State Medicaid Fraud Control Units closed FY 2025 with 15,810 open investigations and $1.97 billion in reported recoveries — and they are now under sharper federal review. KFF published a Sept. 28, 2026, explainer on how MFCUs work and why HHS-OIG’s recertification push matters.

Federal law requires every state to run an MFCU that investigates provider fraud and patient abuse or neglect. Units must operate independently of the state Medicaid agency — typically inside the attorney general’s office — and HHS-OIG pays 75% of operating costs while recertifying each unit annually. Most open investigations involve suspected provider fraud rather than abuse cases. In FY 2025, MFCUs obtained 1,180 criminal convictions and 661 civil settlements or judgments; 900 people or entities were excluded from federal health programs based on MFCU criminal convictions, about one-third of all OIG exclusions that year.

The political temperature rose in 2026. A May 13 letter from the HHS inspector general to every state attorney general promised “rigid MFCU compliance” and “robust review.” In June, OIG denied recertification and cut federal funding for Hawaii’s and New York’s units, citing low indictment and conviction production and recoveries that looked weak next to staffing (New York) or Medicaid growth (Hawaii). As of Sept. 17, OIG had issued standard recertifications to three states and conditionally recertified 11, a designation KFF notes did not appear to be routine before 2026. In August, OIG also waived prior-approval requirements so more MFCUs can mine Medicaid data for fraud leads.

KFF cautions that recoveries are a poor scorecard: they miss fraud that prevention stopped, vary with a few large cases, and look small next to total Medicaid spending. States that invest in early detection may show fewer recoveries even when integrity work is strong.

Why this matters for providers and DSPs

MFCUs are not only billing cops. They can pursue patient abuse and neglect in Medicaid-funded facilities and may elect to investigate non-institutional HCBS settings — the same group homes and in-home services where DSPs work. Conditional recertifications and the New York/Hawaii funding cuts signal more pressure for criminal cases and data mining. Provider agencies should expect tighter referral pipelines from managed care and state program-integrity shops, and should treat documentation, incident reporting, and exclusion-list checks as frontline risk controls — not back-office paperwork.