Last updated: November 2026
A Medicaid managed care program integrity compliance plan is the written compliance program, overpayment reporting procedure, service-verification method and fraud referral protocol a managed care plan keeps to meet the program integrity terms of its state Medicaid contract under 42 CFR 438.608. The regulation is written to the State: the State, through its contract, must require the plan, or a subcontractor to the extent it is delegated responsibility for coverage of services and payment of claims, to implement and maintain arrangements or procedures designed to detect and prevent fraud, waste, and abuse. This page is for compliance officers, general counsel and executives at managed care organizations, prepaid inpatient health plans and prepaid ambulatory health plans; Integral Healthcare Solutions (IHS) drafts the plan, procedures and evidence file under its Compliance Services practice line for your leaders to adopt, and your staff investigate, refer and certify.
What does 42 CFR 438.608 require of a managed care plan?
It requires a compliance program with seven named elements, plus provisions for notifying the State of enrollee and network provider changes, overpayment reporting, service verification, whistleblower policies, fraud referral and payment suspension. IHS read 42 CFR 438.608, 42 CFR 438.610, 42 CFR 438.606, 438.604 and 438.66 (eCFR build of November 4, 2026, read November 6, 2026; Title 42 last amended October 8, 2026; 438.608 last amended May 10, 2024).
The seven elements in paragraph (a)(1)
The elements are written policies, procedures and standards of conduct; a Compliance Officer who reports directly to the Chief Executive Officer and the board of directors; a Regulatory Compliance Committee on the Board of Directors and at the senior management level, charged with overseeing the compliance program; training and education; lines of communication with employees; well-publicized disciplinary guidelines; and a system with dedicated staff for routine internal monitoring and auditing of compliance risks, prompt response, investigation of potential compliance problems, and correction (or coordination of suspected criminal acts with law enforcement agencies).
The other contract provisions
- (a)(2): "Provision for reporting within 30 calendar days all overpayments identified or recovered, specifying the overpayments due to potential fraud, to the State."
- (a)(3) and (a)(4): prompt notification to the State under (a)(3) of information about changes in an enrollee's circumstances that may affect eligibility, including changes in residence and the death of an enrollee, and notification under (a)(4) of information about changes in a network provider's circumstances that may affect its eligibility to participate in the managed care program, including termination of its provider agreement.
- (a)(5): a method to verify, by sampling or other methods, whether services that network providers represented as delivered were received by enrollees, and the application of such verification on a regular basis.
- (a)(6): for a plan that makes or receives annual payments under the contract of at least 5,000,000 dollars, written policies for all employees of the entity, and of any contractor or agent, giving detailed information about the False Claims Act and other Federal and State laws described in section 1902(a)(68) of the Act, including employees' rights to be protected as whistleblowers.
- (a)(7): prompt referral of any potential fraud, waste, or abuse the plan identifies to the State Medicaid program integrity unit, or of any potential fraud directly to the State Medicaid Fraud Control Unit. CMS's referral toolkit (last updated 06/16/2025, opened November 6, 2026; guidance to States) leaves the timeline for prompt to the State and encourages two business days from identification. Paragraph (a)(8) adds suspension of payments to a network provider for which the State determines there is a credible allegation of fraud, in accordance with 42 CFR 455.23.
- (d)(2): the plan requires, and has a mechanism for, a network provider to report an overpayment it has received, return it to the plan within 60 calendar days after the date on which it was identified, and notify the plan in writing of the reason. Paragraph (d)(3) requires an annual report to the State on all overpayments identified or recovered.
- (f): "Paragraphs (a)(2), (d)(3) and (e) of this section apply to the first rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 1 year from July 9, 2024." CMS's overpayments toolkit (last updated 10/23/2026, opened November 6, 2026; guidance to States) states that date as July 9, 2025.
Prohibited affiliations and certification
- 438.610(a): the plan may not knowingly have a paragraph (c) relationship with a person debarred, suspended or otherwise excluded from Federal procurement or nonprocurement activities, or with that person's affiliate. Paragraph (c) lists directors, officers and partners; subcontractors; persons with beneficial ownership of 5 percent or more of the plan's equity; and a network provider or person with an employment, consulting or other arrangement for items and services significant and material to the plan's obligations under its State contract.
- 438.610(b): the plan "may not have a relationship with an individual or entity that is excluded from participation in any Federal health care program under section 1128 or 1128A of the Act."
- 438.606: for the data, documentation or information specified in 438.604, including the annual overpayment report, the submission must be certified by the plan's Chief Executive Officer, its Chief Financial Officer, or an individual who reports directly to either with delegated authority to sign, so that the CEO or CFO is ultimately responsible. The certifier attests that, based on best information, knowledge, and belief, the data, documentation, and information is accurate, complete, and truthful.
Who needs this plan and what triggers it
A managed care organization, prepaid inpatient health plan or prepaid ambulatory health plan with a state Medicaid contract needs this plan, as does a subcontractor to the extent of its delegated responsibility. Three situations start the work:
- A new or renewing state contract that carries these terms, including the 30-day and annual overpayment reports, which apply from the first rating period for contracts beginning on or after July 9, 2025.
- A compliance officer who does not report directly to the chief executive officer and the board, or no documented overpayment reporting or service verification.
- Referral volume. HHS-OIG reported in September 2025 that 33 of 337 plans (10 percent) said they made no provider referrals to any entity in calendar year 2022 (page opened November 6, 2026).
How IHS helps
IHS starts with a gap assessment against 438.608, 438.610 and 438.606, drafts what is missing, and tests it with a tabletop case.
What IHS drafts
- The compliance plan, standards of conduct and charters.
- An overpayment procedure tracking the 30-day, 60-day and annual dates, a service-verification sampling method, and State-notice procedures for enrollee and network provider changes.
- For a plan at or above the 5,000,000 dollar threshold, the False Claims Act and whistleblower policies.
- A referral protocol that routes potential fraud, waste or abuse to the plan's own decision-maker, and a payment-suspension procedure that waits for the State's determination.
- An exclusion-screening procedure sized to 438.610(a), (b) and (c), and a 438.606 certification workflow naming the CEO, CFO and delegated-signer routes and the 438.604 data covered.
- An evidence file with one entry per element.
What you supply
You supply your state contract, compliance plan, minutes, training records, hotline and referral logs, overpayment tracking and delegation agreements. Counsel decides legal questions such as self-disclosure.
The real limit
IHS does not investigate cases, make fraud referrals, contact a state agency or a Medicaid Fraud Control Unit, or submit anything to CMS. Your staff do; IHS drafts the procedures they follow.
What to have ready
- Your state contract and its program integrity terms (438.608(a)).
- Your compliance plan, Compliance Officer reporting line and committee minutes (438.608(a)(1)(ii) and (iii)).
- Your monitoring and auditing plan and dedicated staff (438.608(a)(1)(vii)).
- Your overpayment log, State reports and service-verification results (438.608(a)(2), (a)(5), (d)(3)).
- Your whistleblower policies, if you meet the 5,000,000 dollar threshold (438.608(a)(6)).
- Your referral log (438.608(a)(7)) and provider agreements with the report, 60-day return and written-reason terms (438.608(d)(2)).
- Your exclusion and affiliation screening records (438.610) and certification workflow (438.606(a)).
A free introductory call is the place to walk through the list.
How it compares
The table does not recommend one.
| Item | Standing program integrity plan (this page) | Readiness review preparation |
|---|---|---|
| Governing text | 42 CFR 438.608, 438.610 and 438.606 | 42 CFR 438.66(d); Program Integrity/Compliance is one area the State's review must assess (438.66(d)(4)(i)(G)) |
| When it applies | While the contract runs | Before a State implements a managed care program, when a plan has not contracted with the State before, or when a current plan will serve new eligibility groups (438.66(d)(1)) |
For the second, see Medicaid managed care readiness review preparation. For compliance programs more broadly, see compliance program development.
What it costs
- Authority fees: none stated in the text opened.
- Consulting fees: IHS scopes each engagement after a free introductory call. Scope depends on how many state contracts you hold, how many elements are documented, whether you delegate to vendors, and what the assessment finds.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not an investigation or referral service.
- It is not a guarantee of any state or CMS review outcome.
Frequently asked questions
What does 42 CFR 438.608 require in a managed care compliance program?
The State, through its contract, must require the plan to implement and maintain arrangements or procedures designed to detect and prevent fraud, waste, and abuse. They include a compliance program with seven named elements, a 30-calendar-day overpayment report, service verification and prompt fraud referral.
Does a Medicaid managed care plan need a special investigations unit?
Section 438.608 does not use the term. Element (a)(1)(vii) asks for dedicated staff for monitoring, auditing and investigating compliance problems, and HHS-OIG's September 2025 report says plans typically establish a special investigation unit to meet it.
How quickly must overpayments be reported to the State?
Paragraph (a)(2) calls for reporting to the State within 30 calendar days all overpayments identified or recovered, specifying those due to potential fraud. Paragraph (f) applies it from the first rating period for contracts beginning on or after 1 year from July 9, 2024, which CMS states as July 9, 2025.
What is the 60-day overpayment rule for network providers?
Under paragraph (d)(2), the plan requires, and has a mechanism for, a network provider to report an overpayment, return it to the plan within 60 calendar days after the date on which it was identified, and notify the plan in writing of the reason. The 60-day return runs from provider to plan; paragraph (c)(3) separately requires the plan to report to the State within 60 calendar days when it identifies capitation or other payments in excess of contract amounts.
When must the plan refer suspected fraud, and to whom?
Paragraph (a)(7) calls for prompt referral of potential fraud, waste, or abuse to the State Medicaid program integrity unit, or of potential fraud directly to the State Medicaid Fraud Control Unit. The State sets what prompt means; CMS encourages two business days from identification, which is guidance and not a rule.
How do we verify that services billed by providers were received?
Paragraph (a)(5) calls for verifying by sampling or other methods whether services network providers represented as delivered were received by enrollees, on a regular basis.
What does 438.610 say about excluded individuals and affiliations?
Paragraph (a) bars the plan from knowingly having a paragraph (c) relationship with a person debarred, suspended or otherwise excluded under federal procurement or nonprocurement rules, or an affiliate. Paragraph (b) bars a relationship with anyone excluded from a Federal health care program under section 1128 or 1128A of the Act. IHS drafts screening for both.
Who has to sign the data certification?
Section 438.606(a) calls for certification of the 438.604 data by the Chief Executive Officer, the Chief Financial Officer, or an individual who reports directly to either with delegated authority to sign, so that the CEO or CFO is ultimately responsible.