Finding Number: 2025-039 Finding: The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Program: 93.767 – Children’s Health Insurance Program 93.767 – COVID-19...
Finding Number: 2025-039 Finding: The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Program: 93.767 – Children’s Health Insurance Program 93.767 – COVID-19 Children’s Health Insurance Program 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Grants to States for Medicaid 93.778 – COVID-19 Grants to States for Medicaid Compliance Requirement: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Questioned Costs: $641 Status: Corrective action in progress Corrective Action: The Authority partially concurs with the finding. Fingerprint based criminal background checks The Authority concurs that a fingerprint-based criminal background check process for high-risk providers was not implemented during the audit period. In coordination with the Centers for Medicare & Medicaid Services (CMS) and the Washington State Patrol, the Authority has developed the required process and is in the final stages of implementation. The program is expected to be launched by March 31, 2026, and will apply to all providers designated as high-risk. Updated license information in ProviderOne When a professional license on a provider record expires, ProviderOne automatically end-dates taxonomies associated with the provider. However, when a provider is enrolled with multiple agencies and only one associated license has expired, the system does not currently end-date the related taxonomies. Currently, 37 of 113,940 servicing-only providers are affected while none of the approximately 9,000 billing providers are impacted. The Authority submitted a system change request in March 2026 to ensure applicable taxonomies are automatically end-dated in these scenarios. In the interim, the Authority developed a weekly report and implemented a process to identify providers with applicable taxonomies that need manually end-dated until the system enhancement is deployed. ProviderOne did not deactivate providers timely ProviderOne is designed to automatically inactivate a provider’s domain when revalidation is not completed timely. Due to an operational issue, a limited number of providers were not deactivated as required. Currently, 50 of approximately 9,000 billing providers are impacted. The Authority submitted a system change request in March 2026 to remediate this issue and prevent recurrence. In the interim, the Authority will conduct weekly monitoring and manually inactivate affected provider domains until the system correction is implemented. Ownership disclosures The Authority does not concur with the determination that it is not in compliance with federal requirements governing ownership disclosures. The Authority’s process requires providers to review and attest to ownership disclosure information maintained by the Authority as part of the revalidation process. The Authority believes this process meets the requirements of 42 CFR 455.104 and appropriately balances regulatory compliance with administrative efficiency. The Authority submitted its procedures to CMS on February 23, 2026, and requested clarification and guidance to ensure continued alignment with federal expectations. Providers not revalidated or deactivated by the five-year deadline The Authority’s revalidation backlog totaled 792 providers in July 2024. Through focused operational improvements and targeted resource deployment, the backlog was substantially reduced to three providers as of June 30, 2025. The Authority remains committed to continuous process improvement to sustain timely revalidations and prevent future backlog growth. As of March 2026, the Authority began working on a daily report of providers nearing the revalidation deadline so they can be prioritized and revalidated timely. Prior Findings: The conditions noted in this finding were previously reported in findings 2024-075, 2023-074, 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Completion Date: Estimated March 2026 Agency Contact: Kari Summerour, CPA External Audit Compliance Manager (360) 725-9586 Kari.Summerour@hca.wa.gov