Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer: Plan for 150 to 210 Days, Not 90
Behavioral health operators enrolling or revalidating Medicaid in Arizona, Tennessee, Indiana, Nevada, or Kentucky should plan for 150 to 210 days from clean application to active billing, not the 90 days most pro formas still assume. State Medicaid agencies quietly moved enrollment and revalidation from a paperwork exercise into a fraud-control checkpoint, and CMS gives them the legal cover to do it under 42 CFR Part 455.
The Arizona Health Care Cost Containment System (AHCCCS) is still working through the fallout from the 2023 sober-living fraud sweep. AHCCCS confirms that since May 2023 it has suspended more than 300 providers, assisted over 10,000 individuals with the humanitarian response, and implemented more than 20 new initiatives to combat fraud, waste, and abuse in the Medicaid program.
Reporting from the Arizona Center for Investigative Reporting and ProPublica put earlier numbers on the recovery tempo: the state had indicted more than 100 individuals and recouped $125 million, or about 5% of the funds the state estimates it paid to bad actors. Attorney General Kris Mayes has since updated those figures, reporting 140 indictments to date and a 92% decline in fraudulent billing on the American Indian Health Plan since 2023. Mayes framed the posture bluntly: “Arizona is a national leader in combating Medicaid fraud because we made it a priority.”
The pattern is wider than Arizona. TennCare tightened site-visit protocols. Indiana’s FSSA pushed revalidation packets with new ownership-disclosure attachments. Nevada Medicaid added a secondary review tier for SUD outpatient enrollments. Kentucky’s Department for Medicaid Services slowed new SUD residential enrollments while it works through an enforcement backlog. None of it comes with a press release. Operators find out when their credentialing coordinator calls to say the enrollment that used to take 90 days is now sitting at 187. Or when a CMS-1500 batch hits a denial wall because the rendering provider’s revalidation lapsed and nobody flagged it.
What CMS Actually Requires: 42 CFR 455, Fingerprints, and the 35-Day Trap
CMS gave states the legal cover to do all of this. The screening framework at 42 CFR Part 455, Subpart E lets state Medicaid agencies demand fingerprint-based background checks, unannounced site visits, and enhanced disclosures for higher-risk categories. Behavioral health, particularly SUD residential and outpatient, sits squarely in the high-risk bucket in most state plans now.
Two regulatory hooks matter for operators. First, 42 CFR 455.414 requires state Medicaid agencies to revalidate every provider at least every five years. Operators who enrolled in 2021 during the COVID public health emergency flexibilities are coming due now, and the documentation bar has moved.
Second, operators keep tripping over 42 CFR 455.104, which lists exactly when ownership disclosures are due: upon submitting the provider application, upon executing the provider agreement, upon request during revalidation, and within 35 days after any change in ownership of the disclosing entity. Every person or entity with 5% or more ownership. Every managing employee. Every subcontractor relationship. If your cap table shifted because of a PE recapitalization or a minority investor came in, and nobody filed within the 35-day window, your revalidation will get kicked back. Federal financial participation is not available in payments made to a disclosing entity that fails to disclose.
What that means in the revenue cycle: our team has watched denial rates jump from 4% to 18% almost overnight when a provider goes inactive mid-cycle. Days in AR is the metric that tells you whether your credentialing function is keeping up. If your days in AR are creeping past 55 and your denial reasons are clustering around provider eligibility, enrollment status, or taxonomy mismatches, your enrollment file is the problem, not your billers.
Site Visits Are Not What They Were Two Years Ago
Medicaid site visits used to be a checklist exercise. A surveyor walked the building, confirmed the address matched the application, looked at a few charts, and left. That is over.
In Arizona, AHCCCS site visits are often unannounced, paired with an OIG investigator, and surveyors pull staff rosters against the National Practitioner Data Bank and the OIG List of Excluded Individuals and Entities (LEIE) in real time. Attorney General Mayes has been clear about the shift, telling reporters her office has driven a 92 percent decline in behavioral health code billing on the American Indian Health Plan since 2023. Governor Katie Hobbs has now layered on an AI tool designed to detect and block fraudulent Medicaid claims before payment. Translation for operators: the posture is not going back to 2019.
If a clinician on your roster shows up on the LEIE and you are billing Medicaid for their services, that is a False Claims Act exposure, not a paperwork problem. Under 42 CFR 455.436, state Medicaid agencies must check the LEIE and SAM (formerly EPLS) no less frequently than monthly. That is the federal floor, not a suggestion.
What surveyors look for on a behavioral health site visit, in plain terms:
- Whether the physical site matches what you said it was.
- Whether the credentialed clinicians are actually working there.
- Whether the schedules and time records line up with the claims you are submitting.
- Whether you can produce a current OIG/SAM exclusion check for every employee and contractor.
Run LEIE and SAM.gov exclusion checks monthly, not at hire. Monthly. Document each one. The two minutes it takes is the cheapest insurance you can buy against a treble-damages FCA case.
Our compliance team supported a Joint Commission survey in South Carolina in May where the surveyor finished faster than scheduled because the operator could produce, on demand, every exclusion check, every credentialing file, and every ownership disclosure. That same file discipline is what gets you through a Medicaid site visit without a corrective action plan.
The FWA-Readiness Audit Every Operator Should Run This Quarter
If you operate in any of the five states above, treat the next 90 days as an internal FWA audit window. The enforcement math is unforgiving.
The DOJ’s 2024 National Health Care Fraud Enforcement Action charged 193 defendants, including 76 doctors, nurse practitioners, and other licensed medical professionals in 32 federal districts, for schemes involving approximately $2.75 billion in intended losses and $1.6 billion in actual losses. Addiction treatment was a named focus: four defendants in two district courts were charged with a $146 million scheme that used kickbacks and other methods to recruit vulnerable individuals, such as the homeless, into drug and alcohol treatment programs, even though those services may never have been provided. The government seized over $231 million in cash, luxury vehicles, gold, and other assets in the coordinated action.
State Medicaid Fraud Control Units are catching more, too. The HHS-OIG FY 2024 MFCU report shows 1,151 convictions, $961 million in criminal recoveries, $407 million in civil recoveries, and 1,042 exclusions of individuals and entities from federally funded programs. Criminal recoveries jumped from $272 million in FY 2023 to $961 million in FY 2024, the highest total over the 10-year period. The enforcement money is following the enrollment money.
Here is the short version of what we run for operators on our managed compliance services:
- Pull every active Medicaid enrollment record. Confirm the ownership disclosure on file matches your current cap table within the last 35 days. If it does not, file a change-of-information today.
- Reconcile your credentialed provider roster against payroll and against your billing data. Anyone billing who is not credentialed, or credentialed who is not billing, is a flag.
- Run LEIE and SAM.gov exclusion checks on every employee, contractor, and board member. Save the screenshots with dates.
- Audit your prior authorization and utilization management files. Pull 20 random charts and confirm the level of care billed matches what was authorized and what the ASAM Criteria 4th Edition assessment actually supported. If you billed residential withdrawal management but the assessment supports a lower level, you have a refund obligation, not a defense.
- Review your single-case agreements and out-of-network arrangements. SCAs that were verbal or never countersigned are denial bait and audit bait.
- Confirm your compliance program has documented training in the last 12 months for every employee, with sign-in sheets, on FWA, HIPAA, and the False Claims Act.
How AHS Helps Operators Stay Ahead of This
Atlantic Health Strategies sits on the operator side of this. Our team runs managed compliance and payer strategy for treatment centers across the lifecycle, from feasibility study and licensure through accreditation, into payer enrollment, and through the revenue cycle.
A Kentucky SUD residential operator we supported through licensure in April watched their Medicaid enrollment timeline run nearly six months from clean application to active billing. We had the licensure. We had the Joint Commission survey on the calendar. The state still took its time on the enrollment review. That is the new normal.
The Joint Commission accreditations our team earned in May across five facilities in three states, and the Kentucky detox and residential licensure we shepherded from property acquisition through opening, came from the same file discipline we apply to Medicaid enrollment. Every disclosure current. Every roster reconciled. Every chart defensible.
If your operations sit in Arizona, Tennessee, Indiana, Nevada, Kentucky, or any other state where Medicaid enrollment is tightening, get your enrollment files into audit-ready shape before a surveyor or an MFCU investigator makes that decision for you. AHS runs state-by-state Medicaid enrollment reviews, FWA-readiness audits, and managed credentialing for operators who would rather pay for prevention than pay defense counsel.
Frequently asked questions
How long does Medicaid behavioral health enrollment realistically take in Arizona, Tennessee, Indiana, Nevada, or Kentucky in 2025-2026?
Plan for 150 to 210 days from clean application to active billing, not the 90 days many pro formas still assume. State agencies are layering enhanced screening under 42 CFR Part 455, Subpart E, including fingerprint-based background checks and unannounced site visits for high-risk categories like SUD residential and outpatient. AHCCCS alone reports having suspended more than 300 providers and implemented more than 20 new fraud, waste, and abuse initiatives since May 2023, and that posture is now baked into how enrollments are reviewed.
What triggers a Medicaid revalidation kickback under 42 CFR 455.104?
The most common trigger is a missed 35-day change-of-information filing after a cap table change. 42 CFR 455.104 requires disclosure within 35 days after any change in ownership of the disclosing entity, covering every person or entity with 5% or more ownership, every managing employee, and every subcontractor. If a PE recapitalization closed or a minority investor came in and the filing was missed, the revalidation will bounce, and federal financial participation is not available in payments to a disclosing entity that fails to disclose.
How often should behavioral health operators run LEIE and SAM.gov exclusion checks?
Monthly, at minimum, for every employee, contractor, and board member. That is the federal floor under 42 CFR 455.436, which requires state Medicaid agencies to check the LEIE and SAM no less frequently than monthly. Save dated screenshots for each check. Billing Medicaid for services rendered by an excluded individual is a False Claims Act exposure, not a paperwork mistake, and MFCUs reported 1,042 exclusions in FY 2024 alone, per HHS-OIG.
Why should PE-backed behavioral health buyers care about Medicaid enrollment timing during diligence?
Because enrollment status and ownership disclosures directly affect close mechanics, working capital, and post-close revenue. If the target’s 5% ownership disclosures do not reflect the buyer’s post-close cap table within 35 days of the transaction, federal financial participation is not available in payments to the disclosing entity that fails to disclose, and the state can suspend billing during revalidation. In states like Arizona and Kentucky, that suspension can easily stretch six months. Sophisticated buyers now model a 150- to 210-day enrollment tail into their post-close revenue ramp and their working capital line, rather than trusting the seller’s 90-day assumption.
References
- AHCCCS: Sober Living Fraud response and provider suspension data
- ProPublica / Arizona Center for Investigative Reporting: Arizona Has Recovered Just 5% of Taxpayer Dollars Lost in $2.5B Medicaid Fraud Scheme
- FOX 10 Phoenix: 140 indicted in billion-dollar Medicaid scheme (AG Mayes update)
- HHS-OIG / DOJ: 2024 National Health Care Fraud Enforcement Action press release
- HHS-OIG: Medicaid Fraud Control Units Annual Report, Fiscal Year 2024
- eCFR: 42 CFR 455.104 – Disclosure by Medicaid providers on ownership and control
- eCFR: 42 CFR Part 455 – Program Integrity: Medicaid
- CMS Toolkit: Disclosures of Ownership and Control under 42 CFR 455.104