Compliance and safety
Medicaid Provider Risk Levels: Limited, Moderate, and High Screening for NEMT Companies
Medicaid provider risk levels are the three screening tiers, limited, moderate, and high, that decide how closely a state checks you before and after enrollment. Limited means license and database checks. Moderate adds site visits. High adds fingerprint-based criminal background checks for every owner of 5 percent or more. Each state picks the level for NEMT companies.
- Limited risk means license and database checks, moderate adds site visits, and high adds fingerprints and a criminal background check.
- NEMT is a Medicaid-only provider type, so each state sets its level. Arizona, Colorado, and Minnesota rate NEMT high, and North Carolina rates NEMT vans moderate.
- A payment suspension, an unpaid overpayment, or a past exclusion moves any provider to high risk.
- At high risk, every owner of 5 percent or more must send fingerprints within 30 days of the request.
- The level applies again at every revalidation and every new location, so a second office can mean another site visit.
What each Medicaid risk level requires
Every state screens Medicaid providers at one of three levels: limited, moderate, or high (42 CFR 455.450). Each level includes everything below it. If you could fit more than one level, the highest applies.
| Level | What the state does | Rule |
|---|---|---|
| Limited | Confirms you meet federal and state rules for your provider type, verifies licenses (including in other states), and checks federal databases before and after enrollment | 455.412, 455.436 |
| Moderate | Everything in limited, plus site visits before and after enrollment | 455.432 |
| High | Everything in moderate, plus a fingerprint-based criminal background check for every owner of 5 percent or more | 455.434 |
The database checks at every level cover the Social Security Death Master File, NPPES, the OIG exclusion list, and the federal debarment list now on SAM.gov. The state checks the exclusion lists at least monthly.
The level applies to more than your first application. States screen each new application, each new practice location, and each revalidation at your current level. Revalidation comes at least every 5 years (42 CFR 455.414), and some states go faster. See Medicaid revalidation.
Where NEMT providers usually fall
Medicare sets the levels for provider types it also enrolls (42 CFR 424.518). Ambulance suppliers are moderate risk there, and CMS says a state may not rate the same provider type lower in Medicaid.
NEMT companies that are not ambulances are a Medicaid-only provider type, so each state chooses their level. CMS’s compendium, updated November 17, 2025, uses non-emergency transportation as its example of that choice. It suggests states weigh audit reports, law enforcement input, and their own enforcement history.
Here is how six states rate transportation, as of September 2026:
| State | Provider type | First enrollment | Revalidation | Source |
|---|---|---|---|---|
| Arizona | Non-emergency transportation, provider type 28 | High: site visit, fingerprints, and fee | One level listed for both | Provider profile PEP-111.28, revised September 2026 |
| Colorado | Non-emergent medical transportation | High: site visits, plus fingerprints from each person with an ownership or control interest | The rule lists NEMT as high without splitting first enrollment and revalidation | 10 CCR 2505-10 sections 8.125.4.L and 8.125.12 (last amended effective February 15, 2025) |
| Indiana | Bus, taxi, and common carrier (ambulatory and nonambulatory) | High | Moderate | Risk matrix, April 10, 2026 |
| Indiana | Ambulance | Moderate | Moderate | Same |
| Indiana | Transportation network company, family member, broker fleet, and waiver transportation | Limited | Limited | Same |
| Minnesota | NEMT | High-risk provider type, with background checks and site visits | The same checks at revalidation every three years | DHS briefing to lawmakers, March 2, 2026 |
| North Carolina | NEMT van, taxi, bus, private vehicle, and transportation network company | Moderate: site visit, no fingerprints | One level listed for both | Provider Permission Matrix, August 16, 2026 |
| North Carolina | Secured medical transport van and transportation broker | Limited | One level listed for both | Same |
| Ohio | Wheelchair van, and waiver supplemental transportation | High | Moderate | Appendix to OAC 5160-1-17.8 (rule effective January 31, 2020) |
| Ohio | Ambulance | Moderate | Moderate | Same |
Look for your state’s risk matrix, provider type profile, or enrollment manual before you apply. Our state guides point to each one.
What moves a provider to high risk
The state must raise you from limited or moderate to high in four cases (42 CFR 455.450(e)). CMS’s compendium explains how long each one lasts.
| What happened | How long you stay high risk |
|---|---|
| The state suspended your payments over a credible allegation of fraud, waste, or abuse | 10 years from the suspension. See payment suspension. |
| You have an existing Medicaid overpayment when you apply or revalidate | While it is unpaid. It counts when it totals $1,500 or more with interest, is more than 30 days old, is not repaid, is not under appeal, and is not on an approved repayment plan. If you hold several enrollments under one tax ID, the state may raise all of them. |
| OIG or another state’s Medicaid program excluded you in the past 10 years, and you have since been reinstated | 10 years from the exclusion’s effective date |
| A moratorium kept you out, and you apply within 6 months after it was lifted | Applies to applications filed in those 6 months. See enrollment moratorium. |
The overpayment rule is the one most in your control. Pay it, appeal it, or get a state-approved repayment plan for the full amount before you file. See Medicaid recoupment.
What high risk means for your owners
At high risk, every person with a 5 percent or greater direct or indirect ownership interest in your company submits fingerprints for a criminal background check. CMS says the 5 percent test covers partnerships too, so a 12 percent limited partner is fingerprinted.
Indirect ownership counts. Say two partners each own 45 percent of your company, and a holding company owned by one investor holds the last 10 percent. In a high risk state, both partners and the investor send fingerprints, because each owns 5 percent or more, directly or through another company.
Colorado’s rule words it more broadly. It asks for fingerprints from every person with an ownership or control interest in a high risk provider (10 CCR 2505-10 section 8.125.12), a federal term that also covers a corporation’s officers and directors and every partner in a partnership (42 CFR 455.101). Ask the state who in your company must be fingerprinted.
Fingerprints are due within 30 days of the state’s or CMS’s request. If they do not arrive, the state must deny or end your enrollment, unless it documents why that is not in the program’s best interest (42 CFR 455.416). CMS lets states make high risk providers pay the cost of collecting fingerprints. If an owner already gave fingerprints for another enrollment and the state kept them, the state can run the new check from those prints, and may rely on the earlier results for up to 3 years.
Fingerprints for owners are separate from driver checks. Your broker contract and state rules set those. See NEMT driver background checks.
What moderate and high risk mean for your office
At moderate and high risk, the state visits before and after enrollment to confirm your application is accurate. If you refuse access, the state must deny or end your enrollment, unless it documents why that is not in the program’s best interest (42 CFR 455.416). For providers in remote areas, CMS allows a live video visit when distance or terrain makes a physical visit too hard, but photos do not count. Adding a location brings another visit, and Texas bars moderate and high risk providers from serving or billing at a new location until it is approved (TMPPM, September 2026). See the Medicaid site visit for NEMT.
The application fee
States collect a federal application fee from institutional providers at first enrollment and at revalidation. CMS sets the amount each calendar year. For applications filed from January 1 to December 31, 2026, the fee is $750 (90 FR 55738, December 3, 2025). CMS announces each new amount in the Federal Register, and the notices for 2024, 2025, and 2026 came out in November or December of the year before. CMS’s compendium names non-emergency transportation providers that bill fee-for-service Medicaid as institutional providers for this fee. You do not pay it again if you are enrolled in Medicare or another state’s Medicaid program, or already paid the fee to either (42 CFR 455.460).
Arizona, Indiana, North Carolina, and Ohio all charge it for their NEMT types in the sources above. Indiana does not charge family members or broker fleets.
How to prepare for your screening level
- Find your level in your state’s risk matrix or provider type profile.
- List every 5 percent owner, direct or indirect, and gather their identity documents.
- Plan for fingerprints at high risk, so each owner can finish within 30 days of the request.
- Get your office ready for a visit at moderate or high risk: signage, hours, records, and vehicles where your application says.
- Clear any overpayment before you file, so it does not raise you to high risk.
- Budget the fee. It is $750 for 2026 applications. Check the 2027 amount before you file next year.
For the full enrollment path, see how to become a Medicaid transportation provider.
Frequently asked questions
What risk level is a NEMT company for Medicaid?
It depends on the state, because NEMT is a Medicaid-only provider type and CMS lets each state choose. As of September 2026, Arizona and Colorado list NEMT companies as high risk, Minnesota calls NEMT a high-risk provider type, and North Carolina rates NEMT vans moderate. Indiana and Ohio rate some NEMT types high at first enrollment and moderate at revalidation. Check your state's risk matrix or provider profile.
Who has to give fingerprints at high risk?
Every person with a 5 percent or greater direct or indirect ownership interest in your company, or you yourself if you enroll as an individual. CMS says the 5 percent test applies to every kind of organization, including partnerships. Fingerprints are due within 30 days of the state's or CMS's request, and the state must deny or end your enrollment if they do not arrive, unless it documents why that is not in the program's best interest.
Can my Medicaid risk level change?
Yes. The state must move you from limited or moderate to high if it suspends your payments over a credible allegation of fraud, you have an unpaid Medicaid overpayment, or OIG or another state excluded you in the past 10 years and has since reinstated you. It can also go down. Indiana and Ohio screen some transportation types as high at first enrollment and moderate at revalidation.
Does a limited risk provider ever get a site visit?
Federal rules require site visits only at moderate and high risk. Every enrolled provider, at any level, must still allow unannounced inspections of any location by CMS, its contractors, or the state (42 CFR 455.432(b)). States may also add screening beyond the federal minimum (42 CFR 455.452), so check your state's rules and your broker contract.
My company is enrolled in Medicare as an ambulance supplier. Does Medicaid screen it again?
The state may rely on the screening Medicare already did (42 CFR 455.410(c)). Medicare rates ambulance suppliers moderate risk, and CMS says Medicaid cannot rate the same provider type lower. If your state rates it higher, the state must add the missing steps. A state that rates ambulance high must run the fingerprint check Medicare did not.