Public Letter

October 15, 2026
2025‑605

The Governor of California
President pro Tempore of the Senate
Speaker of the Assembly
State Capitol
Sacramento, California 95814

Dear Governor and Legislative Leaders:

The Department of Health Care Services (Health Care Services) is the federally designated single state agency responsible for administering the California Medical Assistance Program (Medi‑Cal), the State’s Medicaid program. In accordance with the State’s high‑risk government agency audit program authorized by Government Code section 8546.5, my office presents this report that provides an additional rationale for designating Health Care Services as a high‑risk agency; specifically, Health Care Services’ insufficient oversight of payments to Medi‑Cal providers.

We first designated Health Care Services as high risk in 2007 because of challenges associated with its organizational restructuring and concerns about its ability to meet the Legislature’s expectations of increased accountability and program effectiveness. In the intervening years, we have continued to monitor Health Care Services’ progress toward addressing its high‑risk status, and in December 2025, we retained Health Care Services on our high‑risk list because of problems we identified with its Medi‑Cal eligibility determinations. In this report, we detail our assessment that results in our updating the state high‑risk list because we have determined that Health Care Services is at substantial risk of making inappropriate payments to Medi‑Cal providers. Curtailing inappropriate payments to providers would allow the Medi‑Cal program to redirect funds to benefit both beneficiaries and those who provide health care to the State’s most vulnerable residents.

It is important to note that this report represents only our assessment of Health Care Services’ oversight of provider payments for Medi‑Cal services as high risk, thus warranting another reason for Health Care Services’ inclusion on the state high‑risk list. Making this assessment allows my office—as resources permit—to self-initiate a subsequent high‑risk audit to more deeply explore the root causes of and potential solutions for curtailing inappropriate payments to Medi‑Cal providers. This report is not the result of an audit under our state high‑risk audit program and therefore does not include any specific recommendations.

Key Observations:

• Health Care Services has a history of weaknesses in overseeing providers, including prior audit findings related to Medi‑Cal payments to providers with indicators of fraudulent activity.
• One of Health Care Services’ risk assessment tools identified approximately 28,000 providers as being in the top 10 percent of risk scores for inappropriate billing because they submit an unreasonably high number of claims, serve a large number of beneficiaries, or take other actions that can indicate fraud; however, Health Care Services has not researched or investigated 26,000 of these providers—who accounted for at least $12 billion in Medi‑Cal services in fiscal year 2024–25. Although not all of these providers may have engaged in fraud, waste, or abuse, the amount underscores the opportunities for enhanced scrutiny by Health Care Services.
• Managed care plans’ investigations and Health Care Services’ follow-up efforts have not always been sufficient to stop providers from inappropriate billing for Medi‑Cal services. Health Care Services has been slow to or failed to follow up on certain providers when there are indications of potential wrongdoing.
  • For example, Health Care Services closed an investigative referral it received from a managed care plan in 2023, even though the plan concluded that some payments were inappropriate and that the provider was nonresponsive during the managed care plan’s investigation. The provider went on to bill more than $5.5 million in Medi‑Cal services in fiscal year 2024–25 before Health Care Services eventually referred the provider to the California Department of Justice (DOJ) for possible criminal investigation and prosecution in April 2026. As of July 2026, DOJ had not filed charges for this provider.
• Two providers collectively billed for nearly $1.6 million in Medi‑Cal services in fiscal year 2024–25, despite having become ineligible to participate in the Medi‑Cal program before or during fiscal year 2021–22.
• Transportation providers overcharged almost $31 million in Medi‑Cal services in fiscal year 2024–25 by charging mileage at a rate intended for nonemergency ambulance trips, even though the claims were for services involving other vehicle types, such as taxicabs and wheelchair vans.

The State High‑Risk Government Agency Audit Program

California Government Code section 8546.5 authorizes the California State Auditor to develop a state high‑risk government agency audit program for the purpose of identifying, auditing, and issuing reports on any state agency or statewide issue that the office identifies as being at high risk. In accordance with this statutory authority, our office adopted regulations in 2016 that provide the criteria and procedures we use to determine high‑risk agencies and statewide issues. Specifically, my office may determine that a state agency or statewide issue is high risk if, in our professional judgment, the agency or issue is at risk of suffering from or producing waste, fraud, abuse, and mismanagement or has major challenges associated with its economy, efficiency, or effectiveness. Further, these regulations allow us to amend the state high‑risk list to add state agencies or statewide issues that meet the criteria for being designated as high risk or to update descriptions for current agencies and issues to better reflect results of more recent assessments.¹

Our office added Health Care Services to the high‑risk list in 2007, and we retained Health Care Services as a high‑risk agency on the most recent high‑risk list because of problems with its Medi‑Cal eligibility determinations. The high‑risk assessment this report details updates the description for why Health Care Services is a high‑risk agency, and it includes our conclusion that Health Care Services’ insufficient oversight of payments to Medi‑Cal providers allows for a high likelihood of fraud, waste, or abuse that poses a serious detriment to the State; that Health Care Services is not taking adequate corrective actions to prevent that risk; and that future audits by my office—and Health Care Services’ implementation of the resulting recommendations—may significantly reduce the risk of inappropriate payments to Medi‑Cal providers. After we designate a state agency or statewide issue as high risk, state law permits my office to issue audit reports with recommendations for improvement. As described previously, this report is not the result of an audit under our state high‑risk audit program, rather it is a justification for the State Auditor to commit resources for future, in depth audits of Medi‑Cal’s payment practices for providers.

Fraud, Waste, and Abuse Increase Medi‑Cal Costs for Both Fee‑for‑service and Managed Care Delivery Models

As the State’s Medicaid program, Medi‑Cal offers no-cost and low‑cost health coverage to beneficiaries, people who live in California and meet certain eligibility criteria, such as income requirements. Although local county offices manage most Medi‑Cal cases—including determining whether individuals are eligible to receive Medi‑Cal benefits—Health Care Services is ultimately responsible for overseeing the program. As of July 2025, Medi‑Cal insured more than 14 million Californians, or more than one‑third of the State’s population. With approximately $220 billion allocated for it in the State’s fiscal year 2026–27 budget, Medi‑Cal is currently one of California’s most costly programs, and the program’s budget has more than doubled during the last 10 years.

Medi‑Cal provides health care to beneficiaries through two primary delivery models: fee‑for‑service and managed care. Under the fee‑for‑service delivery model, Medi‑Cal directly reimburses providers for each individual service they provide to beneficiaries. Fee‑for‑service is primarily a temporary coverage category that typically covers beneficiaries when they first qualify for Medi‑Cal services. However, fee‑for‑service coverage is also available for beneficiaries who qualify for an exemption from managed care because, for example, they have certain complex medical conditions. Health Care Services sets maximum allowable rates that providers participating in the fee‑for‑service model can charge to Medi‑Cal for covered services. Providers submit claims for payment to Health Care Services’ contracted claims processing partners, which evaluate the claims and either pay or deny them.

For managed care, Health Care Services contracts with health plans to provide comprehensive health care coverage through a network of providers. Medi‑Cal delivers care to 95 percent of beneficiaries through managed care plans, and to compensate the plans, Health Care Services pays a capitation rate—a fixed, predetermined amount—to the managed care plan each month for each enrolled beneficiary, regardless of whether the beneficiary seeks Medi‑Cal services during the month. Managed care plans pay providers for Medi‑Cal services and bear the financial risk if a beneficiary uses more Medi‑Cal services than the capitation payment covers.

Fraud, waste, and abuse in Medi‑Cal provider payments increase costs to Health Care Services for both service delivery models. In the fee‑for‑service model, the Medi‑Cal program directly overpays providers when claims are inappropriate or fraudulent. In managed care plans, inappropriate payments to providers serve to increase Health Care Services’ future costs for managed care. Because Health Care Services bases the capitation rates that it pays to managed care plans in part on previous service use and cost information, undetected inappropriate payments in managed care inflate the future capitation rates that Health Care Services pays. Although Health Care Services has developed a mechanism for excluding known overpayments from its capitation rate development process, this mechanism does not safeguard the State against undetected inappropriate payments driving up Health Care Services’ future capitation rates.

Health Care Services Has a Problematic History of Overseeing Medi‑Cal Providers

Health Care Services has faced a history of concern from both state and federal governmental entities related to its oversight of Medi‑Cal providers. As Figure 1 shows, my office, as well as the federal Department of Health and Human Services’ Office of Inspector General (HHS‑OIG) and the Centers for Medicare and Medicaid Services (CMS), have found a variety of problems over the last 15 years. These problems include payments to ineligible providers and a lack of ongoing provider oversight within the managed care system, such as through audits or data mining, making it vulnerable to ongoing fraudulent or abusive practices by providers. Although some of these issues have been resolved, recent program reviews by federal entities have continued to express concerns over the State’s fraud prevention and investigative activities.

Several of the federal observations demonstrate that Health Care Services has not always prioritized correcting known issues or preventing fraud. Specifically, CMS’ November 2012 and March 2016 program integrity reviews identified multiple repeat findings, including concerns related to Health Care Services not doing enough to ensure that ineligible providers do not participate in Medi‑Cal, an issue that we also reported on in 2022 and that we discuss later in this assessment. In 2017, CMS twice requested that Health Care Services complete corrective action plan updates for addressing all recommendations that CMS reported in 2016, but Health Care Services did not respond to either request.

In another example, HHS-OIG’s California Medicaid Fraud Control Unit: 2023 Inspection report, published in May 2025, noted concerns with the low number of fraud referrals that Health Care Services and managed care plans submitted to DOJ for possible criminal investigation and prosecution, which echoed a similar concern that CMS published in its September 2023 California Focused Program Review Integrity Review: Medicaid Managed Care Oversight report: the number of investigations managed care plans referred to Health Care Services was low for a program the size of California’s. The HHS-OIG report stated that the primary factor influencing the number of fraud referrals that Health Care Services submitted to DOJ was a shift in Health Care Services’ leadership priorities, which caused staff to focus their resources on activities other than fraud investigations. That report also discussed DOJ’s challenges in using Medi‑Cal claims data for its investigations because Health Care Services sometimes took months to process DOJ’s data requests. Although HHS-OIG reported in July 2026 that these latest concerns have been largely resolved because DOJ now receives referrals directly from managed care plans and DOJ has obtained direct access to a portion of the Medi‑Cal claims data, these issues demonstrate that Health Care Services has not always prioritized preventing fraud.

Our past reports have identified indications of fraud in the Medi‑Cal program. In Report 2013‑119, California Department of Health Care Services: Its Failure to Properly Administer the Drug Medi‑Cal Treatment Program Created Opportunities for Fraud, August 2014, we identified nearly $94 million in payments to providers who had indicators of fraudulent activity. Likewise, in Report 2021‑123, California Hospice Licensure and Oversight: The State’s Weak Oversight of Hospice Agencies Has Created Opportunities for Large-Scale Fraud and Abuse, March 2022, we identified numerous indicators of fraud and abuse by hospice agencies that affected both the federal Medicare program and Medi‑Cal. In that report, we also determined that hospice agencies likely overbilled Medi‑Cal by at least $3.1 million in 2019 for fee‑for‑service payments and that data limitations prevented us from including in our overbilling estimate similar payments for managed care.

Health Care Services acknowledges that the size and complexity of the Medi‑Cal program create a significant risk of undetected fraud, waste, and abuse in Medi‑Cal billing. Further, Health Care Services identified more than $2 billion in cumulative overpayments to Medi‑Cal providers from fiscal years 2020–21 through 2024–25, $300 million of which Health Care Services states that it has not yet recovered from the providers. According to Health Care Services, recovery of overpayments occurs on a flow basis with dollars being collected over multiple years. Further, new overpayments are identified each fiscal year, which adds to the cumulative amount of overpayments for collection. According to Health Care Services, recently identified overpayments may have lower rates of collection compared to older debts because not enough time has elapsed for collection, which may skew the overall appearance of its progress toward collecting overpayments. However, Health Care Services acknowledged that in some cases, overpayments remain outstanding because the provider is out of business or not working and, therefore, no longer has the means to pay back what it owes.

Health Care Services Is Responsible for Detecting, Evaluating, and Investigating Potential Fraud, Waste, and Abuse in the Medi‑Cal Program

As the department responsible for Medi‑Cal program integrity and oversight, Health Care Services receives and logs in its case tracking system a monthly average of nearly 2,000 complaints, reports, and allegations of suspected fraud, waste, or abuse—collectively known as referrals. Referrals can include specific allegations of fraud or indicators of potential fraud, both of which may warrant further research. As Figure 2 shows, referrals can be complaints that beneficiaries, providers, or other members of the public submit to Health Care Services, but other entities, such as managed care plans or Health Care Services’ own audits or data analytics groups, may also forward or create referrals.

Health Care Services does not need to investigate every referral. To determine which referrals to investigate, Health Care Services performs initial research, during which staff evaluate and rank each referral according to program risk, taking into consideration factors such as the egregiousness of the suspected fraud and sufficiency of the evidence. Based on this review, Health Care Services may close a referral without investigating if it determines, for example, that the referral does not warrant an investigation; that the managed care plan took sufficient action to address the provider’s suspected fraud, waste, and abuse; or that the referral is lower risk and Health Care Services wants to prioritize investigating other referrals that are more likely to result in a credible allegation of fraud.

After it opens an active investigation, Health Care Services can temporarily suspend a provider. However, Health Care Services noted that unless the case involves beneficiary harm or egregious fraud, it typically waits until it refers a case to DOJ before it limits payments to providers because such actions may impede beneficiary access to care and have a large negative impact on providers—such as possibly resulting in the end of their businesses—when cases may end up being closed without prosecution or a conviction.

Investigations that Health Care Services opts to perform can culminate in several different outcomes. Health Care Services may impose a variety of remedies, such as initiating recovery of payments that it made for inappropriate billing or sending an educational letter to the provider. If investigators in Health Care Services’ Audits and Investigations Division establish a credible allegation of fraud, it refers the case to DOJ and is supposed to suspend payments to the provider, unless it has good cause to believe that suspending payments could jeopardize the investigation. In some instances, Health Care Services closes the investigation because it lacks evidence of wrongdoing.

We observed that the risk of inappropriate payments can continue even after Health Care Services refers a provider to DOJ for possible criminal investigation and prosecution. Specifically, in early 2026, Health Care Services referred a provider to DOJ for overprescribing medication. According to Health Care Services, it should have suspended the provider from participating in the Medi‑Cal program, but it did not do so due to its own internal oversight. Health Care Services confirmed that during the ensuing five-month period, this provider issued an additional $200,000 worth of Medi‑Cal prescriptions for beneficiaries. The acting deputy director and assistant deputy director of Health Care Services’ Audits and Investigations Division acknowledged that our inquiry into this provider triggered a review that allowed it to identify the oversight and begin processing the suspension.

Despite Identifying Providers With High Risk Scores, Health Care Services Has Not Followed Up on More Than 26,000 of Them

Health Care Services has developed multiple risk assessment tools for measuring the risk that providers are inappropriately billing for Medi‑Cal services.² Each risk assessment tool focuses on risk indicators specific to a particular aspect of the Medi‑Cal program and can identify providers with billing activity or patterns that may indicate potentially fraudulent, wasteful, or abusive activity. Health Care Services explained that the risk scores from these tools—in conjunction with other analytic tools and information—support audits and guide program integrity investigations. However, despite Health Care Services having proactively developed such tools and identified indicators of potential wrongdoing, it has yet to create a referral for, or investigate, most providers its largest risk assessment tool identifies as having the highest risk scores. This risk assessment tool assigns each provider a risk score based on factors such as unusual provider behavior or billing patterns. The text box shows examples of risk indicators that can contribute to a high risk score.

However, a former acting chief of Health Care Services’ Data Analytics and Case Development Branch explained that a high risk score does not necessarily indicate fraud. She said that a sudden increase in a provider’s billing activity compared to its historical billing trends could be an indicator of fraud, waste, or abuse, but atypical billing activity could also be the result of business changes, such as the implementation of a new program, a change in provider ownership, or other legitimate changes in provider activity. She further noted that because Health Care Services does not have direct control over the data that the managed care plans submit, those data are sometimes incomplete, missing, or inaccurate, which may affect the sensitivity and reliability of the risk assessment tools. Although the risk assessment tools evaluate providers for indicators of potentially fraudulent activity, Health Care Services must still perform additional research to determine whether providers that receive high risk scores are committing fraud, waste, or abuse.

Federal best practices published by HHS-OIG provide examples of various analyses that entities like Health Care Services may use to identify providers for further follow-up. These analyses include evaluating the amount of time providers spent per beneficiary visit, the number of beneficiaries providers saw per day, and whether providers billed for an improbable number of visits in a single day. The goal of these analyses is to identify providers whose billing may pose a risk and who thus warrant further scrutiny.

Although its largest risk assessment tool considers these types of risks indicators, we found that Health Care Services did not follow up on the majority of providers with the highest risk scores. To evaluate Health Care Services’ use of the risk assessment tool’s results, we analyzed the approximately 28,000 providers with risk scores in the highest 10 percent per Health Care Services’ own metrics for fiscal year 2024–25. Among those, we identified more than 26,000 providers for which Health Care Services had not initiated any referrals or investigations as of March 2026, despite these providers collectively accounting for at least $12 billion in Medi‑Cal services for fiscal year 2024–25.³ While it is likely that not all $12 billion is related to fraud, waste, or abuse, even a small percentage represents a significant amount of money. For example, even 1 percent of this amount equates to $120 million. In addition, a 2023 report by CMS estimated that the percentage of Medi‑Cal payments that were inappropriate was approximately 8 percent. Although this estimate did not account for a variety of risks related to improper managed care payments, should this estimate hold true for the 26,000 providers, it would equate to nearly $1 billion in inappropriate payments. This amount is roughly equivalent to the amount of state funds California’s enacted budget for fiscal year 2026–27 allocated for DOJ or the Department of Water Resources.

Moreover, we identified examples within this population that warrant further scrutiny. Figure 3 shows five of the providers that Health Care Services’ largest risk assessment tool designated as being in the top 3 percent of risk scores, and we agree with Health Care Services’ assessment that these providers’ high volume of claims appear to indicate potential risk. These providers used a Medi‑Cal billing procedure code intended for office visits requiring a low level of medical decision-making and commonly lasting between 20 and 29 minutes. If we presume an eight‑hour workday, we would expect that each provider would generally see two to three beneficiaries per hour, although the length of the actual office visits may vary. However, on days when these providers used this procedure code, they claimed to have seen more than three beneficiaries per hour during nearly 80 percent of their workdays, and that number does not account for other services they may have provided during those same hours or services during which they were supervising another provider, such as a physician assistant or nurse practitioner, who was treating the beneficiary. In fact, Providers A through D in Figure 3 claimed to have seen an average of more than seven beneficiaries per hour, equating to the providers having spent an average of fewer than nine minutes with each beneficiary, which is significantly less than the 20 to 29 minutes that appointments for this billing code commonly last.⁴

Health Care Services states that this risk assessment tool is intended to cast a wide net to find potential anomalies and is only one of multiple factors when evaluating the risk for fraud, waste, and abuse. However, the thousands of providers the tool assigned a high risk score, whom Health Care Services has not initiated any referrals or investigations represent a missed opportunity for the department to scrutinize providers with indicators of potential risk. While all 26,000 providers may not require an investigation, many, such as the providers in Figure 3, likely do warrant further scrutiny.

Health Care Services Has Missed Opportunities to Prevent Future Questionable Payments

Health Care Services receives a monthly average of nearly 2,000 referrals of suspected fraud, waste, or abuse. When it receives referrals, Health Care Services reviews and evaluates them to determine the next action it takes, which may include conducting more research, sending educational letters to providers, opening a case for investigation, or forwarding the referral to another agency. If it determines that the referral warrants an investigation, Health Care Services ranks the case based on risk factors and assigns it to one of its about 140 investigative staff. We found that Health Care Services investigates less than 15 percent of referrals. Health Care Services asserts that although not all referrals warrant an investigation, its limited resources prevent it from pursuing more fraud investigations than it currently conducts, which we discuss in the next section.

Health Care Services is not the only entity that can investigate suspected provider fraud: managed care plans also perform such inquiries. Managed care plans are contractually required to report any suspected fraud, waste, and abuse to Health Care Services within 10 business days, at which time Health Care Services creates a referral for the provider in its case tracking system. However, the efforts of both Health Care Services and the managed care plan are sometimes insufficient to address inappropriate Medi‑Cal billing. We observed instances in which providers continued billing for and receiving millions of dollars for questionable Medi‑Cal services after Health Care Services closed a referral for a provider whom the managed care plan investigated and identified inappropriate payments. Figure 4 shows three providers who collectively billed more than $11 million in Medi‑Cal services even after managed care plans identified inappropriate payments to them, and Health Care Services closed the referrals after taking no action of its own.

Provider F, a hospice provider, was the most financially significant of the three examples. Health Care Services received a referral during the first half of fiscal year 2023–24 stating that the managed care plan was investigating Provider F for submitting claims for services that it allegedly did not provide. According to Health Care Services’ notes, the managed care plan made multiple attempts to follow up with Provider F during the investigation, but Provider F did not respond. Consequently, the managed care plan concluded that Provider F had inappropriately billed for the services and issued an overpayment letter to Provider F because of its noncompliance. Health Care Services noted that the managed care plan was able to recover about $41,000—or a little more than half—of the $78,000 that Provider F received for the services it allegedly did not provide.

Despite the managed care plan’s finding and Provider F’s nonresponsiveness, Health Care Services closed the referral in its case tracking system during the second half of fiscal year 2023–24, rather than following up. The former acting chief of Health Care Services’ Data Analytics and Case Development Branch explained that it closed the referral for Provider F because the managed care plan was sending the provider an overpayment letter, Provider F did not trigger any alerts in its fraud and abuse detection system, and Provider F had no additional referrals on file. Nonetheless, given the earlier indicators of inappropriate billing, Provider F’s nonresponsiveness during the managed care plan’s investigation, and the fact that Health Care Services is ultimately responsible for overseeing the Medi‑Cal program, we expected that Health Care Services would have immediately escalated follow‑up procedures, such as conducting its own investigation to see if it could establish a credible allegation of fraud and suspend payments to Provider F to prevent future questionable payments.

In the meantime, Provider F went on to bill more than $5.5 million for Medi‑Cal services in fiscal year 2024–25. It was not until the end of fiscal year 2024–25—or more than one year after it closed the initial referral—that Health Care Services created another referral for Provider F, citing a variety of fraud indicators that included a sudden increase in billing. Health Care Services investigated and determined that Provider F was fraudulently billing managed care plans for Medi‑Cal services—including billing for individuals who asserted that they were not receiving hospice care. In April 2026, Health Care Services referred the case to DOJ for criminal investigation and prosecution; as of July 2026, DOJ had yet to file charges against Provider F.

Although Health Care Services has a process for excluding known overpayments from its rate development process when establishing future capitation rates for managed care plans, the examples we present in Figure 4 demonstrate the risk that Health Care Services is letting some questionable costs continue, even after it has become aware of wrongdoing by providers. Further, although Health Care Services ultimately referred Provider F and Provider G to DOJ for possible criminal investigation and prosecution for fraud, it has not performed further follow up on Provider H, despite a history of overbilling and continued questionable claims. To the extent that any of Provider H’s claims are inappropriate, they could increase the future capitation rates that Health Care Services pays for managed care.

Limited Resources May Contribute to Health Care Services Not Identifying Additional Fraud

Although we would expect Health Care Services to follow up on more of the providers with indicators that point to a high risk of fraud, waste, or abuse to ensure the appropriateness of their claims, Health Care Services asserts that it has limited resources and has not researched or investigated all such providers. Health Care Services explained to us that it considers a variety of factors in prioritizing which referrals to investigate, including the egregiousness of the suspected fraud and the potential for harm to beneficiaries. In one case, Health Care Services’ staff recommended a provider for investigation for overbilling for office visits associated with COVID‑19 tests, but we observed that the investigation notes indicated no activity for more than two years. The staff notes on the closure date for this referral explain that the allegations were now old, that the case had low materiality, that Health Care Services lacked resources, and that they recommended closing the case and monitoring the provider activity.

Increasing resources for fraud prevention would likely prevent additional fraud and result in savings that exceed the additional investment. When we followed up about its investigative staffing levels, Health Care Services provided information showing that these staffing levels have remained relatively stagnant over the last 11 years. While staffing ranged from a low of 112 to a high of 159 during this period, the number of investigative staff in 2016 was about the same as 2026: 137 staff members compared to 141 staff members. However, over this same period, the Medi‑Cal budget more than doubled. As Figure 5 shows, the number of investigative staff per billion dollars spent on Medi‑Cal dropped significantly.

Health Care Services had 1.69 investigative staff for every billion dollars spent on Medi‑Cal in 2016. However, the number of investigative staff per billion dollars spent on Medi‑Cal dropped by 57 percent to 0.73 by 2026. Health Care Services explained that this decrease coincides with a shift in beneficiaries moving from a fee‑for‑service to a managed care delivery system—an average of 79 percent of beneficiaries in 2016 were enrolled in a managed care plan compared to 95 percent in 2026. Additionally, Health Care Services contractually requires managed care plans to conduct their own investigations, which provide further monitoring of fraud, waste, and abuse beyond Health Care Services’ Audits and Investigations Division. However, as Figure 4 shows, investigations by managed care plans have not always been successful in stopping questionable payments, and Health Care Services remains ultimately responsible for ensuring payments are appropriate.

Health Care Services asserts that it seeks to prevent all fraud, waste, and abuse in Medi‑Cal and that it saves $8.60 for every $1 it spends on its Audits and Investigations Division. Although Health Care Services stated during our assessment that more resources would surely result in more fraud prevention, it believed that it struck the proper balance of investment and return. Given that resources dedicated to fraud prevention deliver savings that far outweigh the initial investment and that Health Care Services believed dedicating additional resources would prevent more fraud, it is unclear why Health Care Services believed its resource level struck the proper balance, especially considering the State’s significant public investment in Medi‑Cal.

Health Care Services Allowed Payment of Medi‑Cal Claims to Ineligible Providers

The HHS-OIG maintains a list of nearly 83,000 individuals and entities that are excluded from receiving payments from federally funded health care programs for various reasons, such as a conviction for Medicaid fraud. Likewise, Health Care Services maintains a list of almost 23,000 providers that are suspended from and ineligible to participate in the Medi‑Cal program. Both lists are publicly available on the internet. State law generally requires that Health Care Services suspend providers from the Medi‑Cal program when they have a license, certificate, or other approval to provide health care that is revoked or suspended by a federal, California, or another state’s approval authority.

Even though Health Care Services has a process for identifying ineligible providers and suspending their eligibility to receive Medi‑Cal payments, we found instances of ineligible providers participating in Medi‑Cal. When we compared Medi‑Cal claims data for fiscal year 2024–25 to the federal and state lists of ineligible providers, we identified two providers that collectively billed for almost $1.6 million in Medi‑Cal services, despite each provider having become ineligible to participate in the Medi‑Cal program years earlier. As Figure 6 shows, we found that the California Department of Public Health (Public Health) revoked Provider I’s hospice license in late 2020, but Health Care Services did not learn of the revocation until nearly five years later while investigating Provider I in fiscal year 2025–26. Because Health Care Services had yet to add Provider I to the State’s ineligible list, Provider I billed for nearly $1.3 million in Medi‑Cal services through a managed care plan for fiscal year 2024–25. We did not identify any fee‑for‑service billings for Provider I during fiscal year 2024–25; Health Care Services asserts that it completed efforts to identify and recoup any fee‑for‑service payments made after the retroactive effective date of the suspension and confirmed that there were no erroneous fee‑for‑service billings past October 2020. Health Care Services explained that after learning that Provider I was ineligible to participate in the Medi‑Cal program, it notified the provider in August 2025 that it would be added to the State’s ineligible list retroactive to 2020, which is why we found Provider I on the State’s ineligible list when we performed our analysis in May 2026.

According to Health Care Services, there does not yet exist an automatic way for it to receive notification when Public Health revokes a provider’s license; rather, Health Care Services depends on Public Health to manually transmit notice of a revocation. Health Care Services recognizes that this process can cause delays, and it explained that it has ongoing workgroups and recurring coordination meetings with Public Health focused on improving cross-agency communication and data flow. Health Care Services stated that as part of these efforts, it is exploring options for an automated notification or data-sharing process so that it can address any future revocations promptly.

The problems we identified involving the second provider were similar. Specifically, the federal Drug Enforcement Administration revoked this provider’s certification to administer or prescribe controlled substances in fiscal year 2021–22. Although Health Care Services was aware of the revocation in January 2024 and subsequently added the provider to the State’s ineligible list, we observed that the provider billed more than $300,000 in Medi‑Cal services through a managed care plan for fiscal year 2024–25. According to Health Care Services, it relies on the managed care plans to address claims paid to suspended providers. Although we did not identify any fee‑for‑service billings for this provider during fiscal year 2024–25, Health Care Services asserts that it completed an erroneous payment correction for this provider in April 2026 for any associated fee‑for‑service payments and recouped an overpayment of nearly $1,300.

Health Care Services allowing ineligible providers to participate in Medi‑Cal is a long-standing problem. In 2012, CMS pointed out gaps in Health Care Services’ screening of providers that are ineligible to participate in the Medi‑Cal program and—four years later—reported that this issue was unresolved. We also identified payments to ineligible providers in Report 2021‑046, Proposition 56 Tobacco Tax: The Department of Health Care Services Is Not Adequately Monitoring Provider Payments Funded by Tobacco Taxes, November 2022. In response to that report, Health Care Services implemented changes to its provider suspension process that became effective April 2025. Most recently, the former acting chief of Health Care Services’ Data Analytics and Case Development Branch asserted that Health Care Services is also looking into how to receive notification of disciplinary actions from the federal Drug Enforcement Administration. Although these are positive steps, as the single agency responsible for administering the Medi‑Cal program, Health Care Services must ensure that it pays only eligible providers.

We Identified Many Inappropriate Medi‑Cal Payments for Ground Transportation Services

For situations involving medical emergencies, emergency medical transportation is available for Medi‑Cal beneficiaries. Medi‑Cal also covers two types of nonemergency ground transportation services to help beneficiaries get to and from Medi‑Cal services: nonemergency nonmedical transportation and nonemergency medical transportation, as Figure 7 illustrates. For beneficiaries who do not have another way to get to their Medi‑Cal appointment because, for example, they do not have a valid driver’s license or money for gas, or they have a physical, cognitive, mental, or developmental limitation, Medi‑Cal provides roundtrip, nonmedical transportation service by private or public vehicle, such as a passenger car or taxicab. For beneficiaries to obtain necessary nonemergency medical care when their medical and physical condition make ordinary modes of transportation unsuitable, Medi‑Cal covers nonemergency medical transportation by vehicles such as a wheelchair van or nonemergency ambulance.

Medi‑Cal has separate mileage rates for nonmedical and medical transportation services. Because the fiscal year 2024–25 rate for nonemergency ambulances for medical transportation was nearly three times more than nonmedical modes of transportation, it makes sense that the State’s Medi‑Cal regulations require Medi‑Cal to provide reimbursement only for the type of nonemergency medical transportation with the lowest cost that is adequate for the beneficiary’s medical needs and that is available at the time transportation is needed.

Health Care Services acknowledges that a variety of fraud schemes may occur in ground transportation, including the practices of phantom trips and upcoding, which respectively refer to providers billing for trips that never occurred or claiming higher rates that are not commensurate with the actual service provided. For this reason, Health Care Services included ground transportation on its list of high‑risk service categories and provider types that require a priority focus. In 2024, Health Care Services forwarded to DOJ credible allegations of fraud against two transportation providers. However, as of July 2026, Health Care Services had not forwarded any additional ground transportation providers to DOJ for possible criminal investigation and prosecution.

When we analyzed claims data for fiscal year 2024–25, we identified more than 130 transportation providers who overbilled the mileage rate for nonemergency ground transportation services for Medi‑Cal beneficiaries. These transportation providers claimed mileage at a rate intended for nonemergency ambulance trips, even though the claims were for services involving other vehicle types, such as taxicabs and wheelchair vans. In total, these transportation providers received nearly $31 million more than the allowable rate for fiscal year 2024–25.

Among those transportation providers that we identified with suspicious billing activity was Transportation Provider J, for which Health Care Services already had two referrals on file. Transportation Provider J both overbilled mileage and claimed suspicious trips with the single‑passenger vehicle he had registered with the program. For example, we found that Transportation Provider J claimed to have provided almost daily nonmedical transportation of more than 300 miles to a single beneficiary during a five-month period. However, even if the trips were legitimate, we found that Transportation Provider J billed and was reimbursed at the nonemergency ambulance rate of $3.55 per mile instead of the $1.30 per mile rate allowed for nonmedical transportation.

As Figure 8 shows, Transportation Provider J’s overbilling totaled more than $105,000 in claims for the beneficiary during the five-month period. When we asked Health Care Services about this overbilling, it followed up with the managed care plan and learned that the managed care plan had erroneously instructed providers to make claims at the nonemergency ambulance rate. Even though Health Care Services was already aware of potential wrongdoing by Transportation Provider J from prior referrals, the fact that neither Health Care Services nor the managed care plan recognized the mistaken billing rate or the extreme mileage demonstrates the opportunity for more proactive research and investigation.

Of the other two referrals of potential fraud or abuse on file for Transportation Provider J, the managed care plan initiated one after receiving a complaint alleging that Transportation Provider J offered payment and gifts to multiple Medi‑Cal beneficiaries in exchange for their requesting unnecessary transportation services, for which Transportation Provider J could then bill Medi‑Cal. Although the managed care plan informed Health Care Services in 2024 that it was investigating this particular complaint, Health Care Services’ case tracking system did not contain any subsequent updates on the investigation until nearly two years later and only after we questioned Health Care Services about Transportation Provider J. When Health Care Services contacted the managed care plan in April 2026 for an update on the investigation, it learned that although the managed care plan suspected Transportation Provider J of potential fraud, waste, or abuse, it could not substantiate misconduct with its available resources and investigation methods. The managed care plan stated that it ended the contract with Provider J in June 2025 for business reasons that were not specifically related to program integrity.

The research data specialist in Health Care Services’ Audits and Investigations Division echoed the managed care plan’s perspective regarding the difficulty of substantiating wrongdoing by transportation providers. He explained that Health Care Services previously identified and researched certain instances of transportation claims that did not have a corresponding medical office visit or treatment for the beneficiary on the same day. He said that although Health Care Services initiated an investigation into a provider, it closed the case without further action, partly because nonemergency nonmedical transportation policy requirements make it difficult for the department to prove fraud, waste, or abuse. Even though Health Care Services’ transportation policy typically allows beneficiary trips for certain nonmedical transport to have no more than eight segments—or four roundtrips—each month, all that the policy requires for a beneficiary to receive additional transportation services is for the transportation provider to submit documentation that the beneficiary asserted that they required the additional transportation to obtain necessary Medi‑Cal services.

The Medi‑Cal Benefits Policy Branch chief acknowledged that these less‑than‑robust utilization control policies and minimal documentation requirements can make identifying fraud, waste, and abuse more challenging. He said that Health Care Services is currently updating its transportation policy with additional utilization controls that will allow it to strengthen oversight. He emphasized that the goal of the new policy is to balance beneficiary access to care, provider administrative burden, and program integrity considerations.

An Audit Could Help Reduce the Risk of Medi‑Cal’s Making Inappropriate Payments to Providers

As this assessment highlights, Health Care Services can improve its process for following up on high‑risk Medi‑Cal providers, its process for preventing payments to ineligible Medi‑Cal providers, and its policy for nonemergency ground transportation services. Because Health Care Services has not taken adequate corrective action to manage these risks, we conclude that it is appropriate for us to update the state high‑risk list description for Health Care Services to include the risk of serious detriment that inappropriate Medi‑Cal payments to providers pose to the State. This conclusion permits my office to, in future engagements, self-initiate audits of Health Care Services’ oversight of payments to Medi‑Cal providers and issue recommendations that may significantly reduce the risks of fraud, waste, and abuse.

Perspective From Health Care Services

Health Care Services disagreed with our overall conclusion to include its oversight of payments to Medi-Cal providers as an additional rationale for the department’s inclusion on the State high‑risk list, but acknowledged that it could do more. Specifically, Health Care Services stated that if it was allocated additional resources it could address additional credible referrals or leads from data analytics. See Health Care Services’ full response and the California State Auditor’s comments.

We prepared this report under the authority vested in the California State Auditor by Government Code section 8546.5 and pursuant to title 2, sections 61000 et seq. of the Code of Regulations.

Respectfully submitted,

GRANT PARKS
California State Auditor

October 15, 2026

Staff:
Ben Ward, MSA, CISA, Project Manager
Ryan P. Coe, MBA, CISA, Team Leader
Sarah Rachael Black, MBA, CISA
Brandon Clift, CPA
Aren Knighton, MPA

Legal Counsel:
Michael Sorich

Agency Response

California Department of Health Care Services

October 2, 2026

THIS LETTER SENT VIA EMAIL

Grant Parks
California State Auditor
621 Capitol Mall, Suite 1200
Sacramento, CA 95814

RESPONSE TO THE CALIFORNIA STATE AUDITOR ASSESSMENT REPORT # 2025-605

Dear Mr. Parks:

The Department of Health Care Services (DHCS) submits this response to the California State Auditor’s (CSA) assessment report number 2025-605, titled “The California State Auditor’s Assessment Report.” DHCS disagrees with the recommendation to designate another issue under DHCS’ responsibility as high-risk.

DHCS’ mission is to provide equitable access to quality health care leading to a healthy California for all. As part of this mission, DHCS seeks to prevent all fraud, waste, and abuse (FWA) and avoid improper payments to ineligible providers. While DHCS pursues this goal relentlessly, the scale and complexity of the Medi-Cal program (nationally known as California’s Medicaid program), with nearly 14 million members, hundreds of thousands of enrolled providers, and about $200 billion in annual payments, means that addressing potential FWA is an ever-present part of DHCS’ work to successfully administer the program for Californians. DHCS actively collaborates with program integrity experts and consistently refines its strategies to deter FWA, improve outcomes, and safeguard Medi-Cal resources.

① CSA’s report omits critical information and context, resulting in an incomplete analysis that does not fully reflect the breadth of DHCS’ oversight of payments to Medi-Cal providers, highlighting isolated anecdotes while ignoring system-wide data showing effective systems and controls. ① ② Although it makes conclusory statements, CSA’s report does not establish two required elements for a high-risk designation: (1) that “the agency is not taking adequate corrective actions to prevent the risk of waste, fraud, abuse, or mismanagement”¹ and (2) that the substantial risk “may be reduced significantly by the State Auditor auditing the state agency and issuing recommendations”². For the reasons outlined below, neither element is met.

• DHCS has strong oversight of the Medi-Cal program, dedicating 20 percent of staff to program integrity efforts, the highest among any large Medicaid program in the country.
• Advancements in technology have strengthened oversight and improved the efficiency of DHCS staffing resources in identifying FWA. ③ DHCS’ ever-evolving systems are intentionally designed to preemptively flag potential irregularities and cast a broad net, then prioritize those for follow up to permit data- and experience-based analyses to guide the deployment of resources to achieve maximum impact and recovery. This approach ensures that follow‑up efforts are strategically targeted, enabling DHCS to deploy resources where they will have the greatest impact.
• ④ CSA’s report also does not address the legislatively adopted standards for initiating overpayment recoupments, temporary suspensions, suspensions, and terminations for providers and members, which balance program integrity with ensuring access to critical services for the millions of Medi-Cal members in our state.  ⑤ ⑥ Moreover, certain recommendations contained in the report appear to conflict with those requirements, which are grounded in due process principles, and the report appears to ignore the risk of over-correcting based on mere flags of irregularity, which would jeopardize access to essential healthcare services. 
• ⑦ CSA’s findings that DHCS did not suspend a certain provider after submitting a credible allegation of fraud (CAF) to the State’s MFCU (MFCU) fail to acknowledge that the MFCU requested a good cause law enforcement exception provided for under applicable State law, and that the CAF investigation is still active. The findings provide no apparent basis to question DHCS’ decision to honor that law enforcement request.
• ⑧ The report also mistakenly overstates the impact of overpayments paid by Managed Care Plans (MCPs) for billed amounts reflected in encounter data. DHCS pays MCPs an actuarily sound rate on a per member per month basis through capitated rates that source paid amount information primarily from cost experience data that is net of identified overpayments and submitted separately from encounter data. The capitation rate development process uses a comprehensive set of data elements, sources, methodologies, and techniques, including but not limited to the Consumer Price Index, National Health Expenditures updates, and multiple industry trend reports including the CMS Medicaid actuarial report. DHCS and its contracted actuary use these data sources and methodologies to perform considerable data analyses that identify anomalous trends or findings and result in the identification of previously unidentified overpayments or excessive cost experience. When such anomalies are identified, DHCS makes adjustments through the rate development process to ensure such overpayments are excluded from capitation payments made to MCPs in alignment with applicable federal law. ⑧ These statements from CSA reflect an over-simplification of key aspects of the program that is subject of the proposed high-risk designation.

One of the elements for a high-risk designation—whether the agency is taking adequate corrective actions—is not established when context and information that DHCS provided, but that was not included in the assessment, is considered. ① Throughout its engagement with CSA, DHCS provided numerous examples of its continuous improvement strategies and the corrective actions it takes to enhance its detection processes and make adjustments based on past instances of FWA. However, the report does not discuss these efforts and makes no attempt at describing why they are inadequate.

Nor is the high-risk designation element—that any risk of FWA be mitigated by CSA’s recommendations—met here. ② ⑨ CSA’s recommendation to audit DHCS payments to Medi-Cal providers ignores DHCS’ risk based and continuously applied systems and operations, misapprehends the nature of program integrity work, and fundamentally incorrectly applies the legal context within which DHCS must detect and address FWA and hold entities accountable. Rather than reducing risk, implementing CSA’s recommendations to include an additional rationale to designate DHCS as a high-risk agency for oversight overpayments to Medi-Cal providers could impede a carefully calibrated program integrity system that over the past five years has saved over $2 billion and has collected over $4 billion.

DHCS Has Strong Oversight of Program Integrity, including Medi-Cal Payments

The CSA report cites concerns raised by state and federal entities dating back to 2011 to conclude DHCS has a history of weak provider oversight. ⑩ As more fully articulated throughout this response, CSA’s conclusion overlooks that those issues, some spanning back over a decade-and-a-half ago, were resolved, and DHCS is now recognized nationally for its results. Since at least March 2025, DHCS organized and implemented a multi-divisional Program Integrity workgroup that meets at least weekly to assess, discuss, coordinate, implement and track various program integrity efforts. DHCS also continues to modernize oversight systems, adopt new technologies, strengthen program integrity, and collaborate closely with partners to maintain robust oversight of the Medi‑Cal provider community.

⑪ In 2024, the U.S. Department of Health and Human Services Office of the Inspector General’s (HHS OIG’s) 2024 annual report on Medicaid Fraud Control Units (MFCUs) showed that California secured the highest amount of Medicaid fraud recoveries among all states. The report highlights California’s effective collaboration with the Federal Bureau of Investigation, HHS OIG, and Veteran’s Affairs OIG as a best practice example in criminal Medicaid fraud.

Furthermore, based on CMS’ own findings, Medi-Cal MCPs perform strongly on recovery of overpayments. In 2026, CMS broadcasted to states that the average MCP recovery is 45 cents, measured on a per-member per-month basis using data reported by states to CMS in a standardized format. CMS emphasized that this amount is too low, and that CMS expects states to achieve higher rates of managed care plan recovery. By CMS’ own metrics, DHCS is a high-performer in this regard, as DHCS reports an average MCP recovery of $1.22 per-member per-month—nearly three times the national average.

The Additional High–Risk Designation Is Unwarranted

⑫ Several CSA conclusions rely on incorrect assumptions that overlook extensive program integrity actions that are already underway. DHCS cannot investigate or prosecute every potential issue immediately or exhaustively; such a result is not required by federal or state law, nor is it a prudent use of taxpayer resources. ⑬ Moreover, CSA’s suggestion that payments be stopped upon any indicia of potential fraud, especially when the allegation is trivial, unreliable, or unsubstantiated, is unreasonable and would result in waste of taxpayer resources and interruption in access to care for individuals served by the Medi-Cal program. CSA’s recommendation also appears to ignore relevant and important statutory and due process requirements. ⑭ As a result, and noted elsewhere, DHCS emphasizes that comprehensive, resource-intensive multidisciplinary provider investigations must be evidence-based, respect due process, and be deployed where they will have the greatest impact and maximize recovery. ④ CSA’s report also ignores that payment suspensions often result in providers declining to provide services, in this case to Medi-Cal members. The legislatively enacted standards and procedural requirements for suspensions and terminations reflect a balance between program integrity and maintaining access to critical services for needy Californians, informed by constitutional due process principles.

With nearly 2,000 FWA referrals each month, DHCS uses risk-based triage and conducts full investigations when warranted. ⑮ This is consistent with industry standards and national best practice guidelines, information provided to CSA, but which CSA again chose to omit from its report. Federal guidance makes clear that fraud tips, complaints, and data anomalies should be vetted for credibility and evidentiary reliability before they warrant a full investigation. This response provides context, outlines ongoing improvements, and reaffirms DHCS’ commitment to transparency, accountability, and effective stewardship of Medicaid resources.

To ensure an accurate understanding of DHCS’ program integrity efforts, DHCS provides the following detailed responses to each Observation in the assessment report.

CSA Observation 1 – DHCS has problematic history of overseeing providers

DHCS is recognized nationally for its results, and its recoveries align with national best practices. DHCS’ return on investment (ROI) ratio is 8.6:1, which means that for every dollar spent by Audits & Investigations (A&I) on audit and investigation activities, DHCS brings in $8.60. This ROI underscores efficient deployment of interdisciplinary teams—analytics, audits, investigations, recoveries, and sanctions—allowing DHCS to direct resources toward the highest‑risk areas. CMS’ Center for Program Integrity has shared DHCS’ ROI methodology and achievements with other states as a national best practice.

③ Since 2022, DHCS has expanded program integrity capabilities by strengthening advanced analytics, improving encounter data validation, and using trend analysis to detect emerging fraud patterns. DHCS has also increased the use of artificial intelligence tools and modernized fraud‑network analytics to enhance prevention and detection.

DHCS meets regularly with MCP Special Investigation Units to share intelligence, coordinate investigations, and standardize practices that improve FWA referral quality across all MCPs. MCPs conduct their own investigations and report cases, and DHCS works with state and federal law enforcement to apply sanctions and payment suspensions when appropriate. In 2026, DHCS leadership established new structured statewide coordination meetings with all MCP SIUs. These recurring meetings provide a forum for information‑sharing, case‑triage discussions, and monitoring emerging fraud trends.

DHCS maintains close coordination with the Division of Medi‑Cal Fraud and Elder Abuse (DMFEA), prioritizing cases, reviewing good‑cause exceptions, and ensuring CAF referrals are high‑quality and prosecution‑ready. Monthly meetings address emerging fraud trends, training, and process improvements—efforts that have significantly increased CAF referrals since 2023. See table below.

State Fiscal Year (SFY)	# of CAF Packages	# of CAF Subjects
2020-21	50	92
2021-22*	10*	16*
2022-23*	10*	21*
2023-24	36	87
2024-25	66	237
2025-26	111	317

*CAF referral volume negatively impacted by COVID-19 Pandemic

Partnerships with CMS’s Unified Program Integrity Contractor (UPIC) and the Medicaid/Medicare Recovery Audit Contractor (MMRAC) further strengthen audit and recovery efforts, ensuring resources are deployed strategically.

More than 20 percent of DHCS’ workforce is dedicated to program integrity—exceeding staffing levels in similarly large Medicaid programs such as New York and Texas. DHCS uses an integrated model that includes provider screening, member‑level validation, claims reviews, audits and investigations, and third‑party liability recovery. These actions produce measurable outcomes including recoveries, sanctions, convictions, terminations, and fraud referrals.

Recent legislation amends several sections of the Welfare and Institutions Code to strengthen Medi-Cal program integrity. The amendments include new requirements for provider disclosure of affiliations that may present fraud risks, expanded grounds for terminating provisional status, and revised suspension and moratorium procedures—all aimed at safeguarding program integrity and protecting public funds.

Because DHCS operates one of the nation’s largest and most complex Medicaid programs, prioritization is essential. Modern analytics intentionally cast a wide initial net but then focus on the most credible, material, and high‑risk issues. ⑯ This calibrated, data‑driven approach ensures resources are used efficiently and in alignment with federal guidance and national best practices—an operational strength the CSA report does not acknowledge. The CSA report omits this important background, while criticizing the percentage of flags investigated (see Observation 2 below).

Further, data from the SFY 2024-25 shows a significant increase in identified overpayments compared to the prior four-year average ($342 million vs $722 million). The increase in identified overpayments in SFY 2024-25 is a direct result of the enhanced program integrity efforts of DHCS.

DHCS has demonstrated a strong commitment to and performance on controlling or eliminating FWA risk in the Medi-Cal program and has developed the capacity, through the commitment of staff and substantial resources, to curtailing or eliminating the risk.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 2 – No action taken on 26,000 providers with high–risk scores

The assessment criticizes that, in SFY 2024-25, DHCS did not research or investigate 26,000 (out of 28,000) providers identified by one DHCS assessment tool. Although CSA characterizes this tool as DHCS’ “largest” risk assessment tool, that is merely quantified by the number of unique National Provider Identifiers included in the tool, not the dollars at risk or other indicia of impropriety or likelihood of flagging actual fraud. DHCS does not open investigations based on data produced by only one of the assessment tools in its program integrity toolbelt. Rather, investigations are based on information compiled from multiple sources. ⑰ The suggestion that this specific assessment tool alone, out of many such targeted provider assessment tools and fraud detection resources, should be used to designate providers as high-risk is inconsistent with best practices for preventing Medicaid FWA issued by multiple federal agencies, a mischaracterization of the DHCS analytics process, and a misunderstanding of the full scope of the complex analytics structure used by DHCS to identify FWA risk.

The assessment tool is intentionally tuned to cast a wide net of the 300,000+ Medi-Cal providers in order to surface potential anomalies for review and to support pre-scoping of new audits and/or investigations. The assessment ignores documentation the audit team had substantiating that the tool risk scores are “signals,” and not “determinations”. ⑰ A provider’s appearance in DHCS’ tool with a high-risk tool score by itself does not automatically warrant a fraud investigation. Specifically, the 26,000 providers flagged by CSA as high scoring providers in the sole profiler tool reviewed by CSA is not alone indicative of FWA and a need for an investigation.

DHCS’ use of the provider assessment tool is fully consistent with CMS and the U.S. HHS-OIG best practices. Federal program integrity guidance makes clear that analytic tools, including data mining, anomaly detection, AI-enabled risk scoring, and peer-group comparisons serve as initial screening mechanisms to identify potential outliers, not as stand-alone determinations of fraud or high-risk behavior. ⑰ CMS’ Medicaid Program Integrity Manual and HHS-OIG’s compliance toolkits emphasize that risk signals must be corroborated through further research, structured analytics, evidentiary review, and subject-matter expertise before any investigative action is taken.  DHCS’ tool operates precisely in this manner: scores are treated as signals, requiring additional analytics, contextual review, and corroborating evidence before any investigation is initiated. This multi-tool, evidence-driven approach mirrors CMS’ UPIC framework, HHS-OIG’s telehealth and high-risk diagnosis toolkits, and the standards embedded in federal regulations.

⑱ CSA’s criticism is misplaced because it does not consider that this tool may have been a data point that led to other investigations and improperly relies on a single analytics assessment tool to conclude DHCS program integrity is inadequate. The tool is intended to be one of a multitude of factors used when assessing FWA. Although CSA acknowledges that the $12 billion attributed to the 26,000 high score providers is unlikely to be entirely related to FWA, it then calculates that even 1 percent would “equate” to $120 million. To take that calculation a step further, investigating 1 percent of the 26,000 providers is an investigation of an additional 260 providers. ⑲ Each audit or investigation would require months of dedicated resources, which would not necessarily “equate” to the kind of overpayment or fraud determination CSA infers. CSA’s oversimplification overlooks the fact that the tool is intended to be used as only one of a multitude of factors when assessing FWA risk.

During SFY 2024-25 (the same timeframe analyzed and criticized by CSA), DHCS was conducting critical investigative work to uncover a complex transnational criminal fraud scheme. ⑳ Publicly announced in April 2026, Operation Skip Trace is a prime example of how DHCS’ robust fraud detection systems ultimately protected Medi-Cal members, ensured program integrity, safeguarded taxpayer dollars against FWA, and coordinated with DMFEA to hold the perpetrators accountable. DHCS’ program integrity efforts resulted in dismantling a $267 million Medi-Cal hospice fraud ring, suspensions of 14 hospice companies (through over 130 shell companies, bank accounts and cryptocurrency to launder the money). ⑳ Felony charges have been filed against 21 suspects, and five people were arrested following raids across multiple locations in Southern California. Although prosecution and pursuit of justice continue, so far, the state has seized $60 million related to Operation Skip Trace.

In addition to moving swiftly to make CAF referrals to DMFEA and suspend the suspected fraudulent hospice providers, DHCS took proactive steps to enhance oversight:

• Improved application security in the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS) through:
  • Stronger residency verification
  • Multifactor authentication for high-risk applications
  • Stronger identity verification with remote identity proofing and a fraud archive reporting service via the CMS Federal Data Services Hub
  • Single sign-on for Service Center users to tighten workforce access controls
• Launched a new digital hospice election form in 2025 to ensure faster processing, fewer errors, and better coordination across delivery systems.
• Updated legislation, effective July 1, 2026, to apply greater oversight to high-risk services, including the ability to implement additional utilization management controls, including prior authorization requirements, in order to review and approve certain services before they are delivered.
• Issued MCP guidance to emphasize program integrity requirements.
• Reinforced policy that requires a valid Notice of Election (NOE) to be on file before any hospice claim can be paid.
• Implemented a Fee-For-Service (FFS) system edit in June 2025 to deny payment for hospice claims submitted without a valid NOE on file.
• Updated guidance through APL 25-008 to ensure MCPs apply and enforce the NOE requirement before hospice claims are paid.
• Developed an online portal to replace email-based submissions for NOEs. This modernization strengthens oversight and helps detect fraud sooner.
• Increased cross-departmental and intra-Agency collaboration to prevent future issues.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 3 – MCP investigations have not always been sufficient to address inappropriate billing

The assessment asserts that MCP investigations and DHCS’ follow-up efforts have not always been sufficient to address inappropriate Medi-Cal billing. ㉑ The assessment, however, ignores that the robust monitoring oversight DHCS has in place is consistent with the requirements of federal law and mischaracterizes DHCS actions as insufficient to address FWA risk in the managed care delivery system.

Furthermore, DHCS emphasizes the need for the auditor to clearly distinguish between overpayments and fraud, as these terms are not equivalent. ㉒ The assessment appears to refer to overpayments and fraud interchangeably. This conflation reflects a fundamental misunderstanding of FWA within the health care sector. As the federal U.S. Government Accountability Office notes³, “While fraud and improper payments are related concepts, they don’t mean the same thing… While all fraudulent payments are considered improper, not all improper payments (i.e. overpayments) are due to fraud.”

MCPs are contractually required to maintain a program integrity and compliance program, including a fraud prevention program, and to report suspected FWA cases to DHCS within ten business days of identification by filing a preliminary report with DHCS. (MCP Boilerplate Contract, Exhibit A, Attachment III, Subsections 1.3.1, 1.3.2.) All managed care FWA referrals received from the MCPs are added into DHCS’ case management system for proper tracking, vetting, and de-confliction with other FWA complaints or investigations that may exist on the same provider or member. It is important to note that the vast majority of preliminary FWA referrals received from the MCPs do not include enough supporting evidence to determine if an investigation by DHCS is warranted. However, the MCPs are contractually required to conduct a complete investigation of all reported suspected FWA cases and to submit completed FWA investigation reports to DHCS within ten business days of completing the investigation. (MCP Boilerplate Contract, Exhibit A, Attachment III, Subsection 1.3.2.D.) The MCPs must also submit a quarterly status report to DHCS on all FWA investigative activities. Outcomes from MCP referrals can range from provider allegations being unfounded, provider education, recovery of identified overpayments, removal from plan networks, pre-payment reviews, DHCS investigation, and a CAF referral to the DMFEA, the state’s MFCU.

DHCS contractually requires MCPs to report all identified overpayments to DHCS within 30 calendar days of the identification of the overpayments. (See MCP Boilerplate Contract, Exhibit A, Attachment III, Section 1.3.6(A).) Similarly, if MCPs recover the overpayments, they are required to report the recovered overpayments within 30 days of its recovery. Additionally, MCPs are required to report all identified or recovered overpayments in their annual report to DHCS, using the rate development template or in another manner specified by DHCS in accordance with 42 C.F.R. section 438.608(d)(3). Any identified overpayments associated with managed care claims will be taken into account in the development of future capitated rates for the MCP.

DHCS continuously evaluates and monitors whether MCPs have internal controls to identify and recover fraud in accordance with C.F.R. Title 42, Chapter IV, Subchapter C, Part 438, Subpart H. This objective is achieved via annual statutorily mandated medical audits to review contract compliance. Target areas of review can include the MCP’s system of submitting FWA referrals to DHCS within contractually obligated timeframes, submitting quality referrals that include relevant factors as established by the contract, as well as conducting thorough investigations with regular contractually required updates. DHCS reinforces MCP expectations via All Plan Letters (e.g., credentialing/screening obligations; actions required upon a credible allegation of fraud, and reporting FWA overpayments), and cross-trains MCP special investigations units (SIUs) on emerging fraud trends to strengthen investigative sufficiency. Second, when DHCS determines that an MCP is not meeting their contractual obligations pursuant to these robust, federally compliant procedures, DHCS may impose corrective action plan to address any such findings, including in the area of FWA.

CSA flagged a specific hospice provider as the most financially significant of three examples of DHCS closing an MCP referral in its case management system while the MCP investigated the matter. ㉓ CSA’s discussion of this provider, however, omits important context that it was provided.

Specifically, DHCS received the preliminary FWA referral from the MCP in December 2023. ㉓ Per the intake unit’s internal tracking process, the referral record was closed in the case management system, to indicate that DHCS was not actively investigating the referral that was actively being investigated by the MCP. However, the record was also placed into a separate record disposition status that indicates that there was an open/ongoing MCP investigation, which is a normal intake protocol within DHCS’ case management system, information provided to, but omitted by, CSA. As an MCP provides updates to DHCS on its investigation, the case management system is updated with notes accordingly. CSA stated correctly that the provider was nonresponsive to the MCP’s attempt to collect requested documentation and ultimately the MCP reported an identified overpayment to DHCS in April 2024. The disposition on the case management record associated with the specific hospice provider was updated to reflect a new disposition of “MCO action taken” and that an overpayment was identified. At the conclusion of the MCP’s investigation, given all other factors, including the identification of the overpayment that was addressed, DHCS did not open a separate investigation into the provider at that time.

Circumstances changed in May 2025 when DHCS opened its own investigation due to a spike in the provider’s billing from October 2024 to December 2024 (i.e., after the MCP had identified the overpayment), which DHCS self-identified in its system through its own data analytics. DHCS referred the case to the DMFEA as a CAF, DMFEA requested a good cause law enforcement exception provided for under state law, and the CAF investigation is still active. The assessment appears to misunderstand the good cause law enforcement exception provided for in state law. ⑦ Once DHCS makes a CAF referral to DMFEA, DMFEA may request a good cause law enforcement exception to suspending a provider (payments, participation, or both). ⑦ The suspensions (including notice to the Provider, as required by law) may be postponed to allow DMFEA to augment the investigation started by DHCS. This could include DMFEA seeking and executing additional search warrants to gather evidence. The good cause exception is authorized by law to avoid tipping off fraudsters in a complex fraud scheme. DHCS has worked collaboratively over the past several years with DMFEA to tighten down the use and length of good cause exceptions, balancing the potential loss of additional funds, against gathering enough evidence to successfully prosecute, root out the source of fraud, and maximize the chances of seizing fraudulently obtained funds. Again, the assessment’s omission of critical context around one of the key anecdotes relied upon fundamentally undermines its basis for this high-risk designation.

㉔ Additionally, CSA’s report fails to mention that the MCP’s reported overpayment will be factored into DHCS’ capitated rate development process. As CSA’s report states earlier, DHCS “has developed a mechanism for excluding those payments it knows were for fraudulent billing from its capitated rate development process.” DHCS pays the MCPs on a per member per month basis through capitated rates that are primarily developed using cost experience data that is net of identified overpayments and submitted separately from encounter data. DHCS does not pay the MCPs the actual dollar amount reflected in the encounter data. ㉔ Accordingly, the claim that DHCS paid $5.5 million to the MCPs for the claims billed by the provider is not accurate.

㉕ Further, the report fails to identify that the capitation rate development process includes considerable data analyses to identify anomalous trends or findings that result in the identification of previously unidentified overpayments or excessive cost experience. When such anomalies are identified, DHCS makes adjustments through the rate development process to ensure such overpayments are excluded from capitation payments made to MCPs in alignment with Federal law. The impact of potential unidentified overpayments included in plan-reported cost experience data is attenuated through the actuarially sound, certified, and federally-approved capitation rate development process, which leverages a multitude of federal, industry, and California-specific data sources and actuarial methodologies. DHCS and its contract actuary use these data sources and methodologies to perform considerable data analyses that identify anomalous trends or findings and result in the identification of previously unidentified overpayments or excessive cost experience. When such anomalies are identified, DHCS makes adjustments through the rate development process to ensure such overpayments are excluded from capitation payments made to MCPs. ㉕ This is yet another example of information provided to CSA that provides relevant context for its findings (and potentially undercuts those findings) that was omitted from the report.

Lastly, the outcome of the active investigation that was referred to the DMFEA may result in court ordered restitution, which would be considered a recovery to DHCS. ㉖ DHCS’ MCP oversight framework mirrors federal expectations, and capitation rate-setting processes exclude and serve to identify fraudulent payments, ensuring the dollars are not impacted by managed care claim-level anomalies or identified FWA overpayments.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 4 – Missed Opportunities to Prevent Future “Questionable” Payments

The assessment observes that less than 15 percent of total fraud referrals are investigated. ㉗ The assessment ignores that the majority of the fraud referrals/complaints received by DHCS do not justify further action or investigation based on DHCS’ vetting criteria, with a majority of complaints lacking substantiating evidence of FWA. Far from being an outlier, DHCS is in alignment with federal program integrity guidance from CMS and HHS-OIG, which underscores that fraud tips and complaints must be vetted for credibility before they warrant a full investigation. ㉘ Initiating investigations into referrals that lack substantiating evidence would be an inefficient use of taxpayer resources, yet CSA appears to question DHCS’ approach on this point.

As reflected in the auditor report, DHCS receives a high volume of FWA complaints and referrals (a monthly average of approximately 2,000 referrals) from the public, MCPs, counties, federal agencies, and internal analytics. The complaints received are associated with both providers and members. DHCS, a CMS-recognized program integrity leader, uses a comprehensive vetting mechanism to evaluate each single fraud complaint.

DHCS’ A&I team analyzes the complaints using criteria such as the egregiousness of the suspected fraud, complaint source (e.g., anonymous complaint versus a referral from a trusted government agency), timeframe of suspect fraudulent activity, materiality of fraudulent claims paid, suspected patient harm, complainant credibility and sufficiency of the evidence provided to determine which complaints should be assigned for investigation. Based on the initial vetting, any complaint that is determined to warrant further investigation is assigned to field staff (auditors or investigators)

㉘ CSA is correct that less than 15 percent of referrals received are assigned out for further investigation, but the report omits critical context around that data point, which it was provided. The assessment acknowledges referrals fall into several paths of action outside of assignment for investigation, including educational letters sent to providers and/or members (10 percent), ongoing MCP investigation (9 percent), and referrals made to the appropriate agency with authority to handle the matter associated with the complaint (8 percent). ㉘ Critically, the assessment fails to acknowledge that over half of all FWA complaints (54 percent) are closed each month due to lack of supporting evidence to indicate FWA to assign for further investigation or justify an educational letter or external referral. This finding appears to criticize why DHCS is not investigating complaints with no substantiating evidence or that are being investigated by another entity, even though doing so would not be a prudent use of DHCS’ resources and likely constitute a waste of taxpayer resources.

DHCS dedicates substantial resources to program integrity, more than 20 percent of its workforce, but those resources while significant, are not unlimited. Accordingly, DHCS uses a data-driven, evidence-based vetting process to ensure investigative resources are directed to complaints with credible indicators of FWA. ㉙ This approach aligns with national best practices and prevents unnecessary waste of DHCS and taxpayer resources on unsubstantiated referrals. Federal guidance from CMS and HHS OIG makes clear that referrals should be vetted for credibility and evidentiary reliability before they warrant a full investigation.

CSA’s criticism suggesting that DHCS should pursue every referral regardless of evidentiary sufficiency ignores the high volume of low-credibility complaints. ㉘ To the extent questions arise about prioritization criteria, DHCS remains open to discussion, but the record does not indicate that CSA evaluated these criteria. ㉚ It is also important to recognize that appropriation levels are set by policymakers, and DHCS allocates the resources provided as efficiently and responsibly as possible. Consistent with this approach, DHCS is enhancing triage workflows with standardized vetting criteria, expanding advanced analytics, increasing staffing, and enhancing capabilities where warranted to maintain high-quality complaint assessment of high referral volume in alignment with federal FWA investigation guidelines.

③ DHCS continues to review existing processes for improvements and utilize new data analytics and audit/investigative techniques to more efficiently identify potential suspect providers for investigation. DHCS continues enhancing triage workflows with standardized vetting criteria and strategic staffing requests to ensure high-quality complaint assessment despite high FWA complaint volume.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 5 – Two Providers billed Medi–Cal despite being ineligible

The assessment observes that two providers billed MCPs, despite being ineligible to participate in the Medi-Cal program. ㉛ Notably, CSA only identifies two examples when comparing against a list of nearly 83,000 providers on the HHS-OIG list and the DHCS suspended and ineligible list containing almost 23,000 providers. ㉜ Additionally, the assessment overlooks the fact that DHCS does not control when it receives notifications of providers’ ineligibility from other State or federal agencies and fails to recognize that the provider’s ineligibility status is often retroactive, resulting in Medi-Cal billings during the ineligibility period due to ineligibility determination that post-dates the billing.

Consistent with federal requirements, DHCS routinely monitors federal exclusion databases and receives notifications from various licensing boards and state agencies overseeing licensing of certain provider types to identify when provider sanctions are required. During the course of an investigation, DHCS may impose a payment suspension on a provider, if there is a CAF referral and no good cause exception is requested, or may impose a temporary suspension on a provider, if there is an active fraud investigation by a law enforcement agency, under standards established by the State Legislature in statute.

When DHCS imposes provider sanctions (e.g., payment suspension under Welf. & Inst. Code, § 14107.11, a temporary suspension under Welf. & Inst. Code, § 14043.36; or a mandatory suspension under Welf. & Inst. Code, §§ 14123 and 14043.6), the effective date can be applied retroactively depending on the circumstances. In the two scenarios referenced by CSA, there was a combination of retroactive effective dates and delayed notifications to DHCS that resulted in almost $1.6 million in managed care encounters from ineligible providers. As described above, in the managed care delivery system, encounter data in managed care does not equate to lost dollars to taxpayers. ㉝ The MCP contracts with DHCS are at risk contracts, the rates paid under those contracts are developed net of overpayments, and the MCPs bear the financial loss associated with those overpayments.

In the first example, DHCS imposed a temporary suspension in May 2024 and subsequently issued a mandatory suspension in July 2025 with a retroactive effective date of October 2020. MCPs are required to monitor the internal restricted provider database for any provider sanctions and take appropriate actions to withhold or terminate payments to providers, including those with retroactive effective dates.

Similar to the first instance, in the second example, the provider’s Drug Enforcement Administration (DEA) registration was revoked in May 2022. However, consistent with federally established processes for state Medicaid agencies to obtain DEA registration status data, DHCS was notified about the DEA revocation when it first appeared on the federal database, CMS Data Exchange System (DEX), in February 2023. In January 2024, DHCS issued a mandatory suspension and added the provider to the Suspended & Ineligible List with a retroactive effective date of May 2022.

Additionally, the impacted MCPs were informed by the DHCS to review the billing associated with the provider as of the retroactive effective date of the sanction and to take the appropriate actions/adjustments, including recovery of overpayments. Moreover, as stated earlier, the ineligible managed care claims do not represent an actual $1.6 million loss to the Medi-Cal program because MCPs are paid a per member per month capitated rate. In the managed care delivery system, encounter data in managed care does not equate to lost dollars. The MCPs contracts with DHCS are at-risk contracts, the capitated rates are developed net of overpayments, and the plans bear the financial loss associated with those overpayments. ㉞ The CSA’s report fails to distinguish between dollars reported in encounter data and actual Medi-Cal program expenditures through capitated rates paid to MCPs. The capitation rate development process excludes overpayments from capitation payments made to MCPs in alignment with Federal law, and further serves to identify overpayments and anomalous cost experience as described above. In this instance, overpayments made to this provider (on a full-risk basis, where the MCPs bear the risk and the state incurs no cost) after the suspension was put into effect are excluded from the cost experience used in the development of future capitation rates. ㉞ This is yet another example of information provided to CSA that provides relevant context for its findings (and potentially undercuts those findings) that was omitted from the report.

As stated in CSA’s report, DHCS continues to seek improvements and efficiency in the provider sanction process, including options to streamline and automate various notifications from state and federal agencies. DHCS has encouraged CMS to consider national standardization, paired with strong, transparent federal support, to deliver substantial nationwide value and ensure a consistent baseline of protection across states. Some specific recommendations made to CMS included streamlining revocation criteria, expanding the use of pre-payment review, and broadening national information-sharing capabilities with state agencies. DHCS is also working on a medium-term solution to create an Erroneous Payment Correction process that is currently used in FFS to be deployed to the managed care delivery system. This expanded functionality in the managed care delivery system will expedite proactive adjustments, improving consistency and auditability across the managed care delivery systems.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 6 – Ground Medical Transportation (GMT) mileage rate overcharges

CSA identified that more than 130 transportation providers overbilled mileage for non-emergency GMT services for SFY 2024-25. These transportation providers billed nearly $31 million to managed care plans in excess of the allowable rate in SFY 2024-25. ㉟ The assessment fails to acknowledge that DHCS has already self-identified the increased FWA risk in the transportation provider sphere and has taken steps to curtail and eliminate the risk, even though this information was provided to the assessment team; this is yet another example of an omission of relevant context related to a finding.

DHCS’ program integrity reviews have identified potential GMT risks (phantom trips, upcoding, and duplicative billing). To remove ambiguity and strengthen the program, DHCS is advancing policy clarifications and operational edits, including updating All Plan Letter (APL) 22-008. These updates provide specific guidance for Non-Medical Transportation (NMT) and Non-Emergency Medical Transportation (NEMT) and require MCPs to implement additional utilization management controls, including prior authorization requirements. MCPs must ensure all network providers and subcontractors, including transportation brokers, comply with state and federal rules, DHCS contract requirements, APLs, and Policy Letters, and must impose corrective action when non-compliance is identified. The updates to APL 22-008 will further clarify MCP oversight requirements for NMT and NEMT providers.

DHCS agrees that proactive research and investigation in this specific area of potential FWA is appropriate to ensure proper billing guidelines are followed. To this end, DHCS has historically met with MCP Chief Financial Officers (CFOs) and Chief Medical Officers (CMOs) to discuss NMT and NEMT. Furthermore, DHCS recently established a new structured statewide meeting series focused on strengthening utilization management and program standards in key priority areas with joint MCP CFO and CMO attendance. DHCS prioritized collaborative review and discussion on NMT and NEMT. ㊱ Through these meetings and internal analysis, DHCS is implementing updated utilization controls⁴ that include requiring plans to conduct additional review on trips beyond newly specified mileage, trip frequency, and service type standards.

② DHCS respectfully submits this Observation does not warrant designation on the State Auditor’s high-risk issue list.

CSA Observation 7 – Limited Staffing Resources

The CSA report contains a chart depicting a decline in dollars spent on DHCS investigative staff, asserting DHCS has a low rate of fraud investigations, which may be attributable to limited resources. ㊲ With the shift in delivery systems from FFS to managed care, DHCS has contractually required MCPs to commit resources to program integrity. Additionally, the UPIC and MMRAC conduct audits on behalf of DHCS. These additional resources complement DHCS’ A&I staff and internal program integrity work.

Furthermore, DHCS continuously leverages advances in technology to enhance its capability to detect fraud and efficiently allocate investigative staffing resources. DHCS utilizes several innovative tools to detect irregular Medi-Cal claims activity and strengthen program integrity. ③ The advanced analytic tools include Statistical Analysis System (SAS), Teradata, SAP Business Objects, and Power Business Intelligence. These additional data analytics tools (e.g. SAS and Power Business Intelligence) leverage AI and enable ongoing anomaly detection, peer group comparisons, sparkline-based outlier identification, and algorithm-driven monitoring of claims patterns that may signal elevated fraud risk. This type of structured data monitoring that looks at the totality of circumstances and various analytics tools enables early identification of programs or provider types whose utilization or costs begin to diverge from expected patterns. When DHCS identifies significant deviations, such as unexpected surges and abnormal increases in claim volume, or program costs that substantially exceed expected levels, these findings are elevated to investigative staff for a potentially targeted review. These technologies enhance investigative staffing productivity, enabling DHCS to focus DHCS resources on all cases with CAF for further investigation.

As explained above in Observation 4, the majority of the fraud referrals/complaints received by DHCS do not justify further action or investigation. This outcome, however, is not a reflection of DHCS’ commitment to program integrity, but an objective reflection of the merits and cost-benefit of pursuing further action from screening and assessment of referrals received. California’s total PIU staffing is the largest reported among other state Medicaid programs. Compared to other large state Medicaid programs such as New York (442) and Texas (588), California (706) ranks the highest in total number of PIU staff resources dedicated to detecting and preventing FWA. In addition to the PIU, DHCS allocates significant additional staffing resources to preventing FWA and recovering overpayments, including (but not limited to) provider screening and revalidation (three percent of total positions), and third-party liability and recovery (four percent of total positions).

Finally, DHCS is not a self-funded agency. Authority to allocate resources does not rest with DHCS. ㊳ If DHCS was allocated additional resources dedicated to program integrity, DHCS would be open to additional discussions and could certainly delve into the next layer of credible referrals or leads from data analytics. In the meantime, and more fully explained above, DHCS must continue to responsibly prioritize program integrity efforts, leverage PI capacity of our MCP partners, the UPIC, the MMRAC and judiciously deploy internal resources, striking a delicate balance.

Conclusion

④ The CSA’s assessment report does not reflect that DHCS operates within a statutory framework set by the State Legislature, which balances fiscal controls against maintaining access to care for the millions of vulnerable Californians served by the Medi-Cal program. Medi-Cal is the largest public health program in United States after Medicare, serving nearly 14 million Californians. DHCS recognizes the risks in administering the nation’s largest, and one of the nation’s most complex Medicaid programs. At the same time, DHCS is adequately and continuously monitoring and mitigating FWA, removing suspect providers appropriately and proportionally, recovering overpayments due to FWA, and advancing clarifying policy changes that strengthen program integrity and reduce ambiguity in billing rules. To this end, over the past five years, DHCS’ program integrity efforts have done the following:

• Saved over $2 billion by imposing monetary sanctions, scrutinizing rates, and cost avoidance from preventing bad actors from enrolling in the program.

• Collected over $4 billion in overpayments from providers, along with securing reimbursements from other health insurers, estates, trusts, and settlements or judgments in tort matters.

Through these and other measures, DHCS performs critical oversight of Medi-Cal that protects both State and federal funds, and we are committed to continuous improvement. DHCS further prioritizes expanding analytics capacity and reinforcing its position as a national leader in Medicaid program integrity.

DHCS appreciates the work performed by CSA and the opportunity to provide feedback on the assessment report. If you have any questions, please contact the DHCS Office of Compliance, Internal Audits at (916) 261-0346.

Sincerely,
Michelle Baass
Director

---

¹ 2 CCR § 61013(a)(3).

² Id. § 61013(a)(4).

³ GAO: https://www.gao.gov/fraud-improper-payments

⁴ DHCS’ Proposed Changes for Utilization Management for Applied Behavior Analysis (ABA)/Behavioral Health Treatment (BHT) and Transportation Services FACT SHEET, Utilization-Management-for-Applied-Behavior-Analysis-BHT-and-Transportation-Services-Fact-Sheet.pdf, May 2026.

cc:

Lindy Harrington
Chief Deputy Director 
Policy and Program Support
Department of Health Care Services
Lindy.Harrington@dhcs.ca.gov  

Tyler Sadwith 
Chief Deputy Director and 
State Medicaid Director
Department of Health Care Services 
Tyler.Sadwith@dhcs.ca.gov

Saralyn Ang-Olson, JD, MPP
Chief Compliance Officer
Office of Compliance
Department of Health Care Services
Saralyn.Ang-Olson@dhcs.ca.gov

Wendy Rasmussen, MPA
Chief
Internal Audits
Department of Health Care Services
Wendy.Rasmussen@dhcs.ca.gov

Stanley White
Acting Deputy Director and Assistant Deputy Director
Audits and Investigations
Department of Health Care Services
Stanley.White@dhcs.ca.gov

---

Comments

California State Auditor’s Comments on the Response From the California Department of Health Care Services

To provide clarity and perspective, we are commenting on the response to our report from Health Care Services. The numbers below correspond with the numbers we have placed in the margin of Health Care Services’ response.

① We disagree that our report is missing context and does not establish that Health Care Services has inadequate oversight of Medi‑Cal providers and is not taking adequate corrective action to control the risk of inappropriate payments. We considered the evidence Health Care Services provided and included appropriate context in our report. Further, our report clearly describes Health Care Services’ problematic history overseeing Medi‑Cal providers and identifies missed opportunities to review suspicious providers. We stand by our conclusion that the issues described in our report warrant inclusion in our description of why Health Care Services is included on the State High Risk list.

② Health Care Services believes the regulatory requirements for inclusion on the State High Risk list have not been met. We disagree and believe our report provides more than sufficient justification for adding this issue to our description of why Health Care Services is included on the State High Risk list. We look forward to working with Health Care Services as we initiate future audits examining its payment practices for Medi‑Cal providers.

③ Health Care Services’ response talks about the strategic deployment of its resources; however, our review found an instance where the department closed its own selected case due to inactivity, in addition to not reviewing the vast majority of providers who scored within the top 10 percent of risk scores according to the department’s own risk assessment tool. As the examples in Figure 3 and Figure 4 show, Health Care Services has failed to follow up on some of these highest‑risk providers. We stand by our assessment.

④ We understand that Health Care Services must ensure Californians have access to medical services while also protecting against fraud, waste, and abuse, and we acknowledge Health Care Services’ attempt to balance these objectives here and here. However, our report also highlights areas where Health Care Services missed opportunities to use its analytic tools to follow up on potential leads or to further investigate providers whom it now believes committed fraud.

⑤ Since this is an assessment and not an audit, our report does not make any specific recommendations to Health Care Services, nor do we suggest taking any action that could impede due process or jeopardize anyone’s access to health care. Instead, the assessment simply presents our justification for including this issue in our description of why Health Care Services is on the State High Risk list and for self-initiating subsequent audits, as resources permit.

⑥ This assessment simply identifies that Health Care Services has opportunities to put more effort into investigating circumstances it is already aware of, such as providers that its own tools have flagged as higher risk, as well as a provider we identified and Health Care Services agreed warranted further action. Should we audit Health Care Services processes in this area in the future, we would consider Health Care Services’ perspective on risks of over‑correction to ensure that any potential recommendations are reasonable and balanced.

⑦ As we discussed with Health Care Services prior to its response, the department misstates the point of this example. In the example cited here, shown in Figure 4 and discussed here and here in our report, Health Care Services missed an opportunity to investigate the provider when the provider showed signs of non‑cooperation with the managed care plan’s investigation—more than a year prior to when the good cause exception was in place. Instead, Health Care Services continued to allow this provider to operate and continue to bill for payments that Health Care Services ultimately referred to DOJ for possible criminal investigation and prosecution. Had the department taken more initiative to investigate the provider sooner, it could have potentially prevented the additional billings that it eventually referred for prosecution.

⑧ Our report—here, here, and here—describes how managed care payments work and how unidentified inappropriate payments in managed care plans can drive up future Medi‑Cal capitation payments. We believe that we have appropriately provided the important context and background in discussing this issue.

⑨ As this is an assessment and not an audit, we did not make any specific recommendations to Health Care Services. However, we do highlight Health Care Services missed opportunities to investigate providers with known wrongdoing and a history of inappropriate payments, some of whom Health Care Services now believes committed fraud.

⑩ We have not overlooked that some of these issues have been resolved, which we acknowledge here, but the repeated findings from multiple reviews demonstrate Health Care Services’ problematic history overseeing Medi‑Cal providers. Moreover, as we also demonstrate in Figure 1, recent reviews by federal entities have continued to express concerns over the State’s fraud prevention and investigative activities.

⑪ Health Care Services does not provide full context for California’s Medicaid fraud recoveries. When accounting for the size of the program, California ranked fourth in Medicaid fraud recoveries in the 2024 annual report. Additionally, in the 2025 annual report, California ranked 25th when accounting for the size of the program.

⑫ Our assessment does not make assumptions, it draws reasonable conclusions based on the evidence we gathered and extensive analysis we conducted. Far from ignoring program integrity actions already in place, our report speaks to Health Care Services’ processes—as shown in Figure 2—and actions it has taken, or failed to take, on specific cases.

⑬ Health Care Services is mischaracterizing our report. Our report never suggests that payments to providers be stopped “upon any indicia of potential fraud.” In fact, our report acknowledges here that Health Care Services does not need to investigate every referral it receives and that additional research is often necessary to establish credible leads. What our report does conclude, however, is that Health Care Services has missed opportunities to improve its processes to allow it to follow up on providers that do warrant further investigation. Furthermore, Health Care Services’ investment in the staffing necessary to more fully investigate potential fraud has stagnated while Medi‑Cal spending has doubled, as demonstrated in Figure 5.

⑭ Since this is an assessment and not an audit, our report does not make any specific recommendations to Health Care Services, nor do we suggest taking any action that would ignore statutory requirements or could impede due process.

⑮ We describe Health Care Services’ risk‑based approach starting here and acknowledge that not all referrals warrant an investigation. We also acknowledge here that the risk assessment tool we analyzed considers the types of risk indicators outlined in federal best practices. However, as demonstrated by the examples in Figure 4, Health Care Services missed opportunities to prevent questionable payments by not investigating providers with known inappropriate payments and warning signs of fraud. Further, in its 2023 review of Health Care Services, the federal government issued various findings and observations regarding the State’s oversight of managed care plans, including Health Care Services’ significant delay in providing the documentation required for the federal review.

⑯ We agree with Health Care Services that prioritization is necessary in a program as large as Medi‑Cal, but our work showed that Health Care Services own analytic tools had identified a large number of providers with high risk scores and that Health Care Services had not conducted any additional research or follow‑up to look into them. As we state on page 11, while not all providers with high risk scores may require an investigation, many, such as the providers in Figure 3, likely do warrant further scrutiny.

⑰ Health Care Services mischaracterizes our point. Our report never asserts that this assessment tool alone is a determination of fraud or should be used to classify providers as high‑risk. In fact, we acknowledge the opposite here and state that Health Care Services must still perform additional research to determine whether providers that receive high risk scores are committing fraud, waste, or abuse. Moreover, as we also state here, while not all 26,000 providers may require an investigation, many, such as the providers in Figure 3, likely do warrant further scrutiny.

⑱ Health Care Services is incorrect that our report does not consider the possibility that the analytics tool may have been a data point that led to investigations. Our report discusses here and here that Health Care Services had not instituted a referral or investigation for approximately 26,000 of 28,000 providers that scored in the top 10 percent of the department’s own risk scores within its assessment tool. As such, the 2,000 that received a referral or were investigated could have been instigated by the assessment tool risk score. Nevertheless, the thousands of providers the tool assigned a high risk score, for whom Health Care Services has not initiated any referrals or investigations, represent a missed opportunity for the department to scrutinize providers with indicators of potential risk. Moreover, our report does not singularly rely on this one analytics assessment tool to draw our conclusions, as we discuss a number of other missed opportunities and issues with Health Care Services’ oversight throughout our report.

⑲ Health Care Services mischaracterizes our point. Our report discusses here how Health Care Services uses risk scores from its analytic tool in conjunction with other analytics tools and information. However, we also note that Health Care Services has not followed up on the vast majority of providers in the top 10 percent of risk scores. While not all of these providers may require a full investigation, many, such as the providers in Figure 3, likely do warrant further scrutiny.

⑳ Our report does not conclude that Health Care Services does not take any action against fraud, waste, or abuse, and we commend the department for taking this action. However, our assessment does highlight the fact that Health Care Services has missed opportunities to act sooner to take proactive measures to stop fraud early or prevent it altogether, such as the examples explained in Figure 4.

㉑ As we describe throughout the report, Health Care Services has missed opportunities to further scrutinize providers and stop questionable payments. For example, Health Care Services initially chose not to investigate a provider that billed for services it did not provide and refused to cooperate with the managed care plan’s investigation. Health Care Services only started to take action more than a year later, and after the provider had claimed more than $5.5 million in Medi‑Cal services.

㉒ We disagree. The issue that Health Care Services raises here was brought to our attention prior to the final draft of the report and has been resolved.

㉓ Health Care Services is incorrect that we omitted context. As the Provider F example in Figure 4 shows, we acknowledge that the managed care plan was investigating the provider and that Health Care Services was tracking this investigation. However, Health Care Services is misunderstanding our concern regarding this investigation despite multiple efforts to explain. As discussed in rebuttal 7 above, Health Care Services missed an opportunity to investigate the provider when the provider showed signs of non‑cooperation with the managed care plan’s investigation. Instead, Health Care Services continued to allow this provider to operate and continue to bill for Medi‑Cal services that Health Care Services ultimately referred to DOJ for possible criminal investigation and prosecution.

㉔ Health Care Services is incorrect. We describe here that this provider fraudulently billed the managed care plan and that Health Care Services has a process for excluding known overpayments from its rate development process when establishing future capitation rates for managed care plans. However, we also state that the examples in Figure 4 demonstrate the risk that Health Care Services is letting some questionable costs continue, even after it has become aware of wrongdoing by providers. Further, we note Health Care Services has not followed up on Provider H, despite a history of overbilling and continued questionable claims, and to the extent that any of Provider H’s claims are inappropriate, these claims could increase the future capitation rates that Health Care Services pays for managed care.

㉕ We disagree that our report omits relevant context. We reviewed the capitation rate setting report prepared for Health Care Services by its contractor. While the report discusses analysis and adjustments at summary levels, such as an adjustment to a managed care plan’s emergency room costs so that it was closer to the region’s average, we did not identify any discussion about analyzing individual providers’ claims for reasonableness. Further, the report states that the contractor did not audit the data, and if the data is materially incomplete or inaccurate, the contractor’s conclusions may require revisions. Health Care Services did not provide any additional information demonstrating adjustments made at the provider level of data. Nevertheless, our report does include a discussion here and here about the capitation rate setting process excluding known overpayments.

㉖ We acknowledge that the result of an investigation could result in a court‑order restitution, but we also believe it would be more beneficial to prevent fraud before court proceedings are necessary to recover funds. We highlight Health Care Services missed opportunities to prevent fraud in Figure 4.

㉗ Health Care Services is incorrect that the assessment ignores that not all referrals need to be investigated. Our report acknowledges here that Health Care Services does not need to investigate every referral it receives. However, the report also highlights missed opportunities for Health Care Services to scrutinize suspicious provider behavior.

㉘ Our report does not suggest initiating investigations into referrals that lack substantiating evidence. Rather, our report points out missed opportunities for Health Care Services to follow up on providers—such as the providers in Figure 4—that presented reasonable cause for concern and additional follow up.

㉙ Our report does not suggest Health Care Services should waste resources on unsubstantiated referrals. Rather, our report discusses—and provides examples of—opportunities for Health Care Services to further scrutinize providers with known wrongdoing and previous overpayments.

㉚ While we acknowledge that appropriation levels are set by policymakers, our report outlines several examples where Health Care Services missed opportunities to prevent future questionable payments and that limited resources could impact their efforts to do so. However, when we spoke with Health Care Services about this, the department indicated that it believed it had struck the right balance between resource allocation and finding and preventing questionable payments while also indicating that with more resources they could likely find more questionable payments.

㉛ While the analysis for this assessment identified two providers, as shown in Figure 1, this phenomenon of ineligible providers still having the ability to participate in Medi‑Cal has persisted for years and has been reported on both by our office and the federal government.

㉜ We acknowledge that other entities play a role in information sharing with Health Care Services, but not receiving important information timely related to providers who have had their eligibility to participate in Medicaid programs revoked is evidence of a problem in the overall process that could be improved. Further, Health Care Services allowing ineligible providers to participate in Medi‑Cal is a longstanding issue.

㉝ Health Care Services is not including relevant context. As we state here and here, Health Care Services did not discover these providers were ineligible until years after they became ineligible. While we acknowledge that Health Care Services’ rate development process accounts for known overpayments, delaying identifying inappropriate costs means that these payments would not be excluded as overpayments in prior rate setting processes, potentially increasing prior capitation rates.

㉞ Health Care Services is incorrect. Our report discusses the fee‑for‑service and managed care payments made to ineligible providers here and here. Further, we describe here and here how managed care payments work and the risk of unidentified inappropriate payments in managed care plans driving up future Medi‑Cal capitation payments.

㉟ Health Care Services is incorrect. Our report acknowledges here that Health Care Services is aware of the variety of fraud schemes that may occur in ground transportation. However, even though they are aware of this fraud risk, our report outlines examples of overbilling and suspicious trips that the department was not aware of prior to our assessment work.

㊱ We are pleased to see Health Care Services taking steps to address this area. Given that Health Care Services was unaware of the overbilling for mileage reimbursement and the excessive mileage that Provider J claimed to drive, Health Care Services needs to improve its oversight in this area, and this is a further example of the benefit an audit by our office can provide by adding this issue to our description of why Health Care Services is included on the State High Risk list.

㊲ We describe that Health Care Services contractually required managed care plans to conduct their own investigations here. However, we also discuss how investigations by managed care plans have not always been successful in stopping questionable payments, and that Health Care Services failed to take immediate action to further investigate the providers, as shown in Figure 4. Health Care Services remains ultimately responsible for ensuring payments are appropriate.

㊳ As we discuss here, Health Care Services told us during our assessment that it believed it was striking the proper balance in terms of resource allocation. As we highlight throughout the report, Health Care Services has missed opportunities to further scrutinize providers. Therefore, we are encouraged that Health Care Services now acknowledges that, given more resources, it could do more, including following up on credible referrals or leads from data analytics. While Health Care Services is not a self‑funded agency, it can seek additional funding to improve its oversight and better safeguard taxpayers’ money.

Footnotes

1. The high-risk list is published in Report 2025-601, State High-Risk Audit Program: The California State Auditor’s Updated Assessment of Issues and Agencies That Pose a High Risk to the State, December 2025. ↩︎
2. We provide only limited information about Health Care Services’ risk assessment tools to protect the integrity of the tools and avoid disclosure of sensitive operational details. ↩︎
3. We used only fiscal year 2024–25 data in our assessment, and the data do not include some types of Medi‑Cal claims, such as dental claims. ↩︎
4. To preserve the integrity of future and ongoing investigations, we are not publicly disclosing the names of the providers we use as examples of potential fraud, waste, and abuse. Instead, we have assigned each of these providers a letter that we use throughout the report. ↩︎