Paragon Health Institute Icon White

Re: CMS Request for Information (RFI) Related to Comprehensive Regulations to Uncover Suspicious Healthcare (CRUSH) RIN 0938-AV97

1AW THUMB Fraud RFI A0wUU000005GxKbYAK
Brian Blase
President at Paragon Health Institute

Brian Blase, Ph.D., is the President of Paragon Health Institute. Brian was Special Assistant to the President for Economic Policy at the White House’s National Economic Council (NEC) from 2017-2019, where he coordinated the development and execution of numerous health policies and advised the President, NEC director, and senior officials. After leaving the White House, Brian founded Blase Policy Strategies and served as its CEO.

3AW SMALLER 240409 STHQ DH01 0112
Senior Policy Analyst

Jackson Hammond is a Senior Policy Analyst at Paragon Health Institute. He has been active in the federal and state health policy space since 2017.

Prior to joining Paragon, Jackson was a health care policy analyst for American Action Forum (AAF). While at AAF, his work focused on payer issues including private insurance, Medicare, and Medicare Advantage. Furthermore, Jackson wrote extensively about the 340B Program and contributed to AAF’s research on a variety of drug pricing issues.

Niklas Kleinworth Headshot SMALLER V2
Director, State Health Reform Initiative; and Policy Analyst

Niklas Kleinworth is the Director of the State Health Reform Initiative and a Policy Analyst at the Paragon Health Institute, focusing on Medicaid and state policy initiatives. He has served in state and federal policy roles since 2021.

ELLE KALISZ HEADSHOT SMALLER 186A6472 V2
Program Manager

Gabrielle “Elle” Kalisz is the Program Manager at Paragon Health Institute. Gabrielle has worked in federal health policy for over five years, advancing free-market principles and partnerships.

Dear Administrator Oz,

Paragon Health Institute appreciates the opportunity to respond to the Centers for Medicare & Medicaid Services’ Request for Information (RFI): Comprehensive Regulations to Uncover Suspicious Healthcare (CMS-6098-NC). We commend CMS for prioritizing program integrity and welcome the opportunity to provide recommendations grounded in our research on structural drivers of fraud, waste, and abuse across federal health programs.

Paragon is a nonpartisan, nonprofit research organization dedicated to reforming government and empowering patients. Our research has extensively covered waste, fraud, and abuse across Medicare, Medicaid, and the Affordable Care Act (ACA) exchanges. The views expressed in this submission are those of Paragon Health Institute and are intended to inform CMS’s consideration of administrative and regulatory actions within its existing authority.

Fraud, waste, and abuse in government health programs are not simply the product of bad actors—they are the predictable consequence of structural policy design flaws. Medicaid’s open-ended federal matching creates powerful incentives for states to maximize spending, often at the expense of program integrity. The ACA’s subsidy design, along with lax verification standards, created significant vulnerabilities for improper enrollment. The most durable anti-fraud reforms are those that address these structural incentive problems at their root, not merely enforcement techniques applied to a fundamentally flawed system. Therefore, the recommendations included in this document are meant to broadly curb improper payments, which in turn would reduce fraud and preserve resources for the truly needy.

The One Big Beautiful Bill (OBBB), signed into law July 4, 2025 (P.L. 119-21), enacted the most substantial Medicaid and exchange program integrity reforms in decades. CMS also finalized the Marketplace Integrity and Affordability Final Rule in June 2025,1 although a federal district court stayed six of eight of the rule’s provisions in City of Columbus v. Kennedy, and the Fourth Circuit denied an emergency motion for a stay.2 Where our recommendations address areas already enacted under the OBBB, we focus on effective implementation and building further on the statutory foundation. Where a court stay applies, we urge CMS to vigorously defend those provisions in litigation while using all available administrative authority to act in the interim. Enacted OBBB provisions whose effective dates are still pending should be implemented as early as operationally feasible.

Medicaid Financing Integrity: IGTs, SDPs, Provider Taxes, and Payment Parity

Medicaid’s open-ended federal matching creates powerful incentives for states to maximize federal revenue through financing gimmicks that essentially function as legalized money laundering. These gimmicks involve provider taxes, intergovernmental transfers (IGTs), certified public expenditures, state-directed payments (SDPs), and supplemental payments. The OBBB took significant reform steps but left critical gaps, particularly on IGTs. The OBBB did not restrict states’ use of IGT-funded supplemental payments to public providers. Paragon’s December 2025 research brief, “The Local Loop: How States Turn Medicaid into a Government Provider Payday Scheme,” documents how the IGT mechanism is being manipulated by states to reward government providers and minimize state funding contributions.3 CMS should address this gap using available administrative authority.

  1. Deny State Plan Amendments with disparities between public and private provider payment rates as inconsistent with “efficiency, economy, and quality of care.”
  2. Replace ‘public funds’ in 42 CFR § 433.51 with ‘units of government’ to close the loophole allowing nonprofits and quasi-public entities to serve as conduits for IGT manipulation.
  3. Require states to publicly report all SDP and supplemental payment flows—source, amount, destination, and the amount of federal matching funds generated—in a standardized, machine-readable format.
  4. Clarify that tax-exempt entities are excluded from net patient revenue calculations for the 6 percent provider tax safe harbor, closing a loophole enabling effective above-safe-harbor taxation.
  5. Clarify that quality incentive payments are SDPs to close a potential technical classification loophole.

Medicaid Eligibility & Program Integrity

Paragon estimates Medicaid improper payment rates have exceeded $1.1 trillion over the last decade, doubling the officially reported number by CMS.4 Relative to the trend, hundreds of billions in Medicaid spending could be saved over the next decade by reducing improper payments in the program.

Medicaid expansion caused the improper payment rate to quadruple by discouraging states from properly determining applicant eligibility before placing them in the program.5 Permissive self-attestation, weak database cross-checks, and structural incentives reward states for maximizing enrollment over accuracy. CMS should build on the OBBB and close structural gaps that allow fraud and abuse.

Building on the One Big Beautiful Bill
  1. Eligibility redeterminations at least every six months for expansion adults (Sec. 71107, effective January 1, 2027): Ensuring full effectiveness of more frequent redeterminations requires prohibiting self-attestation for key enrollment criteria such as income, household size, and residency. States should be required to cross-check this information against federal databases.
  2. Immigration eligibility restrictions (Sec. 71109 and 71110, effective October 1, 2026): CMS should strictly enforce immigration restrictions. This means immediately disenrolling individuals who cannot be verified as eligible by the deadline. CMS should consider rulemaking to reduce the 90-day reasonable opportunity period and clarify that a state may only offer one opportunity period to an applicant.
  3. Good-faith waiver limits on 3 percent Payment Error Rate Measurement (PERM) disallowance (Sec. 71106, effective October 1, 2029): CMS should issue guidance now applying a strict interpretation of permissible waivers.
Federal & State Database Cross-Checks
  1. CMS should build on OBBB requirements by compelling regular cross-checks against relevant federal and state data sources. These include those covering Social Security, tax, immigration, and criminal databases.
  2. CMS should provide clear guidance on the use of reliable third-party data sources to verify eligibility, including income, residency, and eligibility status.
  3. CMS should provide states with direct real-time API access to the federal Do Not Pay (DNP) database so pre-payment holds are triggered automatically.
Self-Attestation, Presumptive Eligibility, and Other Gaps
  1. Reject self-attestation for household size, income, and residency. CMS should issue rules that reduce instances where an enrollee can remain eligible based on self-attested information.
  2. Prohibit self-attestation of immigration status as the basis for enrollment—require Department of Homeland Security (DHS) and Systematic Alien Verification for Entitlements (SAVE) cross-checks at the point of enrollment and subsequent redeterminations.
  3. Establish guardrails on entities’ use of presumptive eligibility if they persistently make errors in their determinations.
  4. Audit cases where HealthCare.gov refers applicants to Medicaid to verify eligibility and prevent duplicate enrollment.

Medicaid High-Risk Service Categories: HCBS, NEMT, ABA, & SUD

One of the main reasons for widespread health care fraud is that too many questionable providers can bill the program. One way to reduce improper billing would be to require annual recertification for providers in high-risk categories, with a biennial recertification requirement for all other Medicaid providers.

Home- and Community-Based Services (HCBS)

HCBS is among Medicaid’s most fraud-prone categories. Decentralized delivery, family caregiver self-direction, and weak documentation requirements create conditions for false claims, inflated hours, and phantom service delivery.6 States lack financial incentives to police this spending under both fee-for-service (FFS) and managed care. CMS should issue appropriate regulations and guidance to accomplish the following:

  1. Prohibit paying household members to provide HCBS or personal care.
  2. Vigorously enforce the 21st Century Cures Act’s electronic visit verification (EVV) requirement and mandatory Federal Medical Assistance Percentage (FMAP) reduction. Require that EVVs include cross-checks against billing claims. Any billing not reconcilable with EVV data should trigger an automatic pre-payment hold.
  3. Require states to share EVV data with the federal government in a uniform machine-readable file.
  4. Establish reasonable utilization management guardrails to prevent excessive or unsupported service volumes.
  5. Audit HCBS programs to determine whether they unlawfully incorporate room and board costs into HCBS rates and recover payments where this has occurred.
  6. Require in-person assessments for all HCBS service determinations and rescind pandemic-era virtual or telephone assessment flexibilities.
  7. Require regular and independent reassessment of care plans.
Non-Emergency Medical Transportation (NEMT)

NEMT fraud is well-documented and pervasive. The GAO found more than 200 criminal convictions and settlements against NEMT providers from 2015 to 2020.7 Low barriers to entry, minimal credentials, and open-ended federal matching make this category particularly exploitable. CMS should issue appropriate regulations and guidance to accomplish the following:

  1. Require robust trip verification mechanisms that ensure alignment between services billed and services delivered. Prohibit paying relatives or household members for NEMT.
  2. Limit duration and require reauthorization of standing ride approvals.
  3. Require disclosure of full corporate structure and ownership for all NEMT providers and brokers.
  4. Require fingerprinting and background checks for all NEMT providers.
  5. Prohibit non-medical transportation from 1115 demonstrations.
  6. Cap hours billable per beneficiary per day and per week.
Applied Behavior Analysis (ABA) / Autism Spectrum Disorder

ABA spending has increased 30-fold in some states since CMS’s 2014 Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) guidance. HHS Office of Inspector General (OIG) audits of Indiana and Wisconsin found $56M8 and $18.5M9  in improper payments, respectively. Neither audit examined managed care claims. Paragon’s research raises concerns about non-clinical incentives driving diagnosis rates.10 CMS should issue appropriate regulations and guidance to accomplish the following:

  1. Require independent diagnostic confirmation before ABA coverage is authorized.
  2. Prohibit financial incentives tied to diagnosis volume.
  3. Scale services to the severity of the disorder, such as tiered authorization criteria matching service intensity to clinical need, not a blanket entitlement.
  4. Require parental or caregiver participation as a condition of Early Intensive Developmental and Behavioral Intervention (EIDBI) and ABA authorization.
  5. Require fingerprinting and background checks for all ABA providers regardless of licensing level.
  6. Require documentation standards that allow verification of services billed against services delivered.
  7. Issue guidance and utilization management parameters for services exceeding 20 hours per week, restrictions on telehealth, and out-of-state providers.
Substance Use Disorder (SUD) Services

SUD services are financed through overlapping federal streams (Medicaid, Substance Abuse and Mental Health Services Administration (SAMHSA), Health Resources and Services Administration (HRSA)) with inconsistent oversight. OIG found in 2020 that 67 of 100 sampled health centers did not use HRSA grants in accordance with federal requirements.11 The Arizona sober living fraud resulted in at least 40 deaths12 and $2.5B in estimated losses.13 CMS should issue appropriate regulations and guidance to accomplish the following:

  1. Require auditable documentation of all SUD services delivered under 1115 waiver programs.
  2. Conduct post-award audits of HRSA grant compliance.
  3. Require explicit program integrity conditions—such as documentation standards, utilization review, outcome reporting—in all SUD 1115 demonstrations.
  4. Target SUD grantmaking to programs with demonstrated outcomes rather than open-ended provider access.

Medicaid Managed Care: Transparency, Reporting, and Managed Care Organization (MCO) Accountability

Medicaid managed care now covers approximately three-quarters of enrollees, yet oversight, financial transparency, and data quality remain chronically weak. Nearly half of MCO medical loss ratio filings are incomplete, and the absence of encounter-level data makes it impossible to evaluate actual service delivery or identify fraud within managed care arrangements.

GAO has repeatedly found gaps in CMS oversight of Medicaid MCOs, including incomplete encounter data and inadequate medical loss ratio (MLR) verification.14 Separately, GAO’s 2022 NEMT report found significant state oversight gaps.15 As of July 2024, 42 states are enrolled in Medicaid Managed Care programs,16 highlighting a clear need for enhanced oversight to prevent waste, fraud, and abuse. CMS should issue appropriate regulations and guidance to accomplish the following:

Require States to Report to CMS:
  1. Encounter-level data for all Medicaid managed care spending (not capitation summaries) to enable genuine audits of service delivery.
  2. Medical loss ratios and administrative expenses by MCO, verified through independent audited financial statements.
  3. Zero-claim enrollees by plan and eligibility group as a critical indicator of phantom and improper enrollment.
  4. All related-party relationships and transactions involving MCOs, their subcontractors, and network providers.
  5. SDP amounts disaggregated by provider and MCO.

Relatedly, MCOs should publicly report their internal, independently audited payment error rate determinations to CMS and states.

Implement Transparency Requirements:
  1. Create public dashboards showing Medicaid spending by provider and service category, updated annually, disaggregated by state and plan.
  2. Aggregate and publish Medicaid Fraud Control Unit (MFCU) annual reports, including case outcomes, amounts recovered, and high-risk categories.
  3. Publish Managed Care Program Annual Reports (MCPAR) from every state in a machine-readable format.
  4. Release data of MCO payments in an open-source format.
Institute MCO Structural Integrity Requirements:
  1. Prohibit MCOs from, directly or indirectly, paying providers and subcontractors that are related parties higher rates, under more favorable payment or utilization management methods, or other preferences than applicable to non-related providers and contractors
  2. Prohibit MCO actuarial rates from being certified by actuaries who also contract with the MCO, a related entity, or the MCO’s parent organization, since it is a clear conflict of interest.
  3. Prohibit MCO actuarial rates from exceeding a rate set by an independent actuary not affiliated with the plan.
PERM Reform

The PERM program is the primary federal tool for measuring Medicaid improper payments, but its current methodology significantly understates the true scale of the problem. PERM currently focuses primarily on FFS claims, while most Medicaid enrollees are served through MCOs. It uses a rotating state review schedule that leaves many states unaudited for years. Its sampling techniques miss cases among low-volume services. CMS should:

  1. Expand PERM to include managed care claims for covered services by requiring encounter-level data reporting from all MCOs. Without this, CMS is measuring a shrinking share of total Medicaid spending.
  2. Conduct full eligibility reviews, not only claims reviews, in every PERM cycle.
  3. Audit inpatient and outpatient services separately from other services.

Additional Medicaid Program Integrity Tools

Several program integrity recommendations apply across Medicaid, Medicare, and the exchanges and are addressed here rather than repeated in each program section.

Provider Enrollment and Screening

Bad actors routinely exploit gaps in provider enrollment screening to enter programs, commit fraud, and migrate to new programs when caught. CMS should establish and enforce a consistent set of enrollment integrity standards:

  1. Require ownership disclosure for all Medicaid providers and subcontractors, including MCO subcontractors, so that bad actors cannot obscure their identities through corporate structures.
  2. Require enhanced screening, including mandatory fingerprinting and background checks for personal care, HCBS, NEMT, and behavioral health providers.
  3. Require periodic on-site verification that provider entities—vehicles, equipment, facilities—actually exist and are actively used for the services being billed.
  4. Conduct randomized provider audits annually across all high-risk service categories, not only when specific fraud indicators have been identified.
  5. Establish a national fraud alert system for rapid cross-state sharing when a provider is identified as fraudulent in one state but may be operating in others.
  6. Permit states to immediately suspend provider enrollment on credible fraud evidence without waiting for full adjudication.
Analytics, Anomaly Detection, and Pre-Payment Review

The current pay-and-chase model is structurally inadequate for modern health care fraud. Sophisticated actors structure fraudulent operations to exploit the lag between billing and recovery, often disbanding before any recovery action can succeed. CMS should prioritize a structural shift toward pre-payment review:

  1. Require pre-payment review for HCBS, NEMT, ABA, and SUD services—as well as any other category with the highest documented fraud risk and the weakest current verification.
  2. Integrate the federal DNP database into standard claims adjudication as a mandatory step, not an optional tool, with automatic pre-payment holds triggered by credible fraud indicators.
  3. Leverage anomaly detection to flag providers with billing patterns significantly above peers in high-risk categories.
Enforcement Infrastructure
  1. Establish robust whistleblower protections for Medicaid fraud reporting, including clear anti-retaliation safeguards and financial incentives.
  2. Require annual program integrity reports to legislatures and the public, disaggregated by service category, provider type, and state.
  3. Expand MFCU authority to include MCO-related fraud investigation.
  4. Establish standing referral protocols to the FTC, DOJ, and state DOIs for deceptive marketing and identity theft cases in the exchange context.

Medicare Program Integrity

Medicare Advantage has been able to innovate in the payment and delivery of services by reducing excessive utilization of lower-value services and by offering supplemental benefits and cost-sharing reductions, improving upon Medicare’s original design for many enrollees. MA has improved patient choice for enrollees and represents an important improvement for health care delivery within federal health programs. This is because capitation and competition align plan incentives with cost control and quality.

The RFI questions in this section on payment suspensions, provider and supplier enrollment requirements, and DMEPOS accreditation are framed from an FFS Medicare perspective that implicitly treats MA plans as passive contractors of government directives rather than as actors with their own incentives to prevent fraud. Layering FFS-style regulatory infrastructure onto MA undermines the logic and plan flexibility that has created many positive results in MA. Every incremental step to add requirements onto MA creates a new regulatory surface area that is an opportunity for ever more FFS-style requirements and micromanagement in the future, drifting MA plans towards being more like Medicare Administrative Contractors.

Payment Suspension Authority

We recommend against establishing any requirements that MA plans implement payment suspensions when directed by CMS. The better approach is to modify the regulations around clean claims and payment of non-contracted providers and suppliers so that MA organizations have clear regulatory authority to suspend payments to out-of-network providers and suppliers when credible evidence of fraud exists. CMS should complement this by sharing fraud intelligence and data with MA organizations in real time, enabling plans to act on their own authority.

Preclusion List

The preclusion list is a tool that CMS should maintain to both improve program integrity in FFS and eliminate any need to impose ill-advised enrollment requirements on dentists or others operating largely outside of Medicare and thereby force additional costs on them from government rules and regulations. Medicare Advantage plans support the FFS program by not paying providers and suppliers on the preclusion list and by sharing information in collaborations like the Healthcare Fraud Prevention Partnership.

FFS Enrollment Requirement

Paragon has concerns with a blanket requirement for all providers and suppliers who bill MA to enroll in FFS. The capitation model already creates strong financial incentives for MA plans to screen providers and suppliers rigorously; mandating that they use the FFS enrollment infrastructure and timelines and processes specifically would add bureaucratic burden without improving results. All of this would be especially problematic for dentists and others who typically do not participate in traditional Medicare, as demonstrated by past attempts at this before the development of the preclusion list, and, separately, would be especially worrisome with respect to mental health practitioners, given current access issues.

DMEPOS in MA

We share CMS’s concern regarding DMEPOS suppliers who are bad actors. The solution is not to force the inefficiencies, timelines, and processes of FFS enrollment onto the MA program. Instead, CMS should make clear that MA plans can refuse to pay claims from non-contracted DMEPOS suppliers who are also not enrolled in FFS. This ensures that MA plans can deny payment to the suppliers, addressing this concern while also ensuring MA plans can contract with suppliers who are offering DMEPOS items and services in new and creative ways or who are focused entirely on serving MA enrollees.

Medicare Claims Filing Deadline

We support reducing the current one-year claim filing deadline for high-risk items and services. The one-year deadline creates an unnecessarily extended window during which fraudulent claims can be submitted with documentation fabricated or adjusted to fit the billing period. Reducing the deadline to 90 to 180 days for high-risk services—consistent with private payer norms—would materially reduce this window. We recommend that CMS:

  1. Apply shortened deadlines first to all high-risk providers and supplier types: DMEPOS suppliers, NEMT providers, home health agencies, and SUD treatment centers.
  2. Apply the shortened deadline to all claims filed by providers designated as high-risk based on prior fraud findings, audit results, or anomalous billing patterns.
  3. A uniform 90 to 180-day standard across all claims would reduce administrative complexity by establishing a single standard rather than a tiered system—the simplification benefits may outweigh the modest additional burden on low-risk providers.
  4. Use flexibility for genuine hardship exceptions without broadly undermining the integrity benefit of shorter deadlines.

ACA Exchange Enrollment Fraud & Program Integrity

We estimate that in 2025, there were 6.4 million improperly enrolled people in fully subsidized ACA plans at a cost exceeding $27 billion.17 In 2024, nearly 12 million exchange enrollees—35 percent of all enrollees—never used their plan a single time.18 Zero-claim enrollees are more than double the rate seen before the COVID-era subsidy expansion.

The causes of ACA exchange fraud are structural: Congress passed legislation creating widespread availability of zero-dollar plans, further perpetuated by distortions from silver-loading; the Biden administration eliminated income verification safeguards; and the Enhanced Direct Enrollment (EDE) infrastructure created a permissive enrollment environment that unscrupulous brokers and organized criminal operations have systematically exploited. The OBBB and the June 2025 Marketplace Integrity Rule took meaningful corrective steps, but several key provisions were stayed by the federal district court in City of Columbus v. Kennedy (Fourth Circuit denied emergency relief), and others are not effective until 2028. CMS should act within its existing authority to close the gap.

Income Verification and Eligibility Determination

CMS should require documentation for key eligibility criteria rather than accepting self-attestation. This is the core structural failure that enabled the explosion of fraudulent exchange enrollment:

  1. Income verification: The OBBB enacted pre-enrollment verification of income and eligibility (effective January 1, 2028). The Marketplace Integrity Rule also included income verification requirements, but the court stayed the pre-enrollment documentation for special enrollment periods (SEPs) provision. CMS should use all available administrative authority to require income documentation before 2028.
  2. Require Employer Identification Number (EIN) verification on all pay stubs submitted as income documentation, immediately and within existing authority, closing online paystub generation loopholes that allow fabricated documentation.
  3. Conduct real-time IRS data cross-checks for all applications claiming income below 150 percent of the federal poverty level (FPL). Annual reconciliation is insufficient because it allows improper subsidies to accumulate for a full year before any correction.
  4. Require documentation from all enrollees with unreconciled prior year advance premium tax credits (APTCs) before new subsidies are authorized. The court stay and OBBB’s 2028 date create a gap; CMS should close it administratively now, treating unreconciled prior-year APTC as a threshold program integrity concern.
  5. Require documentation and verification for 100 percent of enrollments through a SEP.
Broker, Agent, and Web-Broker Oversight

Unscrupulous enrollment intermediaries have been a central driver of exchange enrollment fraud. Intermediaries can currently enroll people with only their name, date of birth, and address—often without the enrollee’s knowledge or consent. They earn per-enrollee commissions of $15-$30 per month plus enrollment volume bonuses, with some as high as $150 per new enrollment in OEP, creating powerful incentives to maximize enrollment volume regardless of eligibility.19

There are significant vulnerabilities with expanding Enhanced Direct Enrollment (EDE) entities. Documented exchange fraud is overwhelmingly concentrated in HealthCare.gov states, where EDE dominates enrollment. We estimate 6.4 million improper exchange enrollees nationally, with the vast majority in HealthCare.gov states.20 A GAO investigation confirmed that the federal exchange approved subsidized coverage for 23 of 24 fictitious applications submitted.21 The exchange’s back-end authority fails to prevent these abuses, and vulnerabilities continue to allow improper enrollment.22 CMS should:

  1. Eliminate or establish enhanced oversight into proxy licensing arrangements (NPN override) through which brokers use other licensed agents’ contracted credentials to conduct and submit enrollments, making individual accountability for fraudulent enrollments impossible. CMS should improve oversight of downstream enrollment processes to ensure adequate policing of fraud and unscrupulous activities.
  2. Require independent enrollee consent verification for any enrollment or plan change—for example, a confirmation code sent to the enrollee directly, separate from the broker’s platform, before the enrollment is finalized. CMS should pursue multifactor or two-factor authentication at the enrollee’s end for all changes made to an application or plan.
  3. Require intermediaries to disclose their commission structures to enrollees at the time of enrollment. Impose civil monetary penalties on brokers who fraudulently enroll consumers or switch plans without consent. Require lead generators to be licensed and subject to the same compliance standards as all other intermediaries; the current gap that allows lead generators to operate without accountability has been a significant source of fraud.
  4. Require all EDEs to report the IP addresses and location of all data stored relating to enrollment and conduct frequent and aggressive oversight to prevent additional sensitive personal information from being held overseas.
  5. Require collection and reporting of key application-level EDE data sufficient to identify anomalous or potentially fraudulent enrollment activity. Flag any application completed in an implausibly short timeframe for a mandatory pre-enrollment hold. Conduct random quarterly audits of this data.
  6. Require safeguards to detect and flag anomalous access patterns, including inconsistencies in location and unusually high application volumes. Confirmed VPN use during a three-way call should be treated as presumptive evidence of fraudulent enrollment, absent a compelling documented explanation.
  7. Remove all broker access to enrollee Social Security Numbers after application submission. No legitimate post-submission purpose exists; this access has been exploited for identity theft by brokers engaged in mass unauthorized enrollment.
  8. Partner with the Federal Trade Commission (FTC) for cross-agency enforcement of deceptive marketing practices and unauthorized enrollment schemes—establish a standing referral protocol for CMS complaints to the FTC and state departments of insurance (DOIs).

Conclusion

Paragon’s research consistently demonstrates that fraud, waste, and abuse in government health programs are not isolated failures—they are the predictable consequences of structural design flaws in program financing and oversight.

We appreciate CMS’s leadership in advancing the CRUSH Fraud Initiative and its focus on strengthening program integrity across federal health programs. The recommendations in this submission are intended to support CMS in identifying durable, administratively feasible approaches to reducing improper payments and addressing the structural incentives that enable fraud.

We would welcome the opportunity to engage further with CMS on these issues and to provide additional analysis or technical assistance as the agency considers next steps.

Thank you for considering our views.

Footnotes

1 Centers for Medicare & Medicaid Services, "Patient Protection and Affordable Care Act; Marketplace Integrity and Affordability," 90 Fed. Reg. 27074, June 25, 2025, https://www.govinfo.gov/app/details/FR-2025-06-25/2025-11606
2 See City of Columbus v. Kennedy, No. 1:25-cv-02114-BAH (D. Md. Aug. 22, 2025) (granting in part a stay of challenged rule provisions), stay pending appeal denied, No. 25-2012 (4th Cir. Sept. 18, 2025).
3 Chris Medrano, Brian Blase, and Kip Piper, "The Local Loop: How States Turn Medicaid into a Government Provider Payday Scheme," Paragon Health Institute, December 15, 2025, https://paragoninstitute.org/medicaid/the-local-loop-how-states-turn-medicaid-into-a-government-provider-payday-scheme/
4 Brian Blase and Rachel Greszler, "Medicaid's True Improper Payments Likely Double Those Reported by CMS," Paragon Health Institute, March 3, 2025, https://paragoninstitute.org/medicaid/medicaids-true-improper-payments-likely-double-those-reported-by-cms/
5 Centers for Medicare & Medicaid Services, "Protecting Medicaid Beneficiaries Against Impermissible Fraud and Abuse Sanctions," State Medicaid Director Letter #24-005, December 5, 2024, https://www.medicaid.gov/federal-policy-guidance/downloads/smd24005.pdf
6 Chris Medrano and Christopher Pope, "Beyond Minnesota: Four Medicaid Services Vulnerable to Fraud and the Case for Stronger CMS Enforcement," Paragon Health Institute, February 17, 2026, https://paragoninstitute.org/medicaid/beyond-minnesota-four-medicaid-services-vulnerable-to-fraud-and-the-case-for-stronger-cms-enforcement/
7 U.S. Government Accountability Office, "Medicaid: Efforts to Address Fraud in Nonemergency Medical Transportation," GAO-22-105447, September 28, 2022, https://www.gao.gov/products/gao-22-105447
8 Office of Inspector General, U.S. Department of Health and Human Services, "Indiana Made at Least $56 Million in Improper Fee-for-Service Medicaid Payments for Applied Behavior Analysis Provided to Children Diagnosed With Autism," A-09-22-02002, December 16, 2024, https://oig.hhs.gov/reports/all/2024/indiana-made-at-least-56-million-in-improper-fee-for-service-medicaid-payments-for-applied-behavior-analysis-provided-to-children-diagnosed-with-autism/
9 Office of Inspector General, U.S. Department of Health and Human Services, "Wisconsin Made at Least $18.5 Million in Improper Fee-For-Service Medicaid Payments for Applied Behavior Analysis Provided to Children Diagnosed With Autism," A-06-23-01002, July 10, 2025, https://oig.hhs.gov/reports/all/2025/wisconsin-made-at-least-185-million-in-improper-fee-for-service-medicaid-payments-for-applied-behavior-analysis-provided-to-children-diagnosed-with-autism/
10 Chris Medrano and Brian Blase, "Beyond Minnesota: Four Medicaid Services Vulnerable to Fraud and the Case for Stronger CMS Enforcement," Paragon Health Institute, February 17, 2026, https://paragoninstitute.org/medicaid/beyond-minnesota-four-medicaid-services-vulnerable-to-fraud-and-the-case-for-stronger-cms-enforcement/
11 Office of Inspector General, U.S. Department of Health and Human Services, "In Selected States, 67 of 100 Health Centers Did Not Use Their HRSA Access Increases in Mental Health and Substance Abuse Services Grant Funding in Accordance With Federal Requirements," A-02-19-02001, November 13, 2020, https://oig.hhs.gov/reports/all/2020/in-selected-states-67-of-100-health-centers-did-not-use-their-hrsa-access-increases-in-mental-health-and-substance-abuse-services-grant-funding-in-accordance-with-federal-requirements/
12 Mary Hudetz and Hannah Bassett, "Dozens of People Died in Arizona Sober Living Homes as State Officials Fumbled Medicaid Fraud Response," ProPublica and Arizona Center for Investigative Reporting, January 27, 2025, https://www.propublica.org/article/arizona-sober-homes-deaths-medicaid-fraud
13 Jasmine Demers, "Arizona Has Recovered Just 5% of Taxpayer Dollars Lost in a $2.5 Billion Medicaid Fraud Scheme," ProPublica and Arizona Center for Investigative Reporting, May 6, 2025, https://www.propublica.org/article/arizona-medicaid-fraud-investigation-taxpayer-funds
14 U.S. Government Accountability Office, "Medicaid Managed Care: CMS Should Improve Oversight of Access and Quality in Demonstrations," GAO-19-10, October 2018,� https://www.gao.gov/products/gao-19-10
15 U.S. Government Accountability Office, "Medicaid: Efforts to Address Fraud in Nonemergency Medical Transportation," GAO-22-105447, September 28, 2022, https://www.gao.gov/products/gao-22-105447
16 KFF, "Medicaid MCO Enrollment by Plan and Parent Firm, 2024," KFF State Health Facts, accessed March 30, 2026, https://www.kff.org/medicaid/state-indicator/medicaid-enrollment-by-mco/
17 Brian Blase, Chris Medrano, Niklas Kleinworth, and Jackson Hammond, "The Greater Obamacare Enrollment Fraud: The Fraud Got Much Worse in 2025," Paragon Health Institute, June 2025, health/the-greater-obamacare-enrollment-fraud/ https://paragoninstitute.org/private
18 Brian Blase, "Explaining the Rise of Phantom ACA Patients," Paragon Health Institute, August 25, 2025, https://paragoninstitute.org/private-health/explaining-the-rise-of-phantom-aca-patients/
19 Gabrielle Kalisz and Brian Blase, "Unpacking The Great Obamacare Enrollment Fraud: How the Exchanges Became the Wild West," Paragon Health Institute, August 7, 2024, great-obamacare-enrollment-fraud/ https://paragoninstitute.org/private-health/unpacking-the
20 Brian Blase, Chris Medrano, Niklas Kleinworth, and Jackson Hammond, "The Greater Obamacare Enrollment Fraud: The Fraud Got Much Worse in 2025," Paragon Health Institute, June 2025, health/the-greater-obamacare-enrollment-fraud/ https://paragoninstitute.org/private
21 U.S. Government Accountability Office, Patient Protection and Affordable Care Act: Preliminary Results from Ongoing Review Suggest Fraud Risks in the Advance Premium Tax Credit Persist, GAO-26-108742, December 3, 2025, https://www.gao.gov/products/gao-26-108742
22 Brian Blase, "Testimony of Brian Blase before the House Committee on the Judiciary?'Fighting Obamacare Subsidy Fraud: Is the Administrative Procedure Act Working as Intended?,'" Paragon Health Institute, December 10, 2025, fighting-obamacare-subsidy-fraud-is-the-administrative-procedure-act-working-as-intended/ https://paragoninstitute.org/private-health/testimony-of-brian-blase-before-the-house-committee-on-the-judiciary

Related Content

Subscribe

Sign up now for your health policy updates.

This field is for validation purposes and should be left unchanged.
Name(Required)