What Is a Medicaid Fraud Control Unit? How NEMT Cases Start and What to Do If Contacted

What a Medicaid Fraud Control Unit is

A Medicaid Fraud Control Unit is a state law enforcement office that handles Medicaid fraud by providers. Section 1903(q) of the Social Security Act sets its shape, and federal rules in 42 CFR part 1007 fill in the details. Each unit must employ at least one attorney, one experienced auditor, and one investigator who work only for the unit, under a director.

The unit must be separate from the state Medicaid agency. It keeps its own budget (42 CFR 1007.5), and no Medicaid official may review its work or overrule a referral for prosecution (42 CFR 1007.9). Most units are part of the state attorney general’s office. HHS OIG’s directory of unit directors, dated April 1, 2026, shows a few exceptions:

State	Where the unit sits
Most states	The attorney general’s office or state department of justice
Connecticut	Office of the Chief State’s Attorney
District of Columbia	Office of the D.C. Inspector General
Iowa	Department of Inspections, Appeals, and Licensing
Tennessee	Tennessee Bureau of Investigation

HHS OIG certifies every unit each year and pays most of its costs. The federal share is 90 percent for a unit’s first 12 quarters and 75 percent after that (42 CFR 1007.19). In fiscal year 2025, the 53 units spent about $424 million, of which about $318 million was federal, and had 2,259 staff on board at year end. They held 15,921 open investigations as of September 30, 2025, according to OIG’s statistical chart.

What fraud control units investigate

Units have two jobs: provider fraud and patient abuse. For NEMT, both can apply.

What the unit handles	What that means for a NEMT company
Criminal and civil fraud by providers	Billing for rides that never happened, padded miles, fake tolls, or kickbacks to riders. Fraud can include misstatements made in reckless disregard of the truth, not only on purpose (42 CFR 1007.1).
Providers in managed care networks	The rules define a provider as anyone who furnishes or arranges Medicaid-paid services, including anyone in a managed care network, so broker and health plan subcontractors are covered (42 CFR 1007.1).
Abuse or neglect of Medicaid patients	Always in health care facilities. Since December 27, 2020, units may also cover members in noninstitutional or other settings, if they choose to. OIG names medical transportation, such as ambulettes, as one of those settings (Policy Transmittal 2021-1, August 30, 2021).
Overpayments found in a fraud case	The unit recovers them in the case or refers them to the state for collection (42 CFR 1007.11(c)).

Some things go elsewhere. Federal funds do not pay for unit work on program abuse, meaning billing practices that break the rules without signs of fraud, or on a member’s own eligibility fraud unless a provider took part (42 CFR 1007.19(e)). Program abuse usually stays with the Medicaid agency and its auditors. For the other reviewers who can check your claims, see how to prepare for a Medicaid audit.

NEMT in the fiscal year 2025 numbers

OIG’s annual report for fiscal year 2025 (OEI-09-26-00140, issued March 18, 2026) and its case outcome data show where transportation stands:

Measure, fiscal year 2025	Nonemergency transportation	All provider types
Fraud convictions	52	856
Abuse or neglect convictions	1	329
Criminal recoveries from fraud cases	$8,386,644	$1.24 billion
Civil settlements and judgments	31	674
Civil recoveries from fraud cases	$21,944,319	$703 million

Transportation tied nurses for third place in fraud convictions, behind personal care attendants and non-residential mental health facilities. It was fifth in civil settlements. For the schemes behind these numbers, see NEMT fraud.

Two recent actions show what these cases look like. On September 17, 2026, Oregon’s attorney general announced guilty pleas by two Portland NEMT owners who also drove for their companies. Both billed for rides for people who had already died. One owes $6,420 in restitution and the other $12,695.34, each with a $5,000 fine and a ban on running any business that receives Medicaid money.

New York shows the scale a single unit can reach. Its June 30, 2025 announcement covered 25 transportation companies across the state. Sixteen agreed to repay more than $13 million between them, seven more were sued, and two people and their companies were convicted.

How NEMT cases start

OIG says cases typically begin as referrals from outside sources, or from a unit’s own data mining. Federal rules build in several paths.

1. The Medicaid agency. When a preliminary review gives the agency reason to believe a provider committed fraud, it must refer the case to the unit (42 CFR 455.15). It must refer all cases of suspected provider fraud and hand the unit its records and data on request (42 CFR 455.21).
2. Health plans. Every Medicaid managed care plan must promptly refer potential fraud to the state’s program integrity unit or directly to the fraud control unit (42 CFR 438.608(a)(7)). In fiscal year 2025, units received 5,991 fraud referrals from managed care entities and opened 1,134 cases from them. Both Oregon cases began with a referral from Trillium Community Health Plan.
3. Tips. Hotline tips count once other evidence backs them up. Federal rules name verified tips, claims data mining, and patterns from audits and civil false claims cases as sources of a credible allegation of fraud (42 CFR 455.2).
4. The unit’s own data work. Units screen claims data themselves. Until August 2026, a unit needed OIG’s advance approval to do this, and 26 units had it as of January 2026. In a policy transmittal signed August 13, 2026, OIG dropped that approval step, so any unit that meets the training and coordination rules in 42 CFR 1007.20 may now mine claims data.
5. Whistleblowers. Employees, riders, and competitors can file suits under the federal or a state False Claims Act, and units pursue civil cases under state law.
6. Complaints about how riders were treated. A report that a driver hurt or neglected a rider can reach the unit in states where it has chosen to cover settings outside facilities.

What gets noticed is often simple. A ride dated after a member’s death, a toll on a route with no toll road, or two trips at the same time by one driver all show up when claims are compared with other data. In the New York cases, one company’s billed miles ran far past what its odometers read at the city’s taxi inspections, and one of its drivers billed 96 separate trips, 2,158 miles, for one day of work. Complete trip documentation is what lets an honest company answer those questions fast.

What happens once a unit opens a case

Records requests. Your Medicaid provider agreement already requires you to keep records of the services you give and to furnish them, on request, to the Medicaid agency, HHS, or the fraud control unit (42 CFR 431.107). State law can add more. In Florida, the attorney general may enter the premises of any Medicaid provider other than a physician to examine its accounts and records, and may subpoena witnesses and records inside or outside the state (section 409.920(10), 2026 Florida Statutes).

Payment suspension. A unit may refer a provider under investigation to the Medicaid agency for a payment suspension (42 CFR 1007.9(e)). Once the agency finds a credible allegation of fraud, it must suspend all payments unless it has good cause not to, and it need not warn you first. It must send notice within 5 days, or later if law enforcement asks in writing, but never more than 90 days after the suspension. The notice must tell you that you may submit written evidence and how to appeal. Medicaid health plans must also suspend payments to a network provider once the state finds a credible allegation of fraud (42 CFR 438.608(a)(8)), so broker and plan trips can stop paying at the same time. The suspension continues while the unit certifies each quarter that the case is still under investigation (42 CFR 455.23). See Medicaid payment suspension.

Outcomes. A case can end with no charges, a civil settlement, or criminal charges. After a conviction, the unit sends OIG the charging papers, plea agreement, and sentencing order within 30 days of sentencing (42 CFR 1007.11(g)). OIG must then exclude anyone convicted of a crime related to Medicare or Medicaid, for at least 5 years (42 CFR 1001.101 and 1001.102). No Medicaid program will pay for any work by an excluded person. See the OIG exclusion list. State penalties can be steep too: in Florida, a conviction for Medicaid provider fraud adds a fine of five times the gain or the loss, whichever is greater (section 409.920(2)).

What to do if a fraud control unit contacts you

A call, a letter, a subpoena, or agents at the door all call for the same first steps.

1. Confirm who it is. Look up your state’s unit in OIG’s directory and call the number listed there, not a number the caller gives you.
2. Call a health care attorney before anyone at the company gives an interview. Tell staff to send every call about the case to one person.
3. Keep every record exactly as it is. That covers trip logs, signatures, GPS and dispatch data, claims, and driver and vehicle files. Pause any routine deletion. OIG’s compliance guidance (November 2023) tells companies running their own investigations to secure documents and prevent their destruction.
4. Produce what the law requires, through your attorney. Keep a copy and a list of everything you hand over.
5. Check your broker agreements. MTM Health’s standard agreement, in the January 1, 2023 version Pennsylvania posts, requires immediate notice to MTM of any criminal investigation, charge, or proceeding against your company or its drivers (section 2.R).
6. Watch for a suspension notice and meet every deadline in it. Plan for cash to cover payroll if payments stop.
7. Fix what you find, with advice. If you learn you were overpaid, the 60-day overpayment rule still applies, but work out with your attorney how to return money connected to an open case.

An audit and an investigation are different things. A records request from the Medicaid agency or a broker usually asks whether claims were paid correctly. A letter from a fraud control unit means a fraud investigation, which can lead to criminal charges or a civil case. The NEMT compliance program guide covers the controls that keep you out of the second kind.

How to report fraud to a unit

Anyone can report suspected Medicaid fraud or rider abuse. Report to your state’s unit, using the contact in OIG’s directory, or to the HHS OIG hotline online or at 1-800-HHS-TIPS (1-800-447-8477). Florida law protects a person who reports suspected Medicaid provider fraud to the state from civil liability for libel or slander, unless the person knew the report was false or acted in reckless disregard of the truth (section 409.920(8)). For kickback offers in particular, see anti-kickback rules for NEMT.