Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
MEDICAID MANAGED CARE 
FRAUD AND ABUSE 
JUNE GIBBS BROWN 
Inspector General 
JUNE 1999 
OEI-07-96-00250  OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, is to 
protect the integrity of the Department of Health and Human Services programs as well as the 
health and welfare of beneficiaries served by them.  This statutory mission is carried out through a 
nationwide program of audits, investigations, inspections, sanctions, and fraud alerts.  The 
Inspector General informs the Secretary of program and management problems and recommends 
legislative, regulatory, and operational approaches to correct them. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) is one of several components of the Office of 
Inspector General.  It conducts short-term management and program evaluations (called 
inspections) that focus on issues of concern to the Department, the Congress, and the public.  The 
inspection reports provide findings and recommendations on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
OEI's Kansas City Regional Office prepared this report under the direction of James H. Wolf, 
Regional Inspector General.  Principal OEI staff included: 
REGION  HEADQUARTERS 
Jennifer King, Project Leader  Wynethea Walker, Program Specialist

Perry Seaton, Program Analyst  Stuart Wright, Associate Director

Linda Paddock, Program Analyst  Barbara Tedesco, Mathematical Statistician

To obtain copies of this report, please call the Kansas City Regional Office at (816)426-3697. 
Reports are also available on the World Wide Web at our home page address: 
http://www.dhhs.gov/progorg/oei  E X E C U T I V E  S U M M A R Y

To describe and assess the manner in which Medicaid Section 1115 Waiver States detect, review, 
and refer for investigation fraud and abuse cases in managed care programs. 
BACKGROUND 
Medicaid is a Federal-State matching entitlement program which provides medical assistance to 
families and individuals below certain income and resource levels.  As costs increase, States are 
looking to managed care organizations (also referred to as managed care plans) to provide cost-
effective medical care while preventing unnecessary medical treatment.  They contract with States 
to provide all or part of the Medicaid benefit package on a prepaid risk basis. 
Fraud and abuse in Medicaid programs threatens States capability to pay for services and provide 
quality care for beneficiaries.  To address this, Medicaid State agencies are required to have an 
integrity program dedicated to detecting and reviewing suspected fraud and abuse cases.  Because 
abuse can entail patient abuse or egregious forms that may represent fraudulent activity, we have 
referenced fraud and abuse cases together in this study. 
In hopes of learning how States are coping with fraud and abuse emerging in managed care 
settings, we examined detection and referral processes, provisions, and data in 10 States operating 
with 1115 Waivers for managed care at the time we started our study.  We collected information 
through surveys, site visits, and interviews of responsible officials in the Medicaid State agencies, 
fraud control units, and 85 managed care organizations.  This study is a preliminary review of 
fraud and abuse detection and referral in managed care settings and does not address related 
aspects such as investigation and prosecution of cases. 
FINDINGS 
Two States have active programs which result in case detection and referral of fraud and 
abuse; others do not 
While 8 of the 10 States in our study report detection and referral of cases, 2 States (Arizona and 
Tennessee) accounted for almost all managed care case referrals (97 percent, or 490 out of 
504 cases) and produced recoveries of over $4.3 million during a 12-month period.  Fraud control 
units in these States employ extensive proactive efforts to detect fraud and abuse cases. The 
remaining eight States fraud units do not have such extensive activities and protocols. 
There is no general agreement about roles and requirements to detect and refer fraud and 
abuse in the managed care setting 
Theoretically, the current program integrity requirements in the fee-for-service Medicaid program 
also legally apply with equal force in the managed care program.  However, Medicaid State 
agencies, fraud control units, and managed care organizations have differing opinions concerning 
)))))))))))
i  who should have the responsibility for detecting and referring managed care fraud and abuse cases 
for investigation.  States also vary in establishing and applying detection and referral requirements 
for managed care organizations, with four States having no specified requirements.  Where 
requirements are established, fraud units and managed care plans are confused or unaware of 
them.  Approximately half of the managed care plans report they have established a coordinator or 
integrity program to proactively detect fraud and abuse.  While Medicaid State agency officials 
generally believe that managed care plans appropriately refer cases, fraud control unit officials do 
not. 
Medicaid State agencies and fraud control units differ in the intensity and the nature of 
oversight activities 
The majority of Medicaid State agencies and fraud units report limited oversight and fraud 
identification efforts.  Officials in two States indicate they have routine or systematic protocols in 
place to identify managed care fraud and abuse.  Two of the 10 States note having provisions to 
penalize plans for non-referral of detected fraud and abuse cases.  Also, few Medicaid State 
agency officials report they conduct reviews of managed care provider contracts and managed 
care plans internal detection and referral efforts. 
Medicaid State agencies, fraud control units, and managed care organizations identify a 
number of tools they believe they need to address fraud and abuse in managed care 
Medicaid State agencies, fraud units, and managed care organizations identify a number of tools 
needed including detection and referral guidelines, training on detection techniques, reliable 
encounter data, and computer systems.  Responding officials also report the need for a centralized 
information resource comprising a national database of detected cases and their outcomes, a 
compendium of best practices, a list of knowledgeable contacts, and additional staffing.  All 10 
fraud units and 41 of the 85 managed care organizations in our study report they do not have staff 
specifically assigned to investigate managed care fraud and abuse.  Likewise, three Medicaid State 
agencies officials note they do not have staff assigned to conduct oversight of internal plan 
detection and referral efforts. 
RECOMMENDATIONS 
We recognize that fraud and abuse in managed care is a newly emerging area of concern for the 
healthcare community.  We conducted this study in hopes of learning how States are coping with 
fraud and abuse, how they detect cases, and what they do with them once detected.  Overall, there 
is confusion and disagreement on how to address fraud and abuse and there is limited activity in 
developing or actively pursuing and referring cases in the Medicaid managed care program. 
However, we have learned that States with proactive efforts are detecting and resolving cases. 
We believe the information obtained in this study provides an opportunity for Medicaid State 
agencies, fraud units, and managed care organizations to learn from those that have established 
proactive managed care fraud and abuse programs. 
)))))))))))
ii  It is important for all entities involved to have an effective fraud and abuse detection and referral 
system to protect the integrity of the Medicaid program and, as fraud in many cases can impact 
quality, to ensure high quality health care for beneficiaries.  We recognize that HCFA initiated a 
number of efforts in this area in 1997, including the formation of the Medicaid Fraud in Managed 
Care Workgroup initiative to develop a model fraud and abuse system for the States, the 
coordination of National Medicaid Consortium meetings to discuss these issues, and participation 
in the Department of Justice Managed Care Work Group.  Beginning in 1998, HCFA also 
initiated a series of four Fraud and Abuse in Medicaid executive-level seminars for state 
decision-makers to discuss strategies and solutions in their efforts to control fraud and abuse. 
However, we believe that implementation of the following recommendations can promote or 
further enhance Medicaid State agency, fraud control unit, and managed care organizations 
efforts to address fraud and abuse in managed care.  To that extent, we recommend HCFA, in 
coordination with the OIG, 
<<	 establish guidelines for States and managed care organizations to follow in 
developing and carrying out proactive fraud and abuse detection and referral 
activities. 
<	 ensure that States monitor managed care organizations fraud and abuse programs 
for compliance with its guidelines. 
<	 continue to develop, sponsor, and emphasize detection and referral training for 
States and Medicaid managed care organizations. 
AGENCY COMMENTS 
The HCFA concurs with recommendations in the report and describes their various efforts and 
initiatives in technical assistance, development of guidelines, consultation with States, and 
detection and referral training.  We are encouraged that the agency reports it is focusing attention 
and efforts in these important areas.  Also, we are pleased that it intends to share the guidelines 
and other fraud and abuse detection and referral products for the OIGs review and comment. 
We note the first recommendation was revised in response to HCFAs comment regarding the 
OIGs  use of guidelines and requirements interchangeably. 
)))))))))))
iii  T A B L E  O F  C O N T E N T S

PAGE 
EXECUTIVE SUMMARY 
INTRODUCTION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

FINDINGS  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Two States with Active Fraud and Abuse Programs  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Disagreement About Roles and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Variations in Oversight and Penalties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Tools Needed to Address Fraud and Abuse  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  16

ENDNOTES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

APPENDICES 
A: Medicaid Section 1115 Waiver States.  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

B: Types of Suspected Fraud and Abuse Cases  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1

C: Fraud and Abuse Referrals to Fraud Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  C-1

D: Agency Comments  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  D-1
 I N T R O D U C T I O N

PURPOSE 
To describe and assess the manner in which Medicaid Section 1115 Waiver States detect, review, 
and refer for investigation fraud and abuse cases in managed care programs. 
BACKGROUND 
Medicaid 
Medicaid is a Federal-State entitlement program which provides medical assistance to families and 
individuals below certain income and resource levels.  Each State, within national guidelines 
established by the Federal Government, can develop its own eligibility standards; determine the 
type, amount, duration, and scope of services; set the rate of payment for services; and 
administers its own program. 
For Fiscal Year (FY) 1996, the Health Care Financing Administration (HCFA), the Federal 
agency responsible for overseeing the Medicaid program, reported that the program served a total 
of 36 million children, elderly, blind and disabled individuals.  Also in 1996, Medicaid costs for 
health care totaled approximately $153 billion, with the States paying $66 billion and the Federal 
government $87 billion. 
Medicaid Managed Care 
As costs increase, States are looking to managed care organizations (also referred to as managed 
care plans) to provide cost-effective medical care while enhancing access to quality care.  The 
purpose of managed care is to control excess costs by using a gatekeeper or primary care 
physician to manage or coordinate beneficiary access to services, while preventing unnecessary 
medical treatment.  Under this concept, plans contract with States to provide all or part of the 
Medicaid benefit package on a prepaid risk basis.  States must operate their Medicaid programs 
under the traditional fee-for-service system unless the State amends its State Plan or obtains a 
HCFA 1115 waiver or 1915 waiver.  Under the Balanced Budget Act of 1997, States are 
permitted to mandatorily enroll Medicaid beneficiaries into managed care by amending its State 
Plan.  If a State opts to incorporate Medicaid managed care permanently into the State Plan, it is 
not necessary to obtain an 1115 Waiver. 
Under section 1115(a) waivers, States can conduct time-limited projects allowing broad new 
initiatives which demonstrate program features that have not been tried or proposed on a 
widespread basis.  This waiver allows States to cover new services, offer different service 
packages, and test reimbursement methods, and may require Medicaid beneficiaries to enroll in 
managed care plans.  Many of the States' approaches are aimed at saving money which enables 
them to cover additional low-income recipients and the uninsured.  Under section 1915(b) 
waivers, States can also cover specific populations in managed care programs, but are generally 
more narrowly focused and are confined to specific Federal Medicaid requirements. 
)))))))))))
1  As of February 1998, there were 16 States that have implemented 1115 State-wide waivers, 
2 States with approved waivers awaiting implementation, and 8 others pending approval.  There 
are other 1115 waivers proposed, approved, or implemented but they involve localized programs 
for special populations or geographic areas.  These 1115 demonstration projects are monitored 
and evaluated by HCFA. 
The concept of managed care is growing rapidly within the Medicaid program.  The HCFA 
reported as of June 30, 1996, that enrollment in Medicaid managed care increased by 
177 percent since June 30, 1993, which includes a 36 percent increase in 1996 alone.  From 
June 30, 1995, to June 30, 1996, the number of beneficiaries enrolled in Medicaid managed care 
grew from 9.8 million to approximately 13.3 million, approximately 40 percent of the total 
Medicaid population.  This trend continues as more States establish 1115 waivers or amend their 
State plans. 
Fraud in Traditional Medicaid Programs 
Fraud in Medicaid programs threatens States capability to pay for services and the quality of 
services to beneficiaries.  To address this fraud, specific requirements exist under the traditional 
Medicaid program for the States detection and investigation of individuals and providers 
violating State and Federal law.  These functional requirements cover three primary State 
components: Medicaid State agencies; Surveillance and Utilization Review Subsystems (S/URS); 
and Medicaid fraud control units. 
Medicaid State Agencies - The Medicaid State agency is authorized by law and regulation and is 
part of the States implementation of a Medicaid State Plan.  The Medicaid State agency 
establishes rules and regulations that it uses for administration of the plan.  The agency must have 
a program integrity component within its domain which is dedicated to detecting and investigating 
suspected cases of fraud. 
Surveillance and Utilization Review Subsystems Units - Under a fee-for-service program, the 
S/URS component within the Medicaid State agency is responsible for detecting and referring 
potential fraud and abuse cases for investigation.  The S/URS unit uses the Medicaid Management 
Information System to apply automated post-payment screens to Medicaid claims and conducts 
preliminary reviews of aberrant providers and beneficiaries to determine whether they substantiate 
a pattern of criminal fraud.  When potential cases are detected, the S/URS refers the cases to 
assigned components within the States that pursue investigation of criminal fraud.  In most cases, 
these are the Medicaid fraud control units. 
Medicaid Fraud Control Units - These fraud units are part of the State Attorney General or 
other State agency which are separate and distinct from the Medicaid State agency.  All States are 
required to have a fraud control unit unless they obtain a waiver.  The scope of their authority is 
to investigate and prosecute suspected cases of fraud in connection with any aspect of the 
provision of medical assistance and to review complaints of abuse and neglect of patients in health 
care facilities which received payments under the State plan.  The fraud units are also responsible 
for investigating suspected cases of fraud which occur within the Medicaid State agency.  There 
are currently 47 States which have established fraud control units as of April 1998. 
)))))))))))
2  Fraud in Managed Care 
Fraud in managed care is a newly emerging area of concern to the healthcare community.  As a

result, there are few who have extensive experience on how to address managed care fraud. 

Although requirements exist for detection and investigation of claims related fraud cases

occurring in traditional Medicaid programs, there have been few requirements 1 developed to

specifically address fraud detection and referral in the managed care setting.  One reason for this

could be the belief of some policy makers, government agency officials, health care insurers, and

providers that the introduction of managed care would all but eliminate fraud in the health field. 

However, there are increasing numbers of officials who believe this is not so.  The National

Association of Medicaid Fraud Control Units notes in the President's Task Force Report, While

many proponents of managed care believe that the very nature of the system prevents fraud, the

experience of the fraud control units proves otherwise....no health care plan is immune from fraud,

but rather that fraud will simply take different forms. 2  In addition, the National Health Care

Anti-Fraud Association (NHCAA) further noted this misconception in a Report to the National

Health Care Anti-Fraud Association Board of Governors by the NHCAA Task Force on Fraud in

Managed Care, by stating, Contrary to the perceptions of some in government and in the health

care reform arena....and even in the health insurance industry.... fraud does not disappear in a

managed care or managed-competition environment. 3

In fully capitated managed care organizations, there is a fixed amount of money paid for the care

of patients and no claims are submitted as in the traditional Medicaid program.  As a result, there

are no State claims review processes through which charges are filtered before payment is made

and, as such, regulations and HCFA requirements have not revised or specified a role for S/URS

units as part of the Medicaid managed care program.  The risk for managed care organizations is

that the capitated rates will not cover all the costs of treating beneficiaries.  Consequently, there

are incentives to provide less than necessary care to recover losses or to increase the plans'

earnings.  Also, capitated managed care has opened the door for less obvious forms of fraud

including:

!  underutilization and denial of necessary covered medical care;

!  exclusion of certain groups from services;

!  failure to provide beneficiaries' services advertised or mandated by law;

!  unreasonable times and distances for appointments to prevent beneficiaries from obtaining

services; 
!  illegal marketing tactics; 
!  enrolling fictitious enrollees or those ineligible for enrollment; 
!  submission of falsely elevated cost data to justify higher capitation payments; and 
!  fraudulent subcontracts. 
In addition, most Medicaid managed care plans themselves face the same kind of fraud threats 
faced by traditional fee-for-service programs.  For example, a plan may contract with physicians 
who may then sub-contract with other physicians and suppliers who could be paid on a 
fee-for-service basis.  It can also receive a capitated rate for managing all beneficiaries services 
and may then compensate 100 percent of its providers on a claims basis.  Therefore, it is likely 
)))))))))))
3  that traditional forms of fee-for-service fraud also impacts managed care operations.  Some

examples of traditional fraud that may also occur include:

!  fraudulent related party transactions;

!  kickbacks;

!  rebates and other illegal economic arrangements; and

!  fraud in the administration of the program. 

Medicaid State agencies are not only dealing with fee-for-service fraud, but also the newly

emerging types occurring in managed care settings.  As the provision of services is 

sub-contracted out from the managed care organizations, the ability to detect fraud becomes

increasingly problematic.

Fraud activity has shifted from the provider level to the corporate managed care level.  The

National Association of Attorneys General, in a report entitled Health Care Fraud In A Managed

Care Environment, discusses the inherent problems with this shifting of responsibility noting,

The managed care organizations (MCO), being the entity closest to the provider, would be in the

best position to monitor the activities of the providers and to match services to costs through a

reporting process.  But this has not always been the case....In some instances it is the MCO itself

that is attempting to cap services to save money.  There would be a natural reluctance with the

MCO to make the effort to police itself and its providers. 4  It seems the responsibility should

evolve for the managed care plans to detect and refer cases of suspected fraud and abuse

committed by plan providers, members, or by the plans themselves.

Abuse in the Medicaid Program 
The subject of the report is managed care fraud and abuse; however, the latter term carries with it 
certain ambiguities.  First, abuse can relate to physical abuse, failure to provide services, or 
neglect of patients in the Medicaid program.  In addition, abuse or exploitation occurs through 
questionable billing, treatment, or other programmatic practices.  Further complicating the issue, 
it is sometimes difficult to make a clear distinction between fraud and abuse.  While neglect of a 
patient or underutilization in the treatment of a patient might traditionally have been considered 
patient abuse, it might also be treated as a fraudulent activity.  Billing practices and other activities 
can be considered programmatic abuse but, upon investigation, may cross the line to criminal 
fraud.  In both scenarios, the Medicaid fraud control units are responsible for investigating cases 
of patient abuse and all areas of egregious activity that might evolve to a fraudulent level. 
Because of these issues, we have been unable to always clearly distinguish between abuse and 
fraud in responses provided to our surveys.  We include data on fraud and abuse cases separately 
where we could make the distinctions.  Where it is not possible, we include abuse with fraud cases 
in the survey and in reporting the results of this study. 
This report does not focus specifically on patient abuse.  The OIG, however, is concerned with 
such abuses and has conducted several studies on patient abuse in home health care and is 
undertaking a number of other studies that addresses this important subject. 
)))))))))))
4  METHODOLOGY 
This study is intended to provide an initial examination of fraud and abuse detection and referral 
activities in Medicaid managed care organizations, Medicaid State agencies, and Medicaid fraud 
control units.  We conducted this study in hopes of learning how States are coping with this newly 
emerging managed care fraud and abuse, how they detect it, and what they do with cases once 
detected.  While managed care fraud and abuse detection is evolving, we hope the information 
provided in this report may contribute insights to policy makers as future efforts are taken to 
address fraud and abuse. 
To accomplish this goal, we examined the fraud and abuse detection and referral processes in the 
10 Medicaid State agencies that were operating under an 1115 waiver at the time the study began 
(See Appendix A).  We chose to focus on 1115 waiver States as they are waived from many of 
the Federal Medicaid requirements and are allowed to require the broad range of Medicaid 
beneficiaries to enroll in managed care organizations.  We collected information through surveys, 
site visits, and interviews of responsible officials in the Medicaid State agencies, fraud units, and 
95 Medicaid managed care plans.  We made site visits to three Medicaid State agencies, three 
fraud units, and six managed care organizations to ensure quality data was collected through the 
survey process.  We received responses from all Medicaid State agencies and fraud units, and 
85 of the 95 managed care plans surveyed.  We compiled data into frequency distributions and 
conducted a content analysis of narrative responses.  We also reviewed fraud and abuse 
processes, guidelines, provisions and other information provided by these entities, and obtained 
data on the number, type, and outcomes of potential fraud and abuse cases detected and referred 
for investigation.  We note that one State, Arizona, has had extensive experience with the 
Medicaid managed care program and might provide a particular fertile ground to obtain 
operational information. 
We emphasize that this study is a review of detection and referral processes only.  It does not 
cover other important aspects of fraud and abuse, such as investigations, prosecutions, civil 
monetary penalties, or the roles of other governmental entities involved with fraud and abuse. 
Although the Office of Inspector Generals Office of Investigations and Office of Counsel for the 
Inspector General, as well as the Department of Justice, U.S. Attorneys, and others have 
important roles in investigation and prosecution of cases, these entities are not included as part of 
this study. 
We plan to continue to look at potential fraud and abuse in the managed care setting and efforts 
being made to address it. 
This inspection was conducted in accordance with the Quality Standards for Inspections issued 
by the Presidents Council on Integrity and Efficiency. 
)))))))))))
5  F I N D I N G S

Two States Have Active Programs Which Result in Case Detection and Referral of 
Fraud and Abuse; Others Do Not 
While officials in 8 States report detection and referral of managed care fraud and abuse cases, 
2 States (Arizona and Tennessee) accounted for almost all cases referred (97 percent of 
504 cases) for investigation in 1996.  As shown in the following table, these States also had case 
resolutions that exceeded $4.3 million in recoveries, overpayments, and fines.  We chose to 
highlight Arizona and Tennessee as these are the States that have yielded outcomes from their 
proactive efforts in this area.  The remaining eight States accounted for three percent of case 
referrals, with fraud units in two States having no referrals. 5 
CASE REFERRALS RECEIVED BY FRAUD UNITS IN 1996 
Number of Cases  Arizona Fraud Unit  Tennessee Fraud Unit 
Referrals Received of Potential Fraud and Abuse  164  326 
Fraud Referrals Opened for Investigation  37  35 
Abuse Referrals Opened for Investigation  38  39 
RESOLUTION OF CASES REFERRALS RECEIVED 
Criminal Indictments  15  6 
Criminal Convictions  17  7 
Global Settlements  *  3 
Patient Abuse Indictments  17  15 
Patient Abuse Convictions  *  11 
Recoveries from Overpayments, Fines, Civil Penalties, 
etc.  $860,473  $3,485,450 
* Information unavailable. 
We found that most fraud units report receipt of some managed care fraud and abuse cases.  A 
few States specifically identify patient physical abuse.  In most cases, however, they are simply 
reported as referrals of fraud and abuse, as specific breakouts are not made.  Where abuse has 
been specifically broken out, as in Arizona and Tennessee, we have reported the case numbers in 
the table. 
)))))))))))
6  Type of Cases Detected 
The types of cases detected include situations normally associated with a fee-for-service program 
(i.e., billing for services not rendered, upcoding, and duplicate billing) and those that relate to 
managed care (i.e., underutilization where services or referrals are denied as a practice, an 
ineligible person using a members identification card for services, and enrollment fraud).  See 
Appendix B for further details on the types of fraud and abuse suspected by reporting entities. 
Case Referral Data 
Through our evaluation of self-reported data on the number of cases referred and the number 
received by the Medicaid State agency, the fraud units, and the managed care organizations, we 
found some inconsistencies in the data.  Data provided by the fraud units indicate they received 
4 referrals from managed care plans during our study period, however, the plans report they 
referred 137 cases to the fraud units.  Likewise, the Medicaid State agencies report they referred 
125 cases to the fraud units, however, the fraud units indicate they received 219 cases from them. 
We acknowledge these inconsistencies in the data and believe there may be several reasons for 
these differences.  In some States, the fraud units meet with the managed care plans and the 
Medicaid State agencies to discuss potential cases.  Discussions of a case may be considered a 
referral by the managed care plan, however, it may not be considered a referral by the fraud unit 
or Medicaid State agency.  In this situation, the case may be determined to be neither fraudulent 
or abusive, or the fraud unit may request the managed care plan conduct further investigation of 
the case.  In one State, the fraud unit receives so many potential cases that they are initially placed 
in a suspended file until a second complaint is received, thus warranting an open investigation. 
While we acknowledge the difficulties in obtaining consistent data on the number of referrals 
made for investigation, we believe it is significant that Medicaid State agencies, fraud units, and 
managed care plans report that fraud and abuse is being detected in the managed care programs 
and that cases are being referred and accepted for investigation. 
We also note that efforts in Arizona and Tennessee have resulted in recoveries and indictments, 
however, data on case referrals to the fraud units in Appendix C indicates that neither unit reports 
receiving case referrals from managed care plans.  In Arizona, managed care plans are required to 
refer cases to the Medicaid State agency where a preliminary investigation is conducted.  If the 
agency believes the case warrants further investigation, it then refers the case to the fraud unit.  In 
other words, the managed care plans are instructed to refer cases directly to the Medicaid State 
agency and not the fraud unit.  In Tennessee, the fraud unit staff meets with the managed care 
plans throughout the year, however, the unit did not maintain data on the number of cases that 
were referred to them by the plans during our data collection period. 
)))))))))))
7  Proactive Efforts in Arizona and Tennessee 
While both Arizona and Tennessee note that further improvements are needed, their receipt of 
97 percent of all referrals to fraud units, and recoveries of over $4 million, invites inquiry into 
their proactive efforts to foster detection and referral.  We note that these fraud units report 
conducting routine, proactive efforts to assist in detection of potential managed care fraud and 
abuse.  Both fraud units conduct extensive training for the managed care plans and hold regularly 
scheduled meetings with them to discuss potential fraud and abuse cases.  The Tennessee fraud 
unit provides substantial opportunity for the plans to receive training by holding annual seminars, 
quarterly round table sessions, and monthly meetings.  In Arizona, the fraud unit makes 
presentations and prepares extensive informational documents on problems inherent in managed 
care fraud and abuse detection in addition to having quarterly meetings and providing training for 
the plans.  Information reported shows that the remaining eight fraud units do not have such 
extensive activities and protocols. 
In Tennessee and Arizona, the fraud units are specifically designated through policy as the 
investigative component of potential fraud and abuse in their respective Medicaid managed care 
programs.  The Tennessee fraud unit is highlighted under the fraud and abuse section of the 
managed care organization contracts as the State agency responsible for investigation of fraud and 
abuse in the managed care program.  In Arizona, the fraud unit is authorized, through a 
Memorandum of Understanding with Medicaid State agency, to carry out investigation and 
criminal prosecution of provider fraud and abuse, abuse or neglect of patients, and fraud in the 
administration managed care program. 
In addition, the Arizona Medicaid State agency conducts proactive efforts in detecting fraud and 
abuse.  It has developed an initiative to educate the public about fraud and abuse through 
television, radio, posters, public forums, and newspapers.  Its program integrity staff meets 
monthly with managed care plans to discuss fraud and abuse and provides instruction on what to 
look for and what to do when cases are detected.  The managed care plans are required to have a 
fraud policy, educate employees on fraud and abuse, and have a fraud contact.  The Medicaid 
State agency reviews the policy on an annual basis and interviews plans staff to ensure they have 
received required fraud training and know what to do when cases surface.  Also, the Medicaid 
State agency has negotiated basic guidelines with the managed care plans that cover detection and 
referral.  The guidelines detail what should be in the fraud policies, definitions of fraud and abuse, 
specify detection activities and how cases may result from them, and include printed forms that 
should be used to refer potential cases to the Medicaid State Agency. 
These proactive efforts, in effect, complement some of the processes discussed by HCFA during 
nation-wide Consortium meetings that were held in 1997.  In addition to increasing awareness, 
the meetings were designed to emphasize coordination among the various State components. 
Such endeavors by HCFA correlate to the perceived needs reported in this inspection. 
)))))))))))
8  There Is No General Agreement About Roles And Requirements to Detect And Refer 
Fraud And Abuse in The Managed Care Setting 
Perceptions of Roles and Responsibilities 
Medicaid State agencies have differing opinions concerning who should have the responsibility for 
detecting and referring managed care cases for investigation.  This is despite the fact that 
theoretically the current program integrity requirements in the fee-for-service Medicaid program 
legally apply with equal force in the managed care program.  As part of the fee-for-service 
program, Medicaid State agencies are required to have a S/URS unit that detects aberrancies 
through post-payment reviews of claims.  Potential fraud cases detected through these reviews are 
referred to the fraud units for investigation.  In Medicaid managed care, no additional guidance 
has been provided.  However, managed care is a new area of concern that seems to be a source of 
confusion and less certainty of which entity(s) is responsible for detection and referral of cases.  In 
fact, three Medicaid State agencies have indicated in their survey responses that they do not 
believe that it is their responsibility.  One reports that detecting fraud and abuse committed by 
beneficiaries, providers, or by individuals operating within managed care is the responsibility of 
the managed care organizations.  The Medicaid State agency officials believe they should not 
duplicate detection efforts and that fraud or abuse occurring in or against managed care plans 
does not impact the Medicaid capitated rates or expenditures.  Also, two other Medicaid State 
agencies explain since the monies are capitated, there is no reason for them to be concerned with 
fraud and abuse.  From their perspective, it impacts the managed care organizations cost of doing 
business and, therefore, is their responsibility. 
Most fraud control units believe, however, that increased costs incurred by managed care plans 
from fraudulent billings will ultimately raise Medicaid costs and therefore are a Medicaid State 
agencys responsibility.  When managed care plans annual expenditure reviews reveal that costs 
are higher than anticipated, capitation rates may be increased by the State for the next year.  If 
fraud and abuse causes managed care costs to increase each year, capitation rates may also be 
increased, resulting in the escalation of Medicaid program expenditures. 
One fraud units perspective is that the Medicaid State agency does not address fraud and abuse 
in managed care due to a general feeling that emphasis upon these issues would interfere with the 
implementation of the Medicaid managed care program.  Six of the 10 officials responding to our 
survey of Medicaid fraud control units believe Medicaid State agencies are not focused on fraud 
and abuse.  In this regard, some fraud unit officials indicate that the Medicaid State agencies do 
not mention them in their communication or direction to the managed care plans, with one noting 
that the plans do not know it exists unless it is investigating a case and contacts them.  In fact, out 
of the 85 managed care organizations surveyed, 27 percent (23) report they were not even aware 
a fraud unit is in their State. 
One managed care organization respondent states it does not perform any routine activities 
specifically to detect potential fraud and abuse as this is a function that the State has reserved 
)))))))))))
9  for itself and the plan is not required or expected to perform activities to detect fraud and abuse. 
In contrast, a fraud unit official suggests it is crucial for managed care organizations to be a part 
of detection and the organizations role is essential in ferreting out fraud and abuse.  Further, they 
need to know the existence and functions of the fraud unit. 
These differences in role perceptions may also account for variations in requirements and actions 
to detect and refer potential managed care fraud and abuse situations. 
Detection and Referral Requirements 
Some States have not made explicit requirements for managed care plans to detect and refer fraud 
and abuse cases for investigation.  Officials in four States indicate they have no requirements in 
contracts with managed care plans or in State law specifying managed care plans to detect 
potential fraud and abuse cases or refer them to Medicaid fraud units, or other appropriate law 
enforcement authorities, for further investigation.  An additional two States require managed care 
organizations to refer cases to the fraud unit but do not require them to detect fraudulent and 
abusive situations.  Despite lack of detection requirements in the six States, the managed care 
organizations, Medicaid fraud units, and Medicaid State agencies report that they have identified 
inaccurate billing, upcoding and unbundling, billing for services not rendered, enrollment fraud, 
beneficiary fraudulent stealing or forging of prescription drugs, ineligible individuals fraudulently 
using member identification cards, and other situations. 
Our survey results also show that in some States with managed care plan detection and referral 
requirements, fraud units and plans are unaware of them, or they disagree there are such explicit 
requirements. 
Detection Requirements 
Fraud control units and managed care plans in 3 of the 10 States are consistent in their awareness 
of detection  requirements, or the absence of them.  Medicaid State agencies, managed care plans, 
and fraud units in the remaining seven States report differing views or they are not sure that 
requirements exist.  Forty-two percent of the managed care plans responses either are 
inconsistent with those of the Medicaid State agencies or are not aware of the requirements to 
detect cases.  Two of the fraud units are also unaware of plans requirements to detect program 
fraud and abuse. 
In one State, the Medicaid State agency officials report that managed care plans are required to 
detect cases while the fraud unit officials disagree, stating that this is not required of the plans. 
To understand possible reasons for this discrepancy in the Medicaid State agency and fraud unit 
responses, we reviewed information provided on managed care organization requirements. 
)))))))))))
10  We found the plans are required by law and through contracts to have an anti-fraud plan.  More 
specifically, both the law and contracts require them to provide as part of their plan: 
!  the name of the person responsible for administering the anti-fraud plan; 
!  procedures to prevent fraud, including fraudulent claims and internal fraud 
involving officers, employees, or agents, and fraud resulting from 
misrepresentations on applications for coverage; 
!  procedures reporting fraud to the appropriate law enforcement authorities; and 
!  procedures for cooperation with the prosecution of insurance fraud cases. 
While this may imply that the managed care organizations are required to detect cases, it does not 
specifically state that detection is a requirement.  The fraud unit and one managed care plan in this 
State contend that plans are not required to detect potential fraud and abuse cases.  It should also 
be noted that of the 51 managed care plans reporting there are detection requirements in their 
States, 4 indicate that this requirement is not documented in State law or their contracts with the 
Medicaid State agency. 
In addition to some of the States requiring managed care plans to detect cases, one Medicaid 
State agency also indicates it requires the plans to review complaints from any source for fraud 
and abuse.  Three other State agencies indicate that the fraud unit, the agency, or other state 
component reviews these complaints for potential fraud and abuse.  While not required in most 
States, 71 percent of the plans (60) report they conduct such reviews.  Forty-seven of 85 
managed care plans (55 percent) report validating encounter data to ensure that services are 
actually provided (e.g., looking for impossible services such as pregnant males, reconciliation with 
medical charts, and through contacting the beneficiaries to ensure services were provided). 
Thirty-six of them review this data for aberrancies.  Approximately half of them (41 out of 85) 
report they have an established fraud and abuse coordinator or program integrity department that 
is responsible for proactively detecting potential managed care fraud and abuse. 
Referral Requirements 
Six of the Medicaid State agencies report that managed care plans are required to refer potential 
fraud and abuse cases for investigation.  Our review reveals that the fraud units and plans 
responses in two States agree that there is such a requirement.  In the remaining 8 States, 
34 percent of the managed care plans responses are inconsistent with those of the Medicaid State 
agencies, or the plans are not knowledgeable of these provisions.  One fraud unit is also not aware 
of the referral requirements.  Of the 55 managed care organizations stating they are required to 
refer cases, 6 of them agree but report that neither State law, procedure, or contracts document 
the requirement to refer suspected fraud and abuse cases. 
One Medicaid State agency and six fraud control units acknowledge the need for specific 
documented requirements for detection and referral of fraud and abuse cases, with two fraud units 
requesting sanctions be attached for failure to comply.  One fraud unit believes penalties should be 
placed on managed care organizations which are equal to the amount of money involved in 
fraudulent cases that they fail to report to the units.  Another believes, at a 
)))))))))))
11  minimum, these organizations should be obligated through contracts or State law to report 
confirmed fraud and abuse cases. 
Six of the fraud units believe current State statutes that may be applicable to managed care are 
insufficient and need improvement to be effective as a basis for criminal charges.  As an example, 
one fraud unit explains that the State statutes addressing theft by swindle and theft by false 
representation only apply to vendors of health care.  It indicates managed care plans are not 
considered vendors, therefore, they cannot be charged with theft under current State law.  In 
addition to problems with State statutes, four units believe that the Code of Federal Regulations is 
inadequate when applied to fraud and abuse in managed care since they were written to address 
fraud and abuse occurring in fee-for-service types of cases. 
Case Referrals 
In four States, we found differences in perspectives between the Medicaid State agencies and 
fraud units regarding whether managed care plans are appropriately referring fraud and abuse 
cases.  The Medicaid State agencies officials believe that the managed care plans are referring 
cases while the fraud units officials suspect they are either resolving or disposing of these cases 
internally rather than referring them to the fraud units.  One Medicaid State agency contends there 
are added assurances and specific requirements on reporting in the new contract.  Despite the new 
contract being in place, the fraud unit reports receiving only one case referral from the seven 
managed care plans.  In another State where the Medicaid State agency believes cases are 
appropriately being referred, it notes there is a hotline where enrollees can call with problems 
which will be quickly addressed.  While a quick resolution may or may not be the appropriate 
method for processing cases, the fraud unit reports they have not received any cases from the 
Medicaid State agency or managed care plans.  We also note in one State the fraud unit stresses 
that the managed care organizations are unaware they can refer cases to them and are reluctant to 
call other enforcement authorities [i.e., the Police or Federal Bureau of Investigation (FBI)] when 
cases occur.  The fraud unit believes that the plans tendency is to eliminate the problem by 
terminating the provider rather than reporting it for investigation. 
We believe it is significant that there is agreement among the Medicaid State agency and fraud 
unit in just one State.  In this instance, both components believe that managed care organizations, 
rather than appropriately referring cases for investigation, are resolving them internally.  The 
Medicaid State agency reports that managed care plans are not proactively reviewing their 
provider networks nor are they making referrals of fraud and abuse cases to the fraud unit. 
Likewise, the fraud unit indicates that in a 12-month period, it had received a total of 5 referrals 
from the 11 managed care plans.  One reason for the low number of referrals given by a managed 
care medical director is that its staff is reluctant to report any cases to the fraud unit because they 
do not want to be known as hard-nosed.  The managed care plan staff believes that physicians 
will leave the network and enrollees will join other plans if it reports cases to the unit. 
)))))))))))
12  Medicaid State Agencies and Fraud Control Units Differ in the Intensity and the 
Nature of Oversight Activities 
Oversight and Detection Activities 
While all Medicaid State agencies report conducting special or periodic reviews of Medicaid 
plans, two indicate that these reviews include internal evaluations of the managed care 
organizations fraud and abuse detection and referral processes.  Fraud unit investigative staff 
participate in such reviews in one State.  In addition, two of the 10 fraud units also report 
conducting routine activities to identify potential managed care fraud and abuse.  Eight Medicaid 
State agencies require managed care plans to report contractual agreements or affiliations with 
subcontractors with three reporting they review one or more of these contracts for potential fraud 
and abuse.  Reviews of contracts may reveal fraudulent arrangements such as illegal kickbacks or 
other schemes. 
Officials in six Medicaid State agencies indicate they have monitoring protocols or systematic 
screening in place to detect aberrancies in providing services and to identify Medicaid managed 
care fraud and abuse cases.  For example, four Medicaid State agencies report they review 
encounter data (statistical data on medical services rendered) for potential fraud and abuse.  Five 
Medicaid State agencies respond that their data reporting systems and fraud and abuse review 
processes are in developmental stages and one other agency indicates that the encounter data is 
not available in a usable format to review for potential fraud and abuse. 
S/URS Involvement in Managed Care 
Six Medicaid State agencies indicate that the S/URS, or like components, are involved in 
managed care reviews, with four focusing on fraud and abuse detection.  Two have systematic 
screening or monitoring protocols in place to identify potential cases.  Additionally, one unit 
studies patterns of care in individual cases, two investigate managed care providers, two conduct 
onsite reviews of a statistically valid sample of claims, and three review and validate random 
samples of encounter data. 
Penalties for Not Referring Fraud Cases 
We found two States include penalties in contracts or provisions for those managed care 
organizations that fail to refer detected cases.  In one, the Medicaid State agency has general 
authority to sanction, fine, or place a cap on enrollment for breach of contract, however, it does 
not specifically cite it as a basis for referral of fraud and abuse cases.  The other reports that fraud 
and abuse is part of the managed care contract.  In it, failure to fulfill contractual agreements 
means material non-compliance with sanctions of up to $2,500 per day.  Although one other 
Medicaid State agency notes it has the authority to terminate contracts with managed care plans 
and physicians, no such actions have been taken when problem providers or plans have been 
identified.  Penalties for failure to comply with referral requirements is supported by the fraud 
units.  One fraud unit explains that without such penalties, there are no hammers to force 
managed care organizations to refer cases. 
)))))))))))
13  Medicaid State Agencies, Fraud Control Units, and Managed Care Organizations 
Identify a Number of Tools They Believe They Need to Address Fraud and Abuse in 
Managed Care 
During our review, Medicaid State agencies, fraud control units, and managed care plans report 
specific obstacles that inhibit the detection and referral of fraud and abuse.  Noting varying levels 
of experience and requirements, the Medicaid State agencies and managed care plans report the 
need for greater information sharing related to fraud and abuse occurring in Medicaid programs. 
Four Medicaid State agencies indicate a need to collaborate with managed care plans, HCFA, and 
other States on fraud and abuse issues in managed care.  Another explains that this type of 
coordinated effort is vital.  Also, one Medicaid State agency reports that it would be helpful to 
learn how other States have detected fraud and abuse.  The primary categories and circumstances 
that relate to their resource needs are summarized below. 
Fraud and Abuse Detection Guidelines 
Over half of the all entities surveyed do not have guidelines on how to detect potential Medicaid 
managed care fraud or abuse cases and refer them to the appropriate authorities.  Six of the 
Medicaid State agencies, 8 of the fraud units, and 55 percent of the managed care plans (47) 
report that they do not have such guidelines.  Managed care organizations cite the need for a 
clearer understanding of how the State fraud and abuse program works and how they can 
coordinate their processes with them. 
Training Needs 
Medicaid State agencies, fraud units, and managed care plans report the need for training on 
detection techniques and examples of fraud and abuse cases.  Five Medicaid State agencies, four 
fraud units, and over half of the managed care plans note they have not received training 
specifically on managed care fraud and abuse detection and investigation.  Five managed care 
plans also indicate they need definitions of fraud and abuse, and guidance from the State on what 
is required, including the systems plans should have in place.  One believes that greater guidance 
would allow the plans more participation in the detection and investigation of the fraud and 
abuse process.  Overall, 80 percent of Medicaid State agencies, fraud units, and managed care 
plans report that training would be beneficial in the following areas: 
- Managed Care Operations; 
- Fraud and Abuse Detection in Managed Care Settings; 
- Computer and Data Manipulation Training; 
- Investigative Techniques; 
- Application of Regulations and Statutes; 
- Definitions of Fraud and Abuse in Managed Care; 
- How Fraud and Abuse Manifests Itself; 
- Software Parameters that Indicate Potential Fraud and Abuse; 
- Clarification of Roles and Responsibilities; and 
- Activities Conducted by the FBI, Office of Inspector General (OIG), etc. 
)))))))))))
14  Encounter Data and Computer Technology 
Many of the entities report there are limited data and technological tools for detecting fraud and 
abuse.  In addition, Medicaid State agencies and fraud units indicate a need for reliable encounter 
data, adequate computer systems, management information systems, claims processing software, 
tools for detection of fraud and abuse, and software to evaluate data for potential cases. 
Half of the fraud units report problems accessing State and managed care plan data, information, 
and documents for their review.  As an example, during one fee-for-service investigation, the 
fraud unit attempted to find out if the provider was also contracting with managed care plans to 
see if the provider might be committing the same fraud in managed care.  The Medicaid State 
agency, however, was unable to provide the fraud unit with this information.  Also, while all 
managed care organizations report collecting encounter data, Medicaid State agencies and fraud 
units indicate that it is in the developmental stages or may not be readily available for investigative 
purposes. One fraud unit notes it is forced to go directly to the suspected provider under 
investigation to obtain encounter data as there is no other way to acquire this information. 
Centralized Information Resource 
Medicaid State agencies, fraud units, and managed care organizations report a general need for a 
centralized point of reference for information relating to managed care fraud and abuse.  Managed 
care organizations indicate the need for a uniform national database on cases reported, an 
interstate transfer of information on providers, a list of best practices, general information on 
fraud and abuse such as suggestions for trade journals, notification when cases are reported, 
feedback on outcomes of cases, and a list of knowledgeable contacts. 
Staffing Needs 
Fraud control units, managed care organizations, and Medicaid State agencies note the need for 
additional staff to proactively detect cases and investigate referrals.  Ten fraud units and 
48 percent of managed care plans (41) report they do not have specific staff assigned the 
responsibility of conducting investigations of potential fraud and abuse in managed care.  Three 
Medicaid State agencies also report that no staff have been assigned the responsibility for 
conducting oversight of internal fraud and abuse detection efforts being made within the managed 
care plans. 
)))))))))))
15  R E C O M M E N D A T I O N S

We recognize that fraud and abuse in the managed care setting is a newly emerging area for 
Medicaid State agencies, fraud control units, and managed care organizations.  We conducted this 
study in hopes of learning how States are coping with managed care fraud and abuse, how they 
detect it, and what they do with cases once detected.  Overall, there is confusion and 
disagreement on how to address fraud and abuse and there is limited activity in developing or 
actively pursuing and referring cases in the Medicaid managed care program.  However, we have 
learned that States with proactive efforts are detecting and resolving cases.  We believe the 
information obtained in this study provides an opportunity for others to learn from those that have 
established proactive managed care fraud and abuse programs. 
It is important for all entities involved to have an effective fraud and abuse detection and referral 
system to protect the integrity of the Medicaid program and, as fraud in many cases can impact 
quality, to ensure high quality health care for beneficiaries.  We recognize that HCFA initiated a 
number of efforts in this area in 1997, including the formation of the Medicaid Fraud in Managed 
Care Workgroup initiative to develop a model fraud and abuse system for the States, the 
coordination of National Medicaid Consortium meetings to discuss these issues, and participation 
in the Department of Justice Managed Care Work Group.  Beginning in 1998, HCFA also 
initiated a series of four Fraud and Abuse in Medicaid executive-level seminars for state 
decision-makers to discuss strategies and solutions in their efforts to control fraud and abuse. 
However, we believe that implementation of the following recommendations can promote or 
further enhance Medicaid State agency, fraud control unit, and managed care organizations 
efforts to address fraud and abuse in managed care.  To that extent, we recommend HCFA, in 
coordination with the OIG, 
!!	 establish guidelines for States and managed care organizations to follow in 
developing and carrying out proactive fraud and abuse detection and referral 
activities. 
HCFA should consider including the following guidelines in the State plan, HCFA 1115 
Waivers, and managed care contracts: 
- definitions of roles and responsibilities for Medicaid State agencies, fraud control 
units, and managed care organizations; 
- guidelines for managed care plans and Medicaid State agencies to have processes 
to detect and refer fraud and abuse cases to the Medicaid fraud control units for 
investigation; 
- specification of when an internal managed care plan investigation is needed or 
immediate referral for investigation is warranted; and 
- guidelines for managed care organizations to document and maintain records on 
detected cases of potential fraud and abuse, maintain a database and monitor it, and 
periodically submit reports to the Medicaid State agencies. 
)))))))))))
16  We believe it is important that the managed care plans acknowledge they are aware of 
these particular guidelines and certify their understanding in writing by signing contractual 
agreements with the Medicaid State agency. 
!!	 ensure that States monitor managed care organizations fraud and abuse programs 
for compliance with its guidelines. 
To ensure plans have an effective detection and referral system, HCFA should consider 
establishing provisions that require States to conduct oversight of managed care plans 
fraud and abuse detection and referral activities.  In addition, we believe it may be 
beneficial for Medicaid State agencies to conduct onsite reviews of plans and, to the 
extent possible, involve fraud units in the evaluation and monitoring of fraud and abuse 
efforts.  Reviews should focus on the processes managed care plans have established and 
the effectiveness of them.  Also, to ensure managed care plans follow the required 
processes, consideration should be given to penalties for those that fail to comply.  In 
providing guidance, HCFA may need to develop model protocols for use in review and 
oversight of plans fraud and abuse detection processes. 
!	 continue to develop, sponsor, and emphasize detection and referral training for 
States and Medicaid managed care organizations. 
We believe that HCFA should continue to broaden efforts to formally train Medicaid State 
agencies, fraud control units, and managed care organizations on program fraud and abuse 
in managed care.  Identified training needs to be addressed include: 
- basic program contracting and provisions for managed care; 
- fundamental instruction on Medicaid State agency and managed care operations; 
- definitions of fraud and abuse that can occur in the managed care setting; 
- examples of cases and how fraud and abuse manifests itself; 
- techniques for detection and referral of fraud and abuse cases; 
- parameters and standards of what is considered acceptable levels of care; and 
- information and feedback on States activities and experiences in detected and 
resolved cases. 
AGENCY COMMENTS 
The HCFA concurs with recommendations in the report and describes their various efforts and 
initiatives in technical assistance, development of guidelines, consultation with States, and 
detection and referral training.  We are encouraged that the agency reports it is focusing attention 
and efforts in these important areas.  Also, we are pleased that it intends to share the guidelines 
and other fraud and abuse detection and referral products for the OIGs review and comment. 
We note the first recommendation was revised in response to HCFAs comment regarding the 
OIGs  use of guidelines and requirements interchangeably.  The full text of HCFAs 
comments are included in Appendix D. 
)))))))))))
17  ENDNOTES

1.  The 1997 Balanced Budget Act (BBA) requires States to establish by August 1998, a 
mechanism to receive reports from beneficiaries and compile data on alleged instances of waste, 
fraud, and abuse in the Medicaid Program.  However, approximately one-third (17) of the States 
are exempted from this provision, and all other provisions related to managed care as part of the 
BBA, for up to 3 years. 
2.  Medicaid Fraud and Patient Abuse: A Review of the State Medicaid Fraud Control Unit 
Program, National Association of Medicaid Fraud Control Units (MFCUs),  p. 75.  At the 
request of the President's Task Force on National Health Care Reform the National Association of 
Medicaid Fraud Control Units prepared a paper which described the MFCUs' experience with 
health care fraud in both the traditional health care delivery system and in a system of managed 
care. 
3.  Fraud in Managed Health Care Delivery and Payment, Report to the National Health Care 
Anti-Fraud Association Board of Governors by the NHCAA Task Force on Fraud in Managed 
Care, p. 2, December 1994. 
4.  Thomas R. Judd and Sarah Elizabeth Jones, Health Care Fraud in a Managed Care 
Environment, National Association of Attorneys General, April 1996, pp. 23-24. 
5.  The two fraud units that report not receiving cases indicate that the managed care programs in 
their States are too new.  In one State, the program was implemented in January 1996 and the 
other State implemented the program in April 1997. 
)))))))))))
18  A P P E N D I X  A

Medicaid Section 1115 Waiver States 
Date  Managed care 
1115 Waiver States  Implemented  Enrollment 1 
Arizona- Arizona Health Care Cost Containment System (AHCCCS)  10/01/82  81% 
Delaware-Diamond State Health Plan (DHSP)  01/01/96  81% 
Hawaii-Hawaii Quest  08/01/94  81% 
Minnesota-MinnesotaCare Health Plan and Long Term Care Options  07/01/95  42% 
Ohio-OhioCare  07/01/96  32% 
Oklahoma-SoonerCare  01/01/96  51% 
Oregon-Oregon Health Plan Demonstration  02/01/94  83% 
Rhode Island-Rite Care  08/01/94  62% 
Tennessee-TennCare  01/01/94  100% 
Vermont-Vemont Health Access Plan  01/01/96  24% 
1 Percentage of Medicaid enrollment in managed care programs. Data based on HCFAs report which
identifies States with Comprehensive Statewide Health Care Reform Demonstrations on June 30, 1997. 
)))))))))))
A - 1
 A P P E N D I X  B

Types of Suspected Fraud and Abuse Cases 
in Medicaid Managed Care 
The following table details the types of fraud and abuse situations suspected by Medicaid State Agencies (MSA) 
and Medicaid Fraud Control Units (MFCU) and the 85 managed care organizations (MCO) included in this study. 
The numbers in the table indicate how many State entities and managed care plans suspect that these fraudulent or 
abusive situations are occurring within the 10 States surveyed. 
ENTITIES REPORTING ISSUES 
ISSUE REPORTED  MSAs  MFCUs  MCOs 
Medicaid Managed Care Subcontractor Fraud  1  4  4 
Inaccurate Billing - Upcoding/Unbundling  0  3  20 
Billing for Services Not Rendered  1  2  13 
Failure to Reimburse Subcontractors or Provider Network  0  2  0 
Kickback Schemes  1  2  0 
Traditional False Claims  1  0  1 
Embezzlement  1  0  0 
Providers Accepting Out-of-Network Payment  0  0  1 
Improper Billing for Physician Assistants  0  0  1 
Provider Billing for Expired Member  0  0  1 
Provider Balance Billing or Double Billing  2  0  4 
Provider Not Reporting Overpayment  0  0  1 
Provider Not Contracting in Medicaid Program Billed for Services  1  0  0 
Member Submitting Incorrect Billing  0  0  1 
All Types of Fee-For-Service Fraud  1  1  0 
Underutilization  1  3  0 
Enrollment Fraud  3  1  0 
Charging Medicaid Enrollees Co-Payments  0  2  1 
Drug/Pharmacy Related Fraud  0  1  4 
Complaints of No Access to Services  0  1  0 
Home Care Fraud  0  1  0 
False Provider Network  0  1  0 
An Ineligible Fraudulently Using Member ID Card for Services  2  0  15 
Beneficiary Fraudulent Stealing or Forging of Prescription Drugs  2  0  11 
)))))))))))
B - 1  ENTITIES REPORTING ISSUES 
ISSUE REPORTED 
MSAs  MFCUs  MCOs 
Falsification of Information on Eligibility for Dates of Uninsurability for 
Enrollment  1  0  5 
Beneficiary Enrolled - Not Eligible -Living in Another State  0  0  4 
Beneficiary Selling Drugs  0  0  1 
Managed Care Organization Employee Fraud  0  0  2 
Beneficiary with Double Coverage - Commercial/Medicaid  0  0  4 
Controlled Substance Abuse  0  0  2 
Beneficiary Drug Overutilization - Fabricating Condition to Obtain 
Drugs  0  0  8 
Illegal Methadone Treatment Program  0  0  3 
Family Fraudulently Listing Dependents Not Eligible  0  0  2 
Patient Physical Abuse or Neglect 1  0  1  1 
1 See page 4 of the report for a discussion on patient abuse.
)))))))))))
B - 2
 A P P E N D I X  C

Fraud And Abuse Referrals to Fraud Units 
SOURCE AND NUMBER OF CASE REFERRALS RECEIVED BY FRAUD UNITS 1 
ENTITIES REFERRING 
CASES  AZ 2  DE  HI  MN  OH  OK  OR  RI  TN 2  VT  TOTAL 
Medicaid State Agency  49  1  169  219 
Relatives, Friends, Private 
Citizens  11  49  60 
Governmental Agencies  41  17  58 
Providers  10  2  2  20  34 
Sources Not Provided  8  19  27 
Local/Statewide Police  3  19  22 
Medical Facilities  13  13 
Insurance Companies  12  12 
Prosecutors  11  11 
Victims  9  9 
Licensing Board  6  6 
Anonymous Referrals  6  6 
Board of Nursing  5  5 
Office of Inspector General  2  2  4 
Managed Care Plans  1  3  4 
Other Fraud Units or 
National Association of 
Medicaid Fraud Control Units 
4  4 
Qui Tam Suits  2  2 
Attorney General Elder Affair 
Project  2  2 
Department of Insurance  2  2 
Federal Bureau of 
Investigation  1  1 
Social Services  1  1 
Board of Medical Examiners  1  1 
Surveillance Units  1  1 
Totals  164  3  2  1  2  0  5  1  326  0  504 
1 Data was reported for cases received during Calendar Year 1996 except for Arizona where data was reported for the time period
July 1995 to June 1996. 
2 AZ and TN fraud units reported no managed care referrals in 1996. AZ managed care plans are required to refer cases directly to
the Medicaid State agency, which then refers cases to the fraud unit if further investigation is needed. The TN fraud unit did not 
report cases referred from plans as they did not maintain data during our study period. 
)))))))))))
C - 1
 A P P E N D I X  D

Agency Comments

Health Care Financing Administration

)))))))))))
D - 1