Audit Estimates Oregon Medicaid System Had Over 11,000 Duplicate IDs and Up to $4.1 Million in Duplicate Payments

Oregon — Oregon’s Medicaid program made duplicate payments for some recipients enrolled under multiple identification numbers, exposing weaknesses in state controls and creating a potential federal compliance risk, according to a new state audit.

The Oregon Secretary of State audit estimated that the Oregon Health Authority paid coordinated care organizations between approximately $232,000 and $4.1 million in duplicate monthly payments from 2020 through 2024.

The audit did not find that federal funding had already been reduced or withheld. It warned, however, that continued failure to identify, recover and report overpayments could place federal funding at risk because states must comply with federal Medicaid requirements.

Oregon spent $19 billion on Medicaid in 2025, including $13 billion in federal funding. About 1.4 million people, or one in three Oregonians, were enrolled as of January 2026.

“If Oregon does not comply with federal Medicaid rules, the federal government can reduce or withhold funding,” auditors wrote.

Oregon’s standard federal matching rate is approximately 58%. That means the state must generally return about 58 cents to the federal government for every dollar identified as an overpayment. Federal regulations require states to return the federal share within one year after an overpayment is identified.

Auditors confirm duplicate records and payments

Most Oregon Medicaid recipients receive coverage through coordinated care organizations, or CCOs. OHA pays those organizations a fixed monthly amount for every enrolled recipient, regardless of how many medical services that person uses.

A person assigned two active identification numbers can therefore trigger two monthly payments for the same period of coverage.

OHA paid CCOs approximately $37 billion in capitation payments from 2020 through 2024. Auditors reviewed more than 2 million identification records and found 645 pairs of potential duplicate IDs connected to concurrent payments.

Auditors tested 56 pairs and confirmed that 31 involved duplicate records for the same person. Twenty-eight of those pairs resulted in overlapping payments totaling $230,252.

Based on that testing, auditors estimated the statewide total was between $231,902 and $4.09 million, with an average estimate of approximately $2.06 million.

Auditors also identified another $51,285 in duplicate payments during 2025 and 2026. Those payments were outside the primary audit period and were not included in the statewide projection.

The audit said OHA had recovered or adjusted some payments before testing was completed. However, the agency had not recovered most of the payments associated with the duplicate recipients identified by auditors.

The report noted that once all duplicate payments are recovered from CCOs, the remaining net overpayment for those cases would be zero. The state would still need to return the federal share within the required period.

Become a Paid Subscriber for Exclusive Content Access and Support Independent News

More than 11,000 duplicate IDs in state systems

The Oregon Department of Human Services estimated that more than 11,000 duplicate identification numbers remained in its systems as of March 2026.

That does not mean all 11,000 records generated duplicate Medicaid payments. Auditors found only 645 potential duplicate pairs associated with concurrent capitation payments during the period reviewed.

Nevertheless, auditors said the larger number represents a significant data-integrity problem because inaccurate records require additional staff time, complicate work performed by contractors and may produce inaccurate federal reports.

“When a single person has duplicate IDs, accuracy is eroded, creating errors which take time and resources to fix,” the audit said.

Some of the potential matches reviewed by auditors were not duplicates. They included twins with similar names and unrelated people who shared the same name and birthdate.

System depends heavily on manual research

Oregon’s ONE eligibility system compares an applicant’s name, Social Security number and birthdate with existing records. It alerts eligibility workers when it identifies a complete or partial match.

However, additional research following a partial match is not required by the system. Auditors concluded the control is effective only when workers recognize the alert and know how to investigate it.

“Staff have not been adequately trained on how to see if applicants already have a system ID assigned to them,” auditors wrote.

Workers may have to search an older state computer system that cannot be operated with a mouse and requires keyboard commands to navigate multiple screens. Auditors said the system is not intuitive and that training materials do not comprehensively explain which screens to check, how to interpret the information or the different ways a recipient’s name should be searched.

Duplicate records can be particularly difficult to detect when an applicant has changed names, uses multiple last names, spells a name differently or has an incorrectly entered birthdate or Social Security number.

The audit also identified a disproportionate connection to applications submitted with help from certified community partners. Those organizations submitted between 12% and 14% of all medical applications in recent years, but helped prepare one or both applications in more than two-thirds of the duplicate cases in the audit sample.

Auditors said community partners reported that inconsistent information from applicants and barriers to accessing records can complicate the application process.

Federal changes could increase pressure

The control problems come as Oregon prepares for more frequent Medicaid eligibility reviews.

According to the audit, approximately 600,000 recipients, representing more than 40% of Oregon’s Medicaid population, will be subject to new federal requirements affecting certain adults covered through the Affordable Care Act.

Oregon currently reviews eligibility once every two years. Under the new requirements, most recipients will be reviewed every six months.

Auditors warned that the additional reviews will increase the administrative burden on state employees and make effective training and automated controls more important.

OHA says payments represent a small fraction of spending

OHA agreed with all five audit recommendations but objected to the report’s title, “Medicaid Duplicate IDs Put Federal Funding at Risk.”

The agency said the estimated duplicate payments represented between 0.0004% and 0.0064% of Oregon’s $64 billion in total Medicaid expenditures from 2020 through 2024.

OHA also said it has a reconciliation team that continually corrects enrollment records, recovers duplicate payments and returns the appropriate federal funding.

“While limited duplicate capitation payments may occur, OHA is committed to correcting any duplication errors and recouping the capitation payments,” Interim Medicaid Director Vivian Levy wrote in the agency response.

The agency said it has already started reviewing the remaining potential duplicate IDs and creating manual adjustments to recover payments from CCOs.

Corrective work extends through 2028

Auditors issued five recommendations calling on OHA and ODHS to:

• Review the remaining potential duplicate IDs and return the federal share of confirmed overpayments.
• Recover duplicate payments from coordinated care organizations.
• Provide eligibility workers with specific training on researching applicants and potential matches.
• Improve the ONE system to reduce manual research.
• Establish quality controls connecting duplicate-record detection, payment recovery and federal repayment.

OHA expects to complete its review and initial payment recovery work by Oct. 31, 2026. New eligibility-worker training is scheduled by June 30, 2027, and an expanded quality-control process is expected by June 1, 2027.

A planned ONE system enhancement intended to screen applicants before duplicate records are created has a target completion date of Dec. 31, 2028.

The audit’s financial findings are small compared with Oregon’s overall Medicaid budget, but auditors characterized the underlying weaknesses as a broader compliance and data-integrity risk. The report did not quantify how much federal funding could be withheld or conclude that such a reduction was imminent.