Medicaid Provider Revalidation: A Critical Moment for Program Integrity 

Medicaid is built on a shared federal-state commitment to stewardship, ensuring that public funds support legitimate providers delivering care to those who depend on the program. Last week, the Centers for Medicare & Medicaid Services (CMS) issued a federal directive to every state Medicaid agency: provider revalidation must become more rigorous, more frequent, and more defensible, and it must start now.   

Through an April 23, 2026, State Medicaid Director (SMD) letter, CMS is requiring states to develop and execute a comprehensive two‑year Provider Revalidation (PR) Strategy, with immediate action focused on providers deemed high risk. CMS has tied these expectations directly to its oversight authority under Title XIX of the Social Security Act and implementing regulations, signaling a clear shift in how provider oversight will be evaluated going forward. 

Why CMS Is Raising the Bar 

CMS makes clear that revalidation is foundational to Medicaid program integrity. While the vast majority of Medicaid providers are legitimate and committed to serving beneficiaries, bad actors can exploit gaps in enrollment and oversight processes. Strengthening protections against fraud, waste, and abuse helps ensure Medicaid programs can continue providing care to our most vulnerable populations. 

Ensuring that provider enrollment data is accurate, current, and consistently verified supports: 

• Effective fraud, waste, and abuse prevention 
• Credible oversight of provider participation 
• Reliable provider directories used by beneficiaries and managed care plans 

In CMS’ framing, inaccurate or outdated provider data undermines not just compliance, but the public’s trust in Medicaid itself. 

What States Are Now Required to Do 

This initiative is no longer conceptual. CMS has established specific actions and timelines that every state must meet: 

Immediate revalidation of high-risk providers. States must notify CMS within 10 days of receipt of the SMD letter of their plans to conduct a swift revalidation of provider types designated as “high risk” under federal regulations, including consideration of off‑cycle or more frequent revalidation intervals beyond the minimum five‑year requirement.  

Submission of two‑year Provider Revalidation strategy. Within 30 days, states must submit a comprehensive PR strategy describing: 

• Their methodology and timeline for revalidation, including off cycle reviews 
• How provider enrollment information is verified and kept accurate on an ongoing basis 
• How consistency and accuracy are maintained across fee‑for‑service and managed care delivery systems 
• Oversight of managed care plan provider directories 
• Metrics used to measure effectiveness and progress 
• Coordination with law enforcement and program integrity partners 
• How providers without a National Provider Identifier (NPI) are assessed, which CMS explicitly calls out as an expectation  

Submission of Medicaid Director strategy. CMS also requires that the strategy be submitted by the Medicaid Director, not a designee, underscoring the executive level importance of this effort.  

The Scale Challenge States Now Face 

Even before this directive, many states were already balancing enrollment workloads with staffing constraints and legacy processes. CMS’ requirements fundamentally change the scale of the challenge. 

Provider revalidation can no longer be treated as a periodic project. States must now be able to demonstrate:

• Ongoing verification, not just point‑in‑time checks 
• The ability to reprioritize providers based on risk 
• Documentation and evidence that can withstand federal audit and review 

Manual, labor-intensive approaches struggle under this level of volume and scrutiny. As revalidation activity increases, inconsistent processes or incomplete documentation quickly become visible—especially during CMS audits. 

Program Integrity Is About Network Credibility, Not Just Enforcement

While fraud prevention is a key driver, CMS emphasizes that revalidation alone is not sufficient to detect all fraud schemes. Instead, it is one component of a broader integrity framework designed to ensure that only qualified, eligible providers are participating in Medicaid.  

Strong revalidation practices also help states: 

• Reduce gaps between “reported” and “actual” provider availability 
• Improve accuracy of managed care directories relied upon by beneficiaries 
• Identify providers who no longer meet enrollment criteria before issues escalate 
• Defend federal matching funds through demonstrable oversight 

In this context, revalidation supports both fiscal accountability and beneficiary access—two pillars of Medicaid’s mission. 

From Episodic Revalidation to Continuous Oversight 

CMS is signaling a clear transition away from episodic revalidation cycles toward continuous accuracy and monitoring. States are expected to reduce latency between a provider’s status change and the state’s ability to detect and act on it. 

This approach aligns Medicaid with modern risk management practices, where oversight is ongoing, data driven, and prioritized by risk rather than timing alone. 

A Defining Moment for Medicaid Stewardship 

The April 2026 CMS directive marks a turning point. Provider revalidation is no longer simply an enrollment requirement—it is a litmus test for how states approach stewardship, accountability, and trust. 

States that use this moment to strengthen revalidation as a system level capability will be better positioned to:

• Demonstrate compliance with federal expectations 
• Improve provider network credibility 
• Protect beneficiaries and public funds 
• Respond confidently to audits and oversight 

In an environment of heightened scrutiny and complexity, provider revalidation has become one of the most concrete expressions of Medicaid program integrity. How states respond now will shape not only compliance outcomes, but the long-term resilience of their Medicaid programs.