On January 6, 2026, the Centers for Medicare & Medicaid Services (CMS) Administrator, Dr. Mehmet Oz, sent a letter to the Governor of Minnesota, Tim Walz, notifying him that his state’s Medicaid agency was “operating its program in substantial noncompliance” with federal requirements to “ensure sufficient controls to prevent, detect, and address fraud, waste, and abuse.” The Administrator advised the Governor that, subject to an opportunity for a hearing, CMS would be withholding “a portion” of the state’s federal Medicaid matching funds—at least $515 million each quarter—until CMS determines that the agency is in compliance with federal requirements. On January 13, the state requested a hearing. As of this writing, CMS has not set a hearing date.
Fraud Against Medicaid
Let’s stipulate up front that there has been fraud against Minnesota’s Medicaid program, as there has been against every state’s program. Fraud against Medicaid is despicable, it is mostly committed by providers, and it harms individuals covered by Medicaid, reputable providers, and taxpayers, but it happens nonetheless. In the past, CMS has worked jointly with state Medicaid agencies, other federal agencies (HHS OIG, DOJ, FBI), and state Medicaid Fraud Control Units (MFCUs) and whistleblowers to detect and prosecute fraud. When fraudulent providers are identified and prosecuted, and payments made to those bad actors are recovered, the recoveries are divided between the federal government and the state in proportion to the federal matching rate (i.e., if the federal government matched 60 percent of the payments made to fraudulent providers, it would receive 60 percent of any amounts recovered).
The primary responsibility for preventing and detecting fraud against Medicaid lies with state Medicaid agencies. The role of CMS is, among other things, to “provide effective support and assistance to states in their efforts to combat Medicaid provider fraud and abuse.” The CMS Comprehensive Medicaid Integrity Plan (CMIP) for Fiscal Years 2024 – 2028 reflects this objective: “Mindful of the uniqueness of each state Medicaid program, this [CMIP] empowers individual states to create innovative programs that best address program integrity challenges while providing CMS with the tools to effectively promote Medicaid program integrity and safeguard taxpayer dollars over the next 5 years.”
CMS Goes Nuclear
Until the January 6 letter, CMS had been operating on this supportive basis with state Medicaid agencies in addressing fraud. That letter, for the first time in the 60-year history of the Medicaid program, launched the nuclear option—withholding federal matching funds going forward—against a state for noncompliance with a state plan requirement relating to compiling information about fraud, waste, and abuse.
To understand how radical this letter is, it’s necessary to understand how Medicaid disputes between states and the federal government are usually resolved: the disallowance process.
Here in a nutshell is how it works. CMS determines, often based on an audit by the HHS Office of Inspector General (OIG), that a state’s claim for federal matching payments on certain expenditures is not allowable under federal law or regulation. CMS specifies the amount of, and reason for, the disallowance and lets the state know. If the state disagrees with CMS as to amount of the disallowance, it has the opportunity to request a reconsideration by the CMS Administrator. If on reconsideration the Administrator upholds the disallowance, the state can seek review by the Departmental Appeals Board (DAB). The DAB’s decision is the final decision of the Secretary; states have the right to appeal to the U.S. District Court within the state. Over the past five years alone, at least 14 states (AK, CA, CO, FL, ID, KS, MD, MI, MO, NC, NM, TX, VA, and WA) have contested disallowances proposed by CMS before the DAB.
The process the January 6 letter has unleashed is very, very different. It’s known as the compliance process. In brief, if the Administrator determines that there is a “failure to comply substantially” with one or more state plan requirements in a state’s day-to-day administration of its Medicaid program, the Administrator can withhold some or all of the federal matching payments the state would otherwise receive. The state is entitled to reasonable notice and opportunity for a hearing before the Administrator can withhold funds.
Note that, unlike the disallowance process, in the compliance process the state has not spent funds and requested federal matching payments that the Administrator believes are not allowable. Instead, the state will not receive matching payments on some spending in the future because the Administrator has determined that it is not operating its Medicaid program in substantial compliance with federal law—even though the particular expenditures may, in fact, be allowable.
This authority to withhold funding upon a finding of substantial noncompliance with “the provisions of section 1902” of the Social Security Act has been in the Medicaid statute, unchanged, since its enactment in 1965, but it has rarely been used. (Longtime observers of the program do not recall its use in connection with Medicaid fraud since 1998, when the state plan requirement at issue in this case—section 1902(a)(64)—was enacted). That is because for decades CMS has taken the view that the most effective and least disruptive way to bring states into compliance with federal Medicaid requirements is to work and negotiate with them, not to withhold federal Medicaid matching funds going forward until they come into compliance. Among other things, withholding of federal matching funds in any significant amount is destabilizing to the state’s Medicaid budget, and potentially to its budget overall, neither of which promotes compliance.
Under the compliance process, once the CMS Administrator gives the state notice of noncompliance, the only thing that stands between the state and the federal withholding is what is known as a conformity hearing before a Department of Health and Human Services (HHS) hearing officer. If the HHS hearing officer agrees with CMS that the state is out of compliance, CMS can begin withholding federal funds. If the hearing officer does not agree, the CMS Administrator can comply with the ruling or reverse the decision and begin withholding funds anyway. The state may appeal a decision to withhold funds to the relevant U.S. Circuit Court of Appeals, but CMS can withhold funds while the state’s appeal is being resolved.
Why What CMS is Trying to Do to Minnesota Matters
So why has Administrator Oz decided to proceed against Minnesota under the compliance process rather than taking a disallowance? The answer may lie in the difference between the two processes. In the case of the compliance process, the CMS Administrator does not have to specify the federal government’s losses to fraud against Medicaid in Minnesota, either through an audit or otherwise. The Administrator can simply conclude, as he does in the January 6 letter, that the Minnesota Medicaid agency “is operating its program in substantial noncompliance with federal requirements.” (In this instance, that is section 1902(a)(64) of the Social Security Act, which requires the state to “have a mechanism to receive reports…and compile data concerning alleged instances of waste, fraud, and abuse…”). If, after considering all the evidence, the HHS hearing officer does not agree with the Administrator’s conclusion, the Administrator can nonetheless reverse and begin withholding federal funds. Minnesota may appeal to the U.S. Circuit Court of Appeals—in its case, the 8th Circuit, located in St. Louis.
Contrast this with the disallowance proceeding. The Administrator would have to determine the amount of federal matching funds that are not allowable and explain the basis for that determination (usually though an audit). The state would have an opportunity to request a reconsideration by the Administrator and, if the Administrator upholds the disallowance, seek review by the DAB, which has four Members, three of whom participate in each decision. The DAB’s decision would be final: the Administrator has no authority to overturn it. If the DAB does not uphold the Administrator’s finding of noncompliance, the Administrator can’t withhold funds. If the decision goes against Minnesota, CMS may start withholding funds, and the state may appeal to the U.S. District Court in Minneapolis.
In the January 6 letter, CMS does not determine that Minnesota’s Medicaid program has lost a specific amount in payments to fraudulent providers and that it intends to disallow the federal matching funds for those specific payments. (The letter does indicate that CMS will begin reviewing state expenditure reports starting in Q4 2025 for potential disallowances). CMS cites no audit results for federal losses to Medicaid fraud in Minnesota. The three audits referenced in the letter are five years old or older—2017, 2019, and 2021—and only one of them relates to one of the 13 high-risk services at issue. Instead, CMS simply alleges that fraud in Minnesota’s Medicaid program is “rampant;” that Minnesota has “historically had significant deficiencies in proactively identifying suspected Medicaid [fraud, waste, and abuse], primarily through limitations in data analytics and monitoring;” and that the state “has not implemented sufficient safeguards to prevent ongoing improper payments.”
At the yet to be scheduled hearing, as requested by the state, CMS will have the opportunity to back up these assertions, and Minnesota will have the opportunity to rebut them. The evidence the state presents in its defense is likely to include the steps it has taken to address fraud in the high-risk services, none of which are acknowledged in the CMS letter. The letter does concede that the state, in response to a CMS request, submitted a corrective action plan (CAP), but the letter dismisses the state’s CAP as “a document labeled as a CAP” that CMS “has determined …is deficient.” It then goes on to demand that the state submit a revised CAP by January 30 if it “plans to come into compliance with federal requirements.”
Historically, CAPs are one tool that CMS uses to bring states into compliance with federal Medicaid requirements generally, not just those relating to program integrity. CMS identifies a problem; as part of the resolution, it may request a CAP from the state Medicaid agency; the state agency submits a CAP; CMS either accepts the CAP or suggests changes to make it acceptable; the back-and-forth continues until a CAP acceptable to both the state and CMS is produced.
In this case, CMS on December 5 directed the Minnesota Medicaid agency to submit a CAP to address CMS’s concerns about its program integrity operations. CMS gave the agency until December 31. Despite the holidays, the agency met the deadline. Six days later, CMS summarily rejected the state’s submission, abandoning the customary back-and-forth to reach a product that both could agree to. CMS gave the state 10 days—or 5 days, depending on which paragraph of the letter you read—to request a hearing or the withholding of federal matching funds would begin.
It is difficult to imagine that the career civil servants at CMS who designed and are implementing the agency’s Comprehensive Medicaid Integrity Plan are OK with this cavalier treatment of the Minnesota Medicaid agency. It is not difficult to imagine that the political appointees at CMS were interested in (or were directed to) participate in what appeared to be a coordinated assault on the Governor and his administration—an assault that includes insults by the President, an ICE operation in the Twin Cities, a freeze on Minnesota’s child care funds, and a Congressional oversight hearing. In that context, the proposed withholding of $2 billion in federal Medicaid funds per year looks less like an effort to reduce fraud against the Minnesota Medicaid program and more like a fiscal strike. ($2 billion is about 17 percent of all federal Medicaid matching payments to Minnesota in 2024).
Of course, this may all be performative on the part of CMS, part of a negotiating strategy to bring the state Medicaid agency to heel. CMS could decide to delay setting a hearing or it could drop the threat to withhold funds altogether. Time will tell. But one thing is clear: all states should be paying careful attention to how this unprecedented use of the compliance process plays out.
