Medicaid Parity Audits for Mental Health Parity Violations Persist, OIG Audits Show
Two new HHS Inspector General Medicaid parity audits find Medicaid MCOs in Kansas and New York still applying stricter prior authorization standards to behavioral health care than to medical care, more than six years after a federal compliance deadline passed. The findings mark OIG’s shift from a single national review to a recurring, state-by-state audit cadence.
Two state audits, four days apart, both following one 2024 review
The Mental Health Parity and Addiction Equity Act (MHPAEA) was extended to Medicaid managed care and the Children’s Health Insurance Program through a 2016 CMS final rule. It bars health plans from applying stricter limits, including prior authorization and “fail first” requirements, to mental health and substance use disorder (MH/SUD) benefits than to comparable medical and surgical (M/S) benefits. States had until October 2, 2017 to build parity provisions into their Medicaid managed care organization (MCO) contracts.
In a March 2024 review of eight states, Arizona, Illinois, Kansas, Mississippi, New Jersey, New York, South Carolina, and Texas, the HHS Office of Inspector General found that none had met that 2017 deadline. Five had not conducted timely parity analyses. MCOs in all eight applied prior authorization and similar limits more restrictively to MH/SUD services than to M/S services. In August 2026, OIG began following up on that finding one state at a time: Kansas on August 10, and New York on August 13.
Read individually, each 2026 audit looks like a state-specific finding. Read together, four days apart, they look like the start of a recurring audit cycle.
New York had a parity program. It still missed what OIG found.
New York implemented a Medicaid parity audits compliance program. OIG audited it anyway and found the program’s own analytic output, the comparison meant to prove MH/SUD and M/S denial rates were treated alike, was not sufficiently supported, or showed they were not actually comparable. That is the more uncomfortable finding: the state’s detection mechanism, not just MCO behavior, did not reliably work.
Two recommendations, both still open
From OIG report A-02-24-01011, issued August 13, 2026.
- Recommendation 1Improve policies and procedures for monitoring MCO compliance: collect and review MCOs’ supporting data, give clear uniform guidance on maintaining accurate data, and set a formal written denial-rate threshold policy.
- Recommendation 2Continue using corrective action measures, including sanctions, when MCOs do not consistently meet parity requirements.
- State responseNew York did not indicate concurrence or nonconcurrence, but described steps it has taken and plans to take.
- StatusBoth recommendations are logged as open and unimplemented; a federal update is expected February 12, 2027.
This is not a two-state story. It is an audit-design story.
Most coverage of these two Medicaid parity audits, if there is any, will treat them as isolated state findings: Kansas fell short, New York fell short. That framing misses the more consequential signal. OIG reviewed eight states together in 2024. In August 2026 it returned to two of those same eight states individually, three days apart, with a report design built to test one state’s actual compliance rather than restate a multi-state pattern. There is no confirmed OIG statement committing to audit the remaining six, Arizona, Illinois, Mississippi, New Jersey, South Carolina, and Texas. But the audit design itself, one state-specific follow-up per original 2024 finding, gives every plan in those six states a specific, checkable signal to watch rather than a vague sense that scrutiny is rising.
What the New York finding changes for delegation oversight
Mental health and substance use disorder prior authorization is frequently delegated to a managed behavioral health organization (MBHO), a vendor that manages behavioral health benefits on the plan’s behalf. When a delegate runs the utilization management program, the plan’s own visibility into MH/SUD versus M/S denial-rate comparability depends entirely on what the delegation agreement requires the MBHO to report, and what audit rights the plan actually holds to verify it independently.
New York’s finding, that the state’s own oversight mechanism did not catch a denial-rate pattern exceeding its own threshold, is the state-level version of exactly this problem: a monitoring layer that exists on paper but was not actually catching the thing it was built to catch.
A health plan cannot outsource the answer to “are we compliant” to a delegate’s self-report any more than a state can outsource it to an MCO’s own analysis without independently checking the data. The plans best positioned for whatever comes next in this audit cycle are the ones that can already produce, on short notice, a denial-rate comparison built from their own data, not their delegate’s summary conclusion.
New York had a parity compliance program. OIG audited it anyway, and found the program’s own math did not hold up.
One audit pattern, five functions carrying real exposure
Compliance
The parity analysis moves from an annual filing to something that has to survive an external audit of its own supporting data, the exact gap OIG found in New York.
Utilization Management
MH/SUD prior authorization criteria need the same non-quantitative treatment limit comparison against M/S criteria that parity actually requires, not just an outcomes-level denial-rate count.
Delegation Oversight
Where an MBHO runs behavioral health utilization management, the plan needs contract data rights sufficient to run its own parity comparison, not reliance on the delegate’s self-reported compliance.
Data and Reporting
A repeatable, defensible extract comparing MH/SUD and M/S denials by benefit classification becomes a standing requirement, not a one-time pull assembled after a request arrives.
Legal
State correspondence and any corrective action requirements tied to parity findings need tracking against response timelines and documentation standards, the same discipline any audit response requires.
The audit didn’t just check a filing. It checked whether the math holds up.
No single function owns this on its own. The table below assigns responsibility; the list after it sequences the work.
| Function | Required response | Evidence to retain |
|---|---|---|
| Compliance | Own the parity analysis methodology and its documentation; confirm it compares MH/SUD and M/S non-quantitative treatment limits within the same benefit classification, not just aggregate denial counts. | Written parity analysis, denial-rate comparison data, and methodology documentation for the most recent plan year. |
| Utilization Management / Clinical Operations | Review MH/SUD prior authorization criteria against comparable M/S criteria for processes, strategies, and evidentiary standards, not just outcomes. | UM criteria sets, clinical review policies, and any criteria-change logs for MH/SUD versus M/S service lines. |
| Delegation Oversight / Vendor Management | Confirm delegation agreements with MBHOs and other behavioral health delegates require data sufficient for the plan to run its own parity comparison, plus audit rights to verify it. | Delegation agreements, MBHO-reported denial and authorization data, and delegate oversight audit records. |
| Data and Reporting | Build or validate a repeatable extract that isolates MH/SUD and M/S prior authorization decisions by benefit classification for comparison, not a manual, one-time pull. | Data lineage documentation and a reproducible denial-rate report by benefit classification. |
| Legal | Track state correspondence and any corrective action requirements tied to parity findings, and confirm response timelines and documentation standards are met. | Correspondence log with the state Medicaid agency and any corrective action plan documentation. |
Within 7 days
Confirm whether your state was named in OIG’s March 2024 eight-state review (Arizona, Illinois, Kansas, Mississippi, New Jersey, New York, South Carolina, Texas) and, if so, brief compliance leadership on the Kansas and New York follow-up audits as a likely leading indicator.
Pull your most recent MH/SUD versus M/S denial-rate comparison and confirm it is dated, methodology-documented, and supported by underlying data, not just a summary conclusion.
Within 30 days
Reconcile MH/SUD prior authorization criteria against comparable M/S criteria specifically for non-quantitative treatment limits (prior authorization, fail-first requirements, and similar utilization management tools), not just financial requirements or quantitative limits.
Confirm delegation agreements with any MBHO or behavioral health utilization management vendor require the data and audit rights needed to run the plan’s own parity comparison independent of the delegate’s self-reported compliance status.
Within 60-90 days
Establish a recurring (at minimum annual) parity analysis cadence with a named compliance owner, rather than a one-time filing revisited only on state request.
If your state has not yet formally documented a denial-rate threshold policy and required MCO actions when it is exceeded, as OIG recommended New York do, raise that gap directly with your state Medicaid contract manager rather than waiting for the state to close it unprompted.
OIG’s shift from a single, multi-state systemic review to individual, state-specific follow-up audits is a meaningful change in enforcement design. This is an operational inference drawn from the audit pattern OIG has begun, not a confirmed OIG policy statement. A single national report is a one-time event a state can absorb and move past. A rolling cycle of state-specific audits, arriving on no announced schedule, is a standing condition a state’s Medicaid agency, and its contracted MCOs, must be prepared for continuously.
The New York finding adds a second, more uncomfortable observation: this state had a parity compliance program, and it still did not catch what OIG’s audit found on a second look. That is not evidence that New York’s program was performative. It is evidence that a compliance program built to produce an annual analysis is a different thing than a compliance program built to withstand an external audit of that analysis’s own supporting data. Health plans that treat parity as a documentation deliverable, rather than as an ongoing analytics function with its own audit trail, carry the same exposure New York’s program had, regardless of which state they operate in.
Questions payer leaders should ask
- 01Does our MH/SUD prior authorization denial rate, measured against comparable medical and surgical services in the same benefit classification, hold up against our own state’s compliance threshold, and can we produce the supporting data on request?
- 02If a delegated MBHO manages our behavioral health prior authorization program, do we have the contractual data access and audit rights to independently verify its parity compliance, or are we relying on the delegate’s own assurance?
- 03When was our parity analysis methodology last challenged or independently reviewed, rather than simply renewed on the same template?
- 04Is our state one of the six named in OIG’s 2024 review that has not yet received a state-specific follow-up audit, and if so, what would we need to produce if one arrived this quarter?
- 05Who in our organization owns parity compliance as a standing function, rather than an annual filing exercise?
- 06Does our evidence retention practice let us reconstruct exactly what data supported our most recent parity analysis, not just its conclusion?
Sources
- HHS Office of Inspector General, “New York Did Not Ensure That Selected Medicaid Managed Care Organizations Complied With Mental Health and Substance Use Disorder Parity Requirements Related to Prior Authorization” (Report A-02-24-01011, issued August 13, 2026)
- HHS Office of Inspector General, “CMS Did Not Ensure That Selected States Complied With Medicaid Managed Care Mental Health and Substance Use Disorder Parity Requirements” (2024 eight-state review)
- Georgetown University Center for Children and Families, “Federal Inspector General Highlights Medicaid Managed Care Mental Health Parity Failings” (April 4, 2024)
- Medicaid.gov, “Parity for Mental Health and Substance Use Disorder Benefits”
- Companion audit: HHS OIG’s Kansas parity compliance audit, completed August 10, 2026 (title and date independently corroborated; a resolvable OIG report page URL could not be verified at time of writing, so it is referenced in the article text without a hyperlink).
Until next week, stay briefed.
Frequently asked questions
What is Medicaid mental health parity, in plain terms?
Medicaid mental health parity requires that health plans not apply stricter limits, such as prior authorization or “fail first” requirements, to mental health and substance use disorder (MH/SUD) benefits than they apply to comparable medical and surgical (M/S) benefits. The requirement extends the Mental Health Parity and Addiction Equity Act to Medicaid managed care through a 2016 CMS final rule, with a compliance deadline of October 2, 2017.
What did OIG actually find in New York?
OIG found that three selected New York Medicaid managed care organizations’ prior authorization denial rates for MH/SUD services exceeded the state’s own compliance threshold, and that the MCOs’ comparative analyses supporting their parity claims were not sufficiently documented. Both findings applied more than six years after the federal parity deadline.
Is this the same as the 2024 OIG report on eight states?
No. The 2024 report reviewed whether eight states, including New York and Kansas, had built parity requirements into their MCO contracts and conducted timely analyses. The 2026 audits are state-specific follow-ups that test whether those states’ MCOs are actually complying with prior authorization parity requirements in practice.
Does this apply to Medicare Advantage plans?
This specific audit series covers Medicaid managed care organizations. Parity requirements under MHPAEA apply differently across commercial, Medicaid, and Medicare markets, and MA plans should confirm their own applicable parity obligations separately rather than assuming this finding transfers directly.
What should a health plan in one of the other six named states do now?
Treat the Kansas and New York audits as a leading indicator rather than an isolated event. Confirm the plan’s own MH/SUD versus M/S denial-rate comparison is current, documented, and supported by underlying data, and confirm delegation agreements with any behavioral health utilization management vendor provide the access needed to verify that vendor’s own parity performance.