A Medicaid investigation can take anywhere from a few weeks to more than three years, and no statute forces the government to finish by any particular date. How long a Medicaid investigation takes depends on what triggered it, how complicated the billing or eligibility question is, how quickly everyone involved turns over records, and whether more than one agency is working the case. A simple eligibility review may close in a month. A multi-provider fraud case built on years of claims data routinely runs past two years before charges or a settlement appear.
Typical Timelines by Case Type
Simple eligibility reviews and minor billing discrepancies often resolve in a few weeks to a few months. These involve limited records, a small number of claims, and little dispute about the facts. The state reviews the documentation, makes a determination, and either closes the case or recoups the overpayment.
Mid-level investigations, such as a provider who systematically billed for a higher level of service than was delivered, tend to run six months to a year. Investigators have to compare clinical documentation against billing codes across a meaningful sample of claims, and that usually means chart-by-chart review with a clinical consultant.
Large-scale fraud cases routinely exceed a year and sometimes stretch to three years or more. These are the cases with forensic accounting, multiple rounds of subpoenas, grand jury proceedings, and coordination across agencies. In fiscal year 2025, Medicaid Fraud Control Units reported 856 fraud convictions and 674 civil settlements and judgments.1U.S. Department of Health and Human Services Office of Inspector General. Medicaid Fraud Control Units Annual Report: Fiscal Year 2025 Each of those outcomes represents a case that was investigated, built, negotiated or tried, and resolved, and for many of them the work began years before the final number was recorded.
What Drives the Length
Case complexity is the single biggest driver. An eligibility question for one beneficiary who moved between states might wrap up in weeks. A billing fraud case involving a chain of clinics, shell companies, and years of falsified records can take two or three years before charges are filed. The more people, facilities, and transactions investigators have to trace, the longer every phase takes.
Cooperation compresses timelines. When providers or beneficiaries respond promptly to document requests and sit for interviews, the process moves. Stonewalling, hiding records, or pursuing every possible procedural delay extends it, and investigators tend to read resistance as a reason to dig deeper.
Agency workload matters too. MFCUs handle fraud, patient abuse, and neglect cases at the same time, and their staffing varies widely by state. A unit juggling hundreds of open investigations moves more slowly on any single one. Cases that involve coordination between a state MFCU, the federal HHS Office of Inspector General, the FBI, and the Department of Justice add logistical layers that stretch things further.
The type of allegation shapes the pace as well. A beneficiary suspected of failing to report income sits inside a relatively contained fact pattern. A physician accused of prescribing unnecessary controlled substances to generate Medicaid billings faces clinical, financial, and potentially criminal tracks running in parallel, each with its own pace.
How Far Back the Government Can Reach
Investigations don’t stay open forever, but the windows are wider than most people expect. For civil monetary penalties under the primary federal Medicaid fraud statute, the government has six years from the date a false claim was submitted to initiate proceedings.2Office of the Law Revision Counsel. 42 US Code 1320a-7a – Civil Monetary Penalties For criminal healthcare fraud charges, the general federal statute of limitations is five years from the date of the offense.3Office of the Law Revision Counsel. 18 US Code 3282 – Offenses Not Capital
The False Claims Act clock is the most generous for the government. A civil action must be brought within six years of the violation or within three years of when a responsible government official knew or should have known about it, whichever is later, but no more than ten years after the violation occurred.4Office of the Law Revision Counsel. 31 US Code 3731 – False Claims Procedure That ten-year outer boundary is why fraud from years ago can still trigger an investigation today, especially when a whistleblower has recently surfaced it.
Federal audit policy generally follows a five-year look-back period, running from the date the provider receives a notification letter, and CMS keeps discretion to extend the window when the facts justify it.5Centers for Medicare & Medicaid Services. CPI Informational Bulletin – Audit Look-Back Period The practical takeaway for any provider: keep billing records and supporting clinical documentation for at least six years, longer if you have any reason to believe a review is coming.
What Happens While the Investigation Is Open
For providers, the wait isn’t neutral. Federal regulations require state Medicaid agencies to suspend all payments to a provider once there is a credible allegation of fraud and a pending investigation, unless the agency finds good cause not to. The agency must send written notice of the suspension within five days of taking action, though law enforcement can request a delay of up to 90 days if notifying the provider would compromise the investigation.6eCFR. 42 CFR Part 455 Subpart A – Medicaid Agency Fraud Detection and Investigation A payment suspension can outlast the investigation itself and is often the most immediate financial pressure a provider feels.
Good cause exceptions exist. A state may lift the suspension if the provider is the sole source of specialized care in a medically underserved area, if law enforcement specifically asks that payments continue to avoid tipping off a target, or if the state determines the suspension is not in Medicaid’s best interest. Those exceptions are narrow, and the default is suspension first.
During the investigation itself, investigators collect documents, issue subpoenas for specific categories of records, and interview beneficiaries, staff, and other providers who dealt with the subject. Data analysts compare billing patterns against statistical baselines to flag outliers that might signal upcoding, unbundling, or billing for services never rendered. Each of those steps takes time on its own, and each one can loop back for follow-up when something new turns up.
What to Do If You’re Under Investigation
Nobody is required to speak with government investigators absent a subpoena compelling testimony. Investigators may downplay the seriousness of the inquiry or suggest an attorney is unnecessary, and that suggestion rarely aligns with the subject’s interests. If you receive a subpoena, an audit notification, or any signal that your billing or eligibility is being reviewed, consulting a healthcare fraud attorney early is the single most impactful step you can take. How your counsel communicates with the government in the early weeks often shapes whether the case stays civil or escalates to criminal.
Providers whose payments have been suspended have the right to submit written evidence to the state Medicaid agency explaining why the suspension should be lifted or reduced.6eCFR. 42 CFR Part 455 Subpart A – Medicaid Agency Fraud Detection and Investigation The suspension notice must describe the general nature of the allegations and explain the state’s administrative appeals process. Ignoring the notice or waiting for the investigation to resolve on its own is the wrong move. On the beneficiary side, if an investigation results in a loss of eligibility or a reduction in services, federal regulations give you the right to request a fair hearing, and the agency’s notice has to explain how.7eCFR. 42 CFR 431.220 – When a Hearing Is Required Requesting the hearing promptly after receiving the adverse notice often lets services continue while the appeal is pending. Every deadline in the notice is real. Missing one can turn a contestable finding into a final answer you can no longer challenge.