Same Medicaid rules, unequal resources: Smaller plans face bigger corrective action plan risk
The Centers for Medicare & Medicaid Services estimated a Medicaid improper-payment rate of 6.12% for fiscal 2025, representing $37.39 billion. CMS said 77.17% of those payments resulted from insufficient documentation rather than fraud.
As 2027 approaches, that gap is under growing pressure, as CureIS Healthcare examines here. H.R. 1, signed into law in July 2025, added work requirements, more frequent eligibility checks, restrictions on retroactive coverage, and tighter limits on state financing tools, including managed care organization taxes. At the California Association of Health Plans conference in Palm Desert in October, state officials outlined projected Medi-Cal impacts, including tens of thousands of disenrollments in the near term and larger reductions later. They also pointed to federal medical assistance percentage adjustments for emergency services.
Those changes coincide with CMS-0057 interoperability deadlines, shorter encounter validation and pend-resolution windows in multiple states, and the ongoing rewrite of the HIPAA Security Rule in the wake of the Change Healthcare cyberattack.
Beginning in 2029, states with eligibility-related improper-payment rates above 3% face reductions in federal matching funds. The enforcement discretion CMS previously signaled for some good-faith state efforts has ended. States push those gaps downstream to contracted plans through corrective action plans (CAPs), payment withholds, liquidated damages, and demands for evidence.
Large plans and integrated systems can build bigger compliance teams, hire outside support, and triage sanctions. Smaller and community-based plans face the same rules with fewer staff, narrower margins, and less room for multiyear remediation.
The price of missing proof
A corrective action plan, or CAP, is often treated as a compliance document. In practice, it’s the operational and financial cost of being unable to prove what happened inside the plan’s own systems. MACPAC’s 2025-2026 review of Managed Care Program Annual Reports from 34 states found that 25 states issued 359 CAPs in a single performance year. Only 12 included direct financial penalties.
Fines are only one part of the cost. CAPs can require years of monitoring, extensive remediation work, leadership attention and repeated reporting to regulators. An unresolved finding can escalate into a payment withhold, increased reserve requirement or other sanction.
A large organization with dozens of full-time compliance employees can absorb that work. It may be more challenging for a midmarket or community plan to be able to pull claims, encounters, enrollment files, diagnoses, source documentation and risk analyses from fragmented systems before a state deadline expires.
Focus on prevention
Much of the vendor market around CAPs focuses on managing findings after they exist: trackers, survey-readiness modules, policy libraries and attestation dashboards. Those tools can organize a response. They do not change whether the file was complete, the encounter reconciled, or the source documentation existed when the state asked.
As plans are asked to do more with less, some leaders are moving their attention from supervised remediation to prevention. State-published encounter data support the strategy. In Arizona, AHCCCS materials show preliminary sanctionable pended-encounter counts in individual quarters resolving from thousands to a few hundred, or to zero, once plans produce evidence inside the challenge window. The pattern is consistent with other states’ published encounter-validation results: findings shrink when the supporting record already exists, but persist when it has to be built after the notice arrives.
What defensible data looks like
State deadlines vary. Arizona’s pend-resolution window is 120 days, with a 5% data-validation threshold. California’s quarterly scoring under QMED 2.0 begins in 2026, with monetary sanctions to follow. But the underlying requirement is that the plan must be able to produce the evidence when the state asks for it.
That capability requires continuous reconciliation across claims, encounters and enrollment records. It also requires automated identification of transactions affected by retroactive rate or rule changes, along with encounter-level lineage that can be produced during the state’s review window. The operational outcome is the ability to produce what the organization knew, and when, before a finding is written.
Tools that can be configured to a specific state contract and run alongside existing platforms can help close upstream gaps before they become findings, which may lead to fewer audit surprises. These kinds of tools may also reduce the remediation labor, sanctions, reserves and management time that follow them.
As H.R. 1 increases redetermination volume and retroactive adjustments, and as states approach the 3% eligibility-error threshold in 2029, being able to reconstruct data on demand can help plans absorb the pressure and avoid paying the CAP tax.
This story was produced by CureIS Healthcare and reviewed and distributed by Stacker.
