The Illusion of Oversight How Medicaid Contractors and State Auditors Can Become the Final Firewall for Closed Systems Why UPIC review, Medicaid enterprise vendors, state auditors, FOIA searches, contractor records, and program integrity systems must be independently audited when Medicaid whistleblower evidence is ignored

The Illusion of Oversight How Medicaid Contractors and State Auditors Can Become the Final Firewall for Closed Systems Why UPIC review, Medicaid enterprise vendors, state auditors, FOIA searches, contractor records, and program integrity systems must be independently audited when Medicaid whistleblower evidence is ignored Public interest notice This article is public interest analysis and federal oversight commentary. It does not ask readers to treat every allegation as a final legal finding. It asks Congress, GAO, CMS, HHS OIG, HHS OCR, DOJ, the Connecticut Auditors of Public Accounts, state Medicaid agencies, Medicaid contractors, disability rights organizations, journalists, families, providers, and taxpayers to determine whether official oversight systems received, preserved, reviewed, and acted on Medicaid disability rights evidence. The word “cartel” is used as an audit theory and public accountability frame, not as a final court finding. The more precise public administration question is this: When a Medicaid system is accused of provider steering, evidence deletion, FOIA obstruction, ADA barriers, Section 504 violations, Olmstead risk, billing irregularities, and retaliation, can the same state and contractor network be trusted to audit itself? The central question The central question is simple: Who audits the auditors when Medicaid oversight itself becomes part of the closed system? Families cannot answer that alone. Providers cannot answer that alone. A person with a brain injury should not be forced to answer that alone. A whistleblower should not have to build a master evidence binder, preserve screenshots, track report numbers, request FOIA records, identify contractor conflicts, and force federal visibility while official oversight systems remain silent. The public deserves to know: Did the official Medicaid program integrity systems receive the evidence? Did UPIC pathways receive the evidence? Did Medicaid enterprise technology vendors preserve relevant records? Did state auditors examine the actual provider directory, referral, billing, and evidence deletion records? Did contractors search their systems? Did state auditors certify their searches? Did federal agencies audit the contractor response? Did anyone compare the whistleblower evidence against claims, referrals, EVV logs, provider directories, care manager notes, grievance records, and payment records? If the answer is no, oversight was not functioning. It was only visible on paper. Why this article comes next The prior articles built the public record. They documented the hidden provider directory issue. They proposed the Family Rights Notice. They proposed the Provider Choice Receipt. They proposed a public federal provider verification website. They proposed the National Disability Rights Accountability Dashboard. They created the First 100 Days No Wrong Door implementation plan. They proposed the Disability Rights No Wrong Door Act. They exposed FOIA obstruction and ADA process barriers. They called for an Independent Federal Disability Rights Monitor. They analyzed read receipt metadata and evidence deletion. They proposed the Evidence Preservation Receipt. They explained federal coordination failure. They mapped the Retaliation Playbook. Now the next public question is unavoidable: Where were the watchdogs? If the evidence was so serious, why did program integrity systems not stop the pattern? If the provider directory was hidden, why did state auditors not require publication? If billing and referral records were central, why did contractors not preserve and compare them? If EVV or claims technology was implicated, why did the technology audit trail not trigger review? If whistleblower evidence was submitted, why did oversight not create protection? If state agencies could not objectively review themselves, why did federal contractor oversight not escalate? That is the illusion of oversight. The legal and oversight foundation CMS states that its Medicaid program integrity work is designed to combat provider fraud, waste, and abuse, support states in combating fraud and abuse, identify overpayments, eliminate improper payments, and use program integrity contractors and reviews to protect Medicaid resources. CMS also states that State Program Integrity Reviews assess the effectiveness of state program integrity efforts and compliance with federal requirements. CMS’s Center for Program Integrity states that it builds and manages provider enrollment systems, oversees medical reviews and audits, uses data analysis to identify and prevent fraud, waste, and abuse, and collaborates with states to protect Medicaid programs. CMS explains that UPICs are contracted to perform program integrity tasks to detect fraud, waste, and abuse in Medicaid and Medicare, and CMS’s contractor directory identifies the Northeast UPIC as SafeGuard Services LLC. HHS OIG has already reviewed UPIC performance and stated that UPICs are CMS’s only program integrity contractors that safeguard both Medicare fee for service and Medicaid from fraud, waste, and abuse, while also noting that challenges remained in the UPIC model. Connecticut DSS’s CT METS key terms document defines MMIS as DSS’s automated claims processing and information retrieval system certified by CMS and states that it is currently operated by Gainwell Technologies. The Connecticut Auditors of Public Accounts state that they serve as an independent watchdog for state and quasi public agencies, conduct audits, review compliance with laws and federal requirements for major federal programs, assess whether programs operate efficiently and effectively, and receive whistleblower complaints from state employees and the public to identify and prevent waste, fraud, and abuse. These official roles create the oversight expectation. If the watchdog systems work, they should preserve evidence, verify records, audit claims, test referrals, review provider directories, examine contractor records, and escalate systemic risk. If they do not, the public must ask whether oversight became part of the problem. The oversight illusion An oversight illusion exists when a system has auditors, contractors, reports, portals, reviews, and compliance language, but the real evidence never reaches independent review. It looks like accountability. It has formal offices. It has dashboards. It has annual reports. It has contracts. It has audit language. It has program integrity plans. It has complaint systems. It has vendor systems. It has state auditors. But when a whistleblower submits evidence, the system does not assemble the record. It does not compare directories. It does not compare referrals. It does not compare claims. It does not compare EVV logs. It does not compare FOIA delays. It does not compare deleted communications. It does not compare retaliation timelines. It does not compare state statements against source records. It processes oversight activity without producing oversight correction. That is the oversight illusion. The corporate firewall problem The first firewall is the contractor layer. CMS does not directly perform every Medicaid program integrity task at the claim, provider, and state system level. CMS uses contractors and supports states through program integrity structures. CMS identifies UPICs as contractors performing program integrity tasks to detect fraud, waste, and abuse in Medicaid and Medicare. That contractor layer can be useful. It can also become a firewall. A contractor may be excellent at reviewing individual provider claims. But the key question in the David Medeiros record is broader: Can a contractor or vendor objectively review evidence that implicates the state system, the referral architecture, the claims system, the provider directory, or the program design that supports the contractor’s own work? This is the conflict risk. Not proof of guilt. Not a final finding. A risk. The public audit question is whether contractor incentives favor narrow provider level review over system level review. A provider making a billing mistake is easy to audit. A state controlled closed system is harder. A provider claim denial can be processed. A provider steering structure must be investigated. A single overpayment can be calculated. A hidden provider directory requires systemic correction. That is why HHS OIG and GAO must examine the contractor role. The UPIC audit question UPICs are meant to identify and investigate suspected fraud, waste, and abuse. CMS’s annual report language describes UPIC work as fraud focused, including investigation development, administrative actions, medical record review, interviews, site visits, and support to state Medicaid agencies. That creates the audit question: Did the relevant UPIC pathway receive the David Medeiros evidence? If yes, what happened? If no, why not? If the evidence alleged state level provider steering, hidden provider directories, billing obstruction, EVV or documentation irregularities, evidence deletion, and retaliation, did UPIC review treat the matter as individual provider noise or as systemic state program integrity risk? Federal reviewers should ask: Was the evidence sent to UPIC? Was SafeGuard Services or any Northeast UPIC pathway notified? Did UPIC open a case? Did UPIC decline the matter? What reason was given? Did UPIC request records from DSS? Did UPIC request Gainwell or MMIS records? Did UPIC examine claims or payment records? Did UPIC examine provider directory records? Did UPIC examine referral patterns? Did UPIC examine EVV logs? Did UPIC examine deletion or read receipt evidence? Did UPIC refer any matter to HHS OIG? Did CMS review UPIC’s handling? Did anyone issue an Evidence Preservation Receipt? If these questions cannot be answered, the oversight system failed its first test: traceability. The Gainwell and MMIS audit question The Connecticut DSS CT METS key terms document states that Connecticut’s MMIS is DSS’s automated claims processing and information retrieval system certified by CMS and currently operated by Gainwell Technologies. It also defines MMIS as including function areas such as Member, Provider, Claims, Reference, Management and Administrative Reporting, and Surveillance and Utilization Review. That makes MMIS records central to any serious Medicaid audit. If the record includes billing obstruction, claim denial, provider identifier issues, payment disruption, referral concentration, provider visibility concerns, or program integrity concerns, the MMIS and related data systems are not peripheral. They are evidence systems. Federal reviewers should ask: What claims did ABI Resources submit? What claims were paid? What claims were denied? What denial codes were used? What manual edits occurred? Who accessed the records? What provider identifiers were used? What provider enrollment status was reflected? What provider directory data existed? What surveillance and utilization reports flagged unusual patterns? What billing rules were applied? Were those rules applied uniformly? Were claim disruptions correlated with protected reporting? Were system logs preserved? Did Gainwell or any MMIS operator receive notice of the whistleblower evidence? Did the system generate reports that should have triggered program integrity review? Were records available for HHS OIG or CMS inspection? The audit question is not whether Gainwell is guilty of wrongdoing. The audit question is whether the MMIS contractor record was preserved, searched, and compared against the whistleblower timeline. The state auditor firewall The second firewall is the state auditor layer. The Connecticut Auditors of Public Accounts describe themselves as an independent watchdog that audits state and quasi public agencies, reviews compliance with laws and federal requirements, examines efficiency and effectiveness, and receives whistleblower complaints from the public and state employees to identify and prevent waste, fraud, and abuse. That official role is important. But the David Medeiros record raises a structural question: Can state level audit review be enough when the allegation is that the state system itself, including Medicaid administration, civil rights processing, records handling, provider referrals, and complaint review, is part of the problem? The public should not assume state auditors are corrupt. The public should also not assume state audit review is enough. The correct standard is independent verification. State auditors should be asked: Did they receive the evidence? Did they acknowledge it? Did they preserve it? Did they review the provider directory issue? Did they review referral neutrality? Did they review DSS records? Did they review CHRO records? Did they review MMIS records? Did they review contractor records? Did they review federal Medicaid compliance? Did they review ADA and Section 504 implications? Did they review whistleblower retaliation? Did they produce a written finding? Did they refer anything to HHS OIG, CMS, DOJ, HHS OCR, GAO, or MFCU? Did they certify what they searched? If the answer is unclear, state audit is not a substitute for federal review. The clean audit problem A clean audit can become dangerous when the audit scope excludes the real evidence. A clean audit may say financial statements were presented fairly. A clean audit may say major federal program testing met audit thresholds. A clean audit may say a sample did not show material exceptions. But those statements do not necessarily prove that: Provider directories were public. Families received real provider choice. Referral patterns were neutral. Whistleblowers were protected. ADA communication was accessible. Section 504 duties were met. Olmstead risks were screened. FOIA searches were complete. Read receipt deletions were reviewed. Billing blockades were neutral. EVV disputes were fair. Contractor records were searched. A clean audit can be technically true and still miss the closed system. That is why scope matters. The public question should always be: Clean audit of what, using which records, with which custodians, with which search terms, and with which exclusions? The single audit gap Single audits and state financial audits are important, but they do not automatically answer civil rights and provider choice questions. A single audit may test federal program compliance at a high level. It may not reconstruct a whistleblower retaliation timeline. It may not compare provider directory visibility against referral distribution. It may not test whether families received Provider Choice Receipts. It may not inspect read receipt metadata. It may not audit whether a person with a brain injury received effective communication. It may not test whether a Medicaid provider was starved of referrals after protected reporting. It may not test whether FOIA searches omitted contractor records. That is why the David Medeiros record requires a special federal performance and program integrity audit. Not only a standard financial audit. The contractor record problem A closed system often survives through contractor record fragmentation. The state says the contractor has the data. The contractor says the state controls the policy. The auditor says the agency produced what it had. The FOIA office says certain records are not in its custody. The provider says the records exist somewhere. The family cannot access any of it. The federal reviewer receives a partial production. That is how records disappear without being destroyed. They are partitioned. Program integrity review must require contractor records. That includes: MMIS claims records. Provider enrollment records. Provider directory records. Surveillance and Utilization Review records. EVV logs. Help desk tickets. Manual correction records. Contractor communications. Referral records held by access agencies. Care management notes. Audit logs. Deletion logs. Records showing who accessed or altered files. Without contractor records, oversight is incomplete. The low hanging fruit problem Program integrity systems often focus on providers because provider claims are measurable. Provider claims have codes. Provider claims have dates. Provider claims have service records. Provider claims can be denied. Provider overpayments can be recovered. That is useful. But a closed system may hide in the layer above the provider. That layer includes: Who gets referrals. Who appears in directories. Which families see which providers. Which providers are discouraged. Which contractors control access. Which care managers steer choices. Which providers are economically isolated. Which records are hidden. Which complaints are closed. Which public funds follow the closed pathway. A contractor that only audits individual provider claims may miss state enabled provider steering. The oversight system then catches the small fish while the structure continues. That is the low hanging fruit problem. The whistleblower evidence problem Whistleblower evidence often looks messy because real systems are messy. It may include emails. Screenshots. FOIA requests. Complaint numbers. Payment disputes. Provider lists. Care manager notes. Portal records. Read receipts. Meeting transcripts. Public statements. Police records. Bank records. EVV logs. Federal closure letters. That complexity can become an excuse to dismiss the evidence. But complexity is not a defect. It is the evidence of a system problem. A closed system cannot be proven with one document because no single document holds the full system. The evidence must be assembled. That is why a 5,133 page master binder, if properly indexed and preserved, should be treated as an audit asset, not a nuisance. The user provided strategic brief identifies the master binder and contractor conflict evidence as central related evidence for this article. The conflict of interest test Federal reviewers should apply a conflict of interest test. Question 1: Who pays the overseer? Does the contractor depend financially on the state, CMS, or both? Question 2: Who controls the records? Does the state, contractor, or vendor control the source data needed to test the allegation? Question 3: Who is being accused? Does the evidence implicate individual providers, state agencies, contractors, access agencies, care managers, or technology systems? Question 4: Who decides whether to escalate? Can a contractor decline systemic review without independent federal examination? Question 5: Who benefits from narrow scope? Does the audit focus on individual provider billing while ignoring referral steering, provider directory suppression, ADA access, and retaliation? Question 6: Who sees the whole record? Is any one entity required to combine claims, referrals, directories, FOIA, accommodation, civil rights, and whistleblower evidence? If the answer to question 6 is no, the oversight system is structurally weak. The HHS OIG target HHS OIG should review the contractor oversight layer. The review should ask: Did UPIC or contractor pathways receive the David Medeiros evidence? Did CMS know the evidence existed? Did HHS OIG know the evidence existed? Did Gainwell or any MMIS operator preserve claims and system records? Did Connecticut DSS preserve and produce records? Did state auditors receive and review the evidence? Did contractor review focus only on provider claims? Did contractor review examine state referral structures? Did contractor review examine EVV or billing blockades? Did contractor review examine provider directory suppression? Did contractor review examine retaliation against ABI Resources? Did contractor review examine evidence deletion and read receipt records? Did contractor review examine whether families received provider choice? Did contractor review examine whether public funds followed closed referral pathways? Did any contractor issue written findings? This is a direct HHS OIG oversight target because UPIC performance and Medicaid program integrity are federal program integrity concerns. The GAO target GAO should review whether Medicaid oversight is fragmented and contractor dependent in a way that allows state closed systems to avoid full review. GAO should ask: Can CMS program integrity systems detect state level provider steering? Can UPICs audit systemic state referral patterns? Can HHS OIG access contractor records quickly? Can state auditors objectively review programs controlled by state political and budget systems? Are Medicaid enterprise vendors required to preserve whistleblower relevant data? Are civil rights issues linked to program integrity audits? Are provider directory failures treated as Medicaid access failures? Are ADA and Section 504 complaints shared with CMS? Are FOIA obstruction claims linked to evidence preservation duties? Are whistleblower complaints tracked across agencies? GAO’s framework for fragmentation, overlap, and duplication exists for exactly this kind of cross agency problem. The congressional target Congress should ask one public question: Did the oversight system review the evidence, or did it simply produce the appearance of review? The hearing should request: CMS UPIC records. UPIC case opening or closing records. SafeGuard Services communications, if applicable. Gainwell MMIS claims records. DSS claims processing records. CT METS records. Surveillance and Utilization Review records. Provider directory records. ABI Waiver referral logs. Provider Choice Receipt records. EVV logs. FOIA search certifications. CHRO records. DSS internal communications. State Auditor complaint handling records. HHS OIG intake records. CMS state program integrity review records. Contractor conflict of interest disclosures. Audit scope documents. Communications about David Medeiros or ABI Resources. Congress should not accept generalized assurances. It should require the audit trail. What state auditors must prove The Connecticut Auditors of Public Accounts should be asked to prove: What records they received. What records they preserved. Whether they reviewed the full Master Evidence Binder or only summaries. Whether they reviewed ABI Waiver provider directories. Whether they reviewed referral data. Whether they reviewed claims data. Whether they reviewed contractor records. Whether they reviewed Gainwell or MMIS records. Whether they reviewed CHRO complaint handling. Whether they reviewed DSS FOIA handling. Whether they reviewed ADA and Section 504 access issues. Whether they reviewed whistleblower retaliation. Whether they referred the matter externally. Whether they issued written findings. Whether political, legislative, contract, or institutional conflicts were screened. The issue is not whether state auditors have authority. They do. The issue is whether the audit scope matched the evidence. What CMS must prove CMS should be asked to prove: Whether the evidence was received. Whether CMS referred it to UPIC. Whether CMS referred it to HHS OIG. Whether CMS reviewed Connecticut’s provider choice compliance. Whether CMS reviewed ABI Waiver provider directory transparency. Whether CMS reviewed referral neutrality. Whether CMS reviewed HCBS grievance access. Whether CMS reviewed evidence deletion concerns. Whether CMS reviewed Medicaid billing disruption. Whether CMS required corrective action. CMS cannot rely only on state representations if state conduct is part of the evidence. What HHS OIG must prove HHS OIG should be asked to prove: Whether it received the evidence. Whether it reviewed contractor performance. Whether it reviewed UPIC handling. Whether it reviewed Gainwell or MMIS records. Whether it reviewed Medicaid payment integrity. Whether it reviewed evidence deletion claims. Whether it reviewed whistleblower retaliation. Whether it reviewed state auditor handling. Whether it referred any matter to DOJ. Whether it produced findings or closure rationale. HHS OIG is the correct federal body to review whether program integrity contractors and state systems failed to act on serious Medicaid evidence. What Gainwell and MMIS records must show Any Gainwell or MMIS related audit should request: Provider enrollment status. Provider identifier history. Claims submitted by ABI Resources. Claims denied. Denial codes. Claims suspended. Claims adjusted. Payment dates. Manual overrides. User access logs. System change logs. Surveillance and utilization reports. Provider file changes. Data extracts involving ABI Waiver providers. Records showing whether claims treatment changed after protected reporting. The question is not whether a vendor caused harm. The question is whether the vendor controlled data necessary to verify or disprove harm. What UPIC records must show Any UPIC review should request: Complaint intake records. Case screening records. Decision not to open records, if any. Open case records, if any. Records received from CMS, DSS, HHS OIG, or the whistleblower. Records requested from DSS. Records requested from Gainwell or MMIS systems. Provider audit scope. Referral pattern analysis. Claims analysis. Site visit records. Interview records. Administrative action recommendations. HHS OIG referral records. Closure rationale. If UPIC did not review the matter, CMS and HHS OIG should explain why. What the public dashboard must show The National Disability Rights Accountability Dashboard should include contractor oversight metrics. It should show: Number of Medicaid whistleblower evidence submissions received. Number referred to UPIC. Number reviewed by MMIS or claims system contractor. Number reviewed by state auditors. Number referred to HHS OIG. Number referred to CMS. Number involving provider directories. Number involving referral steering. Number involving claim denial or payment disruption. Number involving EVV or technology systems. Number involving evidence deletion. Number involving ADA access. Number involving Section 504. Number involving whistleblower retaliation. Number closed with documented findings. If oversight cannot be measured, it cannot be trusted. The independent federal monitor link This article connects directly to the Independent Federal Disability Rights Monitor proposal. An independent monitor is needed because: State agencies may control the records. Contractors may control the data. State auditors may have limited scope. UPIC pathways may focus narrowly on provider claims. HHS OIG may not see every civil rights fact. CMS may rely on state representations. DOJ may receive fragmented reports. Families and providers cannot force data integration. The monitor’s job is to assemble the whole record. Not assume guilt. Not expose private records. Preserve, verify, compare, and report. Corrective action blueprint 1. HHS OIG audit of contractor response HHS OIG should audit whether UPIC, MMIS, and related contractor pathways received, preserved, reviewed, and escalated the David Medeiros evidence. 2. CMS review of UPIC handling CMS should determine whether the relevant UPIC pathway assessed systemic provider steering, billing obstruction, EVV disputes, evidence deletion, and retaliation claims. 3. Gainwell and MMIS data preservation Connecticut DSS and Gainwell should preserve all claims, provider, reference, management, administrative reporting, surveillance, utilization, payment, access, and audit logs related to ABI Resources, David Medeiros, and the ABI Waiver. 4. State auditor search certification The Connecticut Auditors of Public Accounts should certify what evidence was received, what systems were searched, what records were reviewed, what findings were made, and what referrals were issued. 5. Contractor conflict screen All Medicaid program integrity, MMIS, care management, and access agency contractors should disclose relevant conflicts, contract dependencies, subcontractor relationships, and limits on audit independence. 6. Provider directory audit CMS should require a full ABI Waiver provider directory audit, including date history, public availability, provider omissions, provider status, and evidence showing families received the directory. 7. Referral neutrality audit Federal reviewers should compare provider referrals before and after protected reporting by ABI Resources and David Medeiros. 8. Billing neutrality audit Federal reviewers should compare claims, denials, manual edits, and payment timing before and after protected reporting. 9. Evidence preservation audit Federal reviewers should examine read receipts, deletion logs, FOIA correspondence, complaint files, contractor records, and metadata. 10. Congressional subpoena package Congress should subpoena CMS, HHS OIG, UPIC, DSS, Gainwell, Connecticut state auditors, and relevant contractors for communications, audit scope documents, claims records, provider directory records, and evidence handling records. The key sentence Oversight is not real when the same state and contractor network accused of controlling provider choice also controls the claims data, referral records, audit scope, FOIA searches, and evidence trail. That is the illusion of oversight. Public interest conclusion This article does not ask readers to accept every allegation as a final legal finding. It asks a public audit question: Can Medicaid oversight be trusted when the same state and contractor systems accused of restricting provider choice, delaying records, blocking billing, mishandling evidence, and retaliating against whistleblowers also control the data needed to prove or disprove those allegations? The answer is no, unless the review is independent, documented, and federal. CMS has broad Medicaid program integrity responsibilities and uses contractors to detect fraud, waste, abuse, review provider activities, identify overpayments, support states, and recover improper payments. UPICs are contracted to detect fraud, waste, and abuse in Medicaid and Medicare, and HHS OIG has already recognized both their promise and the challenges that remain. Connecticut’s MMIS is the claims processing and information retrieval system certified by CMS and currently operated by Gainwell Technologies, according to Connecticut DSS CT METS definitions. The Connecticut Auditors of Public Accounts describe themselves as an independent watchdog that reviews state agencies, federal requirements for major programs, waste, fraud, abuse, efficiency, and effectiveness. Those roles create public duties. If the watchdogs worked, the public should see the trail. Where is the UPIC review? Where is the CMS referral? Where is the HHS OIG analysis? Where is the Gainwell claims data preservation? Where is the MMIS audit log? Where is the provider directory audit? Where is the referral neutrality analysis? Where is the billing neutrality analysis? Where is the state auditor search certification? Where is the contractor conflict screen? Where is the evidence preservation receipt? Where is the independent federal finding? If those records do not exist, oversight was not complete. If they exist, they should be preserved and reviewed. David Medeiros of Connecticut identified the oversight gap. He showed that a Medicaid closed system is not protected only by silence. It is protected by fragmented oversight. It is protected when contractors review narrow claim issues but not state controlled referral structures. It is protected when state auditors review agency summaries but not the full evidence binder. It is protected when MMIS data remains inside contractor systems. It is protected when FOIA searches do not include contractor records. It is protected when civil rights evidence is separated from program integrity records. It is protected when clean audits become shields. It is protected when no one asks who audits the auditors. That must end. HHS OIG should audit the contractor response. CMS should audit UPIC handling. GAO should review oversight fragmentation. Congress should subpoena the contractor, state, and federal records. HHS OCR and DOJ should review whether contractor controlled Medicaid systems created disability access barriers. State auditors should certify exactly what they reviewed. Gainwell and any MMIS related records should be preserved. UPIC records should be produced for federal review. The provider directory should be audited. Referral neutrality should be audited. Billing neutrality should be audited. Evidence deletion should be audited. Because oversight is not a title. Oversight is proof. If the watchdogs reviewed the evidence, show the records. If they did not, the public deserves to know why. That is the Illusion of Oversight. Suggested quote graphic Oversight is not real when the same state and contractor network accused of controlling provider choice also controls the claims data, referral records, audit scope, FOIA searches, and evidence trail. Suggested social post David Medeiros identifies the next Medicaid accountability failure: the illusion of oversight. If UPIC pathways, MMIS vendors, state auditors, and state agencies control the evidence, then HHS OIG, CMS, GAO, and Congress must audit the auditors.