26 of the 48 state Medicaid agencies studied could not report the number of “critical incidents” — such as abuse, neglect or exploitation.