Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer: Plan for 150 to 210 Days, Not 90
Behavioral health operators enrolling or revalidating Medicaid in Arizona, Tennessee, Indiana, Nevada, or Kentucky should plan for 150 to 210 days from clean application to active billing, not the 90 days most pro formas still assume. State Medicaid agencies have quietly moved enrollment and revalidation from a paperwork exercise to a fraud-control checkpoint, and CMS’s screening rules at 42 CFR Part 455 give them the legal cover to do it.
The Arizona Health Care Cost Containment System (AHCCCS) is still working through the fallout from the 2023 sober-living fraud sweep. AHCCCS confirms that since May 2023 it has suspended more than 300 providers and implemented more than 20 new initiatives to combat fraud, waste, and abuse in the Arizona Medicaid program. Reporting from the Arizona Mirror puts sharper numbers on the tempo: new behavioral health fraud investigations dropped from about 1,400 at the scandal’s peak in 2023 to 270 as of August 2025, a decline AHCCCS attributes to tighter billing controls, not looser oversight. Local reporting has estimated the underlying scheme cost Arizona roughly $2.8 billion.
The pattern is wider than Arizona. TennCare tightened site-visit protocols. Indiana’s FSSA pushed revalidation packets with new ownership-disclosure attachments. Nevada Medicaid added a secondary review tier for SUD outpatient enrollments. Kentucky’s Department for Medicaid Services slowed new SUD residential enrollments while it works through an enforcement backlog.
None of this comes with a press release. Operators find out when their credentialing coordinator calls to say the enrollment that used to take 90 days is now sitting at 187. Or when a CMS-1500 batch hits a denial wall because the rendering provider’s revalidation lapsed and nobody flagged it.
What CMS Actually Requires: 42 CFR 455, Fingerprints, and the 35-Day Trap
CMS gave states the legal cover to do all of this. The screening framework at 42 CFR Part 455, Subpart E lets states demand fingerprint-based background checks, unannounced site visits, and enhanced disclosures for higher-risk categories. Behavioral health, particularly SUD residential and outpatient, sits squarely in the high-risk bucket in most state plans now.
Two regulatory hooks matter for operators. First, 42 CFR 455.414 requires state Medicaid agencies to revalidate every provider at least every five years. Operators who enrolled in 2021 during the COVID public health emergency flexibilities are coming due now, and the documentation bar has moved.
Second, operators keep tripping over 42 CFR 455.104, which lists exactly when ownership disclosures are due: upon submitting the provider application, upon executing the provider agreement, upon request during revalidation, and within 35 days after any change in ownership of the disclosing entity. Every person or entity with 5% or more ownership. Every managing employee. Every subcontractor relationship. If your cap table shifted because of a PE recapitalization or a minority investor came in, and nobody filed within the 35-day window, your revalidation will get kicked back. The regulation is blunt about the consequences: “Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section.”
What that means in the revenue cycle: our team has watched denial rates jump from 4% to 18% almost overnight when a provider goes inactive mid-cycle. Days in AR is the metric that tells you whether your credentialing function is keeping up. If your days in AR are creeping past 55 and your denial reasons are clustering around provider eligibility, enrollment status, or taxonomy mismatches, your enrollment file is the problem, not your billers.
Site Visits Are Not What They Were Two Years Ago
Medicaid site visits used to be a checklist exercise. A surveyor walked the building, confirmed the address matched the application, looked at a few charts, and left. That is over.
In Arizona, AHCCCS site visits are often unannounced, paired with an OIG investigator, and surveyors pull staff rosters against the National Practitioner Data Bank and the OIG List of Excluded Individuals and Entities (LEIE) in real time. Providers who lived through the AHCCCS crackdown have told legislators that AHCCCS owes some behavioral health operators well over $375,000 in delayed claims tied to prepayment reviews. If a clinician on your roster shows up on the LEIE and you are billing Medicaid for their services, that is a False Claims Act exposure, not a paperwork problem.
What surveyors look for on a behavioral health site visit, in plain terms:
- Whether the physical site matches what you said it was.
- Whether the credentialed clinicians are actually working there.
- Whether the schedules and time records line up with the claims you are submitting.
- Whether you can produce a current OIG/SAM exclusion check for every employee and contractor.
We tell operators to run LEIE and SAM.gov exclusion checks monthly, not at hire. Monthly. Document each one. The two minutes it takes is the cheapest insurance you can buy against a treble-damages FCA case.
Our compliance team supported a Joint Commission survey in South Carolina in May where the surveyor finished faster than scheduled because the operator could produce, on demand, every exclusion check, every credentialing file, and every ownership disclosure. That same file discipline is what gets you through a Medicaid site visit without a corrective action plan.
The FWA-Readiness Audit Every Operator Should Run This Quarter
If you operate in any of the five states above, treat the next 90 days as an internal FWA audit window. The enforcement math is unforgiving.
The DOJ’s 2024 National Health Care Fraud Enforcement Action charged 193 defendants, including 76 doctors, nurse practitioners, and other licensed medical professionals across 32 federal districts, for schemes involving approximately $2.75 billion in intended losses and $1.6 billion in actual losses. Addiction treatment was a named focus area: four defendants in two district courts were charged with a $146 million scheme that “used kickbacks and other methods to recruit vulnerable individuals, such as the homeless, into drug and alcohol treatment programs,” even though those services may never have been provided. The government also seized over $231 million in cash, luxury vehicles, gold, and other assets in the coordinated action.
State Medicaid Fraud Control Units are catching more too. The HHS-OIG FY 2024 MFCU annual report shows 1,151 convictions, $961 million in criminal recoveries, $407 million in civil recoveries, 493 civil settlements and judgments, and 1,042 exclusions of individuals and entities from federally funded programs. Criminal recoveries were the highest amount in the past 10 years, more than double the rolling 5-year average. The enforcement money is following the enrollment money.
Here is the short version of what we run for operators on our managed compliance services:
- Pull every active Medicaid enrollment record. Confirm the ownership disclosure on file matches your current cap table within the last 35 days. If it does not, file a change-of-information today.
- Reconcile your credentialed provider roster against payroll and against your billing data. Anyone billing who is not credentialed, or credentialed who is not billing, is a flag.
- Run LEIE and SAM.gov exclusion checks on every employee, contractor, and board member. Save the screenshots with dates.
- Audit your prior authorization and utilization management files. Pull 20 random charts and confirm the level of care billed matches what was authorized and what the ASAM Criteria 4th Edition assessment actually supported. If you billed residential withdrawal management but the assessment supports a lower level, you have a refund obligation, not a defense.
- Review your single-case agreements and out-of-network arrangements. SCAs that were verbal or never countersigned are denial bait and audit bait.
- Confirm your compliance program has documented training in the last 12 months for every employee, with sign-in sheets, on FWA, HIPAA, and the False Claims Act.
How AHS Helps Operators Stay Ahead of This
Atlantic Health Strategies sits on the operator side of this. Our team runs managed compliance and payer strategy for treatment centers across the lifecycle, from feasibility study and licensure through accreditation, into payer enrollment, and through the revenue cycle.
A Kentucky SUD residential operator we supported through licensure in April watched their Medicaid enrollment timeline run nearly six months from clean application to active billing. We had the licensure. We had the Joint Commission survey on the calendar. The state still took its time on the enrollment review. That is the new normal.
The Joint Commission accreditations our team earned in May across five facilities in three states, and the Kentucky detox and residential licensure we shepherded from property acquisition through opening, came from the same file discipline we apply to Medicaid enrollment. Every disclosure current. Every roster reconciled. Every chart defensible.
If your operations are in Arizona, Tennessee, Indiana, Nevada, Kentucky, or any other state where Medicaid enrollment is tightening, get your enrollment files into audit-ready shape before a surveyor or an MFCU investigator makes that decision for you. AHS runs state-by-state Medicaid enrollment reviews, FWA-readiness audits, and managed credentialing for operators who would rather pay for prevention than pay defense counsel.
Frequently asked questions
How long does Medicaid behavioral health enrollment realistically take in 2025-2026?
In the five states seeing tightened scrutiny (Arizona, Tennessee, Indiana, Nevada, and Kentucky), operators should plan for 150 to 210 days from clean application to active billing, not the 90 days many pro formas still assume. State agencies are layering enhanced screening under 42 CFR Part 455, Subpart E, including fingerprint-based background checks and unannounced site visits for high-risk categories like SUD residential and outpatient. AHCCCS alone has suspended more than 300 providers and implemented more than 20 new fraud, waste, and abuse initiatives since May 2023, and that posture is now baked into how enrollments are reviewed.
What triggers a Medicaid revalidation kickback under 42 CFR 455.104?
The most common trigger is a missed 35-day change-of-information filing after a cap table change. 42 CFR 455.104 requires disclosure within 35 days after any change in ownership of the disclosing entity, covering every person or entity with 5% or more ownership, every managing employee, and every subcontractor. If a PE recapitalization or minority investor came in and the filing was missed, revalidation will bounce, and the regulation states plainly that Federal financial participation is not available in payments made to a disclosing entity that fails to disclose.
How often should behavioral health operators run LEIE and SAM.gov exclusion checks?
Monthly, on every employee, contractor, and board member, with dated documentation retained. Billing Medicaid for services rendered by an excluded individual is a False Claims Act exposure with treble-damages risk. HHS-OIG’s FY 2024 MFCU report tallied 1,042 exclusions and $961 million in criminal recoveries, the highest single-year criminal recovery total in the past 10 years, so the enforcement infrastructure is active and well-funded.
Which states are tightening behavioral health Medicaid enrollment most aggressively right now?
Arizona, Tennessee, Indiana, Nevada, and Kentucky are the five states where AHS is seeing enrollment and revalidation timelines stretch well past the historical 90-day norm. Arizona is the loudest example given the sober-living fraud scheme, which local reporting has pegged at roughly $2.8 billion, and AHCCCS has since suspended more than 300 providers, denied 160 provider applications, and terminated 79 providers for quality-of-care failures. Tennessee, Indiana, Nevada, and Kentucky have taken quieter but material steps: expanded site-visit protocols, ownership-disclosure attachments in revalidation packets, secondary review tiers for SUD outpatient enrollments, and slowed new SUD residential enrollments during enforcement backlogs.
References
- eCFR, 42 CFR 455.104: Disclosure by Medicaid providers and fiscal agents: Information on ownership and control
- AHCCCS, Sober Living Fraud: Response and Reforms
- Arizona Mirror, Medicaid Fraud Targeting Indigenous Communities Continues Despite AHCCCS Reforms (Feb. 2026)
- 12News, AHCCCS Makes Changes to Combat Widespread Fraud that Reportedly Cost Arizona $2.8 Billion
- HHS-OIG, 2024 Nationwide Health Care Fraud Enforcement Action
- HHS-OIG, Medicaid Fraud Control Units Annual Report: Fiscal Year 2024 (OEI-09-25-00090)
- U.S. Department of Justice, Criminal Division Health Care Fraud Unit, 2025 National Case Summaries