Background

Under the authority of PPACA, HHS approves the operation of state- based marketplaces that meet certain standards, such as the state-based  marketplaces’ ability to carry out the required functions of a marketplace  consistent with relevant HHS regulations. A state-based marketplace  must be a governmental agency or nonprofit entity established by the  state. A state may enter into agreements with an eligible entity, such as a  state Medicaid agency, to carry out one or more responsibilities of the  marketplace. The three state-based marketplaces we selected to  examine—Idaho, Maryland, and Rhode Island—have the following  structures:  Idaho. Your Health Idaho is an independent entity in charge of  managing the state-based marketplace for Idaho. The marketplace  was established by the state in 2013 and began operating its own  platform in plan year 2015. Prior to plan year 2015, the marketplace  operated through the federally facilitated marketplace. Your Health  Idaho established an agreement with Idaho’s Department of Health  and Welfare to conduct eligibility determinations for all applicants  seeking subsidized health care. Applicants who wish to receive  subsidized health care can begin an application either through Your  Health Idaho or through the Department of Health and Welfare. Once  eligibility for a qualified health plan is determined, the applicant’s  information and eligibility determination, including any subsidy  amounts for which the applicant qualifies, are sent back to Your  Health Idaho, the entity that manages plan enrollment.
Maryland. Maryland Health Benefit Exchange is a public corporation  and independent state agency that was established in 2011 and  began operations in plan year 2014. The marketplace works with  three state executive-branch agencies: the Department of Health and  Mental Hygiene, the Department of Human Resources, and the  Maryland Insurance Administration. In accordance with federal law,  applicants can apply for health coverage through an online portal  operated by the marketplace and through other methods such as  broker enrollments. Maryland Health Benefit Exchange maintains  eligibility and enrollment data for all individuals with qualified health- plan coverage.
Rhode Island. Originally established through executive order in 2011,  HealthSource RI was formally established in statute in 2015 and  operates as a division of the Rhode Island Department of  Administration. The marketplace began operations in plan year 2014.  Applicants can apply for health coverage through a single online  portal operated by the marketplace. HealthSource RI maintains  eligibility and enrollment data for all individuals with qualified health- plan coverage. HealthSource RI is also the system of record for  premium payment information, since applicants make premium  payments directly to the marketplace.
In plan year 2015, 14 states, including the District of Columbia, operated  their own state-based marketplaces. The remaining 37 states relied on  HealthCare.gov, the federally facilitated marketplace. CMS is  responsible for operating HealthCare.gov and overseeing the  marketplaces operated by the states.
Combined, state-based marketplaces accounted for about 28 percent of  the over 9.3 million enrollments in all marketplaces as of September  2015, or about 2.6 million enrollments. California and New York together  made up about 64 percent of state-based marketplace enrollments, or  about 1.7 million enrollments. Our selected state-based marketplaces  made up about 9 percent, about 237,000 enrollments, of the total state- based marketplace enrollments. Figure 1 shows states operating their  own marketplace platforms and their percentages of the total state-based  marketplace enrollments as of September 2015.
PPACA generally requires that individuals maintain minimum essential  health-care coverage. Minimum essential health-care coverage can  include eligible employer-sponsored minimum essential coverage, such  as plans offered by an individual’s employer; and non-employer- sponsored coverage, such as individual health coverage purchased  directly from an insurance company, a qualified health plan purchased  through a state-based or federally facilitated health-insurance  marketplace, or coverage received through government-sponsored  programs.
Under PPACA, to be eligible to enroll in a qualified health plan offered  through a state-based or federally facilitated marketplace, an individual  must be a U.S. citizen or national, or otherwise lawfully present in the  United States; reside in the marketplace service area; and not be  incarcerated (unless incarcerated while awaiting disposition of charges).  Individuals must meet additional eligibility requirements to receive  subsidies for qualified health plans, such as meeting certain household- income thresholds.
State-based marketplaces, like the federally facilitated marketplace, are  required by PPACA to verify applicant information to determine eligibility  for enrollment and income-based subsidies, if applicable. Specifically, the  marketplaces must  check for Medicaid eligibility before determining eligibility for qualified  health plans;  validate an applicant’s SSN, if one is provided, by comparison to  SSA’s records;  verify citizenship or immigration status by comparison with SSA or  Department of Homeland Security (DHS) records, respectively; and  verify household income and family size by comparison against tax- return data from the Internal Revenue Service (IRS), as well as data  on Social Security benefits from SSA.
Additionally, marketplaces must determine whether an applicant is eligible  for minimum essential coverage through eligible employer-sponsored or  non-employer-sponsored plans by using any available HHS-approved  data source. HHS regulations permit marketplaces to accept applicant  attestation as verification of meeting certain eligibility standards, such as  incarceration status, residency, and minimum essential coverage, if a  data source is unavailable, unless the attestation is not reasonably  compatible with other information obtained by the marketplace. Finally,  marketplaces are required to perform periodic examinations of data  sources to identify changes to applicant information, such as an  applicant’s death.
If any of the applicant’s self-attested information does not match the  information contained in the data source, or if a data source is not  available to verify the information, a data-matching inconsistency is  generated. For those inconsistencies that cannot be resolved through a  reasonable effort to identify and address the cause of the inconsistency,  the marketplaces must send out a notification to the applicant, who  generally has 90 days to present satisfactory documentary evidence to  resolve the inconsistency. During this time, applicants will receive  conditional eligibility. If the inconsistency is not resolved within 90 days,  unless an extension is granted, the applicant’s eligibility is determined  based on the available information. Depending on the type of  inconsistency and the availability of the data sources, the applicant’s  eligibility may be terminated, or the applicant’s subsidy amount may be  recalculated. Figure 2 shows the marketplace application eligibility- determination and enrollment process for subsidized qualified health  plans according to HHS regulations.
For eligible applicants, PPACA provides two possible forms of subsidies  for consumers enrolling in individual health plans, both of which are  generally paid directly to insurers on consumers’ behalf. The premium tax  credit is a federal income-tax credit, which reduces a consumer’s monthly  premium payment. The other form, known as cost-sharing reduction, is a  discount that lowers the amount consumers pay for out-of-pocket charges  for deductibles, coinsurance, and copayments. Eligible applicants may  use these subsidies to help make their health insurance more  affordable.
Both state-based and federally facilitated marketplaces use applicants’  reported household income and family size at their time of application to  calculate the maximum allowable premium tax-credit amount. Applicants  can choose to have some, all, or none of the premium tax credit paid in  advance to their insurance issuer. Applicants who choose to have all or  some of the credit paid in advance, known as an advance premium tax  credit (APTC), must reconcile the amount paid to insurers on their behalf  with the amount for which the applicants qualify based on the actual  household income and family size reported on their tax returns.  Applicants do not have to reconcile any cost-sharing reductions paid on  their behalf.
The marketplaces are required to provide IRS, through HHS, with  information on enrolled individuals on a monthly basis. These data  include information on the individuals enrolled in a qualified health plan  through the marketplace, the coverage start and end dates, the monthly  premium amounts, and the amount of APTC paid to the insurer on behalf  of the taxpayer. Marketplaces also provide an annual summary of this  information in the Form 1095-A, Health Insurance Marketplace  Statement, to applicants who were enrolled in health insurance through  the marketplace in the plan year and to IRS.

	Selected States’ Key Processes Used Multiple Data Sources to Verify Applicant Eligibility, and CMS Relied on Several Methods to Oversee the States’ Efforts

		Key Processes Used Federal and State Data Sources to Verify Applicant Eligibility

Each of the selected state-based marketplaces’ key processes to verify  applicant eligibility for subsidized coverage used various electronic data  sources in plan year 2015. PPACA requires marketplaces to verify  applicant eligibility using data sources and methods approved by HHS.  As shown in table 1, the data sources included various federal data, some  of which were accessed via the federal data services hub (data hub), and  various state data, among other sources.
As reflected in the table above for plan year 2015, two of the selected  state-based marketplaces—Maryland and Rhode Island—used the data  hub to perform much of their verification process. The third selected state- based marketplace—Idaho—opted to use the state’s existing benefit- eligibility system and leveraged many of its existing eligibility-verification  processes, adding or modifying processes where needed, to meet the  verification requirements for subsidized qualified health plans. Because  Idaho used the same eligibility system for many other benefits programs,  Idaho officials noted that they may have preexisting relationships with  applicants applying for qualified health plans. For example, an applicant  may also participate in other state-administered programs such as  Medicaid or the Supplemental Nutrition Assistance Program. In such  cases, Idaho leveraged this known relationship to expedite certain steps  of the eligibility-determination process, such as the verification of SSN,  citizenship, and lawful presence.
Officials from our selected state-based marketplaces cited inherent  limitations or challenges with using certain third-party data to verify  eligibility, such as the age of the data, unreliable results, or limited  availability. As noted above, the selected state-based marketplaces had  access to local data sources, some of which may have been more current  than the data sources used by the data hub. For example, all three  selected state-based marketplaces supplemented federal tax income  information obtained through the data hub with more-current state wage  information to verify income for subsidy eligibility. IRS income information  provided via the data hub can be up to 2 years old, which may cause  differences between the current applicant-reported income and the  information that IRS provides to the data hub. State wage information is  updated quarterly.
Further, state officials noted inherent challenges with receiving inaccurate  or outdated information from incarceration databases. According to  officials from one state-based marketplace, these databases contained  information on when an individual was incarcerated, but did not always  accurately record when an individual was released. Therefore, an  individual may have been identified as currently incarcerated when he or  she may already have been released. This information required additional  follow-up work by the state-based marketplaces to determine whether the  individual was still in fact incarcerated and therefore not eligible for  coverage. Maryland officials stated that due to the number of false  positives they received from the data hub’s connection with the SSA  Prisoner Update Processing System and the investment needed to  resolve these inconsistencies, they stopped using this source to  determine eligibility in December 2014. The other two selected state- based marketplaces—Idaho and Rhode Island—used state or county  data sources in addition to, or in place of, the Prisoner Update Processing  System, but Idaho officials noted that these data sources also required  additional follow-up. Rhode Island officials said that they relied on  responses from the state incarceration data over the Prisoner Update  Processing System to identify individuals incarcerated in its state prisons.  CMS officials previously said that the Prisoner Update Processing System  was unreliable for use by the federally facilitated marketplace because  the data were not sufficiently current or accurate, after receiving reports  that people were misidentified as incarcerated. We recommended in 2016  that CMS reevaluate its use of the Prisoner Update Processing System in  eligibility determinations or explore other options, such as applicant- attestation, for the federally facilitated marketplace. CMS concurred with  this recommendation.
Officials from two selected state-based marketplaces also noted  challenges with verifying certain types of information provided by the  applicant, such as employer-sponsored minimum essential coverage,  because there were limited data sources from which to verify the information. The Rhode Island state-based marketplace used the data  hub to verify that applicants were not receiving health-care benefits  through a federal employer. However, none of the selected state-based  marketplaces verified other types of employer-sponsored coverage, such  as those from a private employer, because, according to state officials,  there was no comprehensive data source available. As a result, they  relied on the applicants’ attestations. Idaho officials said that their staff  may contact employers directly in some cases, for example if the  applicant works for certain employers known to offer minimum essential  coverage, such as a state employer. Maryland state-based marketplace  officials told us they are developing a quarterly process to contact  employers directly to verify minimum essential coverage for a random  sample of applicants.
Two of the selected state-based marketplaces also reported challenges  with the inconsistency-resolution process as they developed their  enrollment and eligibility systems. Maryland transitioned to a new  enrollment and eligibility system in plan year 2015, while Rhode Island  was working toward integrating its marketplace and Medicaid systems in  plan year 2015. Due to these changes, the state-based marketplaces  encountered some challenges, but officials from both states told us they  have since improved and modified their eligibility-determination and  inconsistency-resolution processes. For example, in plan year 2015, the  inconsistency-resolution process was manual for these two states. While  their systems were able to identify inconsistencies, they did not always  create an alert when the 90-day resolution period for applicants to submit  sufficient documentation had expired. As a result, some individuals with  unresolved inconsistencies continued to receive coverage beyond the 90- day period. Maryland and Rhode Island officials said that they have since  put in place automated or semiautomated inconsistency-resolution  processes that allow them to automatically identify expired inconsistency  time frames, redetermine eligibility, and terminate coverage, if  appropriate, for inconsistencies that have not been resolved within the 90- day period.

		CMS Oversaw State- Based Marketplaces’ Efforts through Various Methods

During plan year 2015, CMS relied on several activities to oversee and  monitor state-based marketplaces’ procedures for verifying applicant  eligibility for subsidized coverage. For example, CMS conducted annual  reviews, collected programmatic data, and engaged in regular  communication with the selected state-based marketplaces. In plan year  2015, CMS did not collect or review data from the state-based  marketplaces related to eligibility-verification procedures, such as the  number or types of inconsistencies generated by the state-based  marketplaces or the inconsistency-resolution status. At the time of our  review, however, CMS was finalizing a data-collection template to capture  that information on a quarterly basis and planned to implement the  template during the 2018 open-enrollment period.

			CMS Conducted Two Annual Reviews of Selected State- Based Marketplaces

CMS conducted two types of annual reviews as part of its oversight and  monitoring activities of the selected state-based marketplaces for plan  year 2015. The first review, CMS’s State-based Marketplace Annual  Reporting Tool (SMART) review, evaluated information submitted by each  state-based marketplace to meet their annual reporting requirements. The  second review, CMS’s Open Enrollment and Readiness Review (OERR),  evaluated the selected state-based marketplaces’ critical operational  areas as they prepared for the upcoming open-enrollment period.
SMART review: HHS regulations require state-based marketplaces to  report to CMS, at least annually, on the activities of their  marketplaces. In response to these requirements and to facilitate  their review, CMS developed the SMART report to compile this  information into an annual reporting mechanism for the state-based  marketplaces. The SMART requires the states to conduct a self- assessment of their marketplace activities, policies, and procedures in  effect during the plan year and provide a summary of marketplace  activities, accomplishments, and strategic priorities for the upcoming  year. They also include the state-based marketplaces’ attestations  indicating whether they have met certain requirements outlined in  HHS regulations, such as the requirements for eligibility-verification  and redetermination procedures, enrollment standards, and annual  external financial and programmatic audits. CMS began requiring the  states to use the SMART in 2015 to cover plan year 2014, the first  year of operation for the marketplaces, and annually thereafter.
Upon submission of the SMART report, the state-based marketplaces’  point of contact at CMS, known as the CMS state officer, and subject- matter experts were to assess the submissions to evaluate each  state-based marketplace’s compliance with HHS regulations and  standards. CMS developed a “desktop tool,” similar to a checklist, that  is designed to assist the state officers in determining whether the  information is sufficient and satisfies the requirements. It is also  designed to provide feedback on the review. For example, CMS state  officers and subject-matter experts were to review the state-based  marketplaces’ fraud, waste, and abuse policies and procedures to  ensure the state-based marketplaces have the ability to identify,  adjudicate, and report on fraud, waste, and abuse within marketplace  operations. These policies and procedures must include reporting  mechanisms for both external and internal parties, penalties for  noncompliance, referrals to law enforcement, and detection activities,  including data analytics and ongoing monitoring of operations.
As part of the SMART review process, CMS state officers were to also  review each state-based marketplace’s external programmatic audit  that evaluates whether the state-based marketplace’s processes and  procedures were designed to prevent improper eligibility  determinations and enrollment transactions, and designed to identify  errors that resulted in incorrect eligibility determinations, among other  items. Further, they were to review any material weaknesses or  significant deficiencies identified by the audit and evaluate the state- based marketplace’s corrective action plan, if applicable.
Upon completion of CMS’s 2015 SMART review, CMS state officers  communicated the results in a final letter to the selected state-based  marketplaces that included a summary of findings and corrective  actions and incorporated the findings from the external audits, if  applicable. For example, in Rhode Island’s 2015 SMART review letter,  CMS requested monthly updates on the progress of the marketplace’s  corrective action plan to address two findings from the marketplace’s  annual external audit, among other items. In Maryland’s 2015 SMART  review letter, CMS requested an action plan and associated timeline  for the implementation of an incarceration-verification process, while  for Idaho, CMS requested a timeline for submission of outstanding  policy-level enrollment reports, among other items. State-based  marketplace officials from our selected states said CMS also regularly  communicated with them to track progress on ongoing issues as a  result of its SMART review. For example, the Idaho state-based  marketplace officials said they had a number of iterative  conversations with CMS to clarify issues and receive feedback on  their SMART report.
OERR: CMS state officers conducted a second type of annual review  of our selected state-based marketplaces that occurred before the  2016 open-enrollment period. The purpose of this review was to  evaluate the state-based marketplace’s critical operational areas,  including the state-based marketplace’s capabilities for performing  eligibility verifications. CMS state-based marketplace oversight  documentation and OERR agendas showed that CMS state officers  met with the selected state-based marketplaces and walked through a  list of questions and state-specific issues pertaining to how the state- based marketplace performs the required functionality. Topics to be  discussed during the OERR included application processing and  notices, redeterminations and renewals, eligibility verifications,  inconsistency processing, and enrollment transactions, among others.  CMS state officers were also to discuss with state-based marketplace  officials any findings from the previous plan year’s SMART review to  assess readiness for the upcoming open-enrollment period. For  example, Maryland’s 2016 OERR included follow-up discussions on  its incarceration-verification procedures and resolving incarceration- status inconsistencies, which were findings from its previous year’s  SMART review.

			CMS Collected Some Enrollment Metrics in 2015 and Was Developing a Data- Collection Template to Include Eligibility-Verification Metrics

During plan year 2015, CMS collected quarterly enrollment metric reports  from the selected state-based marketplaces, which included information  such as the number of individuals that applied for coverage, the number  of individuals who were determined eligible for a qualified health plan, the  number of appeals, and the number of complaints, among other items.  As discussed above, HHS regulations require state-based marketplaces  to collect and report this type of performance-monitoring data to CMS.
However, for plan year 2015, CMS did not collect information that showed  the number or types of inconsistencies generated by the state-based  marketplaces or their resolution status. As previously mentioned, CMS  state officers were to review each state-based marketplace’s annual  independent external programmatic audit as part of the SMART review to  help ensure the state-based marketplaces’ procedures were designed to  prevent improper eligibility determinations, among other things. However,  our review of the three states’ external audits found that they did not  provide CMS with insight into the overall number or type of  inconsistencies or their resolution status. Further, the external  programmatic audits occurred once a year and were provided to CMS  after the conclusion of the plan year, which limited the states’ and CMS’s  ability to use the results of these audits to make timely program changes,  as appropriate.
At the time of our review, CMS was revising its metrics requirements and  developing a new quarterly data-collection template for the state-based  marketplaces to include information related to the number and type of  inconsistencies generated and their resolution status. If implemented as  intended, this revision may provide CMS with the type of information  needed to assess whether certain verification procedures are working  effectively. For example, CMS officials said they planned to use the  information to identify areas in which the states may need technical  assistance or improvements that could be made for verification  procedures that are generating too many inconsistencies. Too many  inconsistencies could be the result of the information provided by the  applicants but could also be the result of using a data source that is not  providing enough relevant information. At the time of our review, the data- collection template was undergoing a final review and public comment  period. CMS officials told us they planned to implement the new data- collection template during the 2018 open-enrollment period.

			CMS Engaged in Regular Communication with State- Based Marketplaces

CMS officials said they also engaged in other regular communication with  the state-based marketplaces to provide ongoing guidance and solicit  feedback on marketplace-related functions. CMS held a number of  different types of teleconferences with state-based marketplaces to  discuss various operational and technical topics, including discussions  related to new CMS policies and procedures, status updates on SMART  and OERR findings, and technical assistance on the implementation and  operation of eligibility-verification procedures. These calls varied in  frequency including weekly, biweekly, monthly, or on a periodic basis.  Officials at our selected state-based marketplaces said that these calls  were valuable because they give marketplaces an opportunity to receive  advance notification on potential changes, provide input on future policy  decisions, and share best practices with CMS and other state-based  marketplaces. According to CMS officials, examples of the different types  of CMS’s regular communication with the state-based marketplaces  included the following:
CMS state officials call discusses ongoing operations and  maintenance issues, such as the SMART, OERR, audits, and other  issues as appropriate.
State-based marketplace enrollment weekly office-hours call  discusses technical guidance and assists state-based marketplaces  as they implement automated functionality to report enrollment data to  CMS.
State-based marketplace group and Chief Executive Officer  (CEO) call shares information with state-based marketplace CEOs  related to new policies and procedures that affect both the federally  facilitated marketplace and state-based marketplaces. The call  provides an opportunity for CEOs to clarify their understanding of  various CMS policies with both CMS and their counterparts at other  state-based marketplaces.
State-based marketplace program-integrity call informs state- based marketplaces of program-integrity efforts related to the  federally facilitated marketplace and allows state officials to share  best practices related to program integrity among their respective  state-based marketplaces.
Eligibility verifications workgroup call provides technical  assistance to state-based marketplaces on the implementation and  operations of marketplace eligibility verifications, from both a  programmatic and a technological perspective. This call includes  discussion of underlying policy and use of the data hub, including  enhancements, to effectively support eligibility verifications.
Eligibility and enrollment policy forum exchanges ideas and  innovations on policy and operational aspects of state and federal  marketplace eligibility and enrollment activities.
Metrics cluster group call provides ongoing assistance to the state- based marketplace staff that collect and report metrics data as they  work to comply with CMS data-reporting requirements.

	Few Indications of Potentially Improper or Fraudulent Enrollments Were Identified in Selected States in Plan Year 2015

Our analysis of plan year 2015 eligibility and enrollment data from three  selected states identified few indications of potentially improper or  fraudulent enrollments. However, our analysis did identify some quality  issues in states’ data, such as SSN or name data-entry errors. Overall,  we analyzed approximately 210,000 individual applicants associated with  about $428 million in APTC amounts. Table 2 shows the population and  APTC amounts by selected state-based marketplace.
We analyzed four areas within the selected state-based marketplaces’  processes to verify applicant eligibility and identify potentially improper or  fraudulent enrollments. We selected these four areas because they were  related to the eligibility and verification requirements that marketplaces  must follow to determine whether individuals are eligible to enroll in  coverage. Specifically, we identified (1) applicants whose information,  including SSN, did not match SSA’s records; (2) applicants who were  potentially deceased; (3) applicants who self-attested to being noncitizens  or were identified by the state-based marketplaces as having immigration- related inconsistencies; and (4) applicants who were identified by the  state-based marketplace as potentially incarcerated. Additionally, we  identified and reviewed a nongeneralizable selection of 60 applicants to  provide illustrative examples of the four areas analyzed. Our analysis  found the following:
Applicants whose personal information did not match SSA’s  records. We identified about 2,000 applicants of the approximately  210,000 applicants for whom SSN, first name, last name, or date of  birth did not match SSA’s records. About half of the 2,000 applicants  were listed as the household’s primary tax filer. These applicants’  information is necessary to reconcile the amount of APTC received on  their federal tax returns at the end of the plan year. SSNs are a key  identifier in the APTC reconciliation process, and invalid personal  information can impair IRS’s ability to complete the reconciliation  process. We have previously recommended that CMS take additional  steps to resolve SSN-related inconsistencies in the federally facilitated  marketplace. CMS concurred with this recommendation. Figure 3  shows the number of applicants whose personal information did not  match SSA’s records.
State-based marketplace officials cited inherent challenges with  verifying SSN information. Specifically, officials from our selected  states pointed to challenges such as applicants with name changes or  incorrect dates of birth. During our review of selected applicant cases,  we observed an instance in which an applicant used what appeared to  be her married last name on her application. The applicant, however,  had provided a passport with a different last name to verify her  citizenship, and officials said she had previously received benefits  under that name. Officials from the applicant’s state said that they do  not automatically update names to match documents provided since  the name could be out of date. In another state, we observed an  instance where the state did not receive validation of an applicant’s  SSN through the data hub. The applicant provided a copy of her  Social Security card and her permanent resident card, which both had  the same three last names. While the state had the correct SSN in  its enrollment data, it had only recorded the third last name, which  may have caused the applicant’s information to not match SSA’s  records.
We also found instances in which the SSNs contained likely data- entry errors in two of our three selected state-based marketplaces. In  plan year 2015, one selected state-based marketplace allowed  applicants to successfully resolve identity-related inconsistencies by  providing documents that may not have had SSN information on  them, such as a birth certificate. In one applicant case from this  state, we observed that the state was not able to verify the applicant’s  SSN through the data hub. The applicant provided a birth certificate  and driver’s license to resolve the inconsistency. As a result of our  review, state officials determined that the applicant’s SSN had a  typographical error in the middle two digits. State officials said that to  identify and appropriately resolve inconsistencies such as these, the  state-based marketplace has since created a distinct SSN-related  inconsistency that would require proof of SSN to resolve the  inconsistency.
In one selected state-based marketplace, we observed a case where  a data-entry error was likely caused by an applicant incorrectly  entering her SSN during the online application process. The  applicant’s original application had the correct SSN but a subsequent  application had an incorrect SSN. Later, her SSN was corrected and  was successfully verified by the state. In the other selected state- based marketplace, we saw an instance in which a marketplace  worker did not update an applicant’s SSN when documentation was  provided to resolve the SSN-related inconsistency. The applicant went  to a walk-in center and provided a copy of his Social Security card to  resolve his inconsistency. Ultimately, the marketplace worker  overrode the SSN inconsistency and did not correct the SSN, which  allowed the error to remain in the state’s data. We shared information  on these data-entry errors with the relevant state-based marketplaces,  and officials told us they have corrected the information in their  systems.
Reportedly deceased applicants. We identified 21 of the almost  210,000 applicants (approximately 0.01 percent) who were deceased  prior to starting coverage in plan year 2015. The majority of these  applicants died after their applications were submitted, but prior to  starting coverage. For 2 of the 21 applicants, 1 was deceased for 6  months prior to the start of coverage, and another for a year. Figure 4  shows the number of applicants who were reportedly deceased or  whose information matched a decedent prior to plan year 2015.
We identified an additional 30 of the nearly 210,000 applicants whose  SSN matched an identity that was deceased before the start of  coverage, but whose names or birthday did not match. We performed  additional review of these applicants and found that the matches were  likely the result of SSN data-entry errors in the same two selected  state-based marketplaces. Specifically, the SSA Enumeration  Verification System (EVS) results for these applicants indicated that  their reported SSNs did not match SSA’s records.
We also reviewed 11 applicant cases of these 30 applicants and  found data-entry errors. For instance, in one state we reviewed a  selected applicant’s case information with the state and saw that the  applicant’s SSN was not verified by the data hub. The applicant  provided a Social Security card, which showed that the state’s data  had two digits of the applicant’s SSN transposed and the first name  spelled incorrectly. Similarly, our review of an applicant case in the  other state found that the applicant’s personal information, including  SSN, failed verification through the data hub for plan year 2015.  Though the applicant had provided a copy of his tax return that had  his correct SSN on it in, his SSN was ultimately not corrected until the  applicant came to a walk-in center in November 2016. We shared  these applicant cases with the relevant state-based marketplaces,  and they have taken steps to correct data-entry errors where  necessary.
Additionally, we identified 324 of the approximately 210,000  applicants (about 0.15 percent) who died during plan year 2015. The  state-based marketplaces ended coverage for about 73 percent of  these applicants within 2 months, while coverage continued for 3–12  months after the reported date of death for the remainder of the  applicants. Through our applicant case review, we observed different  ways that states received information about deceased individuals. For  example, in one state, an applicant’s parent called to report that the  applicant had died during plan year 2015, and the information was  processed by the state-based marketplace the same day. In a  different state, we observed that while the state was not aware of an  applicant’s death, her insurance carrier terminated her coverage due  to nonpayment.
Unresolved immigration status. In Rhode Island and Maryland,  almost 3,000 applicants—about 2.4 percent of 123,000 applicants  from these states—did not resolve their immigration-related data- matching inconsistencies. More than half of these applicants received  coverage for more than 6 months. As previously discussed, these two  state-based marketplaces had manual inconsistency-resolution  processes in place during plan year 2015 and may not have  terminated coverage for these applicants in a timely manner. Officials  from these states told us that since plan year 2015 they have  implemented automated or semiautomated processes to automatically  close inconsistencies and terminate coverage after the 90-day period.  We were not able to test whether these automated or semiautomated  inconsistency-resolution processes would appropriately terminate  coverage for these applicants after the 90-day period because they  were implemented after our period of review.
We reviewed 12 applicant cases from our three selected state-based  marketplaces in which applicants self-attested to being noncitizens or  had immigration-related inconsistencies. In our review, we observed  applicant cases that successfully verified immigration status as well as  applicant cases in which applicants’ eligibility was terminated for  failure to provide documentation. For example, in one selected case,  we saw the DHS Systematic Alien Verification for Entitlements system  results used to verify the applicant’s lawful presence. In another case,  the state requested immigration documents from the applicant and  later terminated an applicant’s coverage for failure to provide the  requested documentation.
Potentially incarcerated. Our selected state-based marketplaces  identified 245 potentially incarcerated applicants out of the nearly  210,000 overall applicants (about 0.1 percent). As previously  discussed, there are many challenges associated with using  incarceration data, including the risk of false positives. We reviewed  nine applicant cases from our selected state-based marketplaces to  learn about the incarceration-verification process but did not  independently verify the incarceration status of the selected cases.  During this review, we observed an instance in which an applicant  provided updated incarceration information. The applicant’s spouse  called the state-based marketplace to inform it that the applicant  would be incarcerated for more than 30 days. The state then  determined that the applicant was no longer eligible for coverage.

	Agency and Third- Party Comments

We provided a draft of this product to HHS, SSA, DHS, the Office of  Personnel Management, Your Health Idaho, the Idaho Department of  Health and Welfare, Maryland Health Benefit Exchange, and  HealthSource RI for comment. In their email responses, Your Health  Idaho, the Idaho Department of Health and Welfare, and HealthSource RI  agreed with our findings. In its written comments, reproduced in appendix  II, SSA indicated it had no comments on the draft. In their email  responses, HHS, DHS, the Office of Personnel Management, and  Maryland Health Benefit Exchange informed us that they had no  comments.  HHS, DHS, Your Health Idaho, and HealthSource RI also  provided technical comments, which we incorporated as appropriate.
We are sending copies of this report to the Secretary of Health and  Human Services, the Administrator of CMS, and other interested parties.  In addition, the report will be available at no charge on the GAO website  at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of this review were to (1) identify key processes used by  selected state-based marketplaces to verify applicants’ eligibility for  subsidized qualified health plans in plan year 2015, and how the Centers  for Medicare & Medicaid Services (CMS) oversaw such efforts; and (2)  assess the extent to which applicant eligibility and enrollment data from  selected state-based marketplaces show indications of potentially  improper or fraudulent enrollments in subsidized qualified health plans in  plan year 2015.
We chose the selected state-based marketplaces—Idaho, Maryland, and  Rhode Island—based on factors such as whether the state used its own  marketplace platform to determine eligibility and enrollment, the continued  operation of the marketplace, and prior audits performed on these states.  Additionally, we considered geographic location and enrollment size,  among other characteristics. The results of our review and analysis of  these state-based marketplaces cannot be generalized to other  marketplaces.
To identify key processes used by selected state-based marketplaces to  verify applicants’ eligibility and to determine how CMS oversaw such  efforts, we reviewed relevant federal and state statutes, Department of  Health and Human Services (HHS) regulations, state policies and  procedure manuals, and CMS documentation, such as annual reports  submitted by the state marketplaces and report-review templates, data- metric templates, and review agendas. We also met with CMS and state  agency officials and visited the state-based marketplaces that perform  eligibility functions in our selected states.
To identify indications of potentially improper or fraudulent enrollments in  plan year 2015, we obtained and analyzed eligibility and enrollment data  for applicants enrolled in the three selected state-based marketplaces  from November 15, 2014, through October 31, 2015. We also obtained  and analyzed advance premium tax credit (APTC) data from the three  states for all of plan year 2015. Maryland and Rhode Island also provide  eligibility-inconsistency data. Idaho did not provide eligibility-inconsistency  data due to the way its data are stored in its system. We identified  criteria for key eligibility-verification processes by examining federal and  state policies, laws, and guidance, including policy and procedure  manuals.
We limited our analysis to applicants in our selected state-based  marketplaces’ eligibility and enrollment data who applied for and enrolled  in subsidized qualified health plans in plan year 2015 and received at  least 1 month of health coverage and at least 1 month of APTC. To  identify these applicants, we removed applicants who were part of an  application but were not seeking coverage; applicants who only received  coverage through a qualified dental plan; applicants who received  coverage through a qualified health plan but did not seek or receive  APTC; and applicants who received coverage through Medicaid or the  Small Business Health Options Program marketplaces. Where  appropriate, we also removed applicants for whom we could not identify  the correct APTC amount, for example applicants with two APTC  amounts in a single month, or whose coverage dates were not in plan  year 2015. Additionally, we did not include applicants who may have  enrolled between November 1, 2015, and December 31, 2015, to avoid  potential changes to the data that may have been made by the plan year  2016 open-enrollment season. For the remaining records, we determined  the total number of unique applicants, unique applications, and the  associated APTC.
We focused on four analysis areas that were based on the eligibility and  verification requirements that marketplaces must follow to determine  whether individuals are eligible to enroll in coverage. Specifically, we  identified (1) applicants whose information, including Social Security  number (SSN), did not match the Social Security Administration’s (SSA)  records; (2) applicants who were potentially deceased; (3) applicants who  self-attested to being noncitizens or had immigration-related  inconsistencies; and (4) applicants who were identified by the state-based  marketplace as potentially incarcerated.
Applicants whose personal information did not match SSA’s  records. To identify applicants whose personal information—name,  date of birth, and SSN—did not match SSA’s records, we used the  SSA Enumeration Verification System (EVS). Specifically, we  processed all applicants in the three selected states’ eligibility and  enrollment information through SSA EVS and analyzed the output  codes to determine whether the states’ information matched SSA’s  records. To determine whether the state-based marketplace had also  identified an SSN-related inconsistency, we compared the SSA EVS  analysis results to the state eligibility information. To identify  applicants listed as the head of household or tax filer whose  information did not match SSA’s records, we reviewed the state  enrollment and subsidy information to identify heads of household and  tax filers and then analyzed the EVS results for these applicants.
Reportedly deceased applicants. To identify applicants who were  potentially deceased prior to or during plan year 2015, we matched  the states’ eligibility and enrollment data to the SSA public-plus-state  Death Master File from June 2016. We matched records using the  SSN and compared last names and dates of birth of all potential  matches. For those applicants whose SSN and last names or date of  birth were exact matches, we determined whether the individual was  reported as deceased prior to or after the start of coverage. For  applicants who were reportedly deceased prior to starting coverage,  we analyzed the reported death date in relation to the application- submission and coverage-start dates. For applicants who were  reportedly deceased during coverage, we analyzed the reported death  date in relation to the coverage-end date. For applicants whose SSN  matched, but last names or date of birth did not match, a decedent,  we reviewed SSA EVS outputs and state eligibility and enrollment  information to determine whether an SSN-related inconsistency  existed.
Unresolved immigration status. To identify applicants with  unresolved immigration-related inconsistencies, we analyzed  Maryland and Rhode Island eligibility data and determined the amount  of coverage received based on their coverage start and end dates.
Potentially incarcerated. To identify applicants who were potentially  incarcerated, we analyzed all three selected states’ eligibility and  enrollment data to identify applicants who were flagged by the state  as being potentially incarcerated.
We did not perform analyses using independent data sources for the  following enrollment and subsidy eligibility requirements for the following  reasons:  Incarceration. While historic extracts of SSA’s Prisoner Update  Processing System exist, SSA officials told us that the data may have  been changed based on updated prisoner information and may be  different from the data provided to the states since plan year 2015.
Immigration status. The Department of Homeland Security’s  Systematic Alien Verification for Entitlements data does not  differentiate between states in its data hub responses, making it  difficult to identify our selected states’ information.
Income. Internal Revenue Service household-income information in  the data hub can be up to 2 years old. Due to the age of the data,  there may be discrepancies between applicants’ attested information  and what state-based marketplaces can obtain through the data hub.
Residency. Individuals must intend to reside in the state and do not  have to have a fixed address in the state. State-based marketplaces  can accept self-attestation unless the information provided by the  applicant is not reasonably compatible with other information provided  by the applicant or in the records of the marketplace.
Employer- and government-sponsored coverage. No single  comprehensive dataset was available in plan year 2015 to check  eligibility for employer- and government-sponsored minimum essential  coverage.
To develop illustrative applicant case examples, we initially identified a  nongeneralizable illustrative selection of 51 applicant cases from our  three selected state-based marketplaces. Specifically, we grouped the  states’ eligibility and enrollment data using the following characteristics:  condition 1 applicants with personal information that did not match SSA’s  records and had SSN-related inconsistencies; condition 2 applicants with  personal information that did not match SSA’s records and did not have  SSN-related inconsistencies; condition 3 applicants whose SSNs and  names or dates of birth matched potentially deceased individuals;  condition 4 applicants whose SSNs matched potentially deceased  individuals but whose names or dates of birth did not; condition 5  applicants who self-attested to being noncitizens or were identified by the  state as having a potential immigration-related inconsistency; and  condition 6 applicants who were identified by the state as being  potentially incarcerated. We randomly selected 51 applicant cases from  these six conditions. Specifically, we selected 9 applicant cases from  conditions 1, 2, 5, and 6, with 3 applicant cases from each selected state.  From condition 3, we selected 8 applicant cases since one state had only  2 applicant cases that met the characteristics of the condition. For  condition 4, we selected 7 applicant cases since one state had only 1  applicant case that met the characteristics of the condition.
After our initial selection of 51 applicant cases, we further refined four of  our conditions and selected 9 additional applicant cases for a total of 60  applicant cases. These refined characteristics were identified during the  course of our analysis and were added to provide additional insight into  the states’ eligibility and verification processes. Specifically, we refined  the following: condition 1 applicants with personal information that did not  match SSA’s records and had an SSN-related inconsistency with an  unresolved status; condition 4 applicants whose SSNs matched  potentially deceased individuals but names or dates of birth did not, and  whose personal information did not match SSA’s records; and condition 5  applicants who were identified by the state as having an unresolved  immigration-related inconsistency. We selected 2 applicant cases from  refined condition 1; 4 applicant cases from refined condition 4; and 3  applicant cases from refined condition 5.
For all 60 of our selected applicant cases, we requested and received  copies of documents and information used by the state to verify eligibility  for the applicants and their associated applications in advance of our site  visits. We then completed on-site reviews of the selected applicant cases’  records as they appeared in the state-based marketplaces’ data systems  and discussed the documents provided. During these reviews, we  identified and discussed any discrepancies between the eligibility and  enrollment data we received, the documents provided by the states, and  the current records in the states’ data systems. Ultimately, we  judgmentally selected 12 of 60 applicant cases to use as in-depth  examples of how states may handle applicant inconsistencies in our  report. For these 12 applicant cases, we selected 4 from each state. Our  applicant case-review results are not projectable to the entire population  of our selected state-based marketplaces, or to other state-based  marketplaces.
To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  selected state-based marketplaces’ data and in federal data files that we  used to perform our work. We also interviewed officials responsible for  their respective databases, and reviewed documentation related to the  databases and literature related to the quality of the data. On the basis of  our own testing and our discussions with agency officials, we concluded  that the data elements used for this report were sufficiently reliable for our  purposes.
We conducted this performance audit from September 2015 to  September 2017 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.

Appendix II: Comments from the Social Security Administration

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, the following staff members  made key contributions to this report: Philip Reiff, Assistant Director;  Tracy Abdo; Mariana Calderón; Colin Fallon; Camille A. Keith; Courtney  Krebs; Maria McMullen; James Murphy; Chris Wickham; and Elizabeth  Wood.

Related GAO Products

Private Health Insurance: In Most States and New Exchanges, Enrollees  Continued to be Concentrated among Few Issuers in 2014. GAO-16-724.  Washington, D.C.: September 16, 2016.
Patient Protection and Affordable Care Act: Results of Undercover  Enrollment Testing for the Federal Marketplace and a Selected State  Marketplace for the 2016 Coverage Year. GAO-16-784. Washington,  D.C.: September 12, 2016.
Patient Protection and Affordable Care Act: Most Enrollees Reported  Satisfaction with Their Health Plans, Although Some Concerns Exist.  GAO-16-761. Washington, D.C.: September 12, 2016.
Patient Protection and Affordable Care Act: Final Results of Undercover  Testing of the Federal Marketplace and Selected State Marketplaces for  Coverage Year 2015. GAO-16-792. Washington, D.C.: September 9,  2016.
Patient Protection and Affordable Care Act: CMS Should Act to  Strengthen Enrollment Controls and Manage Fraud Risk. GAO-16-29.  Washington, D.C.: February 23, 2016.
Patient Protection and Affordable Care Act: Preliminary Results of  Undercover Testing of the Federal Marketplace and Selected State  Marketplaces for Coverage Year 2015. GAO-16-159T. Washington, D.C.:  October 23, 2015.
Patient Protection and Affordable Care Act: IRS Needs to Strengthen  Oversight of Tax Provisions for Individuals. GAO-15-540. Washington,  D.C.: July 29, 2015.
Patient Protection and Affordable Care Act: Observations on 18  Undercover Tests of Enrollment Controls for Health-Care Coverage and  Consumer Subsidies Provided under the Act. GAO-15-702T. Washington,  D.C.: July 16, 2015.
Patient Protection and Affordable Care Act: Status of CMS Efforts to  Establish Federally Facilitated Health Insurance Exchanges.   GAO-13-601. Washington, D.C.: June 19, 2013.
Patient Protection and Affordable Care Act: HHS’s Process for Awarding  and Overseeing Exchange and Rate Review Grants to States.   GAO-13-543. Washington, D.C.: May 31, 2013.
Health Insurance: Seven States’ Actions to Establish Exchanges under  the Patient Protection and Affordable Care Act. GAO-13-486.  Washington, D.C.: April 30, 2013.
Medicaid Expansion: States’ Implementation of the Patient Protection and  Affordable Care Act. GAO-12-821. Washington, D.C.: August 1, 2012.
Patient Protection and Affordable Care Act: Estimates of the Effect on the  Prevalence of Employer-Sponsored Health Coverage. GAO-12-768.  Washington, D.C.: July 13, 2012.

Summary:
Why GAO Did This Study

PPACA offers subsidized health-care coverage for qualifying applicants, and states may elect to operate their own health-care marketplaces to assist consumers in comparing and selecting insurance plans offered by private issuers. In plan year 2015, 14 states, including the District of Columbia, operated their own marketplaces and determined eligibility and enrollment. CMS is responsible for oversight of these marketplaces. GAO was asked to examine PPACA enrollment controls for state-based marketplaces. This report, for plan year 2015, (1) identifies key processes used by selected state-based marketplaces to verify applicants' eligibility for subsidized qualified health plans, and how CMS oversaw such efforts; and (2) assesses the extent to which applicant eligibility and enrollment data from selected states show indications of potentially improper or fraudulent enrollments in subsidized qualified health plans.
GAO selected three state-based marketplaces for review—Idaho, Maryland, and Rhode Island—based on factors such as geographic distribution and enrollment size. GAO reviewed relevant documentation and interviewed CMS and state officials. GAO analyzed the selected state-based marketplaces' eligibility and enrollment data for plan year 2015 and matched these data to external data sources to identify indications of potentially improper or fraudulent enrollments, and reviewed an illustrative selection of applicants' information. The results are not generalizable to other marketplaces. GAO is not making any recommendations.

What GAO Found

For plan year 2015, GAO reviewed three selected state-based marketplaces' key processes to verify applicant eligibility for subsidized coverage and found that they used various data sources. Under the Patient Protection and Affordable Care Act (PPACA), marketplaces are required to verify applicant eligibility using data sources and methods approved by the Department of Health and Human Services (HHS). Applicant information that must be verified or validated to receive subsidized coverage includes Social Security number (SSN), citizenship or lawful presence, and income. To accomplish this verification, the selected state-based marketplaces relied on various federal data sources, including sources accessed via the federal data services hub (data hub). They also used state data sources, some of which may have been more current than the data hub sources. For example, all three selected state-based marketplaces supplemented federal tax income information accessed through the data hub, which can be up to 2 years old, with more-current state wage information to verify income. HHS's Centers for Medicare & Medicaid Services (CMS) oversaw the state-based marketplaces' verification procedures by conducting annual reviews, collecting enrollment metrics, and engaging in regular communication in plan year 2015.
For the three selected states, GAO found few indications of potentially improper or fraudulent enrollments for plan year 2015 in the verification processes reviewed, but did identify data-quality issues, such as data-entry errors or name changes.
About 2,000 of approximately 210,000 applicants (about 1 percent) had SSNs, names, or dates of birth that did not match the Social Security Administration's records. State officials cited inherent challenges with verifying SSN information, such as name changes. GAO also found instances in which SSNs contained likely data-entry errors.
Twenty-one of approximately 210,000 applicants (about 0.01 percent) were reportedly deceased prior to starting coverage. The majority of these applicants died after their application was submitted, but prior to starting coverage.
About 3,000 of approximately 123,000 applicants in two states (about 2 percent) did not resolve immigration-related inconsistencies. Inconsistencies occur when an applicant's information does not match information contained in the data source used to verify the information. The two states had manual inconsistency-resolution processes for plan year 2015 and may not have terminated coverage for these applicants in a timely manner. Officials from both states said they have since implemented or plan to implement changes to automatically close expired inconsistencies and terminate coverage, as appropriate.