The Medicaid Fiscal Accountability Rule, known as MFAR, was a proposed federal regulation from the Centers for Medicare & Medicaid Services (CMS) that would have tightened oversight of how states finance their share of Medicaid costs. It was published in November 2019, drew more than 4,200 public comments, and was formally withdrawn in January 2021 without ever taking effect. It is not law, and it never was. But most of the financing practices MFAR tried to curb have since been addressed through separate legislation and rulemaking, including a 2026 final rule that CMS estimates will recover roughly $24 billion a year in federal funds tied to a health care-related tax loophole.
What MFAR Was Trying to Fix
Medicaid is jointly financed. The federal government pays a percentage of each state’s Medicaid costs under the Federal Medical Assistance Percentage formula, and the state covers the rest. States generate their share through three main tools: intergovernmental transfers from local governments, certified public expenditures by government-run providers, and health care-related taxes on categories of providers such as hospitals or nursing facilities. Federal law requires those provider taxes to be broad-based, uniformly imposed, and free of any arrangement that guarantees providers will be repaid for their tax costs.
CMS argued that some states were using these tools to inflate their reported spending and draw down more federal money than their actual outlays justified. MFAR grouped the concerns into three buckets: questionable sources of the non-federal share, supplemental payments that cycled back to state treasuries instead of staying with providers, and a lack of data granular enough for federal regulators to spot either problem.
What the Proposed Rule Would Have Done
Tighter Definitions for Funding Sources
MFAR would have revised 42 CFR § 433.51, the regulation governing what counts as a legitimate state expenditure for federal matching. CMS wanted clearer lines around when intergovernmental transfers and certified public expenditures qualify, and it wanted to scrutinize provider-related donations more aggressively. Federal law permits provider donations only when they have no connection to the Medicaid payments the provider receives, and CMS said some states had built financial structures that effectively returned donated money to providers through inflated reimbursements.
Providers Would Keep 100 Percent of Supplemental Payments
A central feature of the rule was a flat requirement that providers receive and retain the full amount of any supplemental payment. In some states, providers received payments above the base Medicaid rate and were then required to return a portion to the state treasury or another government entity. MFAR would have prohibited these arrangements outright, so the amount reported as an expenditure had to be the amount the provider actually kept.
New Reporting Requirements
States would have had to submit provider-level data on every supplemental payment: the amount each hospital, nursing facility, or physician group received, the legal authority behind the payment, and the source of the non-federal share. States would also have had to document every health care-related tax, the revenue it produced, and each governmental entity contributing to the state’s share. Reports would have been filed annually and certified by a state official.
A Three-Year Cap on Supplemental Payment Approvals
CMS proposed capping approvals of supplemental payments at three years. States would have needed to reapply and show the payments still met federal efficiency and access standards, replacing an existing system in which some supplemental payment authorities ran indefinitely without reauthorization.
Why the Rule Was Withdrawn
CMS published MFAR in the Federal Register on November 18, 2019, and withdrew it on January 21, 2021. In the withdrawal notice, the agency acknowledged commenters’ concerns about the rule’s effect on state budgets, provider reimbursement, and patient access. Many commenters argued CMS lacked statutory authority for several of the proposals and that the rule granted the agency too much discretion over state financing choices. CMS also pointed to the Consolidated Appropriations Act of 2021, signed just weeks before the withdrawal, which had created new statutory reporting requirements that overlapped with parts of MFAR. The agency said it wanted room to reconsider its approach.
What Took Its Place
The withdrawal did not leave Medicaid financing unregulated. Over the following five years, Congress and CMS addressed most of the same accountability gaps through narrower actions with clearer legal footing.
Statutory Reporting Under the 2021 Consolidated Appropriations Act
The Consolidated Appropriations Act of 2021 added section 1903(bb) to the Social Security Act, requiring states to report detailed information about supplemental payments: the criteria used to determine which providers are eligible, how payments are calculated and distributed, the amount each provider receives, assurances that totals do not exceed upper payment limits, and an explanation of how the payments support efficiency, economy, quality, and access. CMS must make the information public. A state that reports incompletely or inaccurately risks having its supplemental payment proposals denied and can face deferral or disallowance of federal matching funds.
The February 2023 Hold Harmless Bulletin
In February 2023, CMS issued an informational bulletin clarifying that arrangements among providers to redistribute Medicaid payments violate the federal prohibition on hold harmless provisions. The bulletin targeted situations where high-Medicaid-volume providers redistribute a portion of their payments to lower-volume providers, creating a reasonable expectation that taxed providers will recoup their tax costs. CMS said such arrangements are prohibited whether oral or written and whether or not a state or local government is directly involved, and that it would begin requesting documentation about potential redistribution when reviewing state payment proposals. Under existing regulations, CMS can reduce a state’s claimable expenditures by the full amount of tax revenue collected under an arrangement that includes a hold harmless provision.
The May 2024 Managed Care Rule
In May 2024, CMS finalized a rule addressing state directed payments within Medicaid managed care, which had grown to at least $38.5 billion by 2022. The rule requires states to submit provider-level data on actual directed payment expenditures and to evaluate whether directed payments exceeding 1.5 percent of a state’s total Medicaid spending are achieving their goals. It caps provider payment levels for certain services at the average commercial rate and requires each provider receiving a directed payment to attest that it does not participate in any arrangement holding taxpayers harmless for tax costs. Post-payment reconciliation for fee-schedule-based directed payments is prohibited, and all directed payments must be included in actuarially sound capitation rates.
The 2025 Law and 2026 Tax Loophole Rule
In July 2025, Congress enacted Public Law 119-21, directing CMS to reduce total payment rates for state directed payments for certain provider types and giving the agency authority to set transition periods of up to three years. On January 29, 2026, CMS published a final rule titled “Preserving Medicaid Funding for Vulnerable Populations—Closing a Health Care-Related Tax Loophole,” effective April 3, 2026.
The rule targets states that had been imposing higher tax rates on Medicaid managed care organizations and other Medicaid providers than on non-Medicaid business, then using the tax revenue to draw down federal matching funds. CMS estimates these arrangements generated about $24 billion a year in tax revenue for a subset of states, with one state alone accounting for roughly $12.7 billion annually. The rule prohibits taxing Medicaid business at a higher rate than non-Medicaid business and bars vague or complex tax structures designed to disguise a disproportionate burden on Medicaid providers.
Transition deadlines vary by tax type:
- Tax waivers approved within two years of April 3, 2026: compliance required by January 1, 2027.
- Tax waivers approved more than two years before April 3, 2026: compliance required by the start of the first state fiscal year beginning at least one year after April 3, 2026.
- Other permissible classes of taxes: transition extends through the end of the state’s fiscal year 2028.
Once a state’s transition period ends, CMS can deduct revenue from non-compliant taxes from the state’s claimable Medicaid expenditures before calculating the federal match, reducing federal funding to the state directly.
How Medicaid Financing Is Policed Now
The 2021 statute, 2023 bulletin, 2024 managed care rule, and 2026 tax rule together cover much of the ground MFAR tried to occupy in a single regulation. CMS still reviews state plan amendments on a 90-day clock that resets when it requests more information, and it publishes approved state directed payment preprints on its website. As of September 2025, those preprints must include minimum quality evaluation elements.
States that submit false or misleading financial data can face liability under the False Claims Act, with civil penalties currently ranging from $14,308 to $28,619 per false claim on top of treble damages. More often, CMS uses administrative tools: deferring or disallowing federal matching funds, denying state plan amendments, and conditioning approval of demonstration waivers on compliance with reporting requirements. For states that lean heavily on supplemental payments and provider tax revenue, losing federal match on even a fraction of their expenditures can open budget holes in the hundreds of millions.