Medicaid Compliance

This section outlines regulatory compliance program requirements for Medicaid.

Delegate/Vendor Oversight: Medicaid Programs

  • As part of our Compliance & Ethics program, UnitedHealth Group has adopted an enterprisewide Code of Conduct detailing the organization’s commitment to acting with integrity.

    For Medicaid programs, the Deficit Reduction Act of 2005 requires established written policies and procedures to support fraud, waste and abuse (FWA) prevention efforts for employees and subcontractors, including requiring delegates to distribute to their employees either the delegate’s code of conduct or the UnitedHealth Group Code of Conduct.

    The Code of Conduct can be shared with the delegated entity as a resource detailing key compliance policies and procedures.

    Standards of Conduct must be distributed within 90 days of hire and annually thereafter.  Delegates must retain proof of distribution for each employee. (See Document Retention

    Find the UnitedHealth Group Code of Conduct in the Standards of Conduct section. 

    • In accordance with the Deficit Reduction Act of 2005 and UnitedHealth Group’s written policies, vendors are required to support our Fraud, Waste & Abuse (FWA) prevention efforts and establish written policies and procedures (P&Ps) for delegated entities’ employees and subcontractors.

    • Vendor agreements also describe the expectations regarding FWA obligations.

    • Vendors must have an established compliance program and P&Ps that describe:
      • The False Claims Act;
      • FWA prevention;
      • State-specific requirements;
      • Implementation of reporting expectations;
      • The mechanism for employees/subcontractors to report FWA; and
      • How to document completion of employee training.

    Confidential reports can be made to UnitedHealth Group’s Vendor Fraud Hotline: 877-401-9430

    For Medicaid, delegates must demonstrate awareness of program or state-specific FWA regulations and training on policies developed for FWA prevention efforts.

    FWA Prevention Efforts Training

    For Medicaid, delegates can provide proof of training by distribution of training materials or policies that provide detailed information on:

    • The False Claims Act;

    • Prevention and detection of FWA including expectations for employees reporting suspected false claims;

    • Whistleblower protections and assurance of nonretaliation for good faith reporting; and

    • Any state-specific requirements.

    See the Code of Federal Regulations: Managed Care.

    Find more information on Reporting Suspected FWA

    • Delegated entities* must review the federal exclusion lists maintained by the Office of Inspector General and the U.S. General Services Administration.

    • Reviews of exclusion lists must be completed prior to hiring or contracting with employees and must continue on a monthly basis.

    • If required by the state, a delegated entity must also review the state level exclusion list for individuals or entities excluded by state Medicaid programs for participating in or receiving payment from that state’s Medicaid program.

    • Proof of the method used (policy or procedure), date performed, employee list and results found must be documented and retained

    • Delegates serving Medicaid Community Plans or membership programs must review state level exclusion lists, if applicable.


    • UnitedHealthcare is required to collect disclosure of ownership, controlling interest and management information from subcontractors that participate in the Medicaid and/or the Children’s Health Insurance Program (CHIP) managed care network pursuant to a Medicaid and/or CHIP state contract with the state agency and the federal regulations set forth in 42 CFR Part §455. This information is collected via the form, accessible below, and should be submitted upon contracting and updated every three (3) years or at the renewal of the contract and at any time there is a revision to the information or upon a request for updated information. Also, information must be provided within 35 days of a request for this information.


    Notification is required for excluded individuals or entities. UnitedHealth Group Compliance & Ethics Help Center: 800-455-4521

    *Delegated entities are required to review all employees, providers and subcontractors -- including those individuals identified in the Disclosure of Ownership and Control Interest Statements -- against the exclusion lists.

    Find more information on Exclusion Checks.


  • Delegates must retain records for 10 years to show compliance with requirements.

    Find more information on Document Retention.

    • Vendors must seek pre-approval for any offshoring activities, as many states expressly prohibit offshoring.

    • Notification is required prior to moving services offshore.

    • Delegates serving Medicaid Community Plan or membership programs must work through their UnitedHealth Group contact to obtain express written approval prior to moving services offshore, as many state contracts prohibit this activity.

    Find more information on Downstream Delegates.