MEDICAID PROGRAM 

INTEGRITY 

Expanded Federal Role 

Presents Challenges to and 

Opportunities for Assisting 

States 

Statement of Carolyn L. Yocom 

Director, Health Care 

Testimony 

Before the Subcommittees on Government Organization, 

Efficiency and Financial Management and Health Care, District of 

Columbia, Census and the National Archives, Committee on 

Oversight and Government Reform, House of Representatives 

For Release on Delivery 

Expected at 10:00 a.m. EST 

Wednesday, December 7, 2011 

GAO-12-288T 

United States Government Accountability Office

GAO 
 United States Government Accountability Office 

Highlights of GAO-12-288T, a testimony before the 

Subcommittees on Government Organization, 

Efficiency and Financial Management and Health 

Care, District of Columbia, Census and the National 

Archives, Committee on Oversight and Government 

Reform, House of Representatives

December 7, 2011 

MEDICAID PROGRAM INTEGRITY 

Expanded Federal Role Presents Challenges to and 

Opportunities for Assisting States 

Why GAO Prepared This 

Testimony 

The Centers for Medicare & Medicaid 

Services (CMS), the federal agency 

that oversees Medicaid, estimated that 

improper payments in the federal-state 

Medicaid program were $21.9 billion in 

fiscal year 2011. The Deficit Reduction 

Act of 2005 established the Medicaid 

Integrity Program and gave CMS an 

expanded role in assisting and 

improving the effectiveness of state 

activities to ensure proper payments. 

Making effective use of this expanded 

role, however, requires that federal 

resources are targeted appropriately 

and do not duplicate state activities. 

GAO was asked to testify on Medicaid 

program integrity. GAO’s statement 

focuses on how CMS’s expanded role 

in ensuring Medicaid program integrity 

(1) poses a challenge because of 

overlapping state and federal activities 

regarding provider audits and 

(2) presents opportunities through 

oversight to enhance state program 

integrity efforts. 

To do this work, GAO reviewed CMS 

reports and documents on Medicaid 

program integrity as well as its own 

and others’ reports on this topic. In 

particular, GAO reviewed CMS reports 

that documented the results of its state 

oversight and monitoring activities. 

GAO also interviewed CMS officials in 

the agency’s Medicaid Integrity Group 

(MIG), which was established to 

implement the Medicaid Integrity 

Program. This work was conducted in 

November and December 2011. GAO 

discussed the facts in this statement 

with CMS officials. 

What GAO Found 

The key challenge faced by the Medicaid Integrity Group (MIG) is the need to 

avoid duplication of federal and state program integrity efforts, particularly in the 

area of auditing provider claims. In 2011, the MIG reported that it was 

redesigning its national provider audit program. Previously, its audit contractors 

were using incomplete claims data to identify overpayments. According to MIG 

data, overpayments identified by its audit contractors since fiscal year 2009 were 

not commensurate with its contractors’ costs. The MIG’s redesign will result in 

greater coordination with states on a variety of factors, including the data to be 

used. It remains to be seen, however, whether these changes will result in an 

increase in identified overpayments. The table below highlights the MIG’s core 

oversight activities, which were implemented from fiscal years 2007 through 

2009. 

MIG’s Core Oversight Activities and Fiscal Year Implemented 

MIG activities Description 

Comprehensive 

program integrity 

reviews 

(fiscal year 2007) 

Every 3 years, the MIG conducts a comprehensive management review of 

each state’s Medicaid program integrity procedures and processes. 

Through the reviews, CMS assesses the effectiveness of the state’s 

program integrity efforts and determines whether the state’s policies and 

procedures comply with federal regulations. 

Technical assistance 

(fiscal year 2007) 

In fiscal year 2009, the MIG responded to 504 requests for technical 

assistance from 49 states, providers, advocates and others. Common 

topics included policy/regulatory requirements on disclosures, law 

enforcement activities, and fraud detection tools. 

Medicaid Integrity 

Institute 

(fiscal year 2007) 

The institute is the first national Medicaid integrity training program. CMS 

executed an interagency agreement with the Department of Justice to 

house the institute at the Department’s National Advocacy Center, located 

at the University of South Carolina. The institute offers substantive 

training, technical assistance, and support to states in a structured 

learning environment. 

National Provider Audit 

Program 

(fiscal year 2009) 

Separate contractors (1) analyze claims data to identify aberrant claims, 

and potential billing vulnerabilities; and (2) conduct post-payment audits 

based on data analysis leads in order to identify overpayments to Medicaid 

providers. 

State program integrity 

assessments 

(fiscal year 2009) 

These annual assessments represent the first national baseline collection 

of data on state Medicaid integrity activities for the purposes of program 

evaluation and technical assistance support. The data provided by states 

are used to populate a one-page profile covering topics such as program 

integrity staffing and expenditures, audits, fraud referrals, and recoveries. 

Education contractors 

(fiscal year 2009) 

The education contractors develop materials in order to educate and train 

providers on payment integrity and quality of care issues. 

Source: CMS. 

The MIG’s core oversight activities present an opportunity to enhance state 

efforts through the provision of technical assistance and the identification of 

training opportunities. The MIG’s assessment of state program integrity efforts 

during triennial onsite reviews and annual assessments will need to address data 

inconsistencies identified during these two activities. Improved consistency will 

help ensure that the MIG is appropriately targeting its resources. The Medicaid 

Integrity Institute appears to address a state training need and create networking 

opportunities for program integrity staff. View GAO-12-288T. For more information, 

contact Carolyn L. Yocom at (202) 512-7114 

or yocomc@gao.gov. 
 

Page 1 GAO-12-288T 

Chairmen Platts, Gowdy, and Members of the Subcommittees: 

I am pleased to be here today to discuss Medicaid program integrity, that 

is, preventing improper payments that result from fraud, waste, and 

abuse.1

 Until the Deficit Reduction Act of 2005 (DRA) expanded the role 

of the Centers for Medicare & Medicaid Services (CMS), the federal 

agency that oversees Medicaid, Medicaid program integrity had been 

primarily a state responsibility.2

 CMS’s expanded role presents an 

opportunity to assist and improve the effectiveness of state activities, but 

also requires that federal resources are targeted appropriately and do not 

duplicate state activities. 

Medicaid is jointly funded by federal and state governments. It is one of 

the largest social programs in the federal budget—covering about 

67 million people in fiscal year 2010—and one of the largest components 

of state budgets. In fiscal year 2010, Medicaid expenditures totaled about 

$401 billion, with a federal share of $270 billion and a state share of 

$132 billion. As a result of flexibility in the program’s design, Medicaid 

consists of 56 distinct state-based programs.3

 The challenges inherent in 

overseeing a program of Medicaid’s size and diversity make the program 

vulnerable to improper payments, which may be the result of fraud, 

waste, and abuse.4

 Because of the program’s risk of improper payments 

as well as insufficient federal and state oversight, we added Medicaid to 

 

1

Medicaid is the federal-state program that covers acute health care, long-term care, and 

other services for certain categories of low-income individuals. 

2

See Pub. L. No. 109-171, § 6034, 120 Stat. 3, 74-78 (2006). 

3

The federal government matches states’ expenditures for most Medicaid services using a 

statutory formula based on each state’s per capita income. The 56 Medicaid programs 

include one for each of the 50 states, the District of Columbia, Puerto Rico, Samoa, 

Guam, the Commonwealth of the Northern Mariana Islands, and the United States Virgin 

Islands. 

4

Fraud involves an intentional act or representation to deceive with the knowledge that the 

action or representation could result in gain. Waste results from clerical errors or the 

provision of medically unnecessary services. Abuse typically involves actions that are 

inconsistent with acceptable business and medical practices that result in unnecessary 

program costs. See, e.g., 42 C.F.R. § 455.2 (2010). 
 

Page 2 GAO-12-288T 

our list of high-risk programs in January 2003.5 CMS estimated that 

Medicaid improper payments were $21.9 billion for fiscal year 2011.6

States are the first line of defense against Medicaid improper payments. 

Specifically, they must comply with federal requirements to ensure the 

qualifications of the providers who bill the program, detect improper 

payments, recover overpayments, and refer suspected cases of fraud and 

abuse to law enforcement authorities. At the federal level, CMS, an 

agency within the Department of Health and Human Services (HHS), is 

responsible for supporting and overseeing state Medicaid program 

integrity activities. 

In 2005, we testified that CMS needed to increase its commitment—both 

the alignment of resources and strategic planning—to helping states fight 

Medicaid fraud, waste and abuse.7

 Subsequently, the DRA established 

the Medicaid Integrity Program and included other provisions designed to 

increase CMS’s support for state activities to address Medicaid fraud, 

waste, and abuse. The DRA provided appropriations to implement the 

Medicaid Integrity Program, and the Patient Protection and Affordable 

Care Act (PPACA) enacted in March 2010 gave CMS and states 

additional provider and program integrity oversight tools.8

You asked GAO to testify today on Medicaid program integrity. My 

remarks focus on how CMS’s expanded role in ensuring Medicaid 

program integrity (1) poses a challenge because of overlapping state and 

federal activities, particularly in the area of auditing provider claims; and 

(2) presents opportunities through oversight to enhance state program 

 

5

See GAO, Major Management Challenges and Program Risks: Department of Health and 

Human Services, GAO-03-101 (Washington, D.C.: January 2003). 

6

In its Fiscal Year 2011 Agency Financial Report, HHS calculated and reported the 3-year 

(2009, 2010, and 2011) weighted average national payment error rate for Medicaid of 

8.1 percent. See Department of Health and Human Services FY 2011 Agency Financial 

Report (Washington, D.C.: Nov. 15, 2011). 

7

See GAO, Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard 

Program Dollars Is Limited, GAO-05-855T (Washington, D.C.: June 28, 2005). 

8

Pub. L. No. 111-148, 124 Stat. 119, as amended by the Health Care Education 

Reconciliation Act of 2010 (HCERA), Pub. L. No. 111-152, 124 Stat. 1029. For example, 

PPACA required states to have Medicaid Recovery Audit Contractors, increased provider 

ownership reporting requirements, and allowed CMS to suspend payments to providers on 

the basis of a credible allegation of fraud. 
 

Page 3 GAO-12-288T 

integrity efforts. To do this work, we reviewed CMS reports and 

documents on Medicaid program integrity as well as our own and others’ 

reports on this topic. In particular, we reviewed CMS reports that 

documented the results of its state oversight and monitoring activities. We 

also interviewed CMS officials in the agency’s Medicaid Integrity Group, 

which was established to implement the Medicaid Integrity Program. We 

conducted our work in November and December 2011 in accordance with 

generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. The data presented in this statement were 

obtained from CMS and we did not independently verify their reliability. 

We believe that the evidence obtained provides a reasonable basis or our 

findings and conclusions based on our audit objectives. 

CMS is responsible for overseeing Medicaid and state Medicaid agencies 

are responsible for administering the program. Although each state is 

subject to federal requirements, it develops its own Medicaid 

administrative structure for carrying out the program including its 

approach to program integrity. Within broad federal guidelines, each state 

establishes eligibility standards and enrolls eligible individuals; 

determines the type, amount, duration, and scope of covered services; 

sets payment rates for covered services; establishes standards for 

providers and managed care plans; and ensures that state and federal 

funds are not spent improperly or diverted by fraudulent providers. 

However, state Medicaid programs do not work in isolation on program 

integrity; instead, there are a large number of federal agencies, other 

state entities, and contractors with which states must coordinate. 

Generally, each state’s Medicaid program integrity unit uses its own data 

models, data warehouses, and approach to analysis. States often 

augment their in-house capabilities by contracting with companies that 

specialize in Medicaid claims and utilization reviews. However, as 

program administrators, states have primary responsibility for conducting 

program integrity activities that address provider enrollment, claims 

review, and case referrals. Specifically, CMS expects states to 

 collect and verify basic information on providers, including whether the 

providers meet state licensure requirements and are not prohibited 

from participating in federal health care programs 

Background 

State Medicaid Program 

Integrity Activities 
 

Page 4 GAO-12-288T 

 maintain a mechanized claims processing and information system 

known as the Medicaid Management Information System (MMIS). 

MMIS can be used to make payments and to verify the accuracy of 

claims, the correct use of payment codes, and a beneficiary’s 

Medicaid eligibility.9

 operate a Surveillance and Utilization Review Subsystem (SURS) in 

conjunction with the MMIS that is intended to develop statistical 

profiles on services, providers, and beneficiaries in order to identify 

potential improper payments. For example, SURS may apply 

automatic post-payment screens to Medicaid claims in order to 

identify aberrant billing patterns. 

 submit all processed Medicaid claims electronically to CMS’s Medical 

Statistical Information System (MSIS). MSIS does not contain billing 

information, such as the referring provider’s identification number or 

beneficiary’s name, because it is a subset of the claims data 

submitted by states. States provide data on a quarterly basis and 

CMS uses the data to (1) analyze Medicaid program characteristics 

and utilization for services covered by state Medicaid programs, and 

(2) generate various public use reports on national Medicaid 

populations and expenditures. 

 refer suspected overpayments or overutilization cases to other units in 

the Medicaid agency for corrective action and refer potential fraud 

cases to other appropriate entities for investigation and prosecution. 

Our reports and testimonies from 2001 through 2006 identified gaps in 

state program integrity activities and noted that the support provided by 

CMS to states was hampered by resource constraints.10 For example, in 

2004, we reported that 15 of 47 states responding to our questionnaire 

 

9

States provide CMS with claims data for use in estimating a Medicaid payment error rate. 

CMS developed the Payment Error Rate Measurement program to comply with the 

Improper Payments Information Act of 2002. The error rate is not a “fraud rate” but simply 

a measurement of payments made that did not meet statutory, regulatory, or 

administrative requirements. 

10See GAO, Medicaid: State Efforts to Control Improper Payments Vary, GAO-01-662

(Washington, D.C.: June 7, 2001); Medicaid Program Integrity: State and Federal Efforts 

to Prevent and Detect Improper Payments, GAO-04-707 (Washington, D.C.: July 16, 

2004); GAO-05-855T; Medicaid Integrity: Implementation of New Program Provides 

Opportunities For Federal Leadership to Combat Fraud, Waste, and Abuse, GAO-06-578T

(Washington, D.C.: March 28, 2006). 
 

Page 5 GAO-12-288T 

did not affirm that they conducted data mining, defined as analysis of 

large data sets to identify unusual utilization patterns, which might 

indicate provider abuse. 

The DRA established the Medicaid Integrity Program to provide effective 

federal support and assistance to states to combat fraud, waste, and 

abuse. To implement the Medicaid Integrity Program, CMS created the 

Medicaid Integrity Group (MIG), which is now located within the agency’s 

Center for Program Integrity. The DRA also required CMS to hire 

contractors to review and audit provider claims and to educate providers 

on issues such as appropriate billing practices. 

The Medicaid Recovery Audit Contractor (RAC) program was established 

by PPACA.11 Each state must contract with a RAC, which is tasked with 

identifying and recovering Medicaid overpayments and identifying 

underpayments. Each state’s RAC is required to be operational by 

January 1, 2012. Medicaid RACs will be paid on a contingency fee 

basis—up to 12.5 percent—of any recovered overpayments and states 

are required to establish incentive payments for the detection of 

underpayments.12 Figure 1 identifies the key federal and state entities 

responsible for Medicaid program integrity. 

 

11Pub. L. No. 111-148, §6411, 124 Stat. 119,773. 

12CMS will not provide federal financial participation for administrative expenditure claims 

if a state establishes a RAC contingency fee that is in excess of the highest Medicare 

RAC contingency fee rate, unless a state requests an exception from CMS and provides 

an acceptable justification. Any additional fees must be paid out of state-only funds. 

Recent Legislation Has 

Conferred New 

Responsibilities on CMS 

and States 
 

Page 6 GAO-12-288T 

Figure 1: Key Federal and State Entities Responsible for Medicaid Program Integrity before and after the Deficit Reduction 

Act of 2005 

Notes: Other federal entities involved in Medicaid program integrity not included in this figure include: 

CMS’s Office of Financial Management and its Center for Medicaid, CHIP, Survey and Certification; 

the Department of Health and Human Services’ Office of Inspector General; the Federal Bureau of 

Investigation; and the Department of Justice. 

a

States are required to contract with at least one RAC, which must be operational beginning January 

2012. 

b

SURS may be performed by an outside contractor (as depicted here) or state program integrity staff 

may carry out the SURS function, in which case it would be integral to the State Program Integrity 

Unit. 
 

Page 7 GAO-12-288T 

Fraud detection and investigations often require more specialized skills 

than are required for the identification of improper payments because 

investigators must establish that an individual or entity intended to falsify 

a claim to achieve some gain. As a result, fraud is more difficult to prove 

than improper payments and requires the involvement of entities that can 

investigate and prosecute fraud cases. In 1977, Congress authorized 

federal matching funds for the establishment of independent state 

Medicaid Fraud Control Units (MFCU).13 MFCUs are responsible for 

investigating and prosecuting Medicaid fraud. In general, they are located 

in State Attorneys Generals’ offices. MFCUs can, in turn, refer some 

cases to federal agencies that have longstanding responsibility for 

combating fraud, waste, and abuse in Medicare and Medicaid—the 

HHS’s Office of Inspector General (HHS-OIG), the Federal Bureau of 

Investigation (FBI), and the Department of Justice. 

A key challenge CMS faces in implementing the statutorily required 

federal Medicaid Integrity Program is ensuring effective coordination to 

avoid duplicating state program integrity efforts. CMS established the MIG 

in 2006 and it gradually hired staff and contractors to implement a set of 

core activities, including the (1) review and audit of Medicaid provider 

claims; (2) education of state program integrity officials and Medicaid 

providers; and (3) oversight of state program integrity activities and 

provision of assistance. Because states also routinely review and audit 

provider claims, the MIG recognized that coordination was key to avoiding 

duplication of effort. In 2011, the MIG reported that it was redesigning its 

national provider audit program to allow for greater coordination with 

states on data, policies, and audit measures. According to MIG data, 

overpayments identified by its review and audit contractors over the first 

3 years of the national audit program were not commensurate with the 

contractors’ costs. 

The DRA provided CMS with the resources to hire staff whose sole duties 

are to assist states in protecting the integrity of the Medicaid program. 

The MIG’s core activities were implemented gradually from fiscal year 

2006 to 2009. The DRA provided start up funding of $5 million for fiscal 

 

13Medicare-Medicaid Anti-Fraud and Abuse Amendments, Pub. L. No. 95-142, §91 

Stat. 1175, 1201. 

Fraud Investigation and 

Prosecution 

CMS’s MIG 

Implemented Core 

Activities from 2006 

through 2009 but 

Effective 

Coordination Is 

Needed Because of 

Overlap with Ongoing 

State Efforts 

Core MIG Activities Were 

Implemented Gradually 

from 2006 to 2009 
 

Page 8 GAO-12-288T 

year 2006, increasing to $50 million for each of the subsequent 2 fiscal 

years, and $75 million per year for fiscal year 2009 and beyond.14 One of 

the first activities initiated by the MIG in fiscal year 2007 was 

comprehensive program integrity reviews to assess the effectiveness of 

states’ activities, which involved eight, week-long onsite visits that year.15

One of the last activities to be implemented was the statutorily required 

National Provider Audit Program where MIG contractors review and audit 

Medicaid provider claims. In fiscal year 2005, we reported that CMS 

devoted 8.1 full time equivalent staff years to support and oversee states’ 

anti-fraud-and-abuse operations, which, in 2010, had grown to 83 out of 

the 100 DRA authorized full time equivalent staff years.16 Table 1 

describes six core MIG activities and the fiscal year in which those 

activities began. 

 

14HCERA provided that for each fiscal year after 2010 the amount appropriated would be 

adjusted to take into account inflation. §1303(b)(3), 124 Stat. at 1058. 

15The states the MIG visited included Arkansas, Connecticut, Delaware, Michigan, 

Missouri, Nevada, Oregon, and Virginia. 

16See GAO-05-855T. 
 

Page 9 GAO-12-288T 

Table 1: Medicaid Integrity Group’s Core Oversight Activities, by Fiscal Year Implemented 

MIG activities Description 

Fiscal year 2007 

Comprehensive program integrity reviews Every 3 years, the MIG conducts a comprehensive management review of each state’s 

Medicaid program integrity procedures and processes. Through the reviews, the MIG 

assesses the effectiveness of the state’s program integrity efforts and determines whether 

the state’s policies and procedures comply with federal statutes and regulations. The 

review areas include provider enrollment, provider disclosures, program integrity, 

managed care operations, and the interaction between the state’s Medicaid agency and 

its Medicaid Fraud Control Unit (MFCU). Each review results in a report which is posted 

on CMS’s Web site that summarizes best practices, compliance issues, and 

vulnerabilities. The MIG also conducts follow-up reviews to evaluate state’s corrective 

action plans addressing any identified vulnerabilities. 

Technical assistance In fiscal year 2009, the MIG responded to 504 requests for technical assistance from 49 

states, providers, advocates and others. Common topics included the National Provider 

Audit Program, policy/regulatory requirements on disclosures, law-enforcement activities, 

and fraud detection tools. Examples of other assistance provided to the states included 

(1) hosting regional State Program Integrity Director conference calls to discuss emerging 

issues and best practices, and (2) issuing a State Medicaid Director letter in January 2009 

which provided guidance to Medicaid providers on screening their employees and 

contractors for individuals excluded from participation in the program. 

Medicaid integrity institute The institute is the first national Medicaid integrity training program. CMS executed an 

interagency agreement with the Department of Justice to house the institute at the 

National Advocacy Center, located at the University of South Carolina. The institute offers 

substantive training, technical assistance, and support to states in a structured learning 

environment. In time, the institute intends to create a credentialing process to elevate the 

professional qualifications of state Medicaid program integrity staff. 

Fiscal year 2009 

National Provider Audit Programa Separate contractors (1) analyze claims data to identify aberrant claims and potential 

billing vulnerabilities, and (2) conduct post-payment audits based on data analysis leads 

in order to identify overpayments to Medicaid providers. 

State program integrity assessments These annual assessments represent the first national baseline collection of data on state 

Medicaid integrity activities for the purposes of program evaluation and technical 

assistance support. The data provided by states are used to populate a one page profile 

covering topics such as program integrity staffing and expenditures, audits, fraud referrals 

to the state’s MFCU, and recoveries. 

Education contractors The education contractors develop materials in order to educate and train providers on 

payment integrity and quality of care issues. 

Source: CMS. 

a

To gain a better understanding of audit processes and procedures as well as variation across the 

states, the MIG initiated test audits in fiscal year 2007, prior to the implementation of the National 

Provider Audit Program. 
 

Page 10 GAO-12-288T 

Figure 2 shows MIG expenditures by program category for fiscal year 

2010. The Medicaid Integrity Institute accounted for about 2 percent of 

the MIG’s fiscal year 2010 expenditures, while the National Provider Audit 

Program accounted for about half of expenditures. 

Figure 2: MIG Expenditures by Program Category, Fiscal Year 2010, in Millions 

a

These activities include courses as well as technical assistance and outreach to states specific to the 

implementation of PPACA. 

b

These activities include the comprehensive program integrity reviews, state program integrity 

assessments, and technical assistance. 

At the outset, the MIG recognized that effective coordination with internal 

and external stakeholders was essential to the success of the Medicaid 

Integrity Program. In a report issued prior to establishment of the 

program, we found that CMS had a disjointed organizational structure and 

lacked the strategic planning necessary to face the risks involved with the 

Medicaid program.17 We identified the need for CMS to develop a 

strategic plan in order to provide direction to the agency, its contractors, 

states, and its law enforcement partners. In designing and implementing 

the program, the MIG convened an advisory committee consisting of 

 

17See GAO-05-855T. 

The MIG Recognized the 

Need for Effective 

Coordination 
 

Page 11 GAO-12-288T 

(1) state program integrity, Medicaid, and MFCU directors from 16 states; 

and (2) representatives of the FBI, HHS-OIG, and CMS regional offices. 

This committee provided planning input and strategic advice and 

identified key issues that the MIG needed to address, including 

 The MIG’s efforts should support and complement states’ Medicaid 

integrity efforts, not be redundant of existing auditing efforts. 

 Program integrity activities of the MIG and other federal entities 

require coordination with states regarding auditing and data requests. 

 The focus of state activities should be shifted from postpayment 

audits to prepayment prevention activities. 

The advisory committee also highlighted the lack of state resources for 

staffing, technology, and training. CMS’s July 2009 Comprehensive 

Medicaid Integrity Plan, the fourth such plan since 2006, stated that 

fostering collaboration with internal and external stakeholders of the 

Medicaid Integrity Program was a primary goal of the MIG. 

In implementing more recent statutory requirements, CMS again stressed 

the need for effective coordination and collaboration. CMS’s commentary 

accompanying the final rule on the implementation of Medicaid RACs 

acknowledged the potential for duplication with states’ ongoing efforts to 

identify Medicaid overpayments. States have been responsible for the 

recovery of all identified overpayments, including those identified since 

fiscal year 2009 by the MIG’s audit contractors. The new requirement for 

states to contract with an independent Medicaid RAC introduces another 

auditor to identify and collect Medicaid overpayments. The Medicaid RAC 

program was modeled after a similar Medicare program, which was 

implemented in March 2009 after a 3-year demonstration.18 Because 

Medicare RACs are paid a fixed percentage of the dollar value of any 

improper payments identified, they generally focused on costly services 

such as inpatient hospital stays. Our prior work on Medicare RACs noted 

 

18The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 directed 

CMS to conduct a project to demonstrate how effective the use of RACs would be in 

identifying underpayments and overpayments, and in recouping overpayments in 

Medicare. Pub. L. No. 108-173, § 306, 117 Stat. 2066, 2256. Subsequently, in December 

2006 the Tax Relief and Health Care Act of 2006 required CMS to implement a national 

Medicare RAC program by January 1, 2010. Pub. L. No. 109-342, div. B, title III, § 302, 

120 Stat. 2924, 2991 (codified at 42 U.S.C. § 1395ddd(h)). 
 

Page 12 GAO-12-288T 

that the postpayment review activities of CMS’s other contractors would 

overlap less with the RACs’ audits if those activities focused on different 

Medicare services where improper payments were known to be high, 

such as home health.19 Because Medicaid RACs are not required to be 

operational until January 1, 2012, the extent to which states will structure 

their RAC programs to avoid duplication and complement their own 

provider review and audit activities remains to be seen. 

In its most recent annual report to the Congress, the MIG indicated that it 

was redesigning the National Provider Audit Program. According to the 

MIG, the National Provider Audit Program has not identified 

overpayments in the Medicaid program commensurate with the related 

contractor costs. About 50 percent of the MIG’s $75 million annual budget 

supports the activities of its review and audit contractors. From fiscal 

years 2009 through 2011, the MIG authorized 1,663 provider audits in 44 

states. However, the MIG’s reported return on investment from these 

audits was negative. While its contractors identified $15.2 million in 

overpayments, the combined cost of the National Provider Audit Program 

was about $36 million in fiscal year 2010. The actual amount of 

overpayments recovered is not known because states are responsible for 

recovering overpayments and the MIG is not the CMS entity that tracks 

recoveries. Actual recoveries may be less than the identified 

overpayments. 

The National Provider Audit Program has generally relied on MSIS, which 

is summary data submitted by states on a quarterly basis that may not 

reflect voided or adjusted claims payments. As a result, the MIG’s audit 

contractors may identify two MSIS claims as duplicates when the state 

has already voided or denied payment on one of these claims. For their 

program integrity efforts, states use their own MMIS data systems, which 

generally reflect real-time payments and adjustments of detailed claims 

for each health care service. States are required to have a SURS 

component that performs data mining as a part of their program integrity 

efforts. The MIG’s review contractors use data mining techniques that 

may be similar to those employed by states, and they may not identify 

any additional improper claims. 

 

19See GAO, Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation 

of Recent Laws and Agency Actions Could Help Reduce Improper Payments, 

GAO-11-409T (Washington, D.C.: Mar. 9, 2011).

The MIG Is Redesigning 

the National Provider 

Audit Program, Whose 

Returns Were Not 

Commensurate with 

Contractors’ Costs 
 

Page 13 GAO-12-288T 

Moreover, MIG officials told us that the National Provider Audit Program 

did not prioritize the activities according to the dollar amount of the claim, 

that is, it did not concentrate its efforts on audits with the greatest 

potential for significant recoveries. Although the amount of overpayment 

identified from any given audit can vary by thousands or millions of 

dollars, the MIG’s comprehensive reviews of several states’ Medicaid 

integrity programs show that these states identified significantly higher 

levels of overpayments in 1 year than the National Provider Audit 

Program identified over 3 years. For example, the number of national 

provider audits (1,663) over three fiscal years was similar to the number 

that New York conducted in fiscal year 2008 (1,352), yet CMS reported 

that New York had identified more than $372 million in overpayments—

considerably more than the $15.2 million identified through national 

provider audits.20

The MIG’s proposed redesign of the National Provider Audit Program 

appears to allow for greater coordination between its contractors and 

states on a variety of factors, including the data to be used.21 In fiscal 

year 2010, the MIG launched collaborative audits in 13 states. For these 

audits, the states and the MIG agreed on the audit issues to review and, 

in some cases, states provided the MIG’s audit contractors with more 

timely and complete claims data. These collaborative projects (1) allowed 

states to augment their own audit resources, (2) addressed audit targets 

that states may not have been able to initiate because of a lack of staff, 

and (3) provided data analytic support for states that lacked that 

capability. Although these activities are ongoing and the results have not 

yet been finalized, such collaborative projects appear to be a promising 

approach to audits that avoids a duplication of federal and state efforts. It 

remains to be seen, however, whether these changes will result in an 

increase in identified overpayments. 

 

20Department of Health and Human Services, Centers for Medicare & Medicaid Services, 

New York Comprehensive Program Integrity Review: Final Report (Washington, D.C.: 

2010). 

21Kathleen Sebelius, Secretary of Health and Human Services, Annual Report to 

Congress on the Medicaid Integrity Program for Fiscal Year 2010 (Washington, D.C.: 

2011). 
 

Page 14 GAO-12-288T 

While the MIG’s audit program is challenged to avoid duplicating states’ 

own audit activities, its other core functions present an opportunity to 

enhance states’ efforts. The MIG’s state oversight activities are extensive 

and labor intensive. Although the data collected during reviews and 

assessments are not always consistent with each other, these oversight 

activities have a strong potential to inform the MIG’s technical assistance 

and help identify training opportunities. The Medicaid Integrity Institute 

appears to address an important state training need. 

The MIG’s core oversight activities—triennial comprehensive state 

program integrity reviews and annual assessments—are broad in scope 

and provide a basis for the development of appropriate technical 

assistance. However, we found that the information collected during 

reviews and the information collected from assessments was sometimes 

inconsistent with each other. 

As of November 2011, the MIG had completed the first round of reviews 

for 50 states and had initiated a second round of reviews in 10 states. 

The reviews cover the entirety of a state’s program integrity activities and 

assess compliance with federal regulations. In advance of the MIG’s 

week-long onsite visit, state program integrity officials are asked to 

respond to a 71-page protocol containing 195 questions and to provide 

considerable documentation.22 Table 2 summarizes the topics covered in 

the protocol. Typical compliance issues and vulnerabilities identified 

during the reviews include provider enrollment weaknesses, inadequate 

oversight of providers in Medicaid managed care, and ineffective fraud 

referrals to state MFCUs. 

 

22The MFCU and managed care entities receive separate protocols and requests for 

documentation. 

Expanded Role Offers 

Opportunity to 

Enhance State 

Efforts, but More 

Consistent Data Are 

Needed 

MIG’s Core Oversight 

Activities Are Broad, but 

the Data Collected During 

Reviews and Assessments 

Were Not Always 

Consistent with Each 

Other 
 

Page 15 GAO-12-288T 

Table 2: Topics Covered in MIG’s Comprehensive State Program Integrity Review 

Protocol 

Modules Number of questions

Program integrity organization and staffing 29

Claims payment review 10

Prepayment review 37

Post-payment review 13

Recovery audit contractors 6

Payment error rate measurement 6

Sampling and extrapolation 14

Fraud identification, investigation, and referral 

Methods 10

Preliminary investigation 4

Full investigation 8

Resolution of full investigation 7

Reporting requirements 3

Provider statements 7

Recipient verification 9

Cooperation with MFCUs 16

Witholding payments 4

Federal reimbursement for operation of data systems 3

False Claims Act requirements 4

Technical assistance 5 

Source: CMS’s fiscal year 2011 comprehensive state program integrity review protocol. 

Much of the information collected during the assessments—Medicaid 

program integrity characteristics, program integrity planning, prevention, 

detection, investigation and recoveries—is also collected during the 

triennial comprehensive reviews.23 In addition, we found inconsistencies 

between the information reported in the comprehensive reviews and in 

the assessments for several states that were conducted at about the 

same time. For example, there was a significant discrepancy for one state 

in the number of staff it reported as being dedicated to program integrity 

activities. According to the MIG, knowing the size of state program 

 

23The MIG collects the data for the assessments through an online questionnaire that has 

56 questions. The responses are used to develop a one-page profile on state activities. 
 

Page 16 GAO-12-288T 

integrity staff helps it to more appropriately tailor content during training 

events. Improved consistency will help the MIG ensure that it is targeting 

its training and technical assistance resources appropriately. Despite the 

frequency of the annual assessments, the most current data cover fiscal 

year 2008, which the MIG began collecting in fiscal year 2010. 

Although the MIG provides states with a glossary explaining each of the 

requested data elements, it is not clear that the information submitted is 

reliable or comparable across states. Our review of a sample of 

assessments revealed missing data and a few implausible measures, 

such as one state reporting over 38 million managed care enrollees. In 

other states, there were dramatic changes in the data reported from 2007 

to 2008, which either raises a question about the reliability of the data or 

suggests that states be allowed to explain significant changes from year 

to year. For example, the number of audits in one state declined from 203 

to 35. 

According to MIG officials, the comprehensive reviews and the 

assessments inform the MIG’s technical assistance activities with the 

states. For example, we found that the MIG published best practices 

guidance in 2008 after finding weaknesses in coordination between state 

program integrity officials and their respective MFCU’s in a number of 

states. In its report to Congress on fiscal year 2010 activities, the MIG 

indicated it completed 420 requests for technical assistance from 43 

states, providers, and others. The most common topics included the 

National Provider Audit Program, policy and regulatory requirements on 

disclosures, provider exclusions and enrollment, and requests for 

statistical assistance related to criminal and civil court actions. Examples 

of assistance provided to the states by the MIG included (1) hosting 

regional state program integrity director conference calls to discuss 

program integrity issues and best practices; and (2) helping develop a 

State Medicaid Director Letter (issued in July 2010) on the return of 

federal share of overpayments under PPACA. 

The federally sponsored Medicaid Integrity Institute not only offers state 

officials free training but also provides opportunities to develop 

relationships with program integrity staff from other states. The institute 

addresses our prior finding that CMS did not sponsor any fraud and 

abuse workshops or training from 2000 through 2005.24 From fiscal years 

 

24See GAO-05-855T. 

Medicaid Integrity Institute 

Trains State Staff and 

Facilitates Networking 
 

Page 17 GAO-12-288T 

2008 through 2012, the institute will have trained over 2,265 state 

employees at no cost to states. Given the financial challenges states 

currently face, it is likely that expenditures for training and travel are 

limited. Expenditures on the institute accounted for about $1.3 million of 

the MIG’s $75 million annual budget. MIG officials told us that states 

uniformly praised the opportunity to network and learn about best 

practices from other states. A special June 2011 session at the institute 

brought together Medicaid program integrity officials and representatives 

of MFCUs from 39 states in an effort to improve the working relations 

between these important program integrity partners. 

In addition to the institute, the MIG has a contractor that provides 

(1) education to broad groups of providers and beneficiaries, and 

(2) targeted education to specific providers on certain topics.25 For 

example, the education contractor has provided outreach through its 

attendance at 17 conferences with about 36,000 attendees. These 

conferences were sponsored by organizations devoted to combating 

health care fraud such as the National Association of Medicaid Program 

Integrity and National Health Care Anti-Fraud Association, as well as 

meetings of national and regional provider organizations (hospital, home 

care and hospice and pharmacy). An example of a more targeted activity 

is one focused on pharmacy providers. The MIG’s education contractor is 

tasked with developing provider education materials to promote best 

prescribing practices for certain therapeutic drug classes and remind 

providers of the appropriate prescribing guidelines based on FDA 

approved labeling. The education program includes some face-to-face 

conversations, mailings to providers, and distribution of materials on a 

website and at conferences and meetings. These activities are 

collaborative efforts with the states so that states are: aware of the 

aberrant providers, participate in the education program, and can 

implement policy changes to address these issues, as appropriate. 

We discussed the facts in this statement with CMS officials. 

 

25The MIG has two education contractors, however, it has only issued task orders to one 

of the contractors. 
 

Page 18 GAO-12-288T 

Chairmen Pratts and Gowdy, this concludes my prepared remarks. I 

would be happy to answer any questions that you or other Members may 

have. 

For further information about this statement, please contact Carolyn L. 

Yocom at (202) 512-7114 or yocomc@gao.gov. Contact points for our 

Offices of Congressional Relation and Public Affairs may be found on the 

last page of this statement. Walter Ochinko, Assistant Director; Sean 

DeBlieck; Iola D’Souza; Leslie V. Gordon; Drew Long; Jessica Smith; and 

Jennifer Whitworth were key contributors to this statement. 

GAO Contact 

and Staff 

Acknowledgments 
Appendix I: Abbreviations 

Page 19 GAO-12-288T 

CMS Centers for Medicare & Medicaid Services 

DRA Deficit Reduction Act of 2005 

FBI Federal Bureau of Investigation 

FDA Food and Drug Administration 

HCERA Health Care Education and Reconciliation Act of 2010 

HHS Department of Health and Human Services 

MFCU Medicaid Fraud Control Unit 

MIG Medicaid Integrity Group 

MIP Medicaid Integrity Program 

MMIS Medicaid Management Information System 

MSIS Medicaid Statistical Information System 

OIG Office of Inspector General 

PERM Payment Error Rate Measurement 

PPACA Patient Protection and Affordable Care Act 

RAC Recovery Audit Contractor 

SURS Surveillance and Utilization Review Subsystem 

Appendix I: Abbreviations 
Related GAO Products 

Page 20 GAO-12-288T 

Fraud Detection Systems: Additional Actions Needed to Support Program 

Integrity Efforts at Centers for Medicare and Medicaid Services. 

GAO-11-822T. Washington, D.C.: July 12, 2011. 

Fraud Detection Systems: Centers for Medicare and Medicaid Services 

Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: 

June 30, 2011. 

Improper Payments: Recent Efforts to Address Improper Payments and 

Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. 

Status of Fiscal Year 2010 Federal Improper Payments Reporting. 

GAO-11-443R. Washington, D.C.: March 25, 2011. 

Medicare and Medicaid Fraud, Waste, and Abuse: Effective 

Implementation of Recent Laws and Agency Actions Could Help Reduce 

Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. 

Medicare: Program Remains at High Risk Because of Continuing 

Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 

2011. 

Opportunities to Reduce Potential Duplication in Government Programs, 

Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington,

D.C.: March 1, 2011. 

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 

2011. 

Medicare Recovery Audit Contracting: Weaknesses Remain in 

Addressing Vulnerabilities to Improper Payments, Although 

Improvements Made to Contractor Oversight. GAO-10-143. Washington, 

D.C.: March 31, 2010. 

Medicaid: Fraud and Abuse Related to Controlled Substances Identified 

in Selected States. GAO-09-1004T. Washington, D.C.: September 30, 

2009. 

Medicaid: Fraud and Abuse Related to Controlled Substances Identified 

in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009. 

Related GAO Products 
Related GAO Products 

Page 21 GAO-12-288T 

Improper Payments: Progress Made but Challenges Remain in 

Estimating and Reducing Improper Payments. GAO-09-628T. 

Washington, D.C.: April 22, 2009. 

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax 

System. GAO-08-239T. Washington, D.C.: November 14, 2007. 

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax 

System. GAO-08-17. Washington, D.C.: November 14, 2007. 

Medicaid Financial Management: Steps Taken to Improve Federal 

Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705. 

Washington, D.C.: June 22, 2006. 

Medicaid Integrity: Implementation of New Program Provides 

Opportunities for Federal Leadership to Combat Fraud, Waste, and 

Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006. 

Medicaid Fraud and Abuse: CMS’s Commitment to Helping States 

Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: 

June 28, 2005. 

Medicaid Program Integrity: State and Federal Efforts to Prevent and 

Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 

2004. 

Medicaid: State Efforts to Control Improper Payments. GAO-01-662. 

Washington, D.C.: June 7, 2001. 

(291007)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact: 

Website: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Please Print on Recycled Paper