What did CMS ask states to do?

Submit a two-year Medicaid provider revalidation strategy within 30 days of the April 23, 2026 letter, and say within 10 days whether they would swiftly revalidate high-risk providers.

Why does this affect HCBS agencies?

CMS's fraud enforcement has focused on home and community-based and personal care services, so those providers are likely to be revalidated first.

CMS tells states to revalidate high-risk Medicaid providers

Q: Which providers are high risk?

States designate them, but CMS expects the group to include any provider without a National Provider Identifier. Revalidating them more often than every five years is encouraged.

On April 23, 2026, CMS Administrator Mehmet Oz asked every state for a two-year Medicaid provider revalidation strategy within 30 days, starting with high-risk providers and those without NPIs.

Direct Support News desk · April 23, 2026 · Updated September 26, 2026 · 2 min read

Every state must draw up a two-year strategy for revalidating its Medicaid providers, starting with those considered high risk. CMS Administrator Mehmet Oz made the request in April 23, 2026 letters to state Medicaid directors and governors. McKnight's Home Care reported it the same day, noting that home and community-based services and personal care are in focus.

What the Medicaid director letter asks

The letter asks states to revalidate providers in the high categorical risk level more often than the five-year federal minimum and to consider prioritizing high-risk providers not screened in the past 12 months. States choose which providers are high risk, but CMS expects plans to cover providers without a National Provider Identifier (NPI).

Each strategy must include a timeline for off-cycle revalidation, metrics, a way to keep provider data accurate, consistency between fee-for-service and managed care data, including plan provider directories, and coordination with law enforcement. The Medicaid director, not a designee, must submit it.

The deadlines

States had 10 days to say whether they would swiftly revalidate high-risk providers and 30 days to submit the full strategy, then must report results. The governors' letter gave 10 business days and said a failure to respond would be considered as CMS evaluates the likelihood of fraud in each state. It told governors CMS expects the high-risk group to include any provider without an NPI.

The letter acknowledged that most Medicaid providers are honest and that revalidation is only one part of program integrity.

Context

The request came as CMS stepped up fraud enforcement focused on HCBS in states including Minnesota, New York and California. Damon Terzaghi of the National Alliance for Care at Home told McKnight's that personal care and related home care services would be front and center, adding that many states have fallen behind on revalidations.

Why this matters for providers and DSPs

HCBS agencies should expect revalidation requests, site visits or data checks sooner than usual. Keeping enrollment records, ownership information and NPIs current will make revalidation faster.