Background

Under PPACA, health-care marketplaces were intended to provide a  single point of access for individuals to enroll in private health plans,  apply for income-based subsidies to offset the cost of these plans—which  are paid directly to health-insurance issuers—and, as applicable, obtain  an eligibility determination for other health coverage programs, such as  Medicaid or the Children’s Health Insurance Program. CMS operates the  federal Marketplace in about two-thirds of the states.
To be eligible to enroll in a qualified health plan offered through a  marketplace, an individual must be a U.S. citizen or national, or otherwise  lawfully present in the United States; reside in the marketplace service  area; and not be incarcerated (unless incarcerated while awaiting  disposition of charges). Marketplaces, in turn, are required by law to verify  application information to determine eligibility for enrollment and, if  applicable, determine eligibility for the income-based subsidies. These  verification steps include validating an applicant’s Social Security number,  if one is provided; verifying citizenship, status as a national, or lawful  presence by comparison with SSA or DHS records; and verifying  household income and family size by comparison against tax-return data  from IRS, as well as data on Social Security benefits from SSA.
In particular, PPACA requires that consumer-submitted information be  verified, and that determinations of eligibility be made, through either an  electronic verification system or another method approved by HHS. To  implement this verification process, CMS developed the data hub, which  acts as a portal for exchanging information between the federal  Marketplace, state-based marketplaces, and Medicaid agencies, among  other entities, and CMS’s external partners, including other federal  agencies. The Marketplace uses the data hub in an attempt to verify that  applicant information necessary to support an eligibility determination is  consistent with external data sources.
For qualifying applicants, the act provides two forms of subsidies for  consumers enrolling in individual health plans, both of which are paid  directly to insurers on consumers’ behalf. One is a federal income tax  credit, which enrollees may elect to receive in advance, which reduces a  consumer’s monthly premium payment. This is known as the advance  premium tax credit (APTC). The other, known as cost-sharing reduction  (CSR), is a discount that lowers the amount consumers pay for out-of- pocket charges for deductibles, coinsurance, and copayments.
Under PPACA, an applicant’s filing of a federal income tax return is a key  element of “back-end” controls—those that occur later in the application  or enrollment process, versus those occurring at the outset, or “front end.”  When applicants apply for coverage, they report family size and the  amount of projected income. Based, in part, on that information, the  Marketplace will calculate the maximum allowable amount of APTC. An  applicant can then decide if he or she wants all, some, or none of the  estimated credit paid in advance, in the form of payment to the applicant’s  insurer that reduces the applicant’s monthly premium payment.
If an applicant chooses to have all or some of his or her credit paid in  advance, the applicant is required to “reconcile” on his or her federal tax  return the amount of advance payments the government sent to the  applicant’s insurer on the applicant’s behalf with the tax credit for which  the applicant qualifies based on actual reported income and family size.
To facilitate this reconciliation process, the Marketplace sends enrollees  Form 1095-A, which reports, among other things, the amount of APTC  paid on behalf of the enrollee. This information is necessary for enrollees  to complete their tax returns. The accuracy of information reported on this  form, then, is important for determining an applicant’s tax liability, and  ultimately, government revenues.

	CMS Does Not Analyze Data Hub Responses Used to Verify Applicant Information and Did Not Resolve One- Third of 2014 Federal Marketplace Applicant Inconsistencies

		CMS Does Not Analyze the Extent to Which the Data Hub Provides Applicant Verification Information

As noted, PPACA requires that consumer-submitted information in  applications for health-care coverage be verified, and CMS uses the data  hub to check external data sources when making eligibility  determinations. Hence, the extent to which federal agencies that support  the verification system can provide or verify applicant information is a key  element of the eligibility and enrollment process.
Under the data hub process, verification efforts include the following:
SSA: The agency responds to data hub inquiries with information  from its records on applicant citizenship status, Social Security  number, incarceration status, and death. In responding to data hub  inquiries, SSA employs a two-step process: It first seeks to match an  applicant’s name, Social Security number, and date of birth. If SSA  can successfully establish this initial match, it will then seek to  respond to other requests from the data hub for information, if made,  based on specifics of a particular application, such as an applicant’s  citizenship status. SSA also provides CMS with information on  monthly and annual Social Security benefits paid to individuals under  the Old Age, Survivors, and Disability Insurance program, if necessary  to determine eligibility.
IRS: The agency provides federal tax information on household  income and family size, to be used for determining eligibility for  insurance affordability programs, including the APTC and CSR  subsidies.
DHS: The agency provides applicant citizenship and immigration  status information. If SSA cannot verify citizenship (as described  above) and an applicant has also provided an immigration document  number relating to citizenship, DHS will be asked to verify the  applicant’s citizenship, or other immigration status. Or, if applicants  have identified themselves as eligible noncitizens and provide  immigration document information, DHS will be asked to verify that  status.
If the eligibility information applicants provide to the federal Marketplace  cannot be verified through the external sources, such as SSA, IRS, and  DHS, an inconsistency will result. In particular, an inconsistency can arise  when the data hub query process yields no information; or when  information is available through the data hub, but it does not match  information the applicant has provided.
CMS officials told us the key performance measures for the data hub are  computer system availability and the extent to which transmissions of  queries and responses are successfully accomplished; that is, that an  inquiry is made and a corresponding reply received, without regard to  content. According to CMS officials, the data hub only captures a code for  type of reply that is generated when agencies respond to the inquiries,  and those codes are not associated with any other applicant-identifying  information or information that may have been provided in response to  the query. There are no additional data kept on what information might  have been transmitted in the source agency’s response, such as income  or family size. Likewise, the data hub does not track whether information  provided through the data hub matches information originally provided by  the applicant, the officials said.
Overall, although the data hub plays a key role in the eligibility and  enrollment process, CMS officials said the agency does not track the  extent to which the federal agencies deliver responsive information to a  request, or, alternatively, whether they report that information was not  available. From the standpoint of data hub operations, either outcome is  valid, CMS officials told us, and the agency does not focus on the  distinction. Additionally, CMS officials said they do not analyze data  provided in response to data hub inquiries. By design, the data hub does  not store individual transactional data that could be collectively analyzed  over time. For policy reasons, the officials said, the agency did not want  the data hub to become a data repository itself, and in particular, a  repository of sensitive personal data. The CMS officials also said the  agency is barred legally from maintaining IRS taxpayer information in the  data hub.
With CMS unable to provide us with information on data hub inquiry  outcomes, we sought available information from the responding federal  agencies. SSA, IRS, and DHS officials generally told us they do not  analyze outcomes of data hub inquiries. Instead, they focus on  responding to inquiries received. Our review also found that SSA, IRS,  and DHS had limited information on the nature and extent of the inquiries  made by the data hub. According to the three agencies, available  statistics reflect data hub inquiries in general, and cannot be broken out  by program, such as a qualified health plan or Medicaid. In addition,  according to agency officials, an unknown number of data hub applicant  inquiries were duplicates, which we could not eliminate from our  examination. Instead, agency officials told us, they generally process  inquiries sequentially as they are received from the data hub. Thus, while  the agencies can provide some information on data hub queries, they  cannot provide comprehensive information specifically on number of  inquiries and individuals represented by those queries.
Our examination of available statistics from SSA, IRS, and DHS, subject  to the limitations noted, showed that while the agencies could  successfully provide applicant verification information in a large  percentage of cases, they nevertheless did not have data in their records  to verify information for millions of data hub inquiries.
SSA. According to statistics provided by SSA, the agency accomplished  its match on name, Social Security number, and date of birth in a large  majority of cases for PPACA’s first enrollment cycle, for 2014 coverage,  as shown in table 1.
However, for about 4.4 million inquiries—or about 5 percent of the total— the applicant information did not match SSA records. In addition, after  completion of the name, Social Security number, and date of birth match,  when SSA attempted to verify additional information, the agency could  not confirm citizenship in about 8.2 million inquiries where individuals  claimed they were citizens. We also obtained updated figures for the  second enrollment cycle—for 2015 coverage. SSA’s total matching  percentage was slightly higher (96.1 percent vs. 94.9 percent), and the  number of unsuccessful citizenship queries was lower (3.6 million vs. 8.2  million), according to available data from SSA.
IRS. According to IRS, household income and family size information was  not available for inquiries representing about 30.7 million people,  including the following:  Inquiries representing about 25 million people for whom tax-return  information was unavailable, primarily because, according to IRS, no  tax returns were found in agency records or there was a mismatch  between taxpayer identification number and name.
Inquiries representing about 3.2 million people where spouse  information reported on an application does not match spouse  information on file. A spouse mismatch may occur when one partner  remarries, or ceases to be a spouse, IRS officials told us.
Inquiries representing about 1.3 million people involved in identity  theft—victims themselves, or those associated with people who are  victims.
For 2015 coverage, the total figure for which IRS was unable to provide  income and household size verification information was similar, at 29.2  million people versus 30.7 million people, according to IRS data.
DHS. Among the major federal agencies involved in the data hub  process, DHS handled the smallest number of inquiries during the first  enrollment cycle—approximately 3.5 million, regarding applicant  immigration status. Of these, DHS provided applicant status information  through its automated inquiry process in about 3 million inquiries. It could  not initially provide information through the data hub process for  approximately 510,000 inquiries, or about 15 percent, of the total. For  2015 coverage, the figure for unresolved queries was about the same:  status information provided in about 3.5 million inquiries, but with about  634,000, or about 15 percent, initially unresolved, according to DHS data.  According to DHS, the reasons for failure to obtain an automated  resolution are: a mismatch between reported name and date of birth;  inability to find the identifying number of immigration documentation  supplied by the applicant; expired documentation; and missing  information on the legal category used to admit an immigrant.
As noted earlier, CMS does not analyze outcomes of the data hub query  process. A variety of standards, however, call for agencies to routinely  examine performance and progress toward key goals. Internal control  standards for the federal government require that departments and  agencies assess program quality and performance over time and work to  address any identified deficiencies. In addition, management must  continually assess and evaluate controls to assure that the activities the  agency employs to implement its controls are sufficient and effective. In  particular, information critical to achieving agency objectives, including  information related to critical success factors—such as, in this case, the  effectiveness of PPACA’s primary enrollment control process—should be  identified and regularly reported to management. In addition, according  to GAO’s fraud framework, it is a leading practice to conduct ongoing  monitoring and periodic evaluations, to, among other things, provide  assurances to managers they are effectively preventing, detecting, and  responding to potential fraud, and also to support decisions about  allocating resources. Monitoring activities, because of their ongoing  nature, can serve as an early warning system for managers to help  identify and promptly resolve issues and ensure compliance with current  law, regulations, and standards. Moreover, monitoring enables a program  to quickly respond to emerging risks to minimize the impact of fraud. A  centerpiece of federal management and accountability standards, the  Government Performance and Results Act, requires regular review of  progress in achieving objectives, including data-driven analysis on  progress toward key performance goals and management-improvement  priorities. Further, creation of a written plan and timetable for actions to  monitor and analyze outcomes of the data hub query process would  demonstrate organizational commitment to program oversight and  improvement, move such actions closer to fruition, and establish a  schedule for accountability.
By not assessing the extent to which data hub–provided data matches  consumer–provided information, CMS foregoes analysis of the extent to  which responding agencies successfully deliver applicant verification  information in response to data hub requests. In doing so, CMS foregoes  information that could suggest potential program issues or potential  vulnerabilities to fraud, as well as information that might be useful for  enhancing program management. In addition, to the extent hub inquiries  cannot provide requested verification information—leading to generation  of applicant inconsistencies—there is a greater burden on both the  agency and the applicant to resolve the inconsistency. Also, as our  enrollment testing work showed (see discussion later in this report), the  inconsistency resolution process that occurs after the initial application is  vulnerable to fraudulent submission of applicant documentation. Thus,  analysis of data hub query outcomes could be used to assess whether  additional data sources or processes could be used to improve the front- end verification process.
CMS officials acknowledged that the current system often leads to  generation of inconsistencies because information applicants submit often  is more current than information maintained by the federal agencies. By  analyzing the outcomes of data hub inquiries, and in particular, clarifying  the nature and extent of inconsistencies arising from this process, CMS  could, for example, assess whether other sources of data, such as the  National Directory of New Hires, could be useful for more current  applicant information on income. Similarly, CMS could analyze the  information to examine whether other sources of citizenship information,  such as the Department of State’s passport data, could be used to aid in  verifying applicant citizenship.
The data hub’s limited capture of transactional details also means there is  not a detailed audit trail between health marketplaces and the federal  agencies responding to inquiries, to determine whether a query was  appropriately handled. Finally, information that federal agencies maintain,  but that is not currently part of the inquiry response process, could also  enhance the verification process. For example, on the key variable of  household income, IRS reports a limited number of response codes to the  data hub when it cannot provide information in response to a hub inquiry.  Among them is a generalized description that tax-return information is  unavailable. Internally, however, IRS tracks more specific reasons for why  tax-return information is unavailable, such as no tax return on file or a  mismatch between name and taxpayer identification number.
As for feasibility of scrutinizing data hub inquiry outcomes, CMS officials  told us that, as currently operated, the data hub is not equipped to allow  such analysis, and that the time required for any such analysis would  likely hinder a key data hub goal of providing real-time responses.  Further, they said, in some cases, analysis within the data hub would not  be possible—for example, as noted earlier, the data hub cannot store  protected taxpayer information. We note, however, that any such analysis  need not take place within the data hub itself. CMS officials agreed it is  possible that such analytical work could be performed on outcomes of  hub operations outside the data hub itself, but cautioned that attempting  to institute performance criteria could be challenging because success of  data hub queries is inherently limited by data available in the source  agencies. A comprehensive feasibility study of actions CMS could take to  monitor and analyze data hub query outcomes, both quantitatively and  qualitatively, would provide a means for the agency to assess a key  operation, as standards provide, and could also lead to improved program  performance and accountability. Such a study, at the least, could examine  not only baseline performance of the data hub process in delivering  usable information for applicant verification, but also examine data more  qualitatively, such as to identify trends or patterns that could suggest  improvements in verification or actions that could reduce the number of  inconsistencies that require further attention.

		The Federal Marketplace Did Not Resolve About One-Third of Applicant Inconsistencies for Coverage Year 2014, Involving $1.7 Billion in Associated Subsidies

As part of our review, we obtained data from CMS on applicant  inconsistencies generated for the federal Marketplace and the value of  APTC and CSR subsidies associated with them, for the 2014 coverage  year. In particular, to observe the number of inconsistencies created  and subsequently resolved, we examined applications that were awarded  subsidies and that were created and submitted during the 2014 open- enrollment period plus a special enrollment period extension that  followed.
Overall, based on this population, we identified about 1.1 million  applications with a total of about 2 million inconsistencies. These  applications had combined APTC and CSR subsidies of about $4.4 billion  associated with them for coverage year 2014. We found, based on our  analysis of CMS data, that the agency resolved about 58 percent of the  total inconsistencies, meaning the inconsistencies were settled by  consumer action, such as document submission, or removed due to  events such as life change, application deletion, or consumer  cancellation. Meanwhile, our analysis found about 34 percent of  inconsistencies, with about $1.7 billion in associated subsidies, remained  open, as of April 2015—that is, inconsistencies still open several months  following the close of the 2014 coverage year.
Figure 1 shows the total number of inconsistencies included in our  analyses, plus their resolution status and associated subsidy amounts.
Among all applications in our analysis, we identified approximately  690,000 applications with about 1.2 million inconsistencies that had  been resolved through consumer or other actions. The subsidies  associated with these applications were about $2.5 billion for APTC  and $534 million for CSR.
We also identified about 431,000 applications that had about 679,000  unresolved inconsistencies as of April 2015. These applications had  associated with them subsidy amounts of about $1.4 billion for APTC  and $313 million for CSR, for a total of about $1.7 billion.
CMS, through its contractor, terminated or adjusted the subsidies for  about 128,000 other applications based on failure to submit required  documentation. These terminated or adjusted applications had about  159,000 inconsistencies. The total value of subsidies associated with  these applications was about $360 million, with about $293 million in  APTC and $67 million in CSR subsidies.
Appendix II presents further details of our analysis of application  inconsistencies, including breakouts by number and category of  inconsistencies.
Because unresolved inconsistencies can lead to termination or  adjustment of subsidies, which in turn affects government costs for the  program, we asked CMS for details of such actions. CMS officials told us  the agency does not track the value of APTC or CSR subsidies that  change when CMS terminates or adjusts subsidy amounts. Instead, CMS  compiles the number of individuals or households affected by such  actions. According to federal internal control standards, managers should  obtain financial information to make operating decisions, monitor  performance, and allocate resources. Tracking the amount of subsidies  eliminated or reduced would provide financial information on direct cost to  the federal government for such subsidies in a manner that tallies of  individuals or households cannot. Hence, by not tracking the magnitude  of such subsidy changes, CMS does not collect and have available key  financial information relevant to effective program management. In  addition, according to GAO’s fraud framework, it is a leading practice to  assess expected costs and benefits of control activities, to determine  whether a particular control is cost-effective. The costs to the  government for these subsidies would be a key element of an  assessment of the cost-effectiveness of eligibility and enrollment control  activities. By not tracking such costs, CMS cannot make a fully informed  judgment on best implementation of such control activities.
Relatedly, we also identified that, unlike APTC subsidies, CSR subsidies  are not subject to a recapture process at the individual level, such as  reconciliation on the taxpayer’s federal income tax return. In particular, in  discussions with CMS and IRS officials, we found that no entity has  established a process to identify and recover the value of CSR subsidies.  The CSR subsidies increase government costs; and, according to IRS,  excess CSR payments, if not recovered by CMS, would be taxable  income to the individual for whom the payment was made. CMS officials  told us the agency plans to reconcile CSR payments made from the  government to insurers. But CMS officials said neither PPACA nor its  implementing regulations currently provide for reconciliation or recapture  of CSR subsidies at the individual level.
According to federal internal control standards, program managers should  be effective stewards of public resources and detect or prevent  unauthorized use of agency assets. In addition, according to GAO’s  framework for managing fraud risk in federal programs, it is a leading  practice for program managers to seek to ensure program integrity by,  among other things, ensuring that funds are spent effectively and assets  are safeguarded. While there is already a recapture process for APTC  subsidies, CMS has not evaluated the feasibility, including whether new  statutory authority would be required, as well as the expected costs and  benefits, of creating a mechanism to recapture CSR subsidies. By doing  so, the agency can be more assured it is fulfilling its responsibility to  spend funds effectively. Given the multiagency approach to reconciling  APTC, any such feasibility evaluation could likewise involve another  agency. Further, to the extent that recapture is feasible or reasonable  under current statutory authority, creation of a written plan and timetable  for providing such a process would demonstrate organizational  commitment to fiscal responsibility, move such a project closer to fruition,  and establish a schedule for accountability.

		CMS Did Not Terminate Coverage or Adjust Subsidies for Certain Types of Inconsistencies

In addressing inconsistencies, CMS decided not to seek terminations of  policies or adjustments to subsidies for certain inconsistency types for  2014 and 2015 enrollment. CMS officials told us that their system did not  have the capability to take action related to a number of different  inconsistency types. As shown in our analysis of 2014 data, CMS did not  terminate or adjust subsides for any applications with incarceration or  Social Security number inconsistencies, plus other inconsistencies.  Further, CMS officials told us that they currently do not plan to take any  actions on individuals with unresolved incarceration or Social Security  number inconsistencies.

			Social Security Number Inconsistencies

Under PPACA, applicants with a Social Security number must provide it,  to allow for verification of citizenship or immigration status. However,  having a Social Security number is not a condition of eligibility. Under  CMS regulations, the Marketplace must validate all Social Security  numbers provided by submitting them to SSA along with other identifying  information. If the Marketplace is unable to validate the Social Security  number, it must follow the standard process for resolving all types of  inconsistencies.
In our inconsistency analysis (discussed in further detail in app. II), we  identified about 35,000 applications having an unresolved Social Security  number inconsistency, which were associated with about $154 million in  combined subsidies. CMS officials told us they did not take action to  terminate coverage or adjust subsidies during 2014 based on Social  Security number inconsistencies. They said this decision was because  such inconsistencies are generally related to other inconsistencies, such  as citizenship or immigration status, and that document submissions for  citizenship or immigration status may also resolve Social Security number  inconsistencies. Overall, CMS officials told us they do not consider  missing or invalid Social Security number information to be a stand-alone  inconsistency that must be resolved, and do not take adverse action in  such cases. However, CMS regulations state that “to the extent that the   is unable to validate an individual’s Social Security number  through the Social Security Administration,” the Marketplace must follow  its standard inconsistency procedures. Further, when promulgating this  regulation, CMS explained that transmission of Social Security numbers  to SSA for validation “is separate from the  provision regarding  citizenship verification, and only serves to ensure that SSNs provided to  the  can be used for subsequent transactions, including for  verification of family size and household income with IRS.”
However, our analysis found more than 2,000 applications with Social  Security number inconsistencies that had no corresponding citizenship or  immigration inconsistencies. We also identified nearly 5,500 applications  with Social Security number inconsistencies that had no corresponding  income inconsistency. These applications had total subsidies of about  $10 million and $31 million associated with them, respectively. They  indicate that Social Security number inconsistencies can stand alone,  unrelated to other inconsistencies. Moreover, as discussed in our July  2015 testimony and summarized later in this report, we successfully  enrolled and received subsidies for eight undercover identities that either  did not provide a Social Security number or had an invalid Social Security  identity. Thus, we view unresolved Social Security inconsistencies as a  potential fraud vulnerability in the application process.
Social Security number inconsistencies also affect tax compliance. As  noted earlier, if an applicant chooses to have all or some of his or her  premium tax credit paid in advance, the applicant must reconcile the  amount of APTC with the tax credit for which he or she ultimately qualifies  based on actual reported income and family size. Although CMS officials  told us they do not consider missing or invalid Social Security number  information to be a stand-alone inconsistency that must be resolved, IRS  officials told us a valid Social Security number is critical to tax compliance  efforts.
In particular, according to the officials, IRS receives applicant information,  including amount of APTC subsidy received, from the federal Marketplace  and state-based marketplaces. If this information does not include a  Social Security number, or has an invalid Social Security number, IRS  cannot use the marketplace data to verify that taxpayers have properly  filed APTC information on their tax returns.
Specifically, according to IRS officials, Social Security numbers are a key  identifier for tax reconciliation under the act. If a health-insurance  marketplace does not provide valid Social Security information to IRS, but  a taxpayer nevertheless reports receipt of APTC on his or her tax return,  IRS can then contact the taxpayer, the officials told us. This situation  results in greater burden on the taxpayer and IRS to resolve the  discrepancy. However, if a marketplace does not provide Social Security  information to IRS, and a taxpayer does not report receipt of APTC—as a  fraudulent filer might do—then IRS is unable to identify unreported APTC  benefits (that should be subject to reconciliation) at the time of filing, the  officials said.
In addition, a missing or invalid Social Security number impairs IRS  outreach to taxpayers who have received the APTC subsidy, IRS officials  told us. IRS uses information from the marketplaces to identify those who  received APTC, but who did not file a tax return, or who did file a return  but requested a filing deadline extension. After close of the filing deadline,  IRS sends letters to these taxpayers, reminding them to file a return and  reconcile the APTC amount. Without Social Security number information,  IRS cannot know who filed a tax return, and thus does not include those  taxpayers in its APTC outreach efforts, officials told us.
Thus, according to IRS officials, it is important for tax compliance efforts  that CMS validate Social Security numbers—for reconciling APTC, and  for outreach efforts. If IRS does not receive valid Social Security  numbers, the key back-end control intended by the tax reconciliation  process can be frustrated, they said. If IRS is unable to reconcile APTC  subsidies, that inability could lead to loss of tax revenue that should  otherwise be collected by the government. We asked IRS whether it could  provide information on the amount of APTC that went unreconciled, or  outreach efforts foregone, due to missing or invalid Social Security  numbers, but officials told us such information was not readily available  and would take substantial effort to obtain.
CMS could make greater efforts to resolve Social Security number  inconsistencies within its existing system and in the same fashion as it  handles other inconsistencies. According to data we reviewed for our  inconsistency analysis (discussed earlier), Social Security number  inconsistencies are separately identified. In addition, Social Security  documents, such as a Social Security card or Social Security benefits  letter, are already among acceptable forms of documentation that  applicants can provide in response to Marketplace requirements.

			Incarceration Inconsistencies

As noted earlier, PPACA provides that incarcerated individuals are not  eligible to enroll in a qualified health plan through a marketplace, with the  exception of those incarcerated pending disposition of charges. CMS  currently uses SSA’s Prisoner Update Processing System (PUPS)  database to generate incarceration inconsistencies when there are  indications an applicant may be incarcerated. As part of the inconsistency  resolution process, the Marketplace notifies applicants to send  documentation to resolve the inconsistency. To do so, consumers can  submit documentation such as release papers, CMS officials told us.
The PUPS system contains information on incarcerated individuals in all  50 state corrections departments, the Federal Bureau of Prisons, and  local and other facilities. According to SSA, it is the only national  database with records of federal, state, and local incarcerations. SSA  uses PUPS to identify individuals who may no longer be eligible for SSA  benefits due to incarceration. In addition to SSA, other federal  programs, such as Medicare, use PUPS data.
In its 2013 computer-matching agreement with CMS, SSA acknowledged  that PUPS is not as accurate as other SSA data and contains information  that SSA may not have independently verified. Thus, the agreement  states that CMS will independently verify information it receives from  PUPS and will provide individuals an opportunity to contest an  incarceration inconsistency before any adverse action in an eligibility  determination. Overall, according to SSA officials, PUPS information can  be used to identify individuals who require additional follow-up to  determine eligibility.
In our inconsistency analysis (discussed in app. II), we identified about  22,000 applications having an unresolved incarceration inconsistency,  which were associated with about $68 million in combined subsidies.  CMS officials, however, told us they did not terminate eligibility for  incarceration inconsistencies, because the agency determined in fall 2014  that PUPS was unreliable for use by the Marketplace. Specifically, CMS  determined that PUPS data were not sufficiently current or accurate for  use by the Marketplace after receiving reports that people were  misidentified as incarcerated, officials told us. PUPS data for inmate  release were also unreliable, they said. As a result, CMS officials told us  the agency elected to rely on applicant attestations on incarceration  status. Under this approach, CMS officials told us, the Marketplace  continues to make an initial verification attempt using the PUPS data. If a  consumer maintains he or she is not incarcerated, CMS will rely on that  representation and not take adverse action, regardless of what PUPS  indicates, officials told us. According to HHS officials, the Marketplace no  longer requires applicants to submit documentation on incarceration  status.
SSA officials told us that CMS did not communicate concerns about  reliability of PUPS data to them until after CMS had determined the data  to be unreliable. They told us CMS requested a modification to the PUPS  data that would result in fewer false positives—where a person is  identified as incarcerated but actually has never been so, according to the  SSA officials. SSA estimated a cost of $100,000 to provide the  modification. However, according to SSA officials, CMS was unable to  fund the modification and thus deferred the enhancement until after 2016  enrollment.
SSA officials also noted to us that although CMS has expressed concerns  about use of PUPS data under PPACA, it continues to use PUPS for the  Medicare program. CMS officials explained that PUPS data are  acceptable for Medicare because that program uses the data to  determine whether Medicare payments are prohibited for claims  (regulations generally bar Medicare payments for those jailed), but not for  determining overall Medicare eligibility.
SSA considers PUPS data to be accurate for its purposes, because it  verifies information about its beneficiaries before taking action, agency  officials told us. SSA provides more information to CMS through the data  hub than is actually validated by SSA. As a result, SSA officials told us it  is imperative that an agency obtaining PUPS information take steps to  verify that information. CMS officials told us that, thus far, the agency has  not used PUPS data as an indicator for additional follow-up on individual  applicant information. Reflecting SSA’s use of its PUPS data as a lead for  further investigation, a relatively small portion of prisoner alerts generated  eventually led to benefit suspensions, according to agency officials.  PUPS generated about 1.01 million alerts from October 2012 to August  2015, which prompted notices being sent to beneficiaries. Ultimately, SSA  officials said the agency suspended about 131,000 Social Security and  237,000 Supplemental Security Income beneficiaries.
Our review of documentation CMS provided for its decision to take no  adverse action on incarceration inconsistencies showed it did not contain  key information supporting the agency’s decision to not use PUPS data.  Specifically, the documentation did not provide specific details on why, or  to what extent, people were misidentified as incarcerated; why CMS also  judged inmate release information to be unreliable; any criteria or  assessment employed to conclude that the PUPS data were not  sufficiently current or accurate; or the potential cost associated with not  verifying incarceration status. According to federal internal control  standards, significant events must be clearly documented, and the  documentation should be readily available for examination. Without  clearly identifying such elements as analysis, scope, and costs of  significant decisions, CMS is at greater risk of providing benefits to  ineligible applicants, and also may undermine confidence in the applicant  verification process and compromise overall program integrity. Although  SSA acknowledges that PUPS has a lower level of reliability than other  SSA data sources, CMS nevertheless could use information from PUPS  in the manner in which it was intended to be used—as a lead for further  investigation—to identify individuals who may be required to provide  additional documentation for their eligibility determinations. By not using  PUPS data in such a fashion, and by relying on applicant attestation in  the alternative, CMS may be granting eligibility to, and making subsidy  payments on behalf of, individuals who are ineligible to enroll in qualified  health plans.
Further, if CMS has determined that PUPS or other data sources are not  sufficiently reliable, CMS is maintaining an inconsistency resolution  process that is not necessary, given the decision to ultimately rely on  applicant attestation. As a result, in continuing to identify incarceration  inconsistencies and directing applicants to submit documentation to  resolve them, and then processing that documentation, CMS imposes  unnecessary cost and burden on both applicants and the Marketplace. In  light of the decision to accept applicant attestation, the inconsistency  resolution process, whatever its outcome, is not necessary for continued  coverage.

	Vulnerabilities in Federal Marketplace Enrollment Processes Allowed Subsidized Coverage for 11 of 12 Fictitious Applicants in 2014, with Coverage Continuing into 2015

As described in our July 2015 testimony, we identified vulnerability to  fraud, and other issues, when we obtained, through undercover testing,  federal Marketplace approval of subsidized coverage for 11 of 12 fictitious  applicants for 2014 coverage. In particular, as we reported in our  testimony:
We obtained the APTC subsidy in all cases, totaling about $2,500  monthly, or about $30,000 annually, for all 11 approved applicants.  We also obtained eligibility for CSR subsidies. Appendix III  summarizes outcomes for all 12 of our phone and online applications,  and shows the fictitious applicant scenarios we used to attempt the  applications.
In all 11 cases in which we obtained coverage, the Marketplace  directed us, either orally or in writing, to send supporting  documentation. However, the Marketplace did not always provide  clear and complete communications. As a result, during our testing,  we did not always know the current status of our applications or  specific documents required in support of them.
Our 11 fictitious enrollees maintained subsidized coverage throughout  2014, even though we sent fictitious documents, or no documents, to  resolve application inconsistencies.
Following our document submissions, the Marketplace told us, either  in writing or in response to phone calls, that the required  documentation for all our approved applicants had been received and  was satisfactory, even when we had sent no documentation. CMS  officials told us that call center representatives do not have available  to them information on current status of inconsistencies and applicant  submission of documents. The CMS officials said the agency hopes to  add the ability to provide inconsistency status information to the call  center representatives, but they did not know how long this would  take.
There have been no cases of fraudulent applications or  documentation referred to the U.S. Department of Justice or the HHS  Office of Inspector General, because CMS’s document-processing  contractor has not identified any fraud cases to CMS. However, the  contractor is not required to detect fraud, nor is it equipped to do so.  Instead, CMS requires the contractor only to inspect for documents  that have obviously been altered. Overall, according to CMS officials,  the agency has limited ability to detect and respond to attempts at  fraud. They told us CMS must balance consumers’ ability to  “effectively and efficiently” select Marketplace coverage with  “program-integrity concerns.”
As explained later in this section, CMS effectively waived certain  applicant documentation requirements for 2014, which likely  accounted for some of our applicants’ ability to retain coverage.  Specifically, for the 2014 coverage year, CMS directed its document  contractor not to terminate policies or subsidies if an applicant  submitted any documentation to the Marketplace. Typically, applicants  submit documentation after receiving a notice from the Marketplace.  Thus, if an applicant submitted at least one document, whether it  resolved an inconsistency or not, that would be deemed a sufficient  good-faith effort so that the Marketplace would not terminate either  the policy or subsidies of the applicant, even if other documentation  had initially been required.
The Marketplace automatically reenrolled coverage for all 11 fictitious  applicants for 2015.
Although tax filing information is key to reconciling APTC, we found  errors with the information CMS reported on 1095-A forms for 3 of our  11 fictitious applicants.
The Marketplace later terminated subsidized coverage for 6 of our 11  applicants in early 2015, but after contacts with Marketplace  representatives, we restored coverage for 5 of these applicants—with  larger subsidies.

		Inability to Provide Information on Status of Document Submissions Is a Vulnerability and Could Lead to Consumer Frustration

In the case of call center representatives not having current information  on consumer document submissions, internal control standards for the  federal government call for agency management to ensure there are  adequate means of communicating with, and obtaining information from,  external stakeholders that may have a significant impact on the agency  achieving its goals. In addition, CMS has noted the importance of the  quality of consumers’ experiences with the Marketplace, particularly in  dealing with call centers. The inability of call center representatives to  obtain current document status information after the application process  is complete is not only a potential vulnerability for efficient and effective  operation of the system, but can also be a frustration for consumers  attempting to provide requested eligibility information, and could cause  them to not file documentation as appropriate. In turn, that could affect  CMS’s goal of extending health-insurance coverage to all qualified  applicants. Given CMS officials’ stated desire to add the ability to provide  inconsistency status information to the call center representatives,  creation of a written plan and timetable for doing so would demonstrate  organizational commitment, move such a project closer to completion,  and establish a schedule for accountability.

		Although Fraud Prevention and Program Integrity Are Stated Key Goals, CMS Has Not Taken the Initial Step of Conducting a Fraud Risk Assessment

Regarding fraud vulnerability an agency may face, federal internal control  standards provide that a key internal control is to assess risks an agency  faces from both internal and external sources. Similarly, a strategic goal  for HHS, CMS’s parent agency, is to strengthen program integrity and  responsible stewardship by, among other things, fighting fraud and  focusing on performance and risk management. In addition, according to  GAO’s framework for managing fraud risks in federal programs, it is a  leading practice for agencies to regularly assess risks to determine a  fraud risk profile. As part of that process, agencies should identify  inherent fraud risks to their programs and determine the likelihood and  impact of those risks on program objectives. In addition to financial  impacts, fraud risks can affect a program’s reputation and compliance  with statutes and regulations.
We asked CMS to provide us with any fraud risk assessment for the  eligibility and enrollment process the agency may have conducted.  Agency officials were unable to provide us with any such assessment.  CMS officials did tell us the agency plans to conduct an assessment of  the Marketplace’s eligibility determination process, including the  application process and the inconsistency resolution process. CMS  officials did not provide a firm date for completion. We note, however, that  while such work could be constructive, it would not necessarily constitute  the type of thorough fraud risk assessment as provided in GAO’s fraud  framework. In addition, CMS officials told us the agency is beginning to  perform risk assessments of the accuracy of payments made to insurers  to fund APTC and CSR subsidies. Again, while such work could be   constructive, we distinguish this from a fraud risk assessment of the  eligibility and enrollment process.
As previously noted, we retained coverage and subsidies for all 11  applicants originally covered, even though we had submitted fictitious  documents or no documents to resolve application inconsistencies.  These results, while not generalizable, nevertheless illustrate that the  Marketplace enrollment process is vulnerable to fraud. Without  conducting a fraud risk assessment—as distinct from a more generalized  review of the eligibility determination process, as described earlier—CMS  is unlikely to know whether existing control activities are suitably designed  and implemented to reduce inherent fraud risk to an acceptable level.  Moreover, CMS is at greater risk of improperly providing benefits as well  as facing reputational risks to the program through perceptions that  program integrity is not a priority.

		CMS Effectively Waived Certain Document Filing Requirements for 2014, and Did Not Fully Analyze the Effects of the Decision

In the case of CMS effectively waiving certain document submission  requirements, PPACA authorized the agency, for the 2014 coverage year,  to extend the period for applicants to resolve inconsistencies unrelated to  citizenship or lawful presence. Additionally, regulations provide that  CMS may extend the period for an applicant to resolve any type of  inconsistency when the applicant demonstrates a “good-faith effort” to  submit the required documentation during the resolution period. CMS  officials told us that the submission of a single document served as  sufficient evidence of a good-faith effort by the applicant to resolve all  inconsistencies, and CMS therefore extended the inconsistency  resolution period through the end of 2014. Hence, CMS did not terminate  coverage for any applicant who made such an effort in 2014.
Our analysis of CMS documentation of the agency’s application of the  good-faith effort regulation showed CMS did not sufficiently analyze or  document its decision and its impact. Specifically, documentation CMS  provided to us did not include information on key factors including the  number of applications and inconsistencies this decision affected or was  expected to affect; expected costs associated with the decision; or an  explicit rationale, created at the time of the decision, for why partial  submission of documents constituted a “good-faith effort” sufficient to  resolve all inconsistencies.
According to federal internal control standards, significant events—in this  case, applying CMS’s good-faith regulation to effectively waive  submission of satisfactory documents to resolve application  inconsistencies—must be clearly documented, and the documentation  should be readily available for examination. All such documentation and  records should be properly managed and maintained. To the extent  CMS’s implementation of the good-faith effort regulation allows otherwise  ineligible applicants to obtain and maintain subsidized coverage, it  contributes to what has been called a practice of “pay and chase”— attempting to recover overpayments (potentially obtained through fraud)  once they have already been made. Without clearly identifying and fully  documenting, on a contemporaneous basis, the policy objectives,  supporting analysis, scope, and expected costs and effects of  implementing the good-faith effort, or other significant decisions on  enrollment and eligibility matters, CMS undermines transparency and  ability to communicate most effectively with both internal and external  stakeholders, and also may undermine confidence in the applicant  verification process and compromise program integrity.
HHS did provide us with an explanation of the agency’s decision to apply  the good-faith effort regulation in such a way that certain applicant  document submission requirements were effectively waived. Due to what  an HHS official said were “resource limitations and operational  challenges,” the Marketplace had limited ability to provide assistance to  applicants with data matching issues in 2014. According to the official, the  Marketplace often had no ability to identify and match which applicants  had even submitted documentation until well after the 90-day  inconsistency resolution period. Further, once the Marketplace was able  to increase its capacity to match applications with applicant-submitted  documentation, it still took months to catch up, the official said.  Compounding the difficulties, the official said, was that the Marketplace’s  initial guidance to consumers needing to submit verification  documentation was not sufficiently specific.
The result, according to HHS, was that applicants were effectively denied  the statutorily mandated period to resolve inconsistencies, and the  Marketplace would not have been authorized to terminate enrollment of  those who had made a good-faith effort to resolve their inconsistencies.  According to the official, the decision to apply the good-faith effort  regulation in a way that waived certain document submission  requirements recognized that applicants required a better understanding  of the eligibility process and that many consumers faced frustrating  technical problems with seeking to resolve inconsistencies.
CMS officials told us that the agency was generally enforcing the full  submission requirement for 2015, and that good-faith extensions granted  in 2015 were decided on a case-by-case basis and were of limited length.  All consumers, regardless of whether they benefitted from the good-faith  effort extension in 2014, will still be subject to deadlines for filing sufficient  documentation, they said. In particular, according to the officials, those  who made a good-faith effort by submitting documentation, but failed to  clear their inconsistencies in 2014, were among the first terminations in  2015, which they said took place in February and early March. In addition,  according to HHS, CMS expects to issue guidance outlining how the  Marketplace will determine whether an applicant has demonstrated a  good-faith effort to obtain the required documentation, and expects good- faith extensions for applications for 2016 coverage to be very limited.
CMS also provided some information on other terminations and  adjustments. Officials told us that from April through June of 2015,  enrollment in coverage through the federal Marketplace was terminated  for about 306,000 consumers with citizenship or immigration status data- matching issues who failed to produce sufficient documentation. In  addition, according to the officials, about 735,000 households with income  inconsistencies had their APTC or CSR subsidies adjusted for coverage  year 2015. By comparison, HHS reported that more than 8.84 million  people selected or were automatically reenrolled in 2015 plans through  the federal Marketplace as of the end of the second open-enrollment  period on February 15, 2015. While the information CMS provided  reflected gross terminations and adjustment activity, it did not include  details on fiscal impact of the actions.

	Conclusions

Implementation of the new PPACA eligibility and enrollment provisions for  the act’s first year was a broad, complex, and costly undertaking. In light  of that, standards for achieving efficiency and transparency, and  assessing risk and fraud potential, are especially relevant. CMS  effectively waived a significant portion of the Marketplace eligibility  determination procedures for the 2014 coverage year. However, as our  review demonstrated, the enrollment process is vulnerable to fraud. Our  work indicates a number of areas where CMS should act to enhance  program integrity and management and better assess potential fraud risk.
The data hub plays a pivotal role in the application process, supporting  the electronic data matching used to assess applicant eligibility, which in  turn determines billions of dollars in federal spending. As such, CMS  program management would benefit from the ability to monitor and  analyze the extent to which data hub queries provide requested or  relevant applicant verification information. CMS officials stressed to us  that, by design, the hub itself is not equipped to perform analysis, but  agreed that any such analysis need not take place within the data hub  itself. Data hub inquiries are important not only as a front-end control  measure, but also because what happens at the front end affects back- end controls as well: The more applicant inconsistencies that arise  following data hub queries—because the data hub process cannot  successfully confirm applicant information—the more emphasis accrues  to back-end controls. These back-end controls involve efforts first by  applicants to submit required documentation and then by the Marketplace  to resolve the inconsistencies. But as our work showed, the process is  vulnerable to fraud. A greater understanding of the effectiveness of the  data hub process could inform assessments about effectiveness of  enrollment and eligibility controls, while still incorporating procedures that  seek to safeguard applicant information. Underscoring the need for  comprehensive data collection and analysis is that the agencies  responding to data hub inquiries themselves have limited and inconsistent  information available on query outcomes. CMS could conclude, upon  making a comprehensive review of data hub inquiry outcomes, that  current procedures are adequate. But without such a review, CMS cannot  make a best-informed judgment.
In the case of not seeking to resolve Social Security number and  incarceration inconsistencies, CMS officials effectively further waived  program eligibility controls. In the case of incarceration inconsistencies,  incarceration status is one of three initial eligibility criteria specified by  PPACA. In the case of Social Security inconsistencies, regulations  specify a resolution process that CMS did not follow, and the CMS  decision also undermines IRS tax compliance efforts—a key control for  ensuring that APTC subsidies, a significant federal cost under the  program, are properly received.
Similarly, the inability of Marketplace call center representatives to have  current information on the status of applicant document submissions can  create consumer frustration and impair timely and accurate filing of  eligibility information.
CMS has assumed a passive approach to identifying and preventing  fraud. CMS relies on a contractor charged with document processing to  report possible instances of fraud, even though CMS does not require the  contractor to have fraud detection capabilities. Adopting a more strategic,  risk-based approach could help identify fraud vulnerabilities before they  could be exploited in the enrollment process. A comprehensive risk  assessment identifying the potential for fraud in the enrollment process— which thus far has not been performed—could inform evaluations of  program integrity and the effectiveness of enrollment and eligibility  controls. In particular, as part of that, determining the value of terminated  or adjusted subsidy payments—both APTC and CSR—could provide  insight into financial risk the federal government faces when eligibility  requirements are not met or it is determined application fraud may have  occurred. In the specific case of CSR subsidies, it could be reasonable,  depending on amounts determined to be at stake, to seek a method, and  additional legislative authority, as necessary, for recovering benefits  received, as there currently is for the APTC subsidy.
CMS’s effective waiving of certain document filing requirements for  applicant inconsistencies, through its application of the good-faith effort  regulation, was a significant policy and financial decision—it allowed an  unknown number of applicants to retain coverage, including subsidies,  they might otherwise have lost, thus producing higher costs for the federal  government. Similarly, we found CMS’s decision on the reliability of  PUPS data for resolving incarceration inconsistencies to be only partially  documented. By failing to fully document its actions, including factors  such as factual basis, scope, and cost, CMS undermines transparency  and ability to communicate effectively with both internal and external  stakeholders, and also may undermine confidence in the program.

	Recommendations for Executive Action

To better oversee the efficacy of PPACA’s enrollment control process; to  better monitor costs, risk, and program performance; to assist with tax  compliance; to strengthen the eligibility determination process; to provide  applicants with improved customer service and up-to-date information  about submission of eligibility documentation; and to better document  agency activities, we recommend that the Secretary of Health and Human  Services direct the Acting Administrator of CMS to take the following eight  actions:  1.  Conduct a comprehensive feasibility study on actions that CMS can  take to monitor and analyze, both quantitatively and qualitatively, the  extent to which data hub queries provide requested or relevant  applicant verification information, for the purpose of improving the  data-matching process and reducing the number of applicant  inconsistencies; and for those actions identified as feasible, create a  written plan and schedule for implementing them.  2.  Track the value of APTC and CSR subsidies that are terminated or  adjusted for failure to resolve application inconsistencies, and use this  information to inform assessments of program risk and performance.  (See related recommendation 7.)  3.  In the case of CSR subsidies that are terminated or adjusted for  failure to resolve application inconsistencies, consider and document,  in conjunction with other agencies as relevant, whether it would be  feasible to create a mechanism to recapture those costs, including  whether additional statutory authority would be required to do so; and  for actions determined to be feasible and reasonable, create a written  plan and schedule for implementing them.  4.  Identify and implement procedures to resolve Social Security number  inconsistencies where the Marketplace is unable to verify Social  Security numbers or applicants do not provide them.  5.  Reevaluate CMS’s use of PUPS incarceration data and make a  a.  use the PUPS data, among other things, as an indicator of further  research required in individual cases, and to develop an effective  process to clear incarceration inconsistencies or terminate  coverage, or  b.  if no suitable process can be identified to verify incarceration  status, accept applicant attestation on status in all cases, unless  the attestation is not reasonably compatible with other information  that may indicate incarceration, and forego the inconsistency  process.  6.  Create a written plan and schedule for providing Marketplace call  center representatives with access to information on the current status  of eligibility documents submitted to CMS’s documents processing  contractor.  7.  Conduct a fraud risk assessment, consistent with best practices  provided in GAO’s framework for managing fraud risks in federal  programs, of the potential for fraud in the process of applying for  qualified health plans through the federal Marketplace.  8.  Fully document prior to implementation, and have readily available for  inspection thereafter, any significant decision on qualified health plan  enrollment and eligibility matters, with such documentation to include  details such as policy objectives, supporting analysis, scope, and  expected costs and effects.

	Agency Comments and Our Evaluation

We provided a draft of this report to HHS, SSA, IRS, and DHS for their  review and comment. HHS provided written comments, reproduced in  appendix IV, in which the agency concurred with our recommendations.  HHS said it is committed to verifying consumer eligibility for Marketplace  plans and subsidies provided to qualifying applicants. HHS outlined  several actions it plans to take, or is considering, to strengthen its  oversight of the federal Marketplace. However, while concurring with our  recommendations, HHS did not elaborate on particular actions it would  take to implement them. For example, while saying HHS is working to  provide call center representatives with current status of eligibility  documentation, there is no indication how and when this will be done.  Similarly, while agreeing to reevaluate use of PUPS incarceration data,  HHS said it continues to use PUPS data as a “trusted data source” while  also questioning its utility. Because actions in response to our  recommendations have yet to be implemented, and it is not yet clear  when and how such steps will be taken, it is too early to determine  whether they will fully address the issues we identified. All four agencies  provided us with technical comments, which we have incorporated, as  appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, the Acting  Commissioner of Social Security, the Commissioner of Internal Revenue,  the Secretary of Homeland Security, and other interested parties. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of this review are to (1) examine the extent to which  information submitted by applicants under the Patient Protection and  Affordable Care Act (PPACA) is verified through the federal “data  services hub” (data hub)—the primary means for verifying eligibility—and  the extent to which the federal Health Insurance Marketplace  (Marketplace) resolved “inconsistencies” where applicant information  does not match information from federal data sources available through  the data hub; and (2) describe, by means of undercover testing and  related work, potential vulnerabilities to fraud in the federal Marketplace’s  application, enrollment, and eligibility verification processes, for the act’s  first open-enrollment period, for 2014 coverage.
To examine outcomes of the data hub applicant verification process, we  obtained information from key federal agencies involved in the process— the Social Security Administration, the Internal Revenue Service, and the  Department of Homeland Security—on the nature and extent of their  responses to electronic inquiries made through the data hub, for the 2014  and 2015 coverage years. We also interviewed agency officials and  reviewed statutes, regulations, and other policy and related information.  To assess the reliability of the agency summary data on data hub  responses, we interviewed officials responsible for their respective data  and reviewed relevant documentation. We concluded the data were  sufficiently reliable for our purposes. In addition, we obtained applicant  data on inconsistencies, subsidies awarded, and submission of required  verification documentation, from the Centers for Medicare & Medicaid  Services’ (CMS) Multidimensional Insurance Data Analytics System.  These data include subsidies provided and submission status of required  verification documents as of April 2015, for coverage received for the  act’s first open-enrollment period, including for our undercover  applications. Specifically, the enrollment period included was October 1,  2013, to March 31, 2014, and also included a special enrollment  extension into April 2014. These data included application information, such as application version, date of creation,  date of submission, and total application-level subsidies for coverage  year 2014; and  inconsistency information, such as type of inconsistency and  resolution status as of April 2015.
For our analysis, we excluded applications modified from their original  version, as well as applications with submission and creation dates after  the special enrollment period ending in April 2014. To examine  inconsistency resolution, we grouped inconsistencies into CMS-identified  categories and determined, at the application level, subsidy amounts  associated with them. As provided to us by CMS, subsidy information is  at the application level, while inconsistencies occur at the individual level.  As a result, subsidy amounts are not mutually exclusive by resolution  status. For example, a single application may have an open inconsistency  in one category, but a resolved inconsistency in another. Thus, subsidy  amounts associated with the application would be reflected in subsidy  totals for each resolution status. This limitation, however, does not affect  our overall calculation of subsidies associated with applications with one  or more unresolved inconsistencies. To identify applications with Social  Security number inconsistencies and no associated  citizenship/immigration or income inconsistency, we first identified  applications with Social Security number inconsistencies. We used those  applications’ unique identifiers to match them to applications with  citizenship/immigration or income inconsistencies, and then removed  those applications appearing in both categories. Additionally, we  interviewed CMS officials to obtain an understanding of the application  data that CMS maintains and reports. To assess the reliability of the CMS  applicant data on inconsistencies, we performed electronic testing to  determine the validity of specific data elements we used to perform our  work. We also interviewed CMS officials and reviewed relevant  documentation. On the basis of our discussions with agency officials and  our own testing, we concluded the data were sufficiently reliable for our  purposes.
To perform our undercover testing of the Marketplace application,  enrollment, and eligibility verification processes, we created 12 fictitious  identities for the purpose of making applications for individual health-care  coverage by telephone or online. Because the federal government, at the  time of our review, operated a marketplace on behalf of the state in about  two-thirds of the states, we focused our work on those states. We  selected three of these states for our undercover applications, and further  selected target areas within each state. To maintain independence in our  testing, we created our applicant scenarios without knowledge of specific  control procedures, if any, that CMS or other federal agencies may use in  accepting or processing applications. We thus did not create the  scenarios with intent to focus on a particular control or procedure. The  results obtained using our limited number of fictional applicants are  illustrative and represent our experience with applications in the three  states we selected. They cannot, however, be generalized to the overall  population of all applicants or enrollees. In particular, our tests were  intended to identify potential control issues and inform possible further  work. We began our undercover testing in January 2014 and concluded it  in April 2015. We shared details of our work with CMS during the course  of our testing, to seek agency responses to the issues we raised.
For these 12 applicant scenarios, we chose to test controls for  verifications related to the identity or citizenship/immigration status of the  applicant. This approach allowed us to test similar scenarios across  different states. We made half of these applications online and half by  phone. In these tests, we also stated income at a level eligible to obtain  both types of income-based subsidies available under PPACA—a  premium tax credit and cost-sharing reduction (CSR). Our tests included  fictitious applicants who provided invalid Social Security identities,  noncitizens incorrectly claiming to be lawfully present in the United  States, and applicants who did not provide Social Security numbers. As  appropriate, in our applications for coverage and subsidies, we used  publicly available information to construct our scenarios. We also used  publicly available hardware, software, and materials to produce  counterfeit or fictitious documents, which we submitted, as appropriate for  our testing, when instructed to do so. We then observed the outcomes of  the document submissions, such as any approvals received or requests  to provide additional supporting documentation.
Overall, our review covered the act’s first open-enrollment period, for  2014 coverage, as well as follow-on work through 2014 and into 2015  after close of the open-enrollment period.
For both objectives, we reviewed statutes, regulations, and other policy  and related information. We also used federal internal control standards  and GAO’s fraud risk management framework to evaluate CMS’s  controls.
We conducted this performance audit from January 2014 to February  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.

Appendix II: Inconsistencies by Number of Applications and Category of Inconsistency

Figure 2 presents details of our analysis of inconsistency data from the  Centers for Medicare & Medicaid Services (CMS), by number of  applications, in the population identified for our analysis of CMS data, with  associated subsidies. The population was applications made during the  2014 open-enrollment period—October 1, 2013, to March 31, 2014—plus  a special enrollment period extension into April 2014; and, in addition,  only applications that were not subsequently modified. These applications  had associated with them a total of about $3.6 billion in advance premium  tax credit subsidies and about $781 million in cost-sharing reduction  subsidies.
Income: Approximately 27 percent (287,000) of applications in our  review had an unresolved income inconsistency, and these were  associated with more than $1 billion in combined APTC and CSR  subsidies. By comparison, CMS adjusted applicant subsidies for  about 6 percent (64,000) of applications with income inconsistencies,  which were associated with $193 million in total subsidies.
Citizenship/immigration status: About 13 percent (141,000) of  applications had an unresolved citizenship or immigration  inconsistency and were associated with more than $633 million in  combined subsidies. CMS terminated coverage of relevant individuals  for about 6 percent (65,000) of applications with citizenship or  immigration status inconsistencies, which were associated with almost  $172 million in total subsidies.
Incarceration: About 2 percent (22,000) of applications had an  unresolved incarceration inconsistency and were associated with  about $68 million in total subsidies. CMS did not terminate any  coverage for incarceration inconsistencies.
Social Security number: More than 3 percent (35,000) of  applications had an unresolved Social Security inconsistency and  were associated with about $154 million in combined subsidies. CMS  did not terminate any coverage or adjust subsidies for Social Security  inconsistencies.
Table 2 presents a breakout, by number of inconsistencies, of all  inconsistency types in the population identified for our analysis of CMS  data. Our analysis examined about 1.1 million unmodified applications  with at least one inconsistency.

Appendix III: GAO Applicant Scenarios

Figure 3 summarizes outcomes for all 12 of our phone and online  applications, and shows the fictitious applicant scenarios we used to  attempt the applications.

Appendix IV: Comments from the Department of Health and Human Services

Appendix V: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact name above, Matthew Valenta and Gary  Bianchi, Assistant Directors; Maurice Belding; Mariana Calderón; Marcus  Corbin; Carrie Davidson; Paul Desaulniers; Colin Fallon; Suellen Foth;  Sandra George; Robert Graves; Barbara Lewis; Maria McMullen; James  Murphy; George Ogilvie; Shelley Rao; Ramon Rodriguez; Christopher H.  Schmitt; Julie Spetz; Helina Wong; and Elizabeth Wood made key  contributions to this report.

Summary:
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can select private health-insurance plans. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $37 billion for fiscal year 2015. GAO was asked to examine the enrollment process and verification controls of the federal Marketplace. For the act's first open-enrollment period ending in March 2014, this report (1) examines the extent to which applicant information is verified through an electronic system, and the extent to which the federal Marketplace resolved “inconsistencies” where applicant information does not match information from federal data sources and (2) describes, by means of undercover testing and related work, potential vulnerabilities to fraud in the federal Marketplace's application, enrollment, and eligibility verification processes. GAO analyzed 2014 data from the Marketplace and federal agencies, interviewed CMS officials, and conducted undercover testing. To perform the undercover testing, GAO submitted or attempted to submit 12 fictitious Marketplace applications. The undercover results, while illustrative, cannot be generalized to the full population of enrollees.

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs.
During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.

What GAO Recommends

GAO makes eight recommendations, including that CMS consider analyzing outcomes of the verification system, take steps to resolve inconsistencies, and conduct a risk assessment of the potential for fraud in Marketplace applications. The Department of Health and Human Services concurred with GAO's recommendations.