Mehmet Oz, the administrator of the Centers for Medicare and Medicaid Services (CMS), has announced a new federal mandate requiring states to overhaul their verification processes for medical providers. Speaking at a Politico health care summit on Tuesday, Oz detailed a plan that asks states to develop strategies within the next month to revalidate providers operating in what the administration deems "high-risk" areas. The directive applies to entities billing Medicare and Medicaid, the two federal programs that together cover more than 150 million Americans and account for a substantial share of federal discretionary and mandatory spending.
The initiative is designed to confirm that entities receiving federal funds are not only legitimate but possess the legal right to provide services. By tightening the oversight of provider rolls, the administration aims to identify "ghost" clinics — facilities that exist on paper but deliver no actual care — and fraudulent billing practices that have long plagued government-funded programs. The move places the burden of verification more squarely on state-level infrastructure, a notable shift in the division of labor between federal and state authorities in program integrity.
Provider Fraud and the Limits of Existing Oversight
Healthcare fraud within Medicare and Medicaid is not a new concern. The Government Accountability Office has for years included these programs on its "High Risk List" of federal operations vulnerable to waste and abuse. Fraudulent billing schemes range from phantom services billed under stolen provider credentials to elaborate networks of sham clinics that cycle through patient identifiers to extract reimbursements. The Department of Justice has historically pursued such cases through coordinated strike forces, often in partnership with the HHS Office of Inspector General.
What distinguishes the current CMS directive is its structural approach. Rather than relying primarily on after-the-fact enforcement — prosecuting fraud once it is discovered — the mandate asks states to build or strengthen front-end verification systems. In practice, this means revalidating provider enrollment data, cross-referencing licensure databases, and conducting site visits to confirm that listed facilities are operational. The one-month timeline for states to submit their plans is aggressive by the standards of federal-state coordination, and it remains to be seen whether state Medicaid agencies, many of which operate with constrained budgets and staffing, can meet the deadline with substantive proposals rather than procedural placeholders.
The concept of "high-risk" areas, as invoked by the administration, also warrants scrutiny. CMS has previously used geographic and categorical risk indicators to flag regions or provider types with statistically elevated rates of improper payments. Whether the current designation follows established actuarial methodology or reflects a broader political calculus is a question that state officials and oversight bodies are likely to press.
Political Friction and the Question of Targeting
This latest directive fits into a broader, highly publicized campaign by the Trump administration to target waste, fraud, and abuse in the federal healthcare system. The rhetorical framing — rooting out illegitimate providers draining public coffers — carries bipartisan appeal in the abstract. In execution, however, the effort has already generated political friction. Previous federal claims of systemic fraud have frequently centered on Democrat-led states, such as Minnesota and California — assertions that have been repeatedly disputed by state leaders who argue the administration's focus is more ideological than actuarial.
The tension is not merely partisan. It touches on a structural question about federalism in healthcare administration. Medicaid, by design, is a joint federal-state program. States set many of their own enrollment and provider standards within federal guardrails. A mandate that effectively requires states to re-prove the legitimacy of their own provider networks can be read as either a reasonable accountability measure or an implicit vote of no confidence in state-level governance — depending on the lens applied.
There is also a practical dimension. Aggressive provider revalidation campaigns, if poorly calibrated, carry the risk of disrupting access to care. Legitimate providers caught in administrative backlogs — particularly smaller clinics, community health centers, and providers serving rural populations — could face payment delays or temporary disenrollment. The balance between fraud prevention and continuity of care is a recurring tension in program integrity work, and one that the compressed timeline of this mandate may sharpen.
The coming weeks will test whether the directive produces a durable shift in how states police their provider rolls or whether it functions primarily as a signaling exercise. The answer depends in part on the specificity of CMS guidance yet to come, the capacity of state agencies to respond, and whether the definition of "high-risk" can withstand scrutiny as a technical rather than political designation.
With reporting from STAT News.
Source · STAT News (Biotech)
