Dr. Oz’s 50-State Medicaid Provider Audit: Compliance Implications for 340B Covered Entities

On April 21, 2026, CMS Administrator Dr. Mehmet Oz announced an initiative requiring all 50 states to audit their Medicaid provider networks and revalidate providers identified as high-risk. The framing from CMS is fraud-and-abuse focused, but the operational reach is broader: every covered entity that bills Medicaid will sit somewhere in the revalidation queue, and the documentation standard appears to be tightening.

For Ryan White grantees and 340B covered entities — many of which depend on Medicaid as a major payer — the audit initiative is best understood as a compliance forcing function. The question is not whether your operations will be reviewed. It is whether the review will find your documentation in good order.340B covered entities have specific compliance obligations that intersect with Medicaid in several places: duplicate discount prevention (the prohibition on a manufacturer paying both a 340B discount and a Medicaid rebate on the same prescription), Medicaid Exclusion File listings, contract pharmacy arrangements, and patient-definition documentation. Each is now likely to receive heightened state attention.

What Dr. Oz’s Letter Requires

Per the CMS communication and Stateline reporting, governors and state Medicaid directors are now required to submit plans for revalidating Medicaid providers “of services at high risk of waste, fraud, abuse, and corruption.” States have discretion in how they define high-risk, but CMS is setting a federal floor and an expectation of pace. Reuters reports that the initiative will expand existing revalidation requirements rather than replace them — which means current 855-form-style documentation remains the baseline, with additional state-level layers on top.

Where 340B and Medicaid Intersect: And Where the Risk Concentrates

340B covered entities have specific compliance obligations that intersect with Medicaid in several places: duplicate discount prevention (the prohibition on a manufacturer paying both a 340B discount and a Medicaid rebate on the same prescription), Medicaid Exclusion File listings, contract pharmacy arrangements, and patient-definition documentation. Each is now likely to receive heightened state attention.

Practical Compliance Steps for the Next 90 Days

• Refresh Medicaid Exclusion File status. Confirm each pharmacy and contract pharmacy is correctly listed (or correctly excluded) on the HRSA MEF, and that those listings match the state Medicaid claims you are submitting.
• Document patient-definition decisions. For any prescription where a 340B-eligibility decision was made, ensure the underlying patient-relationship documentation is contemporaneous and retrievable.
• Audit your contract pharmacy reconciliations. Replenishment-model errors are the most common 340B compliance finding. Run a quarterly reconciliation against your TPA reports and document the result.
• Stress-test work-requirement implementation. Many of the same states implementing Medicaid work requirements (Indiana set a three-month requirement; KFF flagged unwinding-style coverage churn risk) will see a wave of patients lose coverage. Map the operational handoff to your enrollment and PIAP teams.

Why PIAP is a Compliance-Positive Strategy

A Premium Insurance Assistance Program shifts a portion of a clinic’s revenue model from Medicaid (which is now under intensified state and federal scrutiny) to commercial-payer billing through marketplace coverage. PIAP doesn’t replace Medicaid for patients who qualify and stay enrolled — but it provides a coverage pathway for patients who lose Medicaid through work-requirement implementation, redeterminations, or revalidation cascades. The result is a more diversified payer mix, lower concentration in any one program, and a documentation trail that is structurally simpler than mixed Medicaid/340B billing.

Schedule time to learn how PIAP can support long-term access and stability for your patients.

Sources