When Governor Butch Otter asked me to serve on the Idaho Health Insurance Exchange board, I agreed on one non‑negotiable condition: that an independent outside auditor be hired and funded to document, in detail, how taxpayer dollars flowed through that new organization. That requirement was adopted, written into the exchange’s governance, and ultimately led to recurring external audits that follow the money rather than the politics. Having seen firsthand how powerful that simple structural protection can be, I am convinced Idaho’s much larger Department of Health and Welfare—and its sprawling Medicaid programs—deserve nothing less. Independent outside audits should become a routine feature of how we oversee Medicaid contracting, enrollment, coding, and reimbursements to large hospital systems and insurance companies, not an emergency measure we dust off after the money is already gone.
Idaho is not starting from scratch. The Department of Health and Welfare already has a Medicaid Program Integrity Unit that audits providers, reviews documentation, recovers overpayments, and can impose civil penalties. The Attorney General’s Medicaid Fraud Control Unit investigates criminal fraud, neglect, and abuse, and has secured convictions and recoveries from providers who tried to game the system. On top of that, federal agencies periodically review Idaho’s performance; last year the Centers for Medicare and Medicaid Services (CMS) completed a focused program‑integrity review of Idaho’s Medicaid managed‑care oversight. These are serious efforts by competent people, and they deserve credit. But in a program that now involves billions of dollars, complex managed‑care contracts, and sophisticated billing operations by large health systems and insurers, relying primarily on internal audits and occasional federal spot‑checks is not sufficient.
CMS’s recent review of Idaho’s Medicaid managed‑care program should be a wake‑up call. Federal reviewers found that Idaho’s managed‑care plans reported relatively low levels of identified overpayments and recoveries for a program of this size, and that there were discrepancies between what the plans said they recovered and what the state reported to CMS. The report also flagged weaknesses in how Idaho incorporates information about overpayments into future rate‑setting for managed‑care organizations. In plain English: too little improper payment is being found, the numbers do not always match up, and lessons from the problems that are found are not consistently being baked back into what we pay health plans going forward. That is not necessarily evidence of bad faith, but it is evidence of a system that could easily miss large patterns of waste, abuse, or fraud.
The risk is not abstract. Nationally, the federal Office of Inspector General has documented how coding errors and documentation failures in hospital billing can produce tens of millions of dollars in overpayments in a single category of claims. Analyses of Medicaid improper payments suggest that the true level of error and abuse may be roughly double the already staggering official numbers reported by CMS. Some of that is classic “fraud” in the popular sense; much of it is a more subtle combination of upcoding, aggressive contracting, and systemic sloppiness that shifts huge amounts of taxpayer money in ways no one intended. Idaho is not magically exempt from these national dynamics.
The vulnerabilities in our state of Idaho, cluster around four obvious pressure points:
First, contracting with large hospital systems and insurance companies. Managed‑care and network contracts now determine the flow of enormous sums of Medicaid money, often using intricate formulas that blend capitation, risk scores, and quality‑based bonuses. CMS has already noted that Idaho’s managed‑care plans report relatively low overpayment recoveries and that the state’s oversight of those recoveries has gaps. When a handful of large entities (large corporations and non-profits) whose lobbyists sit at the right hand of many of our politicians, while also sitting on top of that much public money, negotiated largely out of public view by lobbyist and bureaucratic cronies, it is simply prudent to have independent auditors digging through those contracts, payment flows, and rate‑setting assumptions.
Second, enrollment and eligibility. Across the country, federal audits have found state Medicaid agencies making substantial unallowable capitation payments to managed‑care organizations on behalf of individuals who were not actually eligible or were enrolled in the wrong program or at the wrong rate. Idaho is not immune to eligibility complexity; we have seen rapid churn as pandemic‑era continuous coverage has ended, and our systems must coordinate data across multiple programs and contractors. Independent auditors with no stake in the enrollment numbers should be routinely sampling files, examining data transfers between the department, contractors, and the exchange, and asking a simple question: are we paying the right amount for the right people at the right time?
Third, coding and billing for procedures. Idaho’s own Medicaid Program Integrity Unit guidelines list familiar problems: billing for services not rendered, misrepresenting the service provided, using unqualified staff, and employing providers who are excluded from the program. Those are important, but they typically rely on case‑by‑case reviews and provider self‑reports. In an era when hospitals and large physician groups use sophisticated billing software and consultants to optimize reimbursement, we need equally sophisticated analytics on the state’s side—data‑mining of high‑dollar Diagnosis‑Related Groups, comparisons of procedure patterns across providers, and focused reviews of outliers. That kind of work is exactly what many independent firms already do for other states and for private health plans.
Fourth, reimbursements to large hospital systems and insurers. CMS’s review emphasized that Idaho’s managed‑care contracts require plans to suspend payments when there is a credible allegation of fraud, but only when the state directs them to do so. That means the effectiveness of this safeguard hinges on the state having timely, accurate, and independent information about where problems may lie. Outside auditors can be tasked explicitly with identifying patterns of suspicious payments and recommending targeted suspensions or recoupments, giving the state leverage it currently lacks.
Why insist on independent outside audits rather than simply beefing up the internal units we already have? The answer is not that state employees are incapable; it is that incentives and perspectives matter. Internal auditors and program staff work within the same hierarchy and budget constraints as the managers whose decisions they are examining. Their careers depend, at least in part, on relationships inside the department and on the department’s public reputation. An external audit firm, by contrast, lives or dies by its credibility as a tough, fair examiner of the numbers. Its contractual duty is to the board, the legislature, or the public body that hired it, not to the managers whose work is under review.
We actually have proof of concept in Idaho. The health insurance exchange, Your Health Idaho as mentioned above, has for years hired an independent outside audit firm to conduct both financial‑statement audits and programmatic “independent external audits” under federal rules. Those firms have tested the exchange’s financial controls, eligibility and enrollment processes, and the handling of federal funds, and reported directly to the board and its finance committee. That is precisely the structural protection we should replicate for Medicaid and major Health and Welfare programs: outside eyes, clear lines of reporting, and public documentation of findings and corrective actions.
The Legislature does not need to reinvent the wheel. Federal law already requires states to establish Medicaid Recovery Audit Contractor (RAC) programs that use outside contractors to identify over‑ and under‑payments in Medicaid claims. Idaho’s own Medicaid State Plan expressly commits the state to contracting with one or more RACs for that purpose, although at times the state has sought exceptions when contracts expired and needed to be rebid. In other words, we have already conceded in principle that independent contractors are appropriate tools for examining Medicaid payments; we simply have not fully embraced what that logic implies for the rest of DHW’s high‑risk activities.
A sensible reform package would have four parts:
First, a statutory mandate for recurring independent audits. The Legislature should require DHW to issue competitive RFPs for independent audits in three areas: (1) large‑provider and hospital‑system claims, (2) managed‑care capitation and overpayment reporting, and (3) high‑risk eligibility and enrollment processes. Audit firms should be barred from simultaneously holding DHW contracts in the areas they are auditing, and their engagements should be time‑limited and rotated to avoid cozy relationships.
Second, strong transparency requirements. Executive summaries of each audit—dollars tested, overpayments and underpayments identified, major control weaknesses, and agreed corrective actions—should be made public, with personal health information and legitimate trade secrets redacted. The point is to give taxpayers, providers, and legislators a clear picture of where the money is going and where it is leaking.
Third, coordination with existing integrity units. The Medicaid Program Integrity Unit and the AG’s Medicaid Fraud Control Unit should not be sidelined; they should be strengthened. Audit findings that suggest criminal conduct should be referred promptly for investigation. Patterns of error that do not rise to criminal fraud should feed into provider education, civil recoupment, and contract changes. Internal staff bring program knowledge and local context; outside auditors bring scale and independence. Used together, they are far more effective than either would be alone.
Fourth, real performance metrics. The goal of independent outside audits is not simply to publish thick reports; it is to change behavior and save money. The state should track dollars recovered, sustained over time in appeals; measurable reductions in error rates in follow‑up audits; improvements in CMS’s assessments of Idaho’s program integrity; and even secondary metrics such as faster suspension of suspect payments. If the audits are not producing measurable benefits, they should be redesigned or firms replaced.
Some will object that this sounds like an expensive luxury in a tight budget. That gets the logic exactly backwards. In programs that move billions of dollars, modest investments in independent oversight often pay for themselves many times over in recovered funds and avoided losses. When I insisted on an independent outside auditor for the Idaho Health Insurance Exchange, not knowing that it would be a federal mandate for the program, I did so because I believed taxpayers deserved more than assurances; they deserved verification. The same principle applies, with even greater force, to the Department of Health and Welfare and Medicaid. If we are going to ask Idahoans to take a big gulp when they look at the size and complexity of these programs, the least we can do is guarantee that someone truly independent is following the money.
A big gulp of spending requires a big swallow of accountability. There is only one reason to avoid that kind of accountability, and its’ not good—some may call it corrupt!
