Department of Health & Human Services 
OFFICE OF 
     
INSPECTOR GENERAL 
 
 
 
 
 
 
 
 
M   M C :
EDICAID  ANAGED  ARE  
 
F A C
RAUD  AND  BUSE  ONCERNS 
 
R D S  
EMAIN  ESPITE  AFEGUARDS 
 
 
 
 
 
 
Daniel R. Levinson  
Inspector General 
 
December 2011 
OEI-01-09-00550   
  
   
 E X E C U T I V E   S U M M A R Y  
OBJECTIVES
 
To determine: 
1.  to what extent selected Medicaid managed care entities (MCE) took 
steps to meet Federal program integrity requirements, 
2.  how States oversee MCEs fraud and abuse safeguards, and 
3.  what major concerns that MCEs and States have regarding fraud 
and abuse in Medicaid managed care.  
BACKGROUND 
Medicaid expenditures almost doubled during the past decade, from 
over $200 billion in 2000 to $374 billion in 2009.  States have 
increasingly adopted managed care as a response to these growing 
expenditures.   States may contract with different types of MCEs to 
provide health care services on a statewide or a community basis.  The 
Centers for Medicare & Medicaid Services (CMS) requires MCEs to 
meet specific program integrity requirements as a condition for 
receiving payment.  These requirements include a written compliance 
plan, effective training and education for MCE employees, and internal 
monitoring and auditing.  CMS also requires MCEs and other Medicaid 
providers to disclose to States certain information related to ownership 
and control.  CMSs Medicaid Integrity Group (MIG) conducts program 
integrity reviews of States and MCEs.  In 2000, CMS issued guidelines 
for addressing Medicaid managed care fraud and abuse.  States are 
directly responsible for monitoring MCE operations.   
We reviewed MIGs files from its program integrity reviews of a 
purposive sample of 13 States and 46 MCEs.  We sent a questionnaire 
to those 46 MCEs and received responses from 45.  We also conducted 
structured telephone interviews with the 13 States, all 10 CMS regional 
offices, and MIG. 
FINDINGS 
All MCEs in our sample reported taking steps to meet Federal 
program integrity requirements.  All 46 MCEs in our sample reported 
to MIG that they met Federal program integrity requirements.  The  
45 MCEs that responded to our questionnaire provided fraud and abuse 
safeguard training to their staffs in 2010, and 41 also offered such 
training to providers in their networks in 2010.  In 2009, 33 MCEs 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  i   
  
   
E X E C U T I V E   S U M M A R Y  
reported cases of suspected fraud and abuse to their State Medicaid 
agencies, with a median of 9 cases.  Twenty MCEs recovered payments 
from providers in 2009 that resulted from fraud and abuse. 
All 13 States in our sample reported taking steps to oversee MCEs 
fraud and abuse safeguards.  All 13 States conduct desk reviews of 
MCEs compliance plans, and 11 States conduct onsite MCE reviews.  
All 13 States reported requiring that MCEs disclose ownership 
information (8 of the States recently updated their reporting 
requirements as a result of MIGs program integrity reviews).  Eleven 
States hold recurring meetings with MCEs; these meetings often 
include fraud and abuse training. 
Although MCEs and States are taking steps to address fraud and 
abuse in managed care, they remain concerned about their 
prevalence.  We asked MCEs, States, and CMS to identify their major 
concerns regarding Medicaid managed care fraud and abuse.  The 
primary concern related to services billed but not rendered.  MIG also 
identified this vulnerability in its program integrity reviews.  MCEs and 
States expressed concerns about provider and beneficiary fraud and 
abuse, including rendering services that are not medically necessary, 
upcoding by providers, questionable beneficiary eligibility, and 
prescription drug abuse by beneficiaries.  The major concerns identified 
in our review largely reflect only one of six areas highlighted in CMSs 
2000 guidelines.   
RECOMMENDATIONS 
CMS should: 
Require that State contracts with MCEs include a method to verify 
with beneficiaries whether services billed by providers were 
received.  CMS could require States to implement one of several 
options, such as sending explanations of medical benefits to 
beneficiaries.  Other options could include contacting beneficiaries by 
telephone or mailing them a questionnaire.   
Update guidance to reflect concerns expressed by MCEs and 
States.  CMS could update and reissue the fraud and abuse guidelines 
it published in 2000.  CMS could also share best practices and 
innovative methods that States and MCEs have used to address fraud 
and abuse concerns and strengthen program integrity oversight. 
 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  ii   
  
   
E X E C U T I V E   S U M M A R Y  
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with both recommendations.  CMS stated that it will 
advise States to work with their MCEs to determine and implement 
effective strategies for verifying that services billed by network 
providers are received.   CMS also stated that it has been developing 
a strategy to effectively address managed care program integrity and 
will revise its guidelines once that strategy is complete.  Finally, CMS 
stated that it provides a compendium of States noteworthy and 
effective practices in key program integrity areas, including Medicaid 
managed care, on its Web site.  We made no changes to the report 
based on CMSs comments. 
  
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  iii    
  
 T A B L E   O F   C O N T E N T S  
EX ECUT I VE  SUM M ARY  .....................................i 
 
 
I NT RO DU CT I O N  ............................................ 1 
 
 
F I NDI NG S  .................................................. 8 
All MCEs in our sample reported taking steps to meet 
Federal program integrity requirements ..................... 8 
All 13 States in our sample reported taking steps to oversee 
MCEs fraud and abuse safeguards .........................  10 
Although MCEs and States are taking steps to address fraud 
and abuse in managed care, they remain concerned about their 
prevalence ............................................  12 
   
RECO M M END AT I O N S  .....................................  15 
Agency Comments and Office of Inspector General Response ....  16 
 
 
APP EN DI X ES  .............................................  17 
A:  Percentage of Medicaid Beneficiaries Enrolled in Managed 
     Care Organizations as of June 30, 2008 ..................  17 
B:  Agency Comments ...................................  18 
 
 
ACKNO WL E DG M E N T S .....................................  20   
  
   
 I N T R O D U C T I O N  
OBJECTIVES 
To determine: 
1.  to what extent selected Medicaid managed care entities (MCE) took 
steps to meet Federal program integrity requirements, 
2.  how States oversee MCEs fraud and abuse safeguards, and 
3.  what major concerns that MCEs and States have regarding fraud 
and abuse in Medicaid managed care.  
BACKGROUND 
Medicaid expenditures almost doubled in the past decade, from over 
$200 billion in 2000 to $374 billion in 2009.1  States have increasingly 
adopted managed care as a response to these growing expenditures.  
Managed care is a health delivery system that aims to maximize 
efficiency by negotiating rates, coordinating care, and managing the use 
of services.  State Medicaid agencies contract with MCEs to provide 
comprehensive health services in return for a fixed, prospective 
payment (capitated payment) for each enrolled beneficiary. 
Medicaid Managed Care 
As of June 2009, 36 million Medicaid beneficiaries (72 percent) were 
enrolled in managed care.2  Some States, such as Tennessee, enroll all 
Medicaid beneficiaries in managed care, whereas others, such as 
Wyoming, do not enroll any.3 
States may contract with different types of MCEs to provide health care 
services on a statewide or a community basis.4  Two types of MCEs are 
subject to specific Federal program integrity requirements:  Managed 
Care Organizations (MCO) and Prepaid Inpatient Health Plans 
(PIHP).5   
 
1 Centers for Medicare & Medicaid Services (CMS), National Health Expenditures by 
Type of Service and Source of Funds, CY 19602009.  Accessed at http://www.cms.gov on 
April 21, 2011. 
2 CMS, Medicaid Managed Care Enrollment as of June 30, 2009.  Accessed at 
http://www.cms.gov on April 14, 2011. 
3 Ibid. 
4 Social Security Act  1932(a)(3).  
5 42 CFR  438.608. 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  1   
  
   
II NN TT RR OO DD UU CC TT II OO NN   
An MCO provides comprehensive medical services through a prepaid 
risk contract with the State.  Under a risk contract, the contractor 
assumes the risk for the cost of covered services and incurs a loss if the 
cost exceeds the payments under the contract.6  A PIHP generally 
provides inpatient hospital or institutional services and does not enter 
into a comprehensive risk contract with the State.7  For example, a 
mental health PIHP would provide only inpatient mental health 
services.8  In this report, we refer to MCOs and PIHPs collectively as 
managed care entities, or MCEs. 
Fraud and Abuse in Medicaid Managed Care  
In 2000, CMS issued Guidelines for Addressing Fraud and Abuse in 
Medicaid Managed Care.9  In the guidelines, CMS adapted the general 
Medicaid definitions of fraud and abuse10 to the managed care 
environment: 
  Fraud means any type of intentional deception or 
misrepresentation made by an entity or person with the knowledge 
that the deception could result in some unauthorized benefit to the 
entity, himself, or some other person.11   
  Abuse means practices that are inconsistent with sound fiscal, 
business, or medical practices and that result in unnecessary costs 
to Medicaid or reimbursement for services that are not medically 
necessary or that fail to meet professional standards or contractual 
obligations for health care.12 
The guidelines also identified six areas of concern:  (1) managed care 
contract procurement, (2) marketing and enrollment,  
(3) underutilization of services, (4) claims submission and billing 
procedures, (5) fee-for-service payments within managed care, and  
 
6 42 CFR  438.2. 
7 Ibid. 
8 Ibid.  
9 CMS, National Medicaid Fraud and Abuse Initiative, Guidelines for Addressing Fraud 
and Abuse in Medicaid Managed Care, pp. 1011, October 2000. 
10 42 CFR  455.2 defines fraud and abuse for general Medicaid purposes.  
11 Fraud or abuse can be committed by a contractor, a subcontractor, a provider, an 
MCE, a State employee, or a Medicaid beneficiary/enrollee.  CMS, National Medicaid Fraud 
and Abuse Initiative, Guidelines for Addressing Fraud and Abuse in Medicaid Managed 
Care, pp. 1011, October 2000, p. 12. 
12 Ibid., p. 13.  
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  2   
  
   
I N T R O D U C T I O N  
(6) embezzlement and theft.  They provided examples for each area, as 
well as some successfully prosecuted cases.13  
The Florida Office of Inspector General noted the need to recognize the 
distinctively different issues in fraud detection and prevention in a 
capitated environment versus the traditional fee-for-service 
environment.14  For example, in a capitated system, providers could 
commit fraud by providing as few services as possible, or by treating 
only healthier patients.15  CMS also noted that fraud could harm States 
ability to operate managed care programs by threatening MCEs 
viability.  Additionally, fraudulent MCE data could raise State costs.  
For example, if MCEs manipulate data to give the appearance of 
providing services to beneficiaries who are not enrolled, the MCEs 
would receive enhanced payments in the future.16 
Medicaid Managed Care Program Integrity Requirements 
To protect against fraud and abuse, Federal regulations require MCOs 
and PIHPs to comply with program integrity requirements as a 
condition of receiving payment.17  In establishing program integrity 
requirements, CMS viewed MCOs and PIHPs as larger, more complex 
types of MCEs with higher enrollment levels, greater administrative 
resources, and higher chances of needing sophisticated methods to 
combat fraud and abuse.18  They must have administrative and 
management procedures, including mandatory compliance plans, that 
contain the following seven program integrity provisions: 
  written policies, procedures, and standards of conduct that 
articulate the organizations commitment to comply with all 
applicable Federal and State standards; 
  designation of a compliance officer and a compliance committee that 
are accountable to senior management; 
 
13 Ibid, p. 13. 
14 Florida Agency for Health Care Administration, Office of Inspector General Annual 
Report 2010, p. 47.  
15 National Association of Medicaid Fraud Control Units, Model Criminal Enforcement 
Statutes For Managed Care, p. i, October 1996. 
16 CMS, National Medicaid Fraud and Abuse Initiative, Guidelines for Addressing Fraud 
and Abuse in Medicaid Managed Care, pp. 1011, October 2000. 
17 42 CFR  438.602.  This section also applies to two other types of MCEs. 
18 67 Fed. Reg. 40989, 41066 (June 14, 2002).   
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  3   
  
   
I N T R O D U C T I O N  
  effective training and education for the compliance officer and the 
organizations employees; 
  effective lines of communication between the compliance officer and 
the organizations employees; 
  enforcement of standards through well-publicized disciplinary 
guidelines; 
  internal monitoring and auditing; and 
  prompt response to detected offenses, and for development of 
corrective actions relating to the MCOs or the PIHPs contract.19 
Medicaid Disclosure Requirements 
CMS also requires every provider to disclose certain information related 
to ownership and control, business transactions, and persons convicted 
of crimes.  Each provider must furnish information to the State on: 
  any person with an ownership or control interest or any 
subcontractor in which it has direct or indirect ownership of  
5 percent or more,20 
  any subcontractor with which it had business transactions totaling 
more than $25,000 in the prior year,21 and 
  any person with ownership or control interest who has been 
convicted of a criminal offense related to Federal health programs.22 
State Medicaid Program Integrity Efforts 
States are directly responsible for monitoring MCE operations.23  States 
must have a method for verifying with beneficiaries whether services 
billed by providers were received.24, 25  As of 2007, 27 States 
incorporated program integrity activities under their State Medicaid 
 
19 42 CFR  438.608. 
20 42 CFR  455.104.  For purposes of provider disclosure requirements under this 
section, the definition of Medicaid provider under 42 CFR  455.101 does not include 
individual practitioners or groups of practitioners. 
21 42 CFR  455.105. 
22 42 CFR  455.106. 
23 42 CFR  438.66. 
24 42 CFR  455.20.  
25 CMSs Medicaid Integrity Group (MIG) does not interpret 42 CFR  455.20 to apply to 
managed care entities.  See: Medicaid Integrity Program, Florida Comprehensive Program 
Integrity Review Final Report, p. 7, September 2009 and Medicaid Integrity Program, 
Washington Comprehensive Program Integrity Review Final Report, p. 6. 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  4   
  
   
I N T R O D U C T I O N  
agencies, 7 used an Inspector General model, and 16 used a hybrid of 
both to monitor their Medicaid programs.26   
In addition, every State must either create a State Medicaid Fraud 
Control Unit (MFCU) or demonstrate that operation of a MFCU would 
not be cost effective.27  A MFCUs mission is to investigate and 
prosecute Medicaid provider fraud and incidences of patient abuse and 
neglect.28  Forty-nine States and the District of Columbia operate 
MFCUs.  The majority of MFCUs are located in Offices of State 
Attorneys General.   
Federal Medicaid Program Integrity Efforts 
CMS regional offices (RO) are responsible for reviewing all State 
contracts with MCEs.29  ROs review the contracts using a checklist to 
ensure that the contracts meet all applicable Federal criteria, including 
program integrity provisions. 
The Deficit Reduction Act of 2005 (DRA) created the Medicaid Integrity 
Program, operated by MIG.30  Since 2006, MIG has conducted triennial 
onsite reviews of States program integrity operations.  In addition to 
assessing compliance with Federal requirements, the reviews identify 
vulnerabilities and effective practices, help States improve program 
integrity, and identify opportunities for CMS to provide technical 
assistance to States.  After each review, MIG issues a report to the 
State.31  
In 2007, CMS collaborated with the Department of Justice to develop 
the Medicaid Integrity Institute.  The Institutes mission is to provide 
effective training to meet the needs of State Medicaid program integrity 
staff, with the goal of raising national program integrity performance 
standards and professionalism.  It offers training at no cost to States on 
 
26 CMS, Medicaid Integrity Group, State Program Integrity Assessment:  Federal Fiscal 
Year 2007 Executive Summary, December 2009.  Accessed at http://www.cms.gov on  
April 14, 2011. 
27 Social Security Act  1902(a)(61). 
28 Social Security Act  1903(q). 
29 42 CFR  438.6(a). 
30 Social Security Act  1936, added by section 6034 of the DRA, P.L. 109-171. 
31 CMS, Medicaid Integrity Program, Program Integrity Review Annual Summary, 
May 2009.  Accessed at http://www.cms.gov on April 15, 2011.   
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  5   
  
   
I N T R O D U C T I O N  
topics such as fraud investigation, data mining and analysis, and case 
development.32    
METHODOLOGY 
Scope 
Our evaluation focused on MCEs that had Medicaid contracts in 
selected States in 2009 and the States that contracted with them.   
Sample 
We identified 37 States and the District of Columbia (States) that 
contract with MCEs subject to the program integrity requirements in 
42 CFR  438.608.  We divided these States into quartiles based on the 
percentage of their Medicaid beneficiaries enrolled in MCEs.  We then 
took a purposive sample of 13 States by selecting 4 States from the top 
quartile and 3 States from each of the other quartiles so as to include 
States from every CMS region (see Appendix A).  These 13 States were 
also subject to a MIG State program integrity review in fiscal year 
2009 or 2010.  From each of these 13 States, we chose up to 6 MCEs 
that were included in the MIG review; we purposively selected the 
MCEs so as to include both larger and smaller ones.  In States with 
fewer than six MCEs, we included all of them.  This resulted in a final 
sample of 46 MCEs. 
Data Sources and Collection 
MCEs.  We mailed a questionnaire in October 2010 to the 46 MCEs in 
our sample asking about actions they take to protect against fraud and 
abuse in their organizations and networks and about their major 
concerns regarding fraud and abuse.  Two of the forty-six MCEs were no 
longer in operation; we received completed questionnaires from the 
remaining 44 MCEs.  One of these MCEs used two subcontractors for its 
fraud and abuse activities; each subcontractor completed its own 
questionnaire, which we counted separately, for a total of  
45 respondents. 
States.  We conducted structured telephone interviews with Medicaid 
agency staff from the 13 States in our sample.  We asked how they 
oversee MCEs and what other actions they take to prevent fraud and 
 
32 Medicaid Integrity Institute Fact Sheet.  Accessed at http://www.justice.gov on  
April 13, 2011. 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  6   
  
   
I N T R O D U C T I O N  
abuse.  We conducted the interviews between December 2010 and 
March 2011. 
CMS ROs.  We conducted structured telephone interviews with 
Medicaid staff at each of the 10 CMS ROs.  We conducted the interviews 
between March and April 2011. 
CMS MIG.  We reviewed MIGs program integrity review files for the 
States and MCEs in our sample.  These files include survey modules 
completed by the States and MCEs, as well as additional supporting 
documentation.  We reviewed the files to collect data on State 
requirements addressing Federal program integrity requirements, 
Federal disclosure requirements, MCE reporting of suspected fraud and 
abuse, and training and education that States provided to the MCEs.  
We also reviewed the MIG final reports on CMSs Web site to identify 
areas of State noncompliance and vulnerabilities; MIG had issued final 
reports for 9 of the 13 States in our sample. 
Analysis 
We performed qualitative data analysis on responses from State and 
CMS interviews and on responses from the MCE questionnaires.  For 
example, we reviewed the responses for common themes.  We analyzed 
MIG data and MCE questionnaire responses by performing frequency 
counts of State and MCE responses. 
Limitations 
The results of our State and MCE analyses are limited to the entities we 
reviewed; we cannot project the results on a national basis.  We did not 
independently verify the data we collected. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors 
General on Integrity and Efficiency.
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  7   
  
   
 F I N D I N G S  
All MCEs in our sample reported taking steps to  All 46 MCEs in our sample 
meet Federal program integrity requirements   reported to MIG that they had 
administrative and management 
arrangements in place to prevent fraud and abuse, as required by 
Federal regulations.33  These arrangements included, but were not 
limited to, compliance plans, written policies and procedures, and 
training of MCE staff and providers.  In our questionnaire, we asked 
MCEs for more detail about the type and extent of fraud and abuse 
safeguard training that MCEs provided and the extent to which MCEs 
reported suspected fraud and abuse cases to their States Medicaid 
Agencies. 
All MCEs provided fraud and abuse safeguard training to their staffs; most 
MCEs also offered this training to providers in their networks 
All 45 MCEs that responded to our questionnaire reported providing 
fraud and abuse training to staff in 2010, as required by the program 
integrity regulations.  The training provided by every MCE addressed 
identifying and reporting suspected fraud and abuse.  Most MCEs also 
included training on protecting confidential beneficiary information and 
on ethics.  See Table 1 for a list of topics included in MCE staff training.   
Table 1:  Topics of MCE Staff Training on Fraud and Abuse 
Prevention (n=45) 
Topic  Number of MCEs 
Identifying Suspected Fraud and Abuse  45 
Reporting Suspected Fraud and Abuse  45 
Ethics  43 
Protecting Confidential Beneficiary Information  43 
Compliance Plan Review  39 
Other  20 
Source:  OIG survey of MCEs, 2010. 
The program integrity regulations require training to be effective;  
37 of the 45 MCEs that responded to our questionnaire reported 
evaluating the effectiveness of staff training.34  MCEs employed several 
 
33 42 CFR  438.608. 
34 42 CFR  438.608.  Although the regulation requires training to be effective, it does 
not require MCEs to evaluate the effectiveness of training. 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  8   
  
   
FF II NN DD II NN GG SS   
methods to evaluate the effectiveness of training, such as surveying 
(23 MCEs) and testing (20 MCEs) staff on the topics covered.  Eight 
MCEs also analyzed staff job performance after the training, and five 
MCEs used some other method.  
Most MCEs also reported that they offered fraud and abuse safeguard 
training to providers in their networks in 2010 (41 of the 45 MCEs).  
The most common topics in provider training were coding accuracy, 
recognizing suspected beneficiary fraud, and protecting confidential 
beneficiary information.  See Table 2 for a list of topics addressed 
during provider training. 
Table 2:  Topics of MCE Provider Training on Fraud and Abuse 
Prevention (n=41)  
Topic  Number of MCEs 
Coding Accuracy  36 
Recognizing Suspected Beneficiary Fraud  31 
Protecting Confidential Beneficiary Eligibility  31 
Federal Fraud and Abuse Laws  30 
Determining Beneficiary Eligibility  30 
Other  13 
Source:  OIG survey of MCEs, 2010. 
In contrast with staff training, only 15 MCEs evaluated the 
effectiveness of provider training.  The most common method that 
MCEs used to measure effectiveness was claims analysis (seven MCEs).  
These MCEs conducted analyses to determine whether billing errors 
decreased following training.  Other methods that MCEs used were 
conducting provider satisfaction surveys (six MCEs), performing audits 
(four MCEs), and measuring beneficiary satisfaction via surveys and 
appeal data (three MCEs).  Four MCEs used other methods to evaluate 
provider training. 
MCEs in our sample identified and reported cases of suspected fraud and 
abuse to their States and recovered payments from providers that resulted 
from fraud and abuse 
In 2009, 33 of the 45 MCEs that responded to our questionnaire 
reported cases of suspected fraud and abuse to their States Medicaid 
agencies, and 22 MCEs reported suspected cases to their States 
MFCUs.  MCEs reporting to State Agencies ranged from 1 case of 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  9   
  
   
F I N D I N G S  
suspected fraud and abuse to 140 cases, with a median of 9 cases; MCE 
reporting to MFCUs ranged from 1 case to 290 cases, with a median of 
7 cases.  Twenty MCEs reported that they recovered payments from 
providers in 2009 ranging from $2,615 to $2,769,900, with a median 
recovery payment of $96,302.   
 
All 13 States in our sample reported taking 
States contract with MCEs to 
steps to oversee MCEs fraud and abuse  provide Medicaid services and are 
safeguards  responsible for oversight of all 
contract provisions.  Program 
integrity requirements are included in these contracts. 
All 13 States conduct desk reviews of MCEs compliance plans   
Six States that we interviewed review compliance plans annually.  The 
remaining seven States vary in when they conduct their reviews; most 
review plans when MCEs apply to Medicaid and when MCEs update 
their plans. 
Regardless of the frequency of their reviews, all States assess whether 
compliance plans contain the relevant Federal requirements.  Some 
States look for provisions that exceed Federal requirements and that 
address fraud and abuse.  These include measures to ensure that 
providers have sound fiduciary practices, methods to identify providers 
with unusual billing patterns and beneficiaries with unusual usage 
patterns, and goals to improve program integrity for the upcoming year. 
Eleven of the thirteen States conduct onsite reviews  
States told us that a compliance plan has little value if it is not 
implemented, so many conduct onsite reviews of MCEs to augment their 
desk reviews of compliance plans.  Eleven States in our sample visit 
MCEs to ensure they comply with Federal program integrity 
requirements.  Seven of those States conduct the reviews themselves; 
the other four use an external quality review organization (EQRO) to 
conduct site visits and ensure program integrity compliance.35  Six of 
the eleven States conduct onsite reviews annually.  The others vary in 
their onsite review cycles.  
 
35 EQROs are independent entities with which States contract to conduct statutorily 
mandated reviews of Medicaid MCE quality outcomes, timeliness, and access to items and 
service.  Social Security Act  1932(c)(2)(A)(i). 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  10   
  
   
F I N D I N G S  
During site visits, States ensure that MCEs implement the provisions of 
their compliance plans.  For example, to assess the effectiveness of MCE 
employee fraud and abuse training, States ask MCE staff where 
compliance plans are located and to whom staff report fraud.  Some 
States also evaluate the timeliness and content of training by 
determining whether MCEs train employees upon hiring and annually 
thereafter, as well as whether training includes pertinent Federal 
requirements, such as the False Claims Act.  To assess whether lines of 
communication are effective, States evaluate MCEs fraud hotlines.  One 
State reviews MCE fraud and abuse safeguard materials provided to 
beneficiaries to ensure that the materials are appropriate and 
understandable. 
All 13 States reported requiring that MCEs disclose ownership information   
Although all 13 States in our sample require MCEs to disclose required 
information on ownership and control, they vary in how often they 
require MCEs to submit data.  Eight States require MCEs and 
providers to submit ownership information during their initial 
application to their States Medicaid programs but vary in their 
submission requirements thereafter.  These States may subsequently 
require submission annually or as ownership changes.  States that do 
not require ownership disclosure at enrollment typically require it 
annually, monthly, or as changes occur. 
Eight States in our sample recently updated their reporting 
requirements as a result of MIGs program integrity review.  Four  
strengthened reporting requirements, primarily by enhancing contract 
language to specifically address all ownership disclosure provisions, 
such as disclosure of owners siblings.  Two States implemented new 
processes to require that MCEs report ownership information.  Two 
States amended their contracts to specify sanctions and other penalties 
for noncompliance. 
Some States told us that they would like further guidance from CMS 
regarding disclosure requirements.  For example, one State reported 
that it is unclear how far downstream MCEs should disclose ownership 
information.  Another State was unsure how to treat information about 
owners that are not individuals, such as publicly traded companies or 
large hospitals. 
Most States found MCEs to be compliant with disclosure requirements 
(the two States that recently implemented ownership disclosure 
requirements had not yet evaluated compliance).  Although States did 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  11   
  
   
FF II NN DD II NN GG SS   
not need to take action against noncompliant MCEs, they told us that 
they would use corrective actions, if needed, including sanctions, 
contract termination, and corrective action plans. 
States reported interacting regularly with MCEs 
Eleven of thirteen States hold recurring meetings with MCEs.  Nine 
States incorporate training into these meetings.  The meetings typically 
involve MCE and State concerns, review of ongoing fraud and abuse 
cases, and provide training on identifying fraud and abuse and on 
reporting requirements.   
MCE compliance officers typically attend these meetings; MFCU staff 
sometimes attend, as well.  Meetings typically are held monthly or 
quarterly.  Five of the eleven States have more than one recurring 
meeting, such as quarterly meetings, which all their MCEs attend, and 
separate monthly meetings with each MCE.   
Ten of thirteen States interact with MCEs on an ad hoc basis, mostly to 
discuss specific fraud and abuse cases and other MCE concerns.  One of 
the two States that does not have recurring meetings with MCEs 
reported that it interacts with them almost daily. 
 
Although MCEs and States are taking steps to 
We asked MCEs and States to 
address fraud and abuse in managed care,  identify their major concerns 
they remain concerned about its prevalence   regarding Medicaid managed care 
fraud and abuse.  These concerns 
included services billed but not rendered, medically unnecessary 
services, and questionable beneficiary eligibility.  CMS has offered 
guidelines for addressing Medicaid managed care fraud and abuse in 
the past, although the major concerns identified in our review largely 
reflect only one area highlighted in CMSs guidelines:  claims 
submission and billing procedures. 
The primary concernshared by MCEs and Statesrelates to services 
billed but not rendered 
MCEs and States reported concerns with providers that bill MCEs for 
medical services not actually provided to beneficiaries.  Twenty-six 
MCEs and four States shared this concern.  The MIG program integrity 
reviews identified services billed but not rendered as a vulnerability in 
eight of the nine States in our sample for which final reports were 
available.  Further, MIG reviews found that only 19 of the 46 MCEs in 
our sample verified with beneficiaries that services were received.   
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  12   
  
   
F I N D I N G S  
One tool MCEs can use to try to verify whether services were received is 
an explanation of medical benefits (EOMB).  MCEs send EOMBs to 
beneficiaries, who can then inform the MCEs if they did not receive the 
listed services.  MIG reviews found that 8 of the 46 MCEs in our sample 
used EOMBs to verify whether services were received.  Two of these 
MCEs recovered payments as a result of this practice. 
Without such verification, States and MCEs have no way of knowing 
whether they are paying for fraudulent claims or whether beneficiaries 
are receiving services.  Fraudulent claims unnecessarily inflate the 
capitation rate paid to MCEs.   
In responses to our questionnaire, MCEs reported using other means to 
address this concern, such as reviewing their payment systems and 
working with outside entities, for example, OIG or State medical boards.  
MCEs and States expressed concerns about provider and beneficiary fraud 
and abuse 
MCEs reported additional concerns regarding provider fraud, such as 
services provided that were not medically necessary and upcoding.  
MCEs also reported concerns regarding beneficiary fraud, such as 
beneficiary eligibility and drug abuse.  See Table 3 for these additional 
concerns. 
The most common method by which MCEs reported addressing 
medically unnecessary services and upcoding was through analysis of 
their payment systems, such as audits or claims analysis.  MCEs also 
used prior authorization processes and medical record reviews.  To 
address upcoding, MCEs educated providers about proper coding and 
alerted providers to atypical billing patterns. 
Table 3:  Additional MCE Concerns About Medicaid Managed 
Care Fraud and Abuse
 
 
Concern  Number of MCEs 
Services Provided to Beneficiaries That Are Not 
16 
Medically Necessary 
Upcoding by Providers  10 
Verifying Beneficiary Eligibility  8 
Beneficiary Drug Abuse and/or Diversion  7 
Source:  OIG survey of MCEs, 2010. 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  13   
  
   
FF II NN DD II NN GG SS   
To address beneficiary eligibility concerns, MCEs encouraged providers 
to verify eligibility when treating new patients and offered resources 
such as a provider Web portal and telephone line with eligibility 
verification capabilities.  To address drug abuse and diversion, MCEs 
conducted monitoring activities, such as providing case management 
services to beneficiaries, analyzing data to identify high-volume 
prescription trends of providers, and investigating suspected cases.  
MCEs also collaborated with State and Federal agencies in reporting 
and monitoring suspected drug abuse and diversion cases.  
About half of the States we interviewed expressed concerns regarding 
beneficiary fraud and abuse.  Examples include beneficiaries fraudulently 
enrolling in Medicaid, abusing pharmaceuticals, and excessively visiting 
hospital emergency rooms.  States expressed frustration that they could 
not apply the same sanctions to address beneficiary fraud as they could 
provider fraud.   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  14   
  
   
 R E C O M M E N D A T I O N S  
 
Managed care presents challenges in addressing fraud that differ from 
those in fee-for-service Medicaid.  For example, managed cares 
capitated payments create incentives for providers to render fewer 
services to beneficiaries, and States must bear financial risk that could 
threaten the viability of their Medicaid managed care programs.  CMS 
guidelines on addressing Medicaid managed care fraud and abuse have 
not been updated since 2000. 
As States increasingly use managed care to deliver Medicaid services, 
implementing safeguards to protect against fraud and abuse remains 
essential.  MCEs, States, and CMS all have a stake in protecting the 
integrity of the program.  Overall, we found that MCEs and States 
reported taking steps to monitor and protect against fraud and abuse.  
However, they also expressed major concerns.   
More than half of the MCEs in our sample reported concerns with 
services billed but not provided to beneficiaries.  CMSs MIG similarly 
identified this vulnerability, finding that most States and MCEs in our 
sample do not verify with managed care beneficiaries whether services 
were received, despite regulations requiring States to do so for fee-for-
service Medicaid. 
CMS guidelines on addressing Medicaid managed care fraud and abuse 
identified six areas of concern.  However, the majority of concerns 
identified in our review fall under only one of these six areas:  claims 
submission and billing procedures.  The other five areas were seldom, if 
at all, reflected in the concerns.  Therefore, we recommend that CMS: 
Require that State contracts with MCEs include a method to verify with 
beneficiaries whether they received services billed by providers 
CMS could require States to implement one of several options.  One is 
for MCEs to send EOMBs to beneficiaries.  As one State Agency told us, 
EOMBs are the best, most effective tool to determine whether billed 
services were actually received.  Other options include contacting 
beneficiaries by telephone or mailing them a questionnaire.  To 
minimize the cost of verifying services, MCEs could contact a 
representative sample of beneficiaries.  MCEs could also sample 
beneficiaries based on billing analyses. 
Update guidance to reflect concerns expressed by MCEs and States 
CMS could update and reissue its Guidelines for Addressing Fraud and 
Abuse in Medicaid Managed Care.  Because most of the concerns 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  15   
  
   
R E C O M M E N D A T I O N S  
reported to us fall under the Claims Submission and Billing 
Procedures section, CMS could use that as a starting point from which 
to expand.  CMS could also share best practices and innovative methods 
that States and MCEs have used to address fraud and abuse concerns 
and strengthen program integrity oversight.  CMS could also share best 
practices via the Medicaid Integrity Institute and its Technical Advisory 
Groups (TAG).  CMS has two relevant TAGsone focused on Medicaid 
managed care and one on fraud and abusethat could collaborate to 
share best practices across all their member States. 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with both recommendations, stating that it will 
advise States to work with their MCEs to determine and implement 
effective strategies for verifying that services billed by network 
providers are received.   CMS will work with States to identify 
efficient and effective strategies based on States and MCEs 
experiences.  CMS also stated that it has been developing a strategy 
to effectively address managed care program integrity and will revise 
its guidelines once that strategy is complete.  Finally, CMS stated 
that it provides a compendium of States noteworthy and effective 
practices in key program integrity areas, including Medicaid managed 
care, on its Web site.  We made no changes to the report based on 
CMSs comments.  See Appendix B for the full text of CMSs 
comments. 
 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  16   
  
   
 A P P E N D I X ~ A  
Percentage of Medicaid Beneficiaries Enrolled in Managed Care Organizations 
as of June 30, 2008 
Medicaid  Percentage 
Medicaid 
State  CMS Region  Managed Care  Enrolled in 
Enrollment 
Enrollment  Managed Care 
Tennessee  Region IV  1,207,136  1,207,136  100% 
Vermont  Region I  141,260  128,571  91% 
Arizona*  Region IX  1,048,635  949,404  91% 
Hawaii  Region IX  211,105  166,948  79% 
Oregon  Region X  417,946  306,957  73% 
New Jersey*  Region II  914,503  659,586  72% 
Ohio*  Region V  1,783,993  1,274,549  71% 
Delaware*  Region III  152,899  106,267  70% 
Maryland*  Region III  710,790  491,274  69% 
Indiana*  Region V  881,888  582,714  66% 
Alabama  Region IV  764,914  504,466  66% 
Connecticut  Region I  435,419  284,465  65% 
New York  Region II  4,147,101  2,685,186  65% 
Michigan  Region V  1,547,246  993,832  64% 
District of Columbia  Region III  146,072  92,985  64% 
Minnesota  Region V  617,397  385,025  62% 
New Mexico  Region IV  472,629  292,456  62% 
Rhode Island*  Region I  178,119  110,195  62% 
Georgia  Region IV  1,271,355  723,621  57% 
Virginia  Region III  753,714  419,904  56% 
Washington*  Region X  960,881  515,545  54% 
Pennsylvania  Region III  1,833,489  968,887  53% 
Wisconsin  Region V  907,455  472,612  52% 
California  Region IX  6,606,893  3,388,651  51% 
Kansas  Region VII  278,705  132,832  48% 
Nevada*  Region IX  188,831  88,871  47% 
West Virginia  Region III  311,064  138,699  45% 
Texas*  Region VI  3,041,201  1,311,046  43% 
Missouri  Region IV  833,112  345,868  42% 
Florida*  Region IV  2,276,014  878,067  39% 
Massachusetts  Region I  1,155,134  402,469  35% 
Utah  Region VIII  208,009  59,904  29% 
South Carolina  Region IV  689,338  184,526  27% 
Kentucky  Region IV  731,911  145,066  20% 
Nebraska*  Region VII  202,297  32,716  16% 
Colorado*  Region VIII  429,895  59,989  14% 
Illinois  Region V  2,106,700  164,100  8% 
Iowa  Region VII  362,807  4,764  1% 
Note:  States with an * are included in this evaluation. 
                  Source:  Office of Inspector General Analysis of Centers for Medicare & Medicaid Services Medicaid Enrollment data as of June 30, 2008. 
 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  17  x 
A  P  PEN  D  B 
Agency Comments 
(4
..........'.,.,....
DEPARTMENT OF HEALTH & HUMAN SERVICES  Centers for Medicare & Medicaid Services 
Administrator 
Washinglon. DC 20201 
DATE:  OCT 2 6 2011 
TO: 	 Daniel R. Levinson 
Inspector General 
FROM: 	 Donald M. Berwick, M.D. 
Administrator 
SUBJECT: 	 Dffice ofInspector General (DIG) Draft Report:  Medicaid Managed Care: Fraud 
and Abuse Concerns Remain Despite Safeguards (DEI-OI-09-00550) 
Thank you for the opportunity to review and comment on the DIG Draft Report entitled, 
"Medicaid Managed Care: Fraud and Abuse Concerns Remain Despite Safeguards (DEI-OJ-09. 
00550)." The objectives of the report are to determine--(I) To what extent selected Medicaid 
managed care entities (MCEs) took steps to meet Federal program integrity requirements; (2) 
How States oversee MCEs' fraud and abuse safeguards; and (3) The major concerns that MCEs 
and States have regarding fraud and abuse in Medicaid managed care. The DIG reviewed CMS' 
program integrity reviews for a sample of 13 States and 46 MCEs, collected questionnaires from 
45 MCEs, and conducted structured interviews with the 13 States and CMS. 
The DIG's report found that all MCEs in the sample reported taking steps to meet the Federal 
program integrity requirements, and all 13 States reported taking steps to oversee MCEs' fraud 
and abuse safeguards.  However, MCEs and States remain concerned about the prevalence of 
fraud and abuse in managed care. 
OIG Recommendation 
The CMS should require that State contracts with MCEs include a method to verify with 
beneficiaries whether services billed by providers were received. 
CMS Response 
The CMS concurs with DIG's recommendation to implement a mechanism for verifying that 
billed services are delivered. Title 42 CFR 455.20 already requires States to implement a 
method for verifying with recipients whether services billed by providers were actually received, 
but the regulation does not prescribe the method States must use.  This language gives the States 
flexibility to determine the most effective -. and costeffective mechanisms for accomplishing 
this, consistent with their administrative infrastructure, delivery systems and beneficiary 
popUlations. Consistent with DIG's recomtnendation, CMS will advise States to work with their 
MCEs to determine and implement effective strategies for verifying that services billed by 
network providers are received and CMS will work with States to identify efficient and effective 
strategies based on States and MCE experiences.  CMS appreciates the work of the DIG in 
OEI010900550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  18   
  
   
A P P E N D I X ~ B  
 
 
   
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  19   
  
   
 A C K N O W L E D G M E N T S  
This report was prepared under the direction of Joyce M. Greenleaf, 
Regional Inspector General for Evaluation and Inspections in the 
Boston regional office, and Russell W. Hereford, Deputy Regional 
Inspector General. 
Ivan Troy served as the team leader for this study.  Other principal 
Office of Evaluation and Inspections staff from the Boston regional 
office who contributed to the report include Alyson J. Cooper and 
Shreya M. Patel; other central office staff who contributed include Kevin 
Manley and Tasha Trusty.  
 
  OEI-01-09-00550  MEDICAID MANAGED CARE:  FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS  20    
  
Office of Inspector General 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health & Human Services (HHS) 
programs, as well as the health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit Services 
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 
audits with its own audit resources or by overseeing audit work done by others.  Audits 
examine the performance of HHS programs and/or its grantees and contractors in carrying 
out their respective responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and 
mismanagement and promote economy and efficiency throughout HHS. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud, waste, or abuse and promoting 
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 
of fraud and misconduct related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI utilizes its resources 
by actively coordinating with the Department of Justice and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to criminal 
convictions, administrative sanctions, and/or civil monetary penalties. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to 
OIG, rendering advice and opinions on HHS programs and operations and providing all 
legal support for OIGs internal operations.  OCIG represents OIG in all civil and 
administrative fraud and abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program guidance, publishes fraud alerts, and provides other 
guidance to the health care industry concerning the anti-kickback statute and other OIG 
enforcement authorities.