disproportionately low relative to the staffing and budget of the state MFCU (New York) or relative to the growth in the state’s Medicaid spending (Hawaii).States that have their MFCU recertification denied can appeal the decision and request that HHS-OIG reconsider; Hawaii indicated they intended to seek reconsideration. Hawaii and New York have responded to their denied MFCU certifications by reiterating their states’ commitment to Medicaid program integrity and highlighting ongoing actions to prevent and detect suspected Medicaid fraud. It is unclear if HHS-OIG may deny the recertification of other state MFCUs, but the discontinuation of federal funding could hamper states’ ability to continue ongoing operations and bolster support for new investigations.

1. MFCUs can also elect to investigate and prosecute patient abuse and neglect in non-institutional settings (e.g., home and community-based settings). ↩︎
2. While states may have their own laws defining responsibilities around investigating beneficiary fraud or program abuse, MFCUs cannot use federal funding to investigate alleged beneficiary fraud unless it is in relation to suspected provider fraud. ↩︎
3. Ibid. ↩︎
4. Recoveries may not reflect the amounts actually collected from defendants (e.g., if the defendant is a company that dissolved before collections could be obtained). MFCUs work with state Medicaid agencies to return the state and federal share of any recovered Medicaid payments. ↩︎
5. Federal requirements and performance standards serve as the basis for MFCU annual recertification by HHS-OIG. When a MFCU applies for annual recertification, the MFCU submits performance and budget data, including staffing, costs, case numbers and outcomes, and other information requested by HHS-OIG. HHS-OIG may conduct an onsite review of the MFCU. ↩︎