Ohio Medicaid Left $4.68 Billion Unreconciled and Unreviewed

Every state that spends federal money above a threshold files a Single Audit -- an independent annual check, performed for Ohio by the elected state Auditor's office, of whether the state complied with the rules attached to that money.▸ Ohio's Single Audit for the year ended June 30, 2025⧉, issued in March 2026, put five separate control failures on the books for the Ohio Department of Medicaid (ODM) -- the agency that ran $29.6 billion of the state's $40-billion-a-year Medicaid and CHIP programming that year, covering 2.9 million residents. Then, five months later, a July 2026 management letter⧉ -- a supplemental report an auditor writes when a deficiency is real but not severe enough to force a formal compliance finding -- added more: $857 million in provider funds ODM never reconciled, and $3.82 billion in drug-manufacturer rebates it never checked.

The two reports test different things but arrive in the same place.▸ The Single Audit is the formal, legally required document; its Medicaid findings carry federal compliance codes and get filed with the U.S. government's Federal Audit Clearinghouse. The management letter is informal by comparison -- Ohio's Auditor of State confirmed that letters like it aren't posted publicly at all, only available on request -- but its author is the same office, checking the same agency, the same fiscal year. Auditor of State Keith Faber said⧉ the office "continue[s] to identify deficiencies in Medicaid spending, which represents the largest taxpayer-funded programming in the state budget," adding that "more needs to be done to ensure public funds are being used to help the most vulnerable among us and not stolen or wasted."

The Single Audit's sharpest finding concerns something narrower than reconciliation: recovery.▸ When a review vendor flags a hospital claim as improperly paid -- billed in error, lacking pre-admission review, not medically necessary -- the state is supposed to issue a "take-back claim," an adjustment request that recoups the overpayment from the provider. In September 2023, ODM suspended processing those take-back claims through its OMES Fiscal Intermediary system. The Single Audit's testing period ran through June 30, 2025 -- 21 months after the suspension began -- and found the claims still weren't being processed; the Department told auditors it expects a backlog once the underlying system issue is fixed, with no date given for when that will happen.

Third-party liability verification -- confirming a Medicaid recipient's other insurance paid its share first -- broke down the same way.▸ It failed after ODM retired its old MITS system on July 7, 2025: the historical verification records simply didn't carry over to the replacement system, so auditors could not confirm the Department's compliance for the entire audit period.

A parallel breakdown showed up in fraud detection.▸ Ohio Benefits, the state's eligibility system, generates an alert -- called an IEVS match -- whenever a recipient's reported income disagrees with outside records like Social Security or the IRS; federal rules give county caseworkers 45 days to clear each one. Of 1,721,772 IEVS alerts the audit tracked for Medicaid and CHIP in SFY2025, 833,232 -- 48.4% -- blew that deadline⧉, clearing anywhere from 1 to 433 days late, an average of 217 days.

A separate data match found the same kind of gap on the other end of a beneficiary's life: comparing payments against Ohio's own death records turned up 13,159 payments totaling $2.5 million made on behalf of 2,165 deceased recipients.▸ Of 60 of those cases tested further, 21 (35%) had a payment the Department still hadn't recovered.

The July management letter widened the picture past claims processing and into money controls.▸ ODM had not performed the required annual reconciliation of $857 million⧉ in provider funds tied to franchise-fee assessments -- the mechanism Ohio uses to help fund its share of Medicaid. It had not obtained or reviewed the third-party administrator reports needed to confirm $3.82 billion in drug-manufacturer rebates complied with program requirements. And it had missed deadlines depositing fees and taxes it collected, which auditors warned raises the risk that "funds could be lost, stolen, or misappropriated."

On the computer systems that run all of this, auditors found "inappropriate user access and a failure to revoke access to former employees," warning that gap "increases the risk of incorrect or inappropriate payment transaction processing or the alteration of data files, which could result in misuse or fraudulent misappropriation of state resources or federal program monies" -- a labor-side control gap sitting next to the money-side ones, on a program whose eligibility determinations still lean on 88 county caseworkers and the vendors and third-party administrators ODM contracts with to process claims and rebates.▸ ODM acknowledged the letter in a written response and outlined some steps it says it's taking, though neither the Auditor's release nor the Single Audit's corrective-action plans give a firm date by which the take-back-claims backlog, the franchise-fee reconciliation, or the rebate reviews will be current.