Medicaid Payment Authorization Credential Authority Failure Through $31.1 Billion in Payments Authorized Without Documentation Condition Present — FY2024

Medicaid payment authorizations operate through a credential chain: the provider enrollment credential certifies that the provider is eligible to bill; the eligibility credential certifies that the beneficiary meets program requirements; the service authorization credential certifies that the claimed service was medically necessary and delivered as specified. Each credential is supposed to be supported by documentation that encodes the conditions under which the payment is authorized. When the documentation is absent or insufficient, the credential has moved as sufficient without the evidentiary basis it is required to represent.

The PERM measurement program audits Medicaid payments across a rotating three-year cycle of states. When auditors cannot locate documentation sufficient to verify that a payment was proper, the payment is classified as improper — regardless of whether the underlying service was actually delivered to an eligible beneficiary. CMS has noted that most improper payments are made for services that were likely appropriate; the documentation condition was absent, but the underlying condition may have been present. The structural diagnosis is precise: the credential authorized the payment without encoding the documentation condition in a form that made it evaluable at the point of authorization.

CMS released FY2024 PERM results in November 2024, reporting a national Medicaid improper payment rate of 5.09 percent and $31.1 billion in improper federal payments. Of that total, $23.4 billion was attributed to insufficient documentation — the largest single category by a substantial margin. The GAO simultaneously reported more than 100 unimplemented recommendations to CMS, including 15 related specifically to improper payments, and noted that actions on those remaining recommendations could further enhance program integrity.

The documentation-based credential gap has been the dominant failure category across every Medicaid PERM measurement cycle. The rate has declined significantly from its FY2021 peak of 21.69 percent, reflecting genuine administrative improvement. The absolute dollar amount of documentation-based improper payments — $23.4 billion in a single fiscal year — documents the scale of the condition that persists after that improvement. The GAO has characterized Medicaid program integrity as a High-Risk area continuously. The condition is not new. The oversight apparatus that documents it annually has not produced a structural resolution.

The Medicaid payment authorization credential authorizes the transfer of federal and state funds to a provider for a claimed service. The documentation condition is not a bureaucratic formality — it is the evidentiary boundary that makes the credential's authorization verifiable. Without documentation, the payment system cannot establish whether the service was delivered, whether the beneficiary was eligible, whether the provider was appropriately enrolled, or whether the clinical conditions for authorization were present. The credential certifies that those conditions were satisfied. The documentation that would encode that certification is absent.

The structural condition this case documents is the same architectural gap present across the payment authorization domain: the credential authorizes transfer without requiring the documentation condition to be present in encoded form at the point of authorization. The payment system accepts the credential. The documentation is supposed to follow. When it does not — or when it cannot be located at the point of audit — the payment has been authorized by a credential that did not represent the conditions it was required to certify.

The remediation record is the enforcement artifact of the gap. CMS has implemented improved eligibility documentation procedures, standardized case record requirements, and expanded audit programs. GAO's 100+ unimplemented recommendations represent the accumulated distance between the current architecture and the structural condition those recommendations address. The gap produces $23.4 billion in documentation-deficient payments in a single fiscal year after decades of reform. The credential authorized each payment. The documentation condition was not present. The authorization was not contingent on its presence.

CMS has taken significant steps in response to GAO recommendations — improving managed care oversight, implementing fraud prevention systems, standardizing eligibility documentation requirements, and expanding state auditor collaboration. These efforts have produced measurable results: the improper payment rate declined from 21.69 percent in FY2021 to 5.09 percent in FY2024. A 2024 CMS rule on eligibility and enrollment established standardized documentation requirements intended to further reduce documentation-based improper payments.

The remediation operates after authorization. Each step in the reform program — enhanced documentation requirements, post-payment audits, expanded oversight — addresses the gap after the credential has already authorized the payment. The PERM measurement cycle itself confirms this: payments are made, then audited months or years later to determine whether the documentation condition was present. The authorization was not contingent on verified documentation at the point of payment. It was contingent on documentation that could be produced if audited. The structural difference between those two conditions is $23.4 billion per year.

• The Medicaid payment authorization credential certifies that a claimed service was provided to an eligible beneficiary by an enrolled provider under conditions satisfying program requirements; the documentation condition is the evidentiary basis of that certification; in FY2024, $23.4 billion in payments — 75 percent of total improper payments — were authorized without the documentation condition present at the point of payment
• Most documentation-based improper payments represent payments where a reviewer could not determine whether the payment was proper because supporting records were absent or incomplete — not necessarily fraud, but the documentation condition required to verify authorization was not encoded in the credential in a form evaluable at the point of payment; the authorization proceeded without it
• The documentation-based credential gap has been the dominant Medicaid improper payment category across every PERM measurement cycle; the rate has declined significantly from its FY2021 peak reflecting genuine administrative improvement; the absolute dollar amount — $23.4 billion in a single fiscal year — documents the scale of the condition that persists after improvement; GAO has designated Medicaid program integrity as High-Risk continuously
• The GAO has issued more than 100 unimplemented recommendations to CMS, including 15 specifically related to improper payments; that accumulated recommendation record is the oversight apparatus's formal documentation of the gap between the current credential architecture and the structural condition those recommendations address; the gap produces $23.4 billion in documentation-deficient payments annually after decades of reform effort
• CMS remediation — enhanced documentation requirements, post-payment audits, expanded oversight, the 2024 eligibility rule — operates after authorization; each reform addresses the gap after the credential has already authorized the payment; the PERM audit cycle confirms the architecture: payments are authorized, then audited to determine whether the documentation condition was present; the authorization was not contingent on verified documentation at the point of payment
• A payment authorization credential that requires the documentation condition to be present and encoded at the point of authorization — making the evidentiary basis of the payment verifiable before the transfer is approved, not reconstructed through audit after the transfer has occurred — is the structural correction this case implies; the difference between those two authorization conditions is $23.4 billion per year