Testimony of: 
 Ann Maxwell 
 Regional Inspector General for Evaluation and Inspections 
Office of Inspector General, U.S. Department of Health and Human Services 
 
Introduction 
Good morning, Chairman Carper, Ranking Member Brown, and other distinguished Members of 
the Subcommittee.  I am Ann Maxwell, Regional Inspector General for Evaluation and 
Inspections of the U.S. Department of Health and Human Services (HHS) Office of Inspector 
General (OIG).  I appreciate the opportunity to appear before you to discuss OIGs recent work 
focused on Medicaid program integrity.   
My testimony today is based on several evaluations recently issued by OIG that focused on two 
national Medicaid integrity programs intended to augment States efforts to protect Medicaid 
from fraud, waste, and abuse.1  This body of work offers insights into the effectiveness of the 
Centers for Medicare & Medicaids (CMS) National Medicaid Audit Program and the Medicare-
Medicaid Data Match Program (Medi-Medi Program). 
OIGs work reveals that these programs are not effectively accomplishing their missions.  A 
primary objective for both programs is to identify improper payments for recovery.  However, 
both programs had low findings of actual overpayments and, as a result, yielded negative returns 
on investment.  These programs also delivered very few referrals of potential fraud to OIG and 
our law enforcement partners.  In many ways, these programs resemble a funnel through which 
significant Federal and State resources are being poured in and limited results are trickling out. 
In evaluating these programs, we found a variety of challenges that limited their potential to 
successfully identify Medicaid overpayments and potential fraud.  Most fundamentally, there are 
significant shortcomings in the data available to conduct efficient, national Medicaid program 
integrity oversight through data analysis and data mining.  In addition, variation in State 
Medicaid policies presented significant learning curves for integrity contractors, which had 
difficulty accurately applying the policies unique to each State.  These problems led Medicaid 
Integrity Contractors (MIC) to misidentify potential overpayments and the Medi-Medi Program 
to identify fewer overpayments and fewer cases of potential fraud for Medicaid than it did for 
Medicare.   
                                                           
1 OIG evaluations that serve as the basis for this testimony are:  (1) Early Assessment of Review Medicaid Integrity Contractors, 
OEI-05-10-00200, February 2012; (2) Early Assessment of Audit Medicaid Integrity Contractors, OEI-05-10-00210, March 
2012; (3) Status of 244 Provider Audit Targets Identified Using Review Medicaid Integrity Contractor Analysis, OEI-05-10-
00201, April 2012; and The Medicare-Medicaid (Medi-Medi) Data Match Program, OEI-09-08-00370, April 2012. 
 
1  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  The potential of these programs to safeguard Medicaid may also have been diminished by the 
way that CMS administered them.  While the National Medicaid Audit Program appeared to 
suffer from too much CMS involvement, the Medi-Medi Program experienced the opposite 
problem:  a lack of involvement by all of the relevant staff at the Federal level.  In addition, CMS 
did not always hold the contractors operating these programs accountable for performing their 
contracted tasks.   
Federal Medicaid Integrity Programs Were Created To Augment States 
Efforts 
The task of ensuring Medicaid program integrity has historically fallen primarily on States; the 
Federal Government has provided support and oversight.  States have their own program 
integrity or inspector general offices dedicated to Medicaid.  In addition, OIG supports the 
Medicaid Fraud Control Units (MFCU), which handle the majority of Medicaid fraud cases.   
Only recently, legislation has led to a greatly expanded role in Medicaid program integrity for 
CMS.  The Deficit Reduction Act (DRA) of 2005 established the Medicaid Integrity Program to 
fight fraud, waste, and abuse.  The DRA requires CMS to contract with entities to identify 
overpayments to Medicaid providers.  CMS contracted with two types of MICsReview MICs 
and Audit MICsto identify such overpayments.  Together, their efforts are known as the 
National Medicaid Audit Program.2 
In general, Review MICs conduct data mining on Medicaid claims, and Audit MICs conduct 
audits of specific providers.  More specifically, Review MICs use Medicaid claims data made 
nationally available through CMSs Medicaid Statistical Information System (MSIS) to identify 
providers that potentially received overpayments.  Audit MICs then audit selected providers to 
determine whether they had received actual overpayments that should be recouped by the State.  
This is what we refer to as the traditional process. 
In addition, CMS established a collaborative process, in which CMS assigned collaborative 
audits when States were willing to participate.  Collaborative audit targets are selected with the 
involvement of Audit and Review MICs, States, and CMS.  The States provide input on program 
areas that are vulnerable to overpayments and the State policies that apply to those program 
areas.  MICs, CMS, and the States then jointly develop data mining models to identify potential 
overpayments.  Instead of using MSIS, collaborative audits identify potential overpayments 
using data available in each States Medicaid Management Information System (MMIS).  All 
parties then determine which providers identified with potential overpayments should be audited.   
                                                           
2 A third contractor type, Education MICs, was also created by the DRA, but they are not involved in the audit 
program.   
2  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  The DRA also funded an expansion of the Medi-Medi Program.  The Medi-Medi Program 
enables CMS and participating State and Federal agencies to collaboratively analyze billing 
trends across the Medicare and Medicaid programs to identify potential fraud, waste, and abuse.  
Participation by State Medicaid agencies and other Federal agencies is optional, and States must 
contribute their own resources to participate.  The purpose of analyzing Medicare and Medicaid 
claims data collectively is to detect billing patterns that indicate possible overpayments or fraud 
that may not be evident when analyzing the data separately.  
CMS requires Medicare integrity contractors, known as Program Safeguard Contractors (PSC), to 
perform mandated Medi-Medi Program integrity tasks, which consist of:    
  identifying program vulnerabilities by using computer algorithms to look for payment 
anomalies that may indicate improper payments or potential fraud; 
  coordinating State and Federal actions to protect Medicare and Medicaid expenditures; and 
  increasing the effectiveness and efficiency of Medicare and Medicaid prepayment denials 
and recovery of fraudulent, wasteful, or abusive expenditures.3 
Federal Program Integrity Efforts Show Limited Results in Protecting 
Medicaid From Fraud and Abuse  
As CMS took on a more active role in Medicaid program integrity at the Federal level, OIG 
assessed those efforts.  Our evaluations assessed the results of the National Medicaid Audit 
Program, operated by CMS and the MICs, and the Medi-Medi Program, operated by the PSCs.  
These evaluations also sought to identify barriers that might be limiting the efficiency and 
effectiveness of these programs integrity efforts.4 
Federal Program Integrity Efforts Were Limited in Their Ability To Identify Medicaid 
Overpayments  
The National Medicaid Audit Program had limited results during the time of our review.  Audits 
of providers selected using the traditional process had particularly limited results.  As Chart 1 
demonstrates, during our review period, Review MICs initially identified 113,378 providers with 
potential overpayments of $282 million, but after performing audits, the Audit MICs eventually 
                                                           
3 CMS is transitioning program integrity work from PSCs to Zone Program Integrity Contractors (ZPIC).  The chief difference 
between PSCs and ZPICs is that ZPICs cover broader geographical areas and multiple parts of the Medicare program, whereas 
PSCs cover more limited areas and scopes. 
4 OIGs three evaluations of the National Medicaid Audit program are an early assessment of the program.  These evaluations 
focused on program integrity activities conducted as the result of assignments CMS made to MICs between January 1 and 
June 30, 2010.  CMS completed the process of awarding MIC task orders to cover all regions of the country in the fall of 2009.  
Our evaluation of the Medi-Medi Program focused on 2007 and 2008.   
3  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  found that only 25 of these providers had overpayments, which totaled $285,629.  The remaining 
102 completed audits found no overpayments.   
Chart 1 shows the process that resulted in the identification of $285,629 in actual overpayments. 
 
  Chart 1:  Identification of Overpayments From Review MIC Analysis 
 
      $282 million in potential      
113,378 providers identified 
  overpayments 
244 providers selected as audit        $39.8 million in potential 
targets  overpayments 
161 providers assigned for   $33.5 million in potential 
audit  overpayments 
25 provider audits  $285,629 in 
found overpayments  overpayments 
 
 
 
A separate evaluation of audits assigned to Audit MICs also found few completed audits with 
findings of overpayments.  OIG found that 81percent of these 370 audits either did not or are 
unlikely to identify overpayments.  At the time of our review, only 11 percent of assigned audits 
were completed with findings, totaling $6.9 million in overpayments.  The remaining audits had 
not progressed enough to draw conclusions about likely outcomes.  
Most of the overpayment findings ($6.2 million) resulted from seven completed audits that used 
the collaborative approach.  The remaining $700,000 in overpayments was identified by 
35 audits that used the traditional approach.   
4  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  The Medi-Medi Program also had limited results, recovering few funds for the Medicaid 
program.  Between 2007 and 2008, the Medi-Medi Program recovered $11.3 million for 
Medicaid.  During the same time period, Medi-Medi recovered more than three times that 
amount  $34.9 million  for Medicare.  While the amount recovered for Medicaid increased 
from $3.5 million in 2007 to $7.8 million in 2008, the total amount was still low compared to 
expenditures on the program. 
Only 5 of the 10 participating States as of 2008 recovered Medicaid overpayments during our 
period of review.5  Two of the participating States ultimately withdrew from the program, 
finding that it offered them minimal benefits.  One of the two States that withdrew reported that 
it invested $250,000 of its own resources in the program, but recovered only $2,000 over a        
5-year period (which included 2007 and 2008).  However, during 2007 and 2008, that State also 
administered its own Medicaid integrity program, which recovered $28.9 million. 
Identified Overpayments Yielded a Negative Return on Investment 
The National Medicaid Audit Program did not identify overpayments commensurate with the 
investment CMS made in the program.  In fiscal year (FY) 2010, CMS paid Review and Audit 
MICs approximately $32.1 million.  Audit MICs identified $6.9 million in overpayments for 
assignments made in the first 6 months of calendar year 2010.  Although we did not collect data 
for the other 6 months of the fiscal year, we have no information that would lead us to expect 
significantly different results.  Projecting the 6-month results over a full year would yield less 
than $14 million, well below the annual expenditures.  Further, these overpayment totals 
represent expected recoveries, not actual recoveries, and therefore may not all materialize as 
providers are given the chance to appeal the findings. 
The Medi-Medi Program also had a poor return on investment.  Although the Medi-Medi 
Program had better results for Medicare than for Medicaid, it was still not enough to achieve a 
positive return on investment during the time period we reviewed.  In 2007 and 2008, Medicare 
and Medicaid expenditures recovered were $46.2 million and expenditures avoided were 
$11.6 million, bringing the program total to $57.8 million.  However, CMS spent $60 million on 
the program during this same period.  
Federal Program Integrity Contractors Made Few Medicaid Fraud Referrals 
The National Medicaid Audit Program generated limited law enforcement referrals.  During the 
time of our review, Review MICs did not identify any potential Medicaid fraud leads from their 
data mining efforts for CMS to review.  CMS officials stated that they have now formalized the 
process for Review MICs to identify potential fraud leads.  Audit MICs, however, have referred 
a limited number of fraud referrals to law enforcement over the course of the program. 
                                                           
5 After 2008, 7 additional States joined the Medi-Medi Program, resulting in a total of 15 participating States.  As a result of the 
transition to ZPICs, the seven additional States joined the Medi-Medi Program as part of three geographic areas. 
5  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  The Medi-Medi Program also produced a small number of Medicaid law enforcement referrals.  
Over the 2 years we reviewed, the Medi-Medi Program produced 10 law enforcement referrals 
for Medicaid among the 10 participating States.  Results for Medicare were better, although still 
limited, with 56 fraud referrals in this time period.  Further, the vast majority of all referrals were 
in just 1 State, accounting for 41 percent (27 of 66) of the total referrals. 
 
Poor Quality of Data Hindered National Medicaid Program Integrity Work  
The poor quality of the Medicaid data on which these programs rely hindered their ability to 
efficiently detect suspicious trends in Medicaid claims for further auditing or investigation.   
Review MICs use MSIS claims data to identify potential overpayments, the only national 
database of Medicaid claims and beneficiary eligibility information.  However, OIG has found 
that the MSIS data are not current, available, complete, and accurate.6  Further, MSIS does not 
capture all data elements that can assist in the detection of fraud, waste, and abuse.   
Unlike the MICs, PSCs obtain Medicaid claims data directly from each participating States 
MMIS to match them to Medicare data.  These data are typically more complete and accurate.  
However, each States MMIS data set is unique, rendering it difficult to match it to other States 
MMIS data or to Medicare data.   
The inaccuracies in and incompleteness of the MSIS data led Review MICs to misidentify 
providers with potential overpayments.  One of the primary reasons audits resulted in no findings 
of overpayments was that the MSIS data used to pinpoint an audit target were inaccurate.  In 
some instances, the reason that audits resulted in no findings of overpayments was that claims for 
outpatient services appeared as inpatient claims in MSIS, making the claims appear suspicious 
when they were, in fact, legitimate.  In other cases, the State adjustments to claims were not 
reflected in MSIS, leading Review MICs to conclude that the State had overpaid a provider for a 
service when it had not.  
The Medi-Medi Program faced different challenges attempting to use existing Medicaid data to 
fulfill its program integrity goals, mainly, efficiently matching State Medicaid data to Medicare 
data.  The Integrated Data Repository was designed to automate the process of matching Medicaid 
to Medicare data.  The repository contains data from Medicare Parts A, B, and D.  However, as of 
the date of this testimony, Medicaid data are not yet included in the repository and are not projected 
to be available for use by the Medi-Medi Program until at least 2015.   
According to CMS, Medicaid data in their current form would not be appropriate to integrate into 
the Integrated Data Repository.  MSIS data lack many of the standardized data elements needed for 
program integrity work and often lack consistency across States.  Similarly, States MMISs do not 
                                                           
6 OIG, MSIS Data Usefulness for Detecting Fraud, Waste, and Abuse, OEI-04-07-00240, August 2009. 
6  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  allow for efficient matching to Medicare data because the data are structured to meet State-specific 
needs, containing variables and data definitions unique to each.   
Medicaid Contractors Had Difficulty Accurately Applying State Medicaid 
Program Policies 
Both the National Medicaid Audit Program and the Medi-Medi Program encountered problems 
when contractors incorrectly applied State Medicaid policies in their analyses of Medicaid data.  
Knowledge of State Medicaid policies is critical to correctly interpreting the data. 
MICs misidentified audit targets because they lacked the appropriate knowledge of each States 
Medicaid program policies.  Five of the seven State Medicaid oversight agencies interviewed 
stated that the audit targets were often inappropriate because of misinterpretation of State policy.  
For example, 44 audit targets were selected because of misidentified duplicate payments for 
services provided to dually eligible beneficiaries (i.e., beneficiaries enrolled in both Medicaid 
and Medicare).  In these cases, Medicaid made two payments for each beneficiarys hospital 
stay, but in this instance, both payments were appropriate.7, 8   
The Medi-Medi program also encountered these same issues with interpreting and analyzing 
Medicaid claims data.  Four of the ten participating State Medicaid program integrity agencies 
said that the Medicare program integrity contractors administering the program do not 
understand Medicaid and that as a result they primarily analyze Medicare claims data. 
Poor Program Administration Diminished the Potential of These Program  
Integrity Efforts  
Our evaluations also reveal that poor administration of the National Medicaid Audit Program and 
the Medi-Medi Program appears to have limited their effectiveness.  In addition, CMS did not 
always hold contractors accountable for the tasks outlined in their contracts.  These are issues 
OIG has identified in the administration and oversight of Medicare integrity contractors for the 
past decade. 
Basic Program Design Limited Efficiency and Effectiveness 
Both the National Medicaid Audit Program and the Medi-Medi Program were constrained by 
elements of their program design.  The National Medicaid Audit Program appears to have been 
constrained by the lack of communication among the contractors and States.  At the time of our 
review, all communication, whether between Review and Audit MICs, between MICs and States, 
                                                           
7 One payment covered all inpatient services, and the second payment covered the coinsurance for ancillary services billed to 
Medicare during the hospital stay.  The State Medicaid agency is required to pay for the Medicare coinsurance for dually eligible 
beneficiaries. 
8 Social Security Act,  1902(a)(10)(E) and 1905(p), 42 U.S.C.  1396a(a)(10)(E) and 1396d(p).  States may differ in the 
policies that determine how Medicare and Medicaid claims for dually eligible beneficiaries are submitted and recorded.  
7  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  or between MICs and different divisions within CMS, went through a multistep process 
controlled by CMS.  According to the MICs, this served to slow the flow of information and 
delayed work.  Audit MICs stated that they felt compelled to duplicate Review MIC analyses 
because they could not easily communicate with Review MICs or States.  The inability to 
communicate freely also meant MICs could not take full advantage of States knowledge of State 
Medicaid policies. 
CMS stated in response to our report that it considered its involvement to be responsible 
oversight in establishing a new program.  Now that the program has been in existence for several 
years, CMS is allowing freer communication among all the parties involved in the National 
Medicaid Audit Program.   
While the National Medicaid Audit Program appeared to suffer from too much CMS 
involvement, the Medi-Medi Program experienced the opposite problem:  a lack of involvement 
by all of the appropriate CMS staff.  Federal Medicaid program integrity staff were not 
incorporated into the administration of the program.  Rather, the Medi-Medi Program was 
administered entirely by the Medicare Program Integrity Group.  Both States and Medi-Medi 
contractors indicated that this resulted in a deemphasis on Medicaid program integrity within the 
program, leaving the majority of Medi-Medi activities focused on Medicare claims analysis.  In 
response to our evaluation, CMS stated that it is assessing ways to increase the involvement of 
Medicaid program integrity staff. 
CMS Did Not Hold Contractors Fully Accountable 
MICs were not held accountable for completing all of their contracted tasks.  Review MICs task 
orders with CMS state that Review MICs are to provide or recommend audit leads, among other 
tasks.  However, during our review period, CMS stated that it expected Review MICs only to 
conduct data analysis and provide lists of providers ranked by the amount of their corresponding 
potential overpayments and did not expect them to recommend audit leads.  As a result, Review 
MICs did not single out any individual providers on their lists as specific audit leads.  Rather, 
Review MICs provided lists containing a total of more than 113,000 providers to CMS for its 
review.  CMS selected only 244 of these providers as audit targets, suggesting that CMS did a 
significant amount of work to screen the provider lists.  Thus, it appears that CMS staff 
completed much of the Review MICs contracted tasks themselves. 
Similarly, CMS did not hold PSCs fully accountable for their administration of the Medi-Medi 
Program.  Although CMS conducts annual assessments of PSCs, CMS did not formally evaluate 
the PSCs on each of the contracted Medi-Medi tasks.  OIG found CMSs documentation of PSC 
performance to be insufficient for drawing conclusions about their effectiveness in completing 
Medi-Medi tasks.   
 
8  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  OIG Recommends Improvements to Medicaid Data and Program 
Administration 
To improve the efficiency and effectiveness of these programs, we recommend that CMS: 
  Devote the resources necessary to improve the quality of the Medicaid data available to 
conduct national Medicaid program integrity data analysis and mining. 
 
  Improve the ability of contractors to properly analyze Medicaid data in light of State-
specific policies. 
 
  Evaluate the goals, design, and operations of both programs to determine what aspects of 
these programs should be part of a national Medicaid program integrity strategy.  For the 
National Medicaid Audit Program, CMS should consider increasing the use of 
collaborative audits.  Collaboration among Audit MICs, Review MICs, States, and CMS 
during audits appears to have improved the selection of audit targets and the efficiency 
of the audit process, leading to better results. 
 
  Hold contractors accountable for all of the tasks outlined in their contracts by 
establishing clear expectations that align with the contracts and evaluating all tasks 
during the annual assessments.  
In response, CMS stated that it has an initiative underway, called Transformed MSIS, to improve 
the quality of national Medicaid data.  Additionally, CMS stated that it has redesigned its approach 
to audit assignments, instructing Audit MICs to focus on collaborative projects.  In fact, CMS 
stated that it assigned more audits through the collaborative process than through the traditional 
process in 2011.  CMS has also stated it has made significant strides in enhancing the effectiveness 
of the Medi-Medi Program.  However, evidence of this has not been made available.     
Conclusion:  More Needs To Be Done To Protect the Integrity of Medicaid 
Payments 
OIGs body of work raises questions about the overall effectiveness of the National Medicaid 
Audit Program and the Medi-Medi Program in protecting Medicaid from fraud, waste, and 
abuse.  OIGs work reveals that neither program produced results commensurate with the 
investments made in them. 
Given the size of current Federal and State outlays for Medicaid and the potential for increased 
outlays as the beneficiary population expands, a robust national approach to Medicaid program 
integrity is imperative. 
9  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012 
  While we are encouraged by the changes that CMS has made, more must be done to improve 
these programs and ensure the economical investment of Federal and State dollars.  Critically, 
CMS needs to improve data available to each program to enable them to efficiently and 
effectively identify potential overpayments and possible fraud. 
Thank you for your interest in this important issue and for the opportunity to be a part of this 
discussion about better protecting Medicaid funds from fraud, waste, and abuse.   
10  U.S. Senate Committee on Homeland Security and Governmental Affairs 
Subcommittee on Federal Financial Management, Government Information, Federal Services, and  
International Security 
June 14, 2012