Where can you prevent the next unsupported payment?

Which recurring error can your agency intercept before the next unsupported payment? That is the operating question behind prepayment control. Start with one identifiable defect, assign someone to resolve it, preserve the evidence, and test whether the correction prevents recurrence while protecting legitimate care.

Retrospective audits and recovery remain necessary. Ohio and Florida illustrate ways to move intervention earlier: Ohio through statutory requirements for provider oversight, and Florida through screening, analytics, revalidation, and enforcement. Their evidence is different—one describes operating duties; the other reports activity and projected financial effects. [1, 2]

Ohio: turn preventive controls into operating duties

Ohio Senate Bill 315, effective October 6, 2026, establishes Medicaid program-integrity requirements covering provider enrollment, revalidation, site inspections, ownership disclosure, electronic visit verification (EVV), and monitoring. Implementation requires agency rules, technical work, and operational follow-through. Enactment alone does not demonstrate effectiveness. [1, 3]

The practical inventory is concrete: in-person reviews or site inspections for initial home- and community-based services provider enrollment; subsequent inspections every three years; disclosure and verification of owners with at least a 5% interest; a public EVV performance dashboard; and claim-validation rules with exceptions, remediation, and provider safeguards. Provider agreements also have a maximum three-year term and a revalidation requirement. [3–6]

For a state leader, the assignment is to connect each requirement to an owner, an authoritative data source, a decision record, and a test of performance. An EVV mismatch or ownership anomaly should trigger proportionate review and a documented disposition. It is not, by itself, proof of fraud.

Florida: distinguish activity from demonstrated outcomes

Florida’s Agency for Health Care Administration launched its initiative in June 2026. Its October 6 update reported more than 400 provider site visits since January, more than 150 referrals to the Attorney General over the preceding year, more than 260 providers placed on payment restrictions or suspensions, and more than 220 terminated providers whose 2025 Medicaid billing exceeded $230 million. These are distinct measures of activity and historical billing; they do not establish an equivalent amount of fraud, prevented payments, or net savings. [2, 7]

Florida also reduced projected annual applied behavior analysis spending for fiscal year 2026–27 from $3.86 billion to $2.88 billion—approximately $980 million. The state attributed the revision to managed-care transition, utilization management, and program-integrity efforts. The announcement does not isolate the contribution of each or demonstrate $980 million in fraud recovery. [2]

The management lesson is to trace an intervention from its trigger through provider response, payment treatment, and subsequent results. Florida’s January 2026 legislative oversight review provides additional context on AHCA’s program-integrity and managed-care oversight responsibilities. [8]

CMS: a distinct example of federal Marketplace matching

On October 14, 2026, CMS reported identifying approximately 189,000 subsidized federal Marketplace enrollees with overlapping Medicare, Medicaid, or CHIP coverage, or deceased-person matches. It projected approximately $1.5 billion in savings over the following year. These are projected Marketplace subsidy savings, not measured Medicaid savings or PERM eligibility results. [9]

The matching process includes notice and 30 days to dispute apparent overlapping coverage or a deceased-person record, with an appeal pathway described for duplicate-coverage determinations. The transferable lesson is the sequence: identify a discrepancy, allow correction of erroneous records, validate the finding, and take lawful action before additional unsupported payments accumulate. [9, 10]

What the control must prove

A useful control distinguishes credible risk from ordinary variation while maintaining access to necessary care. Retain the source data, applicable rule version, review trigger, exception decision, and payment disposition. Measure false positives, time to resolution, appeals and reversals, independently verified payment effects, staff effort, and effects on providers and members. Where an MCO or vendor operates the control, the state still needs evidence it can review. A further capacity test is whether controls remain timely and accurate as workload grows, without increasing erroneous denials or disrupting legitimate care.

Ohio, Florida, and the federal Marketplace example do not establish a comparable ranking of effectiveness. They offer operating designs and evidence questions that states can apply to their own controls.

California: a current federal test of payment defensibility

An October 20 CMS letter supplies a timely counterpoint. CMS deferred approximately $1.262 billion in federal Medicaid funding claimed by California for the quarter ended June 30, 2026, pending documentation or downward adjustments. The largest item—$1.086 billion—concerned Community First Choice and personal-care services. Separate repeat deferrals identified $20.95 million in claims reported at the enhanced expansion matching rate for people outside the qualifying age range, $24,048 in fee-for-service eligibility-date mismatches, and $258,682 in managed-care eligibility-month mismatches. These are different problems, not a single PERM eligibility finding. [11]

A deferral is not a final disallowance. CMS requested supporting records or adjustments and gave California 60 days from receipt to respond, with a possible written extension. The operational lesson is nevertheless immediate: an effective control must connect the eligibility span, service date or capitation month, claim, federal matching rate, CMS-64 reporting line, and supporting record before the exposure accumulates. A state should be able to demonstrate not only that it investigates questionable payments, but that its controls reliably prevent or correct unsupported federal claims—and preserve the evidence of that correction. [11]

The PERM connection

Provider screening and service-documentation controls do not directly measure Medicaid eligibility accuracy or prove that H.R. 1 eligibility disallowance exposure has been reduced. The relevant connection is earlier correction supported by a durable decision record and independent verification. For eligibility operations, that means testing whether a valid correction remains effective at subsequent decisions and payments while protecting eligible members.

That is the educational ambition behind 97 or Better™—Before 2029: earlier correction, durable evidence, and verified accuracy. An alert initiates review; it does not establish an error or justify an automatic loss of coverage.

Prepayment Integrity Control Checklist

Complete these ten fields for one proposed control. Use the record to expose missing ownership, evidence, or safeguards before expanding the approach.

  1. Control objective: What specific error or unsupported payment should this control prevent?

  2. Trigger and source: What event initiates review, and which data are authoritative?

  3. Legal basis: Which law, policy, and rule version govern the decision?

  4. Accountable owner: Who is responsible for resolution and performance?

  5. Handoffs: What must the vendor, MCO, county, or other team deliver?

  6. Verification and exceptions: How will staff validate the alert and resolve legitimate exceptions?

  7. Payment action and safeguards: What can lawfully be paid, delayed, corrected, or denied, with what notice and review rights?

  8. Evidence retention: Can an independent reviewer reconstruct the data, chronology, rule, and decision?

  9. Performance measures: How will timeliness, false positives, reversals, cost, and access effects be measured?

  10. Independent test: Who will verify that the correction worked and remains effective?

Possible pilot controls include provider revalidation, ownership and exclusion checks, EVV claim-to-visit matching, or other-insurance coordination. Choose a defined problem with evidence available to test the result.

Three actions to take now

  1. Select one recurring defect. Establish a baseline and identify the point where a lawful intervention could prevent the next unsupported payment.

  2. Assign one accountable owner. Document the authoritative evidence, correction chronology, handoffs, exceptions, and member or provider safeguards.

  3. Independently retest the result. Confirm that the repair holds in subsequent decisions and payments; measure false positives, reversals, and access effects before expanding the control.

Sources and evidence limitations

[1] Ohio Legislature, SB 315, effective October 6, 2026: https://www.legislature.ohio.gov/legislation/136/sb315

[2] Executive Office of the Governor of Florida, October 6, 2026 integrity initiative results: https://www.flgov.com/eog/node/6935

[3] Ohio Revised Code Chapter 5164, sections 5164.302, 5164.305, 5164.42 and 5164.421: https://codes.ohio.gov/ohio-revised-code/chapter-5164

[4] Ohio Revised Code §5162.17, EVV dashboard: https://codes.ohio.gov/ohio-revised-code/section-5162.17

[5] Ohio Revised Code §5164.42, EVV claim validation and provider safeguards: https://codes.ohio.gov/ohio-revised-code/section-5164.42

[6] Ohio Revised Code §5164.32, provider revalidation: https://codes.ohio.gov/ohio-revised-code/section-5164.32

[8] Florida OPPAGA, January 2026 Biennial Review of AHCA Oversight of Fraud and Abuse: https://oppaga.fl.gov/Products/ReportDetail?rn=26-02

[9] CMS, October 14, 2026, Federal Marketplace duplicate and deceased enrollee announcement: https://www.cms.gov/newsroom/press-releases/trump-administration-delivers-second-year-savings-stopping-taxpayer-payments-duplicate-deceased

[10] CMS, Marketplace Eligibility and Enrollment Verifications — Periodic Data Matching: https://www.cms.gov/marketplace/resources/data/marketplace-eligibility-enrollment-verifications

[11] CMS, October 20, 2026, California CMS-64 deferral letter for quarter ended June 30, 2026 (deferral, not final disallowance): https://www.dhcs.ca.gov/wp-content/uploads/2026/10/Deferral-Letter-CA-Q3-2026-102026-daf.pdf

Source review: October 26, 2026. The state initiatives, federal Marketplace matching, and PERM eligibility measurement address distinct programs and measures. New public evidence may warrant an update.

Related Perspective: Stop the Error Clock — https://www.perminsights.org/p/stop-the-error-clock

Ralph Choate | Founder, Editor & Principal Author

Keep Reading