State Sanctions May Not Affect Medicaid Managed Care

ABSTRACT

Sanctions are a key tool that states use to hold Medicaid managed care organizations (MCOs) accountable for their use of public funds. The 2023 reports that MCOs submit to CMS have been made publicly available. One-fourth of the sanctions states levy against MCOs are not remediated. States vary widely in how they enforce standards and penalize noncompliant MCOs. In the absence of clear CMS guidelines on sanction reporting and follow-up, gaps in oversight can leave compliance issues unresolved and beneficiaries unprotected.

Am J Manag Care. 2026;32(5):302-304. https://doi.org/10.37765/ajmc.2026.89914

Takeaway Points

We analyzed public Managed Care Program Annual Report data from 20 states and 1 territory and found that one-fourth of Medicaid managed care organization (MCO) sanctions remain unresolved. Variations across states in sanction types, remediation efforts, and reporting practices underscore the need for stronger federal oversight and standardized transparency. This study’s findings do the following:

• Highlight inconsistencies in enforcement and classification not previously explored
• Support the need for standardized, transparent reporting systems to monitor care quality in Medicaid managed care
• Inform health care reform efforts to strengthen accountability within public-private care delivery models

Medicaid is the largest health insurance program in the US, financing health care for 78.4 million low-income people as of April 2025.¹ Managed care is the main delivery system that states utilize for it; based on data from 2022, 72% of Medicaid beneficiaries are enrolled in managed care organizations (MCOs), which provide comprehensive acute care services across 42 states and the District of Columbia.^2,3

State Medicaid agencies enter contracts with MCOs with oversight processes to ensure that cost-effective care management strategies do not conflict with patient safety. These contracts include expectations of the MCO on delivery of services, access standards, and complaints from members, all separate from federal Medicaid requirements.⁴ The Medicaid and CHIP (Children’s Health Insurance Program) Managed Care Final Rule, first published in 2016, requires Medicaid agencies to complete a Managed Care Program Annual Report (MCPAR), detailing quality measures, appeal data, and sanctions levied against MCOs.⁵ The first reports were due to CMS in December 2022. Each state must submit MCPARs to CMS within 180 days after each contract year to improve federal oversight and transparency.

The MCPAR must include the result of any sanction imposed by the state on an MCO. States can levy and impose a plethora of penalties, utilizing several enforcement mechanisms, if the MCO does not meet contractual obligations.⁶ Prior to the 2016 rule, states were able to choose whether they wanted to make their MCPARs accessible to the public. CMS recently made MCPARs for 20 states and 1 territory available to the public as a part of its increased focus on transparency.

Sanctions are how the state Medicaid agencies hold MCOs accountable, but with such ranging variability in how these sanctions are reported, it is difficult to understand whether they are ensuring compliance.

STUDY DATA AND METHODS

Data on sanctions and subsequent penalties from the performance year 2023 are available from CMS.⁷ The following 20 states and 1 territory had publicly available MCPAR data: Arizona, California, Colorado, Florida, Georgia, Iowa, Louisiana, Michigan, Missouri, Nebraska, New Hampshire, New Jersey, North Carolina, Ohio, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Texas, Virginia, and West Virginia. Based on data from December 2023, 61.22% of all Medicaid enrollees were represented.⁸ The proportion of beneficiaries enrolled in an MCO varied between 61% and 100% among 19 of the states and Puerto Rico, based on 2022 data; Colorado was an outlier with only 10% of beneficiaries enrolled in an MCO.²

We define a sanction as a penalty or enforcement mechanism levied by the state against an MCO due to the MCO not meeting contractual obligations. Sanctions reported in the MCPARs included 9 data features: intervention type, intervention topic, plan name, reason for intervention, instances of noncompliance, sanction amount, date assessed, remediation date on which the noncompliance was corrected, and whether the sanction was a corrective action plan.

We first provide descriptive information on the total number of sanctions remediated by MCOs. Remediation date was listed as D3.VIII.8 in the MCPAR. A sanction was defined as remediated if a remediation date was provided or the sanction was listed as “in progress,” and we defined sanctions as not remediated only when “no remediation” was listed. In a sensitivity analysis, we dropped the 3 states with the highest nonremediation rate and reestimated the remediation rate. After dropping the 3 states with the highest nonremediation rate, the resultant percentage of Medicaid enrollees from our original set of states was 58.94%.

We then present descriptive information on the topic of sanctions for each state. Each state was able to input its own description for each sanction topic, and we inductively coded these state-reported topics into 6 categories: networks and payments, services and benefits, data, reporting and performance measurement, beneficiary rights and communications, and other. The other category was created for intervention types that did not fit into a category due to a lack of reasoning provided. For example, “late submission of required materials” was not specific enough to categorize the intervention type into 1 of the 5 outlined.

We then present descriptive information on the sanction type for each state. There were 10 sanction types identified within the MCPAR data: action monitoring plan, civil monetary penalty, compliance letter, corrective action plan, corrective action plan and liquidated damages, directed corrective action plan, fine, liquidated damages, overpayment letter, and security incident/Health Insurance Portability and Accountability Act (HIPAA). We inductively coded sanction types into 5 categories: civil monetary penalties, which included fines; corrective action plans, which included directed corrective action plans; liquidated damages; compliance action, which included compliance letters; and other, which included action monitoring plans, combined sanctions such as corrective action plans and liquidated damages, and overpayment letters and security incident/HIPAA.

Civil monetary penalties are regulated under Title 42 of the Code of Federal Regulations. Corrective action plans are step-by-step plans developed to remediate errors. Liquidated damages are monetary penalties that are noted in the state’s managed care contract. Compliance action refers to compliance letters or compliance points. Other refers to state agencies exercising their authority to impose additional sanctions under state statutes or regulations that address areas of noncompliance specified under Title 42.

This study was deemed exempt from human subjects research review by the University of Illinois Chicago Institutional Review Board.

RESULTS

In 2023, there were 790 sanctions reported across the MCPARs: 789 were accessible, and 1 sanction was not classified because the file could not be read. A total of 3 sanctions included sanction topics that could not be found due to an upload error or because the section was blank.

Of these sanctions, more than 1 of every 4 sanctions (25.47%) were not remediated (Figure 1). In a sensitivity analysis removing the 3 states with the highest nonremediation rate, more than 1 of every 5 sanctions (20.85%) were not remediated. These findings suggest that of our sample of 20 states and 1 territory, the majority of the sample is driving a high rate of nonremediation rather than a small subset of outliers.

To address these contractual infractions, states can employ a few different sanction types. States varied greatly in their usage of these sanction types. Sanctions such as civil monetary penalties, corrective action plans, and liquidated damages can include a fine. Monetary penalties attached to corrective action plans, civil monetary penalties, liquidated damages, and other sanction types were found in 212 of the 790 sanctions (26.84%) (Figure 2).

DISCUSSION

The MCPAR sanction data highlight significant gaps in the enforcement of sanctions. When infractions occur, it is important that state agencies and federal regulators have the capacity and oversight mechanisms to mandate timely remediation. Although previous work has examined topics such as enforcement of network adequacy,⁹ this study is the first to our knowledge to examine comprehensive domains of Medicaid MCO sanction topics. Strengthening federal oversight and clear guidelines on state responsibilities could help to standardize enforcement practices and protect beneficiaries from the consequences of ongoing noncompliance.

As private entities continue to deliver essential Medicaid services, consistent and robust enforcement mechanisms become increasingly important, especially given the complexity of care and the vulnerability of the populations served. This inconsistency presents challenges in benchmarking compliance planning and demonstrating value to state partners. Enhancing federal guidance and transparency requirements could support long-standing policy goals such as improving oversight, reducing disparities, and strengthening the overall effectiveness of Medicaid managed care.¹⁰

One limitation of this analysis is that CMS did not provide every MCO’s MCPARs for each state. The data only included a subset of MCOs in some states. The MCPARs may not have been made publicly available for every MCO due to lack of harmonized data quality, the report having been submitted per the deadline, or the data having been suppressed for ongoing CMS analysis. However, these data remain the best available to study Medicaid sanction practices.

The variations in how sanctions are remediated across states point to the absence of standardized guidance. Sanction data offer a valuable lens into how well MCOs are upholding their responsibilities to beneficiaries whose care is funded by public dollars. It is the duty of CMS and state partners to ensure that MCOs fulfill their contractual obligations and beneficiaries receive the services and protections they are entitled to.

CONCLUSIONS

CMS needs improved guidance and regulations for the reporting of sanctions within MCPARs to ensure that MCOs are upholding their contractual obligations and to further analyze the efficacy of sanctions. 

Author Affiliations: University of Illinois Chicago (AR, NMT), Chicago, IL.

Source of Funding: None.

Author Disclosures: The authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

Authorship Information: Concept and design (AR); acquisition of data (AR); analysis and interpretation of data (AR, NMT); drafting of the manuscript (AR); critical revision of the manuscript for important intellectual content (AR, NMT); statistical analysis (AR); and supervision (NMT).

Address Correspondence to: Nathaniel M. Tran, PhD, University of Illinois Chicago, 1603 W Taylor St, M/C 923, Chicago, IL 60612. Email: nmtran@uic.edu.

REFERENCES

1. April 2025 Medicaid & CHIP enrollment data highlights. CMS. Accessed August 11, 2025. https://web.archive.org/web/20250811220213/https://www.medicaid.gov/medicaid/program-information/medicaid-and-chip-enrollment-data/report-highlights

2. Total Medicaid MCO enrollment. KFF. Accessed August 11, 2025. https://www.kff.org/medicaid/state-indicator/total-medicaid-mco-enrollment/

3. Hinton E, Raphael J. 10 things to know about Medicaid managed care. KFF. February 27, 2025. Accessed August 11, 2025. https://www.kff.org/medicaid/issue-brief/10-things-to-know-about-medicaid-managed-care/

4. Freund DA, Hurley RE. Medicaid managed care: contribution to issues of health reform. Annu Rev Public Health. 1995;16:473-495. doi:10.1146/annurev.pu.16.050195.002353

5. Medicaid and CHIP managed care reporting. CMS. Accessed August 11, 2025. https://www.medicaid.gov/medicaid/managed-care/guidance/medicaid-and-chip-managed-care-reporting

6. Hinton E, Raphael J. Medicaid managed care network adequacy & access: current standards and proposed changes. KFF. June 15, 2023. Accessed August 11, 2025. https://www.kff.org/medicaid/issue-brief/medicaid-managed-care-network-adequacy-access-current-standards-and-proposed-changes/

7. Public access to state submitted MCPARs. Medicaid.gov. Accessed August 11, 2025. https://www.medicaid.gov/medicaid/managed-care/guidance/medicaid-and-chip-managed-care-reporting/public-access-state-submitted-mcpars

8. Medicaid and CHIP Scorecard. Medicaid.gov. Accessed August 11, 2025. https://www.medicaid.gov/state-overviews/scorecard/main

9. Zhu JM, Polsky D, Johnstone C, McConnell KJ. Variation in network adequacy standards in Medicaid managed care. Am J Manag Care. 2022;28(6):288-292. doi:10.37765/ajmc.2022.89156

10. Moskowitz D, Guthrie B, Bindman AB. The role of data in health care disparities in Medicaid managed care. Medicare Medicaid Res Rev. 2012;2(4):mmrr.002.04.a02. doi:10.5600/mmrr.002.04.a02