The State Medicaid agency—

(a) As a condition of enrollment, must require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.

(b) Must establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program.

(1) Upon the State Medicaid agency determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets the State Medicaid agency's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, the State Medicaid agency will require that each such provider or person submit fingerprints.

(2) The State Medicaid agency must require a provider, or any person with a 5 percent or more direct or indirect ownership interest in the provider, to submit a set of fingerprints, in a form and manner to be determined by the State Medicaid agency, within 30 days upon request from CMS or the State Medicaid agency.