For as long as most people in Medicaid have been working, federal oversight ran on a quiet assumption: the money moves, and if questions come, they come later, politely, with time to answer. That assumption did not survive the first half of 2026. It was dismantled in five months, in public, one announcement at a time. Put the announcements side by side and they stop looking like separate news stories. They look like a sequence.
February 25. CMS defers federal Medicaid funds to Minnesota, and does something no deferral has done before: it denies funding for entire service areas at once. Deferrals used to be scalpels, applied to specific questioned expenditures. This one was a different instrument, and it was announced not in a routine notice but from the White House.
May 13. Two things happen on the same day, from the same podium. CMS defers $1.34 billion from California, eleven separate deferrals against a single quarter of expenditures, the largest deferral in the agency’s history. And HHS-OIG sends a letter to every state attorney general in the country announcing a robust review of every Medicaid Fraud Control Unit before its next recertification. One day. Two fronts. The money side and the enforcement side, opened together.
June 4. Hawaii’s Medicaid Fraud Control Unit is decertified, the first decertification in the program’s history, and its federal funding is discontinued. Recertification had been a formality for four decades. A formality cannot be failed. As of June 4, it can be.
June 30. New York’s unit, 270 people, with federal grant funding covering three quarters of its budget, is denied recertification. Eight more states are recertified only conditionally. In seven weeks, the robust review promised in the May letter has produced two defunded units and eight on notice.
July 21. CMS pauses more than a billion dollars in a single announcement: roughly $867 million to California and $199 million to Minnesota, citing suspected fraud and noncompliance. It is Minnesota’s third action of the year. The CMS Administrator says more announcements involving other states are coming, and describes the new posture in one sentence: the agency is done chasing stolen and misused funds after they have already left the building.
Read the five events as a unit and the real story is not that enforcement got stricter. Stricter enforcement would mean more questions, harder audits, deeper reviews. What happened instead is structural. The sequence used to be: questions, then consequences. It is now consequences, then questions. Funds are held first. Documentation is demanded second. The record is read by reviewers looking for reasons to hold, not reasons to release. And the clock, which used to run in a state’s favor while answers were negotiated, now runs against it, in dollars per week.
Here is the detail that should reorganize how every program in the country thinks about this, and it is hiding in plain sight in the Minnesota story. Minnesota was not passive. The state had disenrolled providers on suspicion of fraud. Its own legislative auditor had flagged the high-risk service areas. That enforcement did not protect the funding. It supplied the targeting map: the flagged areas became the reviewed areas, and the large majority of the paused dollars involved claims from providers the state itself had already thrown out. The states hit hardest this year were not the ones doing the least. They were doing the work. What they could not do, fast enough, on a hostile reviewer’s timeline, was prove it from the written record alone.
That is the lesson of the five months, and it is uncomfortable precisely because it is not about effort. Enforcement activity and a defensible record have become separate things. One finds the problems. Only the other keeps the money. Every program, in every state, is now operating under a burden of proof that has changed sides, whether its name has been in an announcement yet or not.
The full argument, including what a defensible posture actually requires, is in our brief, After the Deferral: What a Defensible Medicaid Program Integrity Posture Looks Like. Request it here.
Leave a Reply