Testimony Before the United States House of Representatives 
Committee on Energy and Commerce 
Subcommittee on Health 
Subcommittee on Oversight and Investigations  
 
 
 
 
The Affordable Care Act on Shaky Ground:   
Outlook and Oversight  
 
Testimony of: 
Gloria L. Jarmon 
Deputy Inspector General for Audit Services 
 
Office of Inspector General  
U.S. Department of Health and Human Services 
 
 
 
 
September 14, 2016 
10:00 a.m. 
Location:  HVC-210 U.S. Capitol Building 
   
1 
  Testimony of: 
Gloria L. Jarmon 
Deputy Inspector General for Audit Services 
Office of Inspector General, U.S. Department of Health and Human Services 
 
 
Good morning, Chairman Pitts, Chairman Murphy, Ranking Members Green and DeGette, and 
members of the Subcommittees.  I am Gloria Jarmon, Deputy Inspector General for Audit 
Services for the Office of Inspector General (OIG), U.S. Department of Health and Human 
Services (HHS).  Thank you for the opportunity to appear before you today to discuss OIGs 
oversight of health insurance marketplaces. 
 
The Patient Protection and Affordable Care Act (ACA) established health insurance exchanges 
(commonly referred to as marketplaces) to allow individuals and small businesses to shop for 
health insurance in all 50 States and the District of Columbia.  States can choose to operate their 
own State marketplaces.  Thirteen States (including the District of Columbia) are operating their 
own State marketplaces.  The ACA provided funding assistance to States for planning and 
establishing State marketplaces.  
 
OIG has identified oversight and operation of the health insurance marketplaces as a Top 
Management Challenge for HHS.  OIG has completed a significant body of audits and 
evaluations regarding the Federal and State marketplaces and other ACA provisions of high 
interest and concern to the Department, Congress, and other stakeholders and plans more work in 
this area.  OIGs marketplace oversight strategy focuses on four areas that we have determined to 
be most critical:  payment accuracy, eligibility systems, management and administration, and 
security of data and systems.  (See the Attachment for a list of OIGs completed ACA work 
related to the marketplaces.) 
 
Today, I will discuss the Consumer Operated and Oriented Plan (CO-OP) program and the State 
marketplaces, but I would like to note that OIG has performed multiple reviews related to the 
operations of the Federal marketplace, including reviews related to (1) systems for determining 
consumers eligibility for qualified health plans and insurance affordability programs, (2) 
enrollment, (3) advance premium tax credits for individuals enrolled in qualified health plans, (4) 
the security of marketplace data and information technology (IT) systems, and (5) contracting.   
 
OIGs Oversight of the CO-OP Program 
The ACA established the CO-OP program to foster the creation of nonprofit health insurance 
issuers to offer qualified health plans.  The ACA authorized the Secretary of HHS to provide 
startup and solvency loans to help establish CO-OPs.  Startup loans were intended to help 
CO-OPs cover approved costs for beginning operations.  CMS has awarded $2.44 billion to 23 
CO-OPs, of which $358 million was for startup loans; the remaining $2.08 billion was for 
solvency loans.  The startup loans were originally treated as debt that each CO-OP was expected 
to repay within 5 years of the disbursement. Solvency loans were structured to comply with 
applicable State insurance laws to meet capital reserve requirements and were expected to be 
repaid within 15 years.  State insurance regulators require insurance issuers to maintain specified 
levels of capital reserves to continue to conduct business. 
2 
  OIGs past work related to the CO-OP loan program examined the Centers for Medicare and 
Medicaid Services (CMS) selection process for awarding financial loans to CO-OPs, early 
implementation of the loan program, and the financial solvency of the CO-OPs.  On the basis of 
that work, we concluded that CMS awarded CO-OP loans in accordance with applicable Federal 
requirements, but we also identified several risks that indicated a critical need for additional 
CMS oversight of the CO-OPs as they prepared to become operational.  For instance, we 
identified a risk that CO-OPs could exhaust all startup loan funding before they became fully 
operational or before they earned sufficient operating income to be self-supporting.  We also 
found that after becoming operational, most CO-OPs had lower-than-expected enrollment 
numbers and significant net losses and that these factors might limit some CO-OPs ability to 
repay loans.  We made recommendations to CMS to improve its oversight of the loans and of the 
financial solvency of the CO-OPs.1  Twelve of the original 23 CO-OPs had closed as of 
December 31, 2015.  After issuance of our reports, 4 additional CO-OPs closed (as of August 31, 
2016), leaving only 7 of the original 23 CO-OPs in business. 
In my testimony today, I will focus on OIGs most recent work, which examines the CO-OPs 
conversion of startup loans into surplus notes (a bond-like instrument issued to provide needed 
capital).  On July 9, 2015, CMS issued a memo to the CO-OPs that provided guidance to allow 
the CO-OPs to amend their startup loan agreements.  According to the guidance, the amendments 
would allow CO-OPs to convert startup loans into surplus notes.  Under the terms of a surplus 
note, CO-OPs are not required to make any repayment on a surplus note that could lead to 
financial distress or default.  Loan conversions were intended to improve capital levels and to 
meet the 500-percent risk-based capital (RBC) requirements generally imposed by CMS, which 
represented the minimum amount of capital needed to support the CO-OPs business operations.2  
In accordance with National Association of Insurance Commissioners accounting principles, 
CO-OPs that converted their startup loans into surplus notes could record and report these loans 
as capital and surplus rather than as debt in financial filings with regulators.  
In August 2016, OIG issued a report examining CMSs oversight and approval of CO-OPs 
conversions of startup loans into surplus notes.3  This work stemmed from a hearing entitled 
Examining the Costly Failures of Obamacares CO-OP Insurance Loans held before the United 
States House Committee on Energy & Commerce, Subcommittee on Oversight & Investigations, 
on November 5, 2015.  The hearing addressed financial challenges that CO-OPs faced and the 
effects on consumers and taxpayers.  During the hearing, members expressed interest in OIG 
auditing the conversions of startup loans to surplus notes. 
OIG determined that the 12 CO-OPs that converted startup loans to surplus notes on or before 
December 31, 2015, complied with CMS guidance and applicable accounting principles when 
                                                           
1 Early Implementation of the Consumer Operated and Oriented Plan Loan Program; The Centers for Medicare & 
Medicaid Services Awarded Consumer Operated and Oriented Plan Program Loans in Accordance with Federal 
Requirements, and Continued Oversight Is Needed; Actual Enrollment and Profitability Was Lower Than 
Projections Made by the Consumer Operated and Oriented Plans and Might Affect Their Ability To Repay Loans 
Provided Under the Affordable Care Act  
2 On the basis of a health insurance issuers size and risk, RBC estimates the minimum amount of capital needed to 
support the issuers business operations. Issuers with a higher level of risk must reserve a larger amount of capital. 
RBC is usually expressed as a percentage. CMS generally required CO-OPs to maintain an RBC of 500 percent but 
allowed for lower levels to increase the long-term sustainability of some CO-OPs. 
3 Conversions of Startup Loans Into Surplus Notes by Consumer Operated and Oriented Plans Were Allowable but 
Not Always Effective. 
3 
  converting startup loans into surplus notes.  However, CMS did not adequately document the 
potential impact of the conversions on the Federal Governments ability to recover the loan 
payments if the CO-OPs were to fail.  Although the conversions provided increased levels of 
capital and surplus, 4 of the 12 CO-OPs approved for conversions ceased operations within 6 
months of the conversion.  Despite the conversions allowing CO-OPs to record the startup loans 
as capital and surplus instead of debt, RBC percentages were at levels below the CMS 
requirement of 500 percent for four of the eight operational CO-OPs as of December 31, 2015.  
On the basis of these findings, OIG made two recommendations to CMS to improve the 
decision-making process for any future conversions of startup loans to surplus notes:  to 
document any potential negative impact from changes in distribution priority and to quantify the 
likely impact on the Federal Governments ability to recover loan payments. 
We are reassessing the CO-OPs financial condition to determine whether any improvements 
were made in 2015 and 2016, and to monitor actions by CMS to address underperforming CO-
OPs.  That work is expected to be issued during fiscal year 2017.  We continue to keep abreast of 
emerging issues related to the CO-OP program and will determine whether additional oversight 
is warranted.   
CMSs Oversight of State Marketplaces 
OIGs work has covered various aspects of State marketplace operations, such as enrollment 
services and eligibility determinations, States use of establishment grant funds, and security of 
the marketplaces data and systems.  
Enrollment and Eligibility 
OIG recently completed a series of reviews to determine whether State marketplaces had 
effective internal controls in place to ensure that individuals signing up for health insurance and 
receiving financial assistance through insurance affordability programs are eligible to do so.  
OIG reviewed the first open enrollment period (October 2013 through March 2014) at seven 
State marketplaces4 and assessed internal controls over three broad areas:  (1) verifying 
applicants identity, (2) determining applicants eligibility for enrollment in a qualified health 
plan and eligibility for insurance affordability programs, and (3) maintaining and updating 
eligibility and enrollment data.  
On the basis of our reviews of sampled applicants at the State marketplaces, we determined that 
certain internal controls were effective at the State marketplaces.  These included internal 
controls for verifying applicants incarceration status, verifying changes reported by enrollees 
that affect their eligibility, and maintaining applicant data and documentation related to resolving 
inconsistencies.  However, we found that most of the State marketplaces had some ineffective 
internal controls for ensuring that individuals were enrolled in a qualified health plan in 
accordance with Federal requirements.  Examples of ineffective internal controls included 
deficiencies in performing identity-proofing verification, appropriately calculating and verifying 
applicants annual household income, verifying applicants eligibility for minimum essential 
                                                           
4 The seven State Marketplaces we reviewed were Colorado, District of Columbia, Kentucky, Minnesota, New 
York, Vermont, and Washington. In addition, OIG prior work included separate reviews at California and 
Connecticut.  
4 
  coverage through employer-sponsored insurance, and resolving inconsistencies in applicants 
eligibility data.  OIG made a number of recommendations to the State marketplaces for 
implementing specific procedures to better ensure that eligibility determinations are accurate and 
performed in accordance with Federal requirements.  OIG also recommended in some instances 
that a State marketplace redetermine the eligibility of sample applicants on the basis of our audit 
findings.  We plan to assess CMSs oversight of the seven State-based marketplaces.  
States Use of Establishment Grant Funds 
The ACA provided $5 billion in funding assistance to the States for the planning and 
establishment of marketplaces,5 but grants had to be awarded before January 1, 2015; after 
January 1, 2015, marketplaces were required to be self-sustaining, meaning they could not use 
grant funds for operational purposes.  CMS also provided guidance stating that after January 1, 
2015, these Federal funds may not be used to cover maintenance and operating costs, which 
include rent, software maintenance, telecommunications, utilities, and base operational personnel 
and contractors. 
In planning and establishing the marketplaces, States could use establishment grant funds for a 
variety of activities, including those that could benefit multiple State health programs.  
Accordingly, CMSs Funding Opportunity Announcements and subsequent grant award terms 
and conditions required marketplaces to allocate shared costs among Medicaid, the Childrens 
Health Insurance Program, and qualified health plans consistent with Federal cost principles.6  
OIG is completing a series of reviews of CMS establishment grants at eight State marketplaces 
across the Nation.7  This work covers the period from the inception of the marketplace through 
December 31, 2014, and has primarily focused on whether marketplaces allocated costs to their 
establishment grants in accordance with Federal requirements.  As of today, we have issued three 
reports on State marketplace establishment grants.8  OIG reported that two of these States did not 
properly allocate costs for establishing a health insurance marketplace to their establishment 
grants in accordance with Federal requirements.  These States used allocation percentages based 
on outdated, estimated enrollment data instead of the updated, better data that were available.  
We made recommendations to the States to refund to CMS misallocated amounts or work with 
CMS to resolve the amounts misallocated to the establishment grants.  
In addition to reporting problems with the allocation of costs, OIG raised concerns about the 
level of detail in CMSs guidance regarding the types of operational costs that State marketplaces 
would not be able to charge against the Federal establishment grant after January 1, 2015.  In 
                                                           
5 CMS provided several different funding opportunities to States, including early innovator cooperative agreements, 
planning and establishment grants, and establishment cooperative agreements.  
6 2 CFR part 225. 
7 Colorado, District of Columbia, Kentucky, Maryland, Minnesota, New York, Nevada, and Vermont. 
8 Nevada Misallocated Costs for Establishing a Health Insurance Marketplace to Its Establishment Grants, The 
District of Columbia Claimed Allocated Costs to Its Establishment Grants in Accordance With Federal 
Requirements, and Maryland Misallocated Millions to Establishment Grants for a Health Insurance Marketplace. 
5 
  April 2015, OIG issued an early alert9 to CMS, encouraging it to provide more specific guidance 
to State marketplaces about what it considered to be operating costs.  OIG stated that without 
detailed guidance, State marketplaces might have used, and might continue to use, establishment 
grant funds for operating expenses after January 1, 2015, contrary to law.  In response to the OIG 
early alert, in June 2015 CMS updated and issued revised guidance10 that provided examples of 
allowable activities (e.g., outreach, education, and stabilizing marketplace IT systems) for which 
States could use establishment grant funds after January 1, 2015.  The revised guidance further 
clarified the kinds of costs that CMS considered unallowable (e.g., rent, hardware/software 
maintenance, telecommunications, and utilities) because they were related to ongoing operations.  
OIG has not independently assessed the effectiveness of CMS guidance in ensuring that 
establishment grant funds were not used for operating costs after January 1, 2015.  As part of our 
oversight of State marketplaces use of establishment grant funds, we are considering additional 
work related to marketplace operational expenses incurred after January 1, 2015, and CMSs 
activities to prevent and detect use of establishment grant funds for unallowable purposes.   
Data and Systems Security  
Because the State marketplaces handle consumers personally identifiable information (PII), OIG 
identified the security of the marketplaces data and systems as a critical oversight area.  CMS 
requires that marketplaces follow Federal IT security standards and additional requirements, 
including standards related to (1) monitoring, periodically assessing, and updating security 
controls and (2) developing and using secure electronic interfaces. 
To date, we have completed reviews of data and systems security in five States and are close to 
completing reviews of two others.11  All States for which we have completed reviews 
implemented some security controls to protect PII; however, vulnerabilities existed in those 
States, and each had at least one vulnerability that, if exploited, could have exposed PII and other 
sensitive information.  Multiple States had weaknesses in patch and vulnerability management 
and failed to conduct required periodic penetration testing, which is an authorized attempt to 
locate and exploit vulnerabilities.  Without an annual external network penetration test, a State 
cannot ensure that adequate controls are in place to defend against external threats that could 
result in unauthorized access to consumer PII and sensitive system information.  States generally 
agreed with our recommendations to improve security and in many instances reported that they 
took immediate action to correct vulnerabilities identified by OIG.          
 
Conclusion  
 
OIG is committed to continued oversight of the Federal and State marketplaces and related 
programs to help ensure that they operate efficiently, effectively, and economically.  Given the 
magnitude and complexity of these programs, close oversight is essential.  OIG has a substantial 
body of work underway and planned to ensure that taxpayer dollars are spent for their intended 
                                                           
9 Early Alert: Without Clearer Guidance, Marketplaces Might Use Federal Funding Assistance for Operational 
Costs When Prohibited by Law. 
10 FAQs on the Clarification of the Use of 1311 Funds for Establishment Activities (June 8, 2015). 
11 We have completed reviews of California, Colorado, Kentucky, New Mexico, and Washington and are close to 
completing reviews of Minnesota and New York. 
6 
  purposes in a system that operates efficiently and is secure.  Our ongoing and planned 
marketplace work will examine critical issues, such as payment accuracy, eligibility systems, 
management and administration, and security of data and systems. We will continue to make 
recommendations for improvements, as appropriate, and follow up, as necessary, with CMS and 
States to encourage prompt implementation of our recommendations.  
 
Thank you, again, for inviting OIG to speak with the Subcommittees today.  We hope that our 
work and this testimony will assist you in your oversight efforts. 
   
7 
  ATTACHMENT:  RELATED OFFICE OF INSPECTOR GENERAL 
REPORTS 
 
Report Title  Report Number  Date Issued 
Payment Accuracy 
Conversions of Startup Loans Into Surplus Notes by Consumer 
Operated and Oriented Plans Were Allowable but Not Always  A-05-16-00019  08/04/2016 
Effective 
Nevada Misallocated Costs for Establishing a Health 
A-09-14-01007  02/17/2016 
Insurance Marketplace to Its Establishment Grants 
CMS Could Not Effectively Ensure That Advance Premium 
Tax Credit Payments Made Under the Affordable Care Act  A-02-14-02025  12/31/2015 
Were Only for Enrollees Who Paid Their Premiums 
The District of Columbia Claimed Allocated Costs to Its 
Establishment Grants in Accordance With Federal  A-03-14-03300  11/04/2015 
Requirements 
Actual Enrollment and Profitability Was Lower Than 
Projections Made by the Consumer Operated and Oriented 
A-05-14-00055  07/29/2015 
Plans and Might Affect Their Ability to Repay Loans Provided 
Under the Affordable Care Act 
CMSs Internal Controls Did Not Effectively Ensure the 
Accuracy of Aggregate Financial Assistance Payments Made 
A-02-14-02006  06/16/2015 
to Qualified Health Plan Issuers Under the Affordable Care 
Act 
Early Alert:  Without Clearer Guidance, Marketplaces Might 
Use Federal Funding Assistance for Operational Costs When  A-01-14-02509  04/27/2015 
Prohibited by Law 
Review of the Accounting Structure Used for the 
OEI-06-14-00590  03/31/2015 
Administration of Premium Tax Credits 
Maryland Misallocated Millions to Establishment Grants for a 
A-01-14-02503  03/26/2015 
Health Insurance Marketplace 
The Centers for Medicare and Medicaid Services Awarded 
Consumer Operated and Oriented Plan Program Loans in 
A-05-12-00043  07/30/2013 
Accordance With Federal Requirements, and Continued 
Oversight Is Needed 
Early Implementation of the Consumer Operated and Oriented 
OEI-01-12-00290  06/16/2013 
Plan Loan Program 
Eligibility Systems 
Not All of the Vermont Marketplaces Internal Controls Were 
Effective in Ensuring That Individuals Were Enrolled in  A-01-14-02507  03/09/2016 
Qualified Health Plans According to Federal Requirements  
Not All of the District of Columbia Marketplaces Internal 
Controls Were Effective in Ensuring That Individuals Were 
A-03-14-03301  02/22//2016 
Enrolled in Qualified Health Plans According to Federal 
Requirements 
8 
  Report Title  Report Number  Date Issued 
Eligibility Systems  continued     
Not All of the Minnesota Marketplaces Internal Controls 
Were Effective in Ensuring That Individuals Were Enrolled in  A-05-14-00043  02/12/2016 
Qualified Health Plans According to Federal Requirements 
Not All of the Washington Marketplaces Internal Controls 
Were Effective in Ensuring That Individuals Were Enrolled in  A-09-14-01006  01/19/2016 
Qualified Health Plans According to Federal Requirements 
Not All of the Colorado Marketplaces Internal Controls Were 
Effective in Ensuring That Individuals Were Enrolled in  A-07-14-03199  12/28/2015 
Qualified Health Plans According to Federal Requirements 
The Kentucky Marketplaces Internal Controls Were Generally 
Effective in Ensuring That Individuals Were Enrolled in  A-04-14-08036  10/14/2015 
Qualified Health Plans According to Federal Requirements 
Not All Internal Controls Implemented by the New York 
Marketplace Were Effective in Ensuring That Individuals Were 
A-02-14-02020  09/21/2015 
Enrolled in Qualified Health Plans According to Federal 
Requirements 
Not All of the Federally Facilitated Marketplaces Internal 
Controls Were Effective in Ensuring That Individuals Were 
A-09-14-01011  08/06/2015 
Properly Determined Eligible for Qualified Health Plans and 
Insurance Affordability Programs 
Marketplaces Faced Early Challenges Resolving 
OEI-01-14-00180  07/02/2014 
Inconsistencies With Applicant Data 
Not All Internal Controls Implemented by the Federal, 
California, and Connecticut Marketplaces Were Effective in 
A-09-14-01000  06/30/2014 
Ensuring That Individuals Were Enrolled in Qualified Health 
Plans According to Federal Requirements 
Management and Administration 
HealthCare.gov:  Case Study of CMS Management of the 
OEI-06-14-00350  02/22/2016 
Federal Marketplace 
CMS Did Not Identify All Federal Marketplace Contract Costs 
and Did Not Properly Validate the Amount To Withhold for 
A-03-14-03002  09/18/2015 
Defect Resolution on the Principal Federal Marketplace 
Contract 
CMS Did Not Always Manage and Oversee Contractor 
Performance for the Federal Marketplace as Required by  A-03-14-03001  09/14/2015 
Federal Requirements and Contract Terms 
Federal Marketplace:  Inadequacies in Contract Planning and 
OEI-03-14-00230  01/20/2015 
Procurement 
An Overview of 60 Contracts That Contributed to the 
OEI-03-14-00231  08/26/2014 
Development and Operation of the Federal Marketplace 
   
9 
  Report Title  Report Number  Date Issued 
Security of Data and Systems 
Public Summary Report:  Washington State Implemented 
Security Controls Over the Web Site and Database for Its 
A-09-15-03005  06/01/2016 
Health Insurance Exchange but Could Improve Protection of 
Personally Identifiable Information 
Public Summary Report:  Connect for Health Colorado 
Generally Protected Personally Identifiable Information on Its 
A-07-15-00454  02/10/2016 
Health Insurance Exchange Web Sites and Databases but 
Could Continue To Improve Information Security Controls 
The Centers for Medicare and Medicaid Services 
Implementation of Security Controls Over the 
A-06-14-00067  09/21/2015 
Multidimensional Insurance Data Analytics System Needs 
Improvement 
California Implemented Security Controls Over the Web Site 
and Databases for Its Health Insurance Exchange but Could  A-09-14-03005  04/30/2015 
Improve Protection of Personally Identifiable Information 
Health Insurance Marketplaces Generally Protected 
Personally Identifiable Information but Could Improve  A-18-14-30011  09/22/2014 
Certain Information Security Controls 
Observations Noted During the OIG Review of CMSs 
Implementation of the Health Insurance Exchange-Data  A-18-13-30070  08/02/2013 
Services Hub 
 
 
 
 
10