OIG: two of three audited Arizona Medicaid plans skipped mental health parity checks on prior authorization

In Arizona, officials at two Medicaid health plans told federal auditors they had not run a mental health parity analysis because nothing material had changed in their benefits or prior authorization processes [1]. Under their reading of state policy, no new analysis had been needed since the initial one a contractor performed for the state in 2017 [1]. The HHS Office of Inspector General (OIG) said that was not enough.

What changed

OIG issued its audit of Arizona’s Medicaid managed care program on August 20, 2026 (report OAS-24-09-002) [1]. It found that the Arizona Health Care Cost Containment System did not ensure that two of three selected managed care organizations (MCOs) complied with parity requirements for prior authorization of mental health and substance use disorder (MH/SUD) services, covering October 1, 2022, through September 30, 2023 [1].

It is the third report in the same series this month. OIG released a Kansas audit dated August 10 and a New York audit dated August 13, both on 2023 data [2, 3]. No payment rate or billing rule changes. The reports are recommendations to states, and they describe in detail how plans review behavioral health prior authorization requests.

Parity here means a plan cannot apply a limit to MH/SUD benefits that is more restrictive than the limit it applies to medical and surgical (M/S) benefits in the same classification [1, 6]. Prior authorization is a nonquantitative treatment limitation (NQTL), a restriction not expressed as a number, and OIG’s 2024 work found it was the most frequent NQTL area of noncompliance [1].

Who it affects

• Behavioral health practices billing Medicaid plans. Psychiatrists, therapy groups and substance use treatment programs in Arizona, Kansas and New York contract with the plans OIG reviewed [1, 2, 3]. OIG does not name the plans.
• Arizona. The state contracted with nine MCOs serving about 1.9 million Medicaid enrollees during the audit period; OIG’s three sampled plans covered about 58% of managed care enrollees [1].
• Kansas. Three MCOs coordinated both MH/SUD and M/S care for everyone enrolled in Kansas Medicaid in 2023 [2].
• New York. OIG’s three selected plans covered about 42% of the state’s Medicaid managed care enrollees [3].
• Other states. OIG says it chose states from its 2024 audit, which found that CMS did not ensure eight selected states complied with Medicaid managed care parity requirements [1, 4].

What did OIG find in each state?

Arizona. One plan did the annual analysis, including an “in operation” check comparing MH/SUD and M/S denial rates, and found its limits no more restrictive [1]. The other two submitted attestations of compliance but did not perform an analysis that met state requirements [1]. On paper their prior authorization rules were comparable, OIG said, but neither could supply reliable data for a denial-rate test. One plan’s data had duplicate entries, did not support its own calculations and did not separate MH/SUD from M/S prescription drug requests [1]. The state’s three-year operational reviews missed the gap: one review in 2022 wrongly recorded an analysis as complete [1].

Kansas. None of the three plans performed or gave the state a complete parity analysis for 2023, and the state did not ask for one [2]. For outpatient out-of-network services, one plan denied 34% of MH/SUD prior authorization requests and 22% of M/S requests [2]. A third plan needed 18 months after OIG’s first request to produce an analysis backed by reconcilable data, and even then only three of the four benefit classifications were supported [2].

New York. The state runs its own parity program and uses a 20% denial-rate threshold to flag plans, but OIG found it had never put the threshold in a written policy and did not follow up promptly when plans crossed it [3]. In 2023, one selected plan’s denial rate for community psychiatric support and treatment was 42%, another’s for partial hospitalization was 37%, and a third’s for continuing day treatment was 20% [3]. Two of the plans were still noncompliant on prior authorization more than six years after the October 2017 compliance date, according to the state’s own 2022 to 2024 reviews [3].

What it means for your practice

Nothing in your fee schedule moves. The practical effect is on the paper trail behind behavioral health prior authorization, and on what you can ask for.

Plans owe you their criteria. The 2016 CMS rule applying parity to Medicaid managed care requires a plan to make its medical necessity criteria for MH/SUD benefits available “to any enrollee, potential enrollee, or contracting provider upon request” [5]. The reason for any denial of payment for MH/SUD services must be made available to the enrollee [5]. The 2008 statute sets a parallel disclosure rule for group health plans [6].

Your own denial data may be better than the plan’s. In all three states, OIG found plans that could not produce reliable prior authorization data separating behavioral health from medical requests [1, 2, 3]. A practice that logs its own requests, approvals and denials by service and plan has numbers ready if a state reviewer or plan asks.

Documentation should become more public. States had to post documentation of parity compliance on their Medicaid websites by October 2, 2017 [5]. During the audit, Arizona revised its plan contracts to require plans to submit the annual analysis to the state and post the results on their websites [1]. Kansas told OIG it posted corrected plan analyses on the KanCare website in December 2024 [2].

State follow-up comes first. Kansas said that plans that miss corrective action deadlines would face contractual remedies [2]. New York told OIG that as of July 2026 it had issued 151 citations for parity violations and collected $1.7 million in sanctions [3].

What to do now

1. Ask for the criteria. Request each Medicaid plan’s medical necessity criteria for the MH/SUD services you deliver most, such as partial hospitalization or community psychiatric support [3, 5].
2. Keep a denial log. Record prior authorization requests and outcomes by plan and service so you can compare over time [1, 2, 3].
3. Look up the posted analyses. Check your state Medicaid website and your plans’ websites for parity documentation, and compare it with what your claims show [1, 5].
4. Help patients get denial reasons. Plans must give enrollees the reason for a denied MH/SUD payment [5].

The policy fight

OIG’s position is that attestations are not proof. It told Arizona that clearer policies would ensure plans “understand that a parity analysis must be performed annually, regardless of whether there were any changes in an MCO’s operations” [1]. It also cautions that “a higher rate of denial for MH/SUD services does not necessarily mean noncompliance with parity requirements,” only that it could indicate it [1].

The states answered differently. Arizona agreed to collect and review the analyses with supporting data but rejected the first part of OIG’s recommendation, saying its policies already required annual analyses [1]. The state said it “anticipates issuing a memo to all MCOs reinforcing these submission requirements, including the complete analysis” [1]. Officials at the two Arizona plans had read the state’s policy to mean an analysis was needed only after a material change [1].

Kansas agreed with all three of its recommendations and said its health department “retains primary responsibility” for parity oversight, working with its aging and disability agency through a new joint workgroup [2].

New York neither agreed nor disagreed [3]. It told OIG it does not believe it is responsible for plans’ failure to complete analyses, citing its templates, technical assistance and feedback, and said its program exceeds federal requirements [3]. Its response also conceded that “MCOs in the State of New York have continued violations with respect to prior authorization” [3].

Behind the state audits is a federal question. In 2024 OIG found that all eight states it reviewed had plan contracts lacking required parity provisions by the 2017 compliance date [4]. CMS concurred and said it would strengthen follow-up and issue guidance to states [4]. The August reports do not say whether that guidance has reached plans in Arizona, Kansas or New York, or how many more states the series will cover.