MEDICAID 

Program Oversight 

Hampered by Data 

Challenges, 

Underscoring Need 

for Continued 

Improvements

Report to Congressional Requesters

January 2017

GAO-17-173

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-173, a report to 

congressional requesters

January 2017

MEDICAID

Program Oversight Hampered by Data 

Challenges, Underscoring Need for Continued 

Improvements

What GAO Found

GAO found that available Medicaid expenditure and utilization data do not 

provide CMS with sufficient information to consistently ensure that payments are 

proper or that beneficiaries have access to covered services. The Centers for 

Medicare & Medicaid Services (CMS), the agency within the Department of 

Health and Human Services (HHS) that administers the Medicaid program, relies 

on two key data sources for program oversight: the CMS-64, which serves as the 

basis for calculating the amount of federal matching funds for states, and the 

Medicaid Statistical Information System (MSIS), which is designed to report 

individual beneficiary claims data. The CMS-64 and MSIS have the potential to 

offer a robust view of payments, overall spending, and services in the Medicaid 

program; however, GAO found that the usefulness of these data is limited 

because of issues with completeness, accuracy, and timeliness. 

• Available expenditure data do not provide complete or accurate information 

on how states finance their portion of program costs, such as complete data 

on the sources or amounts of local government funds used to finance states’ 

share of Medicaid costs, thus complicating CMS’s ability to assess the 

appropriateness of states’ financing.

• Available utilization data, particularly for Medicaid managed care, are 

incomplete and are reported up to 3 years late, complicating CMS’s ability to 

identify billing patterns that indicate inappropriate provider behavior or ensure 

that beneficiaries have access to covered services. 

CMS has acknowledged the need for improved Medicaid data and cites the

Transformed Medicaid Statistical Information System (T-MSIS) as its key 

initiative to improve Medicaid data and program oversight. T-MSIS includes 

aspects aimed at improving the completeness, accuracy, and timeliness of state 

data available to CMS, yet uncertainty remains as to when these data will be 

available from all states as implementation has been delayed for several years. 

As of October 2016, 18 states were submitting T-MSIS data. Although CMS 

officials were uncertain when the remaining states would begin submitting data, 

they estimated that states representing over 70 percent of the Medicaid 

population would be submitting T-MSIS data by the end of calendar year 2016. 

CMS officials identified several factors contributing to states’ delayed T-MSIS 

implementation, such as coinciding with the ongoing efforts of over 30 states to 

redesign or replace their Medicaid information technology systems. Moreover, 

CMS has not fully developed its plans to ensure the quality of T-MSIS data, and

its plans for using these data for oversight purposes remain preliminary. Through 

rulemaking and other guidance, CMS has taken other actions to improve data; 

however, given that these actions have recently or not yet been implemented, it 

is unclear how they will affect CMS’s oversight. CMS’s continued reliance on 

inaccurate, incomplete, and untimely data, and the ongoing uncertainty about the 

scope and timing of its remedial actions, hamper effective oversight and are

inconsistent with federal internal control standards, which require entities to rely 

on quality and timely information to oversee their programs and take timely 

View GAO-17-173. For more information, actions to improve deficiencies.

contact Carolyn L. Yocom at (202) 512-7114 

or yocomc@gao.gov.

Why GAO Did This Study

To inform its oversight of Medicaid, 

CMS relies on state-reported data that 

contain information on multiple aspects 

of the program, including expenditures 

and service utilization. Recent 

increases in Medicaid improper 

payments, which were an estimated 

$36 billion in fiscal year 2016, have 

exacerbated concerns about the 

quality of data available to CMS for 

program oversight.

GAO was asked to examine the 

usefulness of Medicaid data for 

oversight purposes and any efforts to 

improve known limitations. This report 

(1) describes how available Medicaid 

expenditure and utilization data affect 

CMS’s ability to oversee the Medicaid 

program; and (2) examines CMS’s

efforts to improve these data. To 

address these objectives, GAO 

reviewed agency guidance, laws, 

regulations, and federal internal control 

standards; reviewed reports from GAO 

and others published from March 2010 

through September 2016; and 

interviewed CMS officials about 

continuing data challenges and 

initiatives to improve data.

What GAO Recommends

GAO recommends that CMS take 

immediate steps to improve Medicaid 

data available for program oversight, 

such as expediting efforts to assess 

and ensure the quality of T-MSIS data.

HHS concurred with GAO’s 

recommendation.
Page i GAO-17-173 Medicaid Data

Letter 1

Background 4

CMS’s Oversight Is Hindered by Insufficient Expenditure and 

Utilization Data 9

CMS Has a Key Initiative to Improve Medicaid Data, but 

Uncertainty Exists Regarding its Implementation and Effect on 

Program Oversight 15

Conclusion 22

Recommendation for Executive Action 23

Agency Comments and Our Evaluation 23

Appendix I Comments from the Department of Health and Human Services 26

Appendix II GAO Contact and Staff Acknowledgements 29

Related GAO Products 30

Table

Table 1: Examples of State Flexibility in Medicaid Program Design 

and Oversight 5

Figure

Figure 1: Key Medicaid Data Sets on Expenditures and Utilization 8

Contents
Page ii GAO-17-173 Medicaid Data

Abbreviations

CHIP State Children’s Health Insurance Program

CMS Centers for Medicare & Medicaid Services

CRS Congressional Research Service

DSH Disproportionate Share Hospital

EPSDT Early and Periodic Screening, Diagnostic, and 

Treatment

FFS fee-for-service

FMAP Federal Medical Assistance Percentage

HCERA Health Care and Education Reconciliation 

Act of 2010

HHS Department of Health and Human Services

HHS-OIG Department of Health and Human Services’ Office 

of Inspector General

MAX Medicaid Analytic eXtract

MACPAC Medicaid and CHIP Payment and Access 

Commission

MCO managed care organization

MMIS Medicaid Management Information System

MSIS Medicaid Statistical Information System

PERM Payment Error Rate Measurement

PPACA Patient Protection and Affordable Care Act

T-MSIS Transformed Medicaid Statistical Information 

System

UPL upper payment limit

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-173 Medicaid Data

441 G St. N.W.

Washington, DC 20548

January 6, 2017

Congressional requesters:

In 2015, the Medicaid program financed coverage for an estimated 68.9 

million low-income and medically needy individuals—nearly one-quarter 

of the U.S. population—and is the largest source of funding of health care 

for America’s most vulnerable populations.1 In recent years, the federalstate program has undergone steady growth, particularly since the 

enactment in 2010 of the Patient Protection and Affordable Care Act 

(PPACA), under which states have the option to expand program 

eligibility to certain nonelderly individuals.2 A significant pressure on 

federal and state budgets, Medicaid’s estimated outlays for fiscal year 

2015 were $554.3 billion, of which $347.5 billion was financed by the 

federal government and $206.8 billion by the states.3

Within broad federal parameters, Medicaid allows states significant 

flexibility to design and implement their programs, resulting in more than 

50 distinct state-based programs.4 This flexibility has allowed states to 

fashion their programs based on their unique needs; however, it has also 

complicated oversight. The states are responsible for day-to-day 

operations of their Medicaid programs, while the Centers for Medicare & 

Medicaid Services (CMS), the agency within the Department of Health 

and Human Services (HHS) that administers Medicaid, has a critical role 

 1

Department of Health & Human Services, Office of the Actuary, Centers for Medicare & 

Medicaid Services, 2015 Actuarial Report on the Financial Outlook for Medicaid.

2

Pub. L. No. 111-148, 124 Stat. 119 (2010), as amended by the Health Care and 

Education Reconciliation Act of 2010 (HCERA), Pub. L. No. 111-152, 124 Stat. 1029 

(2010). For purposes of this report, references to PPACA include the amendments made 

by HCERA. 

Historically, Medicaid eligibility has been limited to certain categories of low-income 

individuals—such as children, parents, pregnant women, persons with disabilities, and 

individuals age 65 and older. However, PPACA permitted states to expand their Medicaid 

programs by covering low-income adults not historically eligible for Medicaid coverage. As 

of July 2016, 31 states and the District of Columbia have opted to expand their Medicaid 

programs. The State Children’s Health Insurance Program (CHIP) is a joint federal-state 

program for children whose household incomes are too high for Medicaid eligibility.

3

See Office of the Actuary, 2015 Actuarial Report.

4

For the purposes of this report, we include the District of Columbia as a state.

Letter
Page 2 GAO-17-173 Medicaid Data

in overseeing states’ compliance with federal requirements, including 

ensuring that federal Medicaid payments are made appropriately.

CMS oversight relies in great part on state-reported data on multiple 

aspects of the Medicaid program, including expenditures and service 

utilization.5 However, we and others have identified the lack of accurate, 

complete, and timely data at the federal level needed to oversee the 

diverse and complex state Medicaid programs.6 These concerns are not 

new—and we have designated Medicaid as a high-risk program since 

2003 due to its size, growth, diversity of programs, and concerns about 

the adequacy of fiscal oversight. Recent trends in improper payments, 

however, have exacerbated concerns about Medicaid oversight.7 In 

particular, improper payments in fiscal year 2016 were estimated to be 

$36.3 billion of Medicaid’s expenditures, a significant increase from the 

estimated $14.4 billion in improper payments in fiscal year 2013.8

Recognizing the need for improved Medicaid data, CMS has undertaken 

a number of steps aimed at streamlining and improving the quality of data 

currently reported by states and available to CMS for oversight purposes.

 5

CMS relies on these and other data, such as data on enrollment, providers, and nursing 

home quality, to inform its oversight of the Medicaid program. For this report, we focused 

on expenditure and utilization data, because they are critical to determining whether 

Medicaid payments are appropriate and access to care is sufficient. 

6

For example, in a report summarizing concerns facing the Medicaid program, we 

stressed the importance of quality data in increasing transparency and improving 

oversight. See GAO, Medicaid: Key Issues Facing the Program, GAO-15-677 

(Washington, D.C.: July 30, 2015). The HHS Office of Inspector General (HHS-OIG) also

identified improving the effectiveness of Medicaid data and systems as a key performance 

and management challenge. See OIG’s FY 2015 Top Management and Performance 

Challenges Facing the Department of Health and Human Services, 

https://oig.hhs.gov/reports-and-publications/top-challenges/2015/challenge01.asp, 

accessed November 10, 2016. The Medicaid and CHIP Payment and Access Commission 

(MACPAC) also noted areas where better federal data on Medicaid are needed for 

improved understanding for policy analysis, such as service use among enrollees in 

managed care. See MACPAC Report to the Congress on Medicaid and CHIP, Chapter 6, 

“Improving Medicaid and CHIP Data for Policy Analysis and Program Accountability,”

(March 2011).

7

An improper payment is defined as any payment that should not have been made or that 

was made in an incorrect amount (including overpayments and underpayments) under 

statutory, contractual, administrative, or other legally applicable requirements. It includes 

any payment to an ineligible recipient, any payment for an ineligible good or service, any 

duplicate payment, or any payment for a good or service not received. 

8

See Department of Health and Human Services, FY 2016 Agency Financial Report

(Washington, D.C.: Nov. 14, 2016). 
Page 3 GAO-17-173 Medicaid Data

You asked us to examine the usefulness of available Medicaid data for 

program oversight purposes, and CMS’s efforts to address known data 

limitations. In this report, we

1. describe how available Medicaid expenditure and utilization data 

affect CMS’s ability to oversee the Medicaid program; and

2. examine the extent to which CMS has undertaken efforts to improve 

the data available to oversee states’ Medicaid programs.

To describe how the available Medicaid expenditure and utilization data 

affect CMS’s ability to oversee the Medicaid program, we reviewed 

relevant federal laws, regulations, and federal internal control standards.9

We also reviewed our own reports that specifically examined Medicaid 

expenditure and utilization data that were issued between March 2010, 

when PPACA was signed into law, and September 2016, the most 

recently available when we conducted this review. A list of the related 

GAO reports and testimonies we reviewed is included at the end of this 

report. For the same time period, we also reviewed reports on Medicaid 

expenditure and utilization data published by other entities, including the 

Medicaid and CHIP Payment and Access Commission (MACPAC), the 

Congressional Research Service (CRS), and HHS’s Office of Inspector 

General (HHS-OIG).10 We interviewed CMS officials to verify that these 

reports’ findings on Medicaid expenditure and utilization data were 

current.

To examine the extent to which CMS has taken steps to improve the data 

available to oversee states’ Medicaid programs, we reviewed federal 

laws, regulations, and guidance, and CMS’s formal responses to GAO 

recommendations regarding identified data limitations. We also 

interviewed CMS officials about current or future initiatives to address 

data quality and the status of those initiatives, and reviewed relevant 

agency documentation.

We conducted this performance audit from February 2016 to January

2017 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

 9

See GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: Sept. 10, 2014). Internal control is a process effected by an entity’s 

oversight body, management, and other personnel that provides reasonable assurance 

that the objectives of an entity will be achieved.

10CHIP stands for State Children’s Health Insurance Program.
Page 4 GAO-17-173 Medicaid Data

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

Medicaid, by design, allows significant flexibility for states to design and 

implement their programs. Within broad federal guidelines and under 

federally approved plans, states have some discretion in setting Medicaid 

eligibility standards and provider payment rates; determining the amount, 

scope, and duration of covered benefits, and how these benefits are 

delivered; and developing their own administrative structures. For 

example, states may pay health care providers for each service they 

provide on a fee-for-service (FFS) basis; contract with managed care 

organizations (MCO) to provide a specific set of Medicaid-covered 

services to beneficiaries and pay them a set amount per beneficiary per 

month; or rely on a combination of both delivery systems.11 This flexibility 

has influenced the development of the program and has resulted in over 

50 distinct state-based programs that vary in how health care is delivered, 

financed, reimbursed, and overseen.

Medicaid expenditures are financed by both the federal government and 

the states. The rate at which the federal government matches most state 

expenditures—the Federal Medical Assistance Percentage (FMAP)—also 

varies by state and by beneficiary eligibility type, which also contributes to 

program variation. Specifically, the federal government pays a higher 

portion of Medicaid expenditures in states with low per capita incomes 

relative to the national average, and pays different portions for 

expenditures for beneficiaries qualifying for Medicaid under traditional 

eligibility rules and those qualifying under a PPACA expansion.12 The 

resulting variation complicates program oversight efforts, which are 

shared by the federal government and the states, and are aimed, in part, 

 11States vary considerably in the extent to which they enroll beneficiaries in managed 

care; however, in 2014, over three-quarters of Medicaid enrollees nationwide—55.2 

million individuals—were enrolled in managed care. See Medicaid Managed Care 

Enrollment and Program Characteristics, 2014, Centers for Medicare & Medicaid Services 

and Mathematica Policy Research, (Spring 2016). 

12For a discussion of these different eligibility groups, see GAO, Medicaid: Additional 

Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal 

Funds, GAO-16-53 (Washington, D.C.: Oct. 16, 2015).

Background
Page 5 GAO-17-173 Medicaid Data

at ensuring that funds are used appropriately and that enrollees have 

access to covered benefits. (See table 1.)

Table 1: Examples of State Flexibility in Medicaid Program Design and Oversight

Program 

flexibility

Description Oversight examplea

Eligibility States determine program eligibility:

• States are required to cover certain categories of low-income

individuals, such as pregnant women, parents and children,

and individuals who are aged or disabled.

• Under the Patient Protection and Affordable Care Act (PPACA),

states can opt to expand Medicaid to cover certain childless adults

with incomes at or below 133 percent of the federal poverty level.

b

The applicable Federal Medical 

Assistance Percentage must be 

applied to each eligibility group to 

ensure appropriate federal payment, 

and to protect the program from 

improper payments.

Services Subject to federal requirements, states determine the amount, scope,

and duration of services covered in their Medicaid programs.

• States must cover a wide array of mandatory services, which include

inpatient hospital services, physician services, and nursing facility

services.

• States may cover additional services.

Beneficiaries’ utilization of services 

must be reported.

Payments States enroll providers and establish payment rates.

• States may reimburse providers based on claims submitted for

each covered service delivered to a beneficiary, referred to as

a fee-for-service payment.

• States may pay managed care organizations (MCO) based on a

predetermined, per beneficiary, per month basis.

• States make supplemental payments to providers, which are above

the regular amounts paid for a service, and may or may not be based

on claims for specific services. Such payments include, for example

• Disproportionate share hospital (DSH) payments.

c

• Medicaid upper payment limit (UPL) payments.

d

Payments to providers must be 

economical, efficient, and for Medicaid 

purposes.

Payments to providers must be 

sufficient so that Medicaid care and 

services are available at least to the 

extent that such care and services are 

available to the general population in 

the geographic area.

Payments to MCOs must be actuarially 

sound.

States and CMS are required to ensure 

appropriate payments, and to protect 

Medicaid from fraud, waste, and abuse.

Sources 

of state 

financing

States can rely on various sources to finance the state share of their 

Medicaid costs, including

• state general funds,

• health care provider taxes and donations, and

• fund transfers from local government entities.

e

At least 40 percent of the state share 

must be from state funds, which include 

state general funds, provider taxes, and 

transfers from other state agencies. 

The remaining 60 percent may be 

derived from fund transfers from local 

government entities. 

Source: GAO analysis of Medicaid requirements. | GAO-17-173

a

The states have primary responsibility for program integrity, because they enroll providers, establish 

payment policies, process claims, and pay for services furnished to beneficiaries. CMS is responsible 

for overseeing states’ design and operation of their Medicaid programs, and ensuring that federal 

funds are appropriately spent.
Page 6 GAO-17-173 Medicaid Data

b

PPACA also provides for a 5 percent disregard when calculating income for determining Medicaid 

eligibility, which effectively increases this income level to 138 percent of the federal poverty level. See 

42 U.S.C. § 1396a(a)(10)(A)(i)(VIII), (e)(14)(I).

c

States are required to make DSH payments to hospitals that serve large numbers of Medicaid and 

uninsured, low-income individuals to help offset these hospitals’ uncompensated care costs of serving 

such individuals. See 42 U.S.C. §§ 1396a(13)(A), 1396r-4.

d

Under federal law, to receive federal matching funds, payments generally (1) must be made for 

covered Medicaid items and services; (2) must be consistent with economy, efficiency, and quality of 

care; and (3) must not exceed the Medicaid upper payment limit (UPL). See 42 U.S.C. § 

1396a(a)(30)(A); 42 C.F.R. §§ 447.272, 447.321 (2015). The UPL is based on what Medicare would 

pay for comparable services. Based on the gap between the UPL and regular Medicaid payments, 

states can make supplemental payments to selected providers. UPL supplemental payments 

represent a significant component of Medicaid spending, totaling over $22 billion in fiscal year 2014.

e

Local government entities include counties, cities, and hospitals or other providers that are owned or 

operated by local governments.

To help inform its oversight, CMS relies on data that states submit from 

their respective Medicaid Management Information Systems (MMIS).

MMIS are claims processing and information retrieval systems that 

support the administration of the program, which states are required to 

implement in order to receive federal matching funds.13 Two data sets 

derived from state MMIS provide CMS with state data on program 

expenditures and utilization.14

13See 42 U.S.C. § 1396b(r). States receive a 90 percent federal match for the costs 

associated with the development of their MMIS system and a 75 percent match for the 

costs associated with ongoing MMIS maintenance and operation. See 42 U.S.C. §§ 

1396b(a)(3)(A)(i), (B).

14CMS relies on other state-reported data to oversee Medicaid expenditures and 

utilization. CMS uses these data to assess the effectiveness of state programs for children 

and to estimate improper payments through the Payment Error Rate Measurement 

(PERM) program. For example, states must report the number of children receiving wellchild checkups, and the number of children referred for treatment and services for 

conditions identified during well-child checkups under the Early and Periodic Screening, 

Diagnostic, and Treatment (EPSDT) benefit on the CMS-416. Through the PERM, CMS 

measures and reports to Congress improper payment rates in three component areas: (1) 

fee-for-service claims, (2) managed care, and (3) eligibility. In light of changes to Medicaid 

eligibility standards and state eligibility systems necessitated by PPACA, CMS has 

suspended the eligibility portion of the PERM program until fiscal year 2018. 
Page 7 GAO-17-173 Medicaid Data

• The CMS-64 contains service expenditures and administrative 

expenses that are not linked to individual enrollees.15 State Medicaid 

agencies must submit this information each quarter 30 days after a 

quarter has ended. CMS-64 data are reported at a state aggregate 

level, such as a state’s total expenditures for such categories as 

inpatient hospital services and prescription drugs, and are the basis 

for determining federal reimbursements to states for Medicaid 

expenditures. The CMS-64 also includes expenditures for 

supplemental payments, including disproportionate share hospital 

(DSH) payments.16

• The Medicaid Statistical Information System (MSIS) is an eligibility 

and claims data set, and is the federal source of state Medicaid 

expenditure and utilization data that can be linked to a specific 

enrollee. For each Medicaid beneficiary, MSIS provides data on 

eligibility status, service utilization, and expenditures, and CMS uses 

these data for policy analysis and forecasting expenditures.17 State 

Medicaid agencies are required to provide CMS, through MSIS, 

quarterly electronic files approximately 45 days after a quarter has 

ended. These files contain (1) information on persons covered by 

Medicaid, known as “eligible files”; and (2) adjudicated claims, known 

as the “paid claims file,” for medical services reimbursed by the 

Medicaid program.18

 15For purposes of this report, we refer to form CMS-64 as “CMS-64.” The CMS-64 is titled 

the Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program. 

The information is stored in the Medicaid Budget and Expenditure System. States are 

required to submit aggregate total quarterly Medicaid expenditures on the form CMS-64 

no later than 30 days after the end of each quarter. 42 C.F.R. § 430.30 (2015). CMS 

reconciles the amount of federal funds advanced to the state at the beginning of the 

quarter with the amount of federal funds claimed for payments made during the quarter to 

finalize the federal funding provided to the state. This results in a reconciliation adjustment 

to finalize the federal reimbursement to the state for the quarter.

16DSH payments are required to be made to hospitals that serve a disproportionate share 

of low-income and Medicaid patients to help offset hospitals’ uncompensated costs of 

serving these individuals. See 42 U.S.C. §§ 1396a(a)(13)(A)(iv), 1396r-4.

17These data also include the utilization of services provided through MCOs, also known 

as managed care encounter data. We previously found that MSIS data are not used by 

the states to manage the daily operations of their Medicaid programs. See GAO, 

Medicaid: Data Sets Provide Inconsistent Picture of Expenditures, GAO-13-47 

(Washington, D.C.: Oct. 29, 2012.)

18Each state’s eligible file contains one record for each person covered by Medicaid for at 

least 1 day during the reporting quarter. Individual eligible files consist of demographic and 

monthly enrollment data. Paid claims files contain information on medical service-related 

claims and MCO payments. 
Page 8 GAO-17-173 Medicaid Data

To support external researchers’ analyses of the Medicaid program, CMS 

also makes excerpts of MSIS data available through the Medicaid 

Analytic eXtract (MAX), which includes data on Medicaid enrollment, 

service use, and expenditures, and the MSIS Annual Person Summary 

file, which includes aggregated expenditure and utilization data for each 

beneficiary. (See fig. 1.)

Figure 1: Key Medicaid Data Sets on Expenditures and Utilization

Note: CMS-64 data also include expenditures derived from non-MMIS sources.
Page 9 GAO-17-173 Medicaid Data

Based on our review of reports issued by GAO and other entities, we 

determined that available Medicaid expenditure and utilization data do not 

provide CMS with sufficient information to consistently ensure that 

payments are proper or that beneficiaries have access to covered 

services, which is inconsistent with federal internal control standards that 

state that management should use quality information to achieve the 

entity’s objectives.19 CMS should rely on quality information to oversee 

the Medicaid program.

The CMS-64, which serves as the basis of calculating the amount of 

federal matching funds for states, and MSIS, which is designed to report 

individual beneficiary claims data, have the potential to offer a robust view 

of payments and overall spending in the Medicaid program. However, as 

the following examples from our work on supplemental payments, states’

sources of financing, and beneficiary eligibility under PPACA 

demonstrate, the usefulness of the CMS-64 and MSIS data is limited,

because of issues with completeness, accuracy, and timeliness.20 For 

example, neither the CMS-64 nor the MSIS is designed to capture 

detailed information on payments made to individual providers or the nonstate sources of the state share of Medicaid payments. Without more 

transparent information on program payments and state funding sources, 

CMS is unable to determine the appropriateness of program expenditures 

and ensure the fiscal integrity of the program.21

Supplemental payments

States report aggregate data regarding supplemental payments on the 

CMS-64, but neither the CMS-64 nor MSIS identifies supplemental 

 19See GAO-14-704G.

20See GAO-13-47.

21Prior work also identified the lack of provider-specific data as affecting CMS’s ability to 

conduct effective program integrity activities. See GAO, National Medicaid Audit Program: 

CMS Should Improve Reporting and Focus on Audit Collaboration with States,

GAO-12-627 (Washington D.C.: June 14, 2012). Since this report was issued, CMS has 

implemented our recommendation and shifted its audit strategy to collaborate more with 

states and use their MMIS data, which are more current and complete than MSIS data. 

CMS’s Oversight Is 

Hindered by 

Insufficient 

Expenditure and 

Utilization Data

Expenditure Data
Page 10 GAO-17-173 Medicaid Data

payments made to individual providers.22 As a result, we had to rely on 

alternative sources to determine Upper Payment Limit (UPL) 

supplemental payment amounts in conducting two reviews.23 In particular, 

we examined states’ mandatory DSH reports, which include some 

information on UPL supplemental payments made to DSH hospitals, and 

interviewed providers from selected states to identify their uses of these 

payments.24 Based on these efforts, we made the following observations, 

among others.

• Thirty-nine states made UPL supplemental payments to 505 hospitals 

that, along with their regular Medicaid payments, exceeded those 

 22Supplemental payments are payments that states make to providers that are above the 

regular amounts paid for a service and may or may not be based on claims for specific 

services. CMS officials acknowledged that the CMS-64 does not specifically identify 

supplemental payments made to individual providers, but noted that it may request 

detailed support at the provider level from the state at any time during the quarterly CMS64 reviews. These officials did not offer information on the extent to which CMS requests 

these data from states, if at all.

23See GAO, Medicaid: More Transparency and Accountability for Supplemental Payments 

are Needed, GAO-13-48, (Washington, D.C.: Nov. 26, 2012); and Medicaid: Federal 

Guidance Needed to Address Concerns About Distribution of Supplemental Payments, 

GAO-16-108, (Washington, D.C.: Feb. 5, 2016).

Under federal law, to receive federal matching funds, payments must not exceed the 

Medicaid UPL. See 42 U.S.C. § 1396a(a)(30)(A); 42 C.F.R. §§ 447.272, 447.321 (2015). 

The UPL is based on what Medicare would pay for comparable services. Based on the 

gap between the UPL and regular Medicaid payments, states can make supplemental 

payments to selected providers. States are also required to make DSH supplemental 

payments to hospitals that serve large numbers of Medicaid and uninsured, low-income 

individuals to help offset these hospitals’ uncompensated care costs of serving such 

individuals.

24DSH reports are independently audited reports that states are required to submit to 

CMS annually identifying each hospital that received a DSH payment in the preceding 

fiscal year and the amount of the payment, as well as additional information the agency 

requires to ensure the appropriateness of the payment. See 42 U.S.C. §1396r-4(j).

Under Medicaid rules, states can obtain federal matching funds for payments made under 

the UPL, which is based on the amount Medicare would pay for comparable services as 

applied to all providers within specified ownership classes. Medicaid UPL supplemental 

payments, which are above the regular Medicaid payments, but within the UPL, are not 

limited to an individual provider’s cost of providing Medicaid services. 
Page 11 GAO-17-173 Medicaid Data

hospitals’ total costs of providing Medicaid-funded care by $2.7 

billion.25

• Certain hospitals use these payments for a wide range of purposes,

from covering the costs of uninsured patients to funding general 

hospital operations, maintenance, and capital purchases, such as a 

helicopter.26

These findings suggest that further examination of UPL supplemental 

payments is warranted; however, data on these payments are incomplete 

as states are not required to report such payments to non-DSH hospitals 

or to other providers at the provider level. By not collecting complete or 

consistent data about these payments to all providers—either through the 

CMS-64 or another vehicle—CMS is missing an opportunity to ensure 

that such payments were made for Medicaid purposes and were 

consistent with Medicaid payment principles.27

States’ sources of financing

States have increasingly relied on health care providers and other nonstate sources to fund the state share of Medicaid payments. However, 

CMS does not collect accurate and complete data on state sources of 

funds to finance the Medicaid program, thus complicating CMS’s ability to 

fully assess whether state financing of the nonfederal share complies with 

federal law, or the extent to which the increased reliance on providers and 

local governments serves to provide fiscal relief to states and shifts costs 

to the federal government.

 25Of the 505 hospitals, 310 received a supplemental payment that, when added to the 

regular Medicaid payments the hospital received, resulted in total Medicaid payments 

exceeding Medicaid costs by about $1.9 billion. The remaining 195 hospitals received 

regular Medicaid payments that exceeded Medicaid costs before they received a 

supplemental payment, and total payments exceeded costs by about $900 million. See 

GAO-13-48. 

26See GAO-16-108.

27For example, with information on UPL supplemental payments from all hospitals, CMS 

could determine the extent to which these payments are targeted to a small number of 

providers, are related to those providers’ Medicaid workload, and resulted in total 

Medicaid payments that exceeded an individual provider’s costs of providing Medicaid 

services.
Page 12 GAO-17-173 Medicaid Data

• We and MACPAC found that CMS does not have complete data on 

the sources or amounts of local government funds states use to 

finance their nonfederal share.

28

• We and CRS also determined that the CMS-64 contained incomplete 

data on provider taxes, and we noted that CMS has not assessed the 

accuracy and completeness of those data.29 For a 2014 report, we 

asked states to identify and quantify the sources of their nonfederal 

share, and 47 states indicated that they had at least one provider tax 

or donation in effect in 2012. In comparing these responses to the 

provider tax and donation data they reported on the CMS-64 for the 

same year, we found that 6 states did not report one or more provider 

taxes.

Beneficiary eligibility under PPACA

As of October 2016, over 30 states have opted to expand their Medicaid 

program under PPACA. Because the FMAP rate can vary by beneficiary 

eligibility type, it is critical that CMS apply the correct matching rate for 

each respective eligibility group in these states to ensure proper payment 

amounts. However, CMS does not collect accurate state data on 

Medicaid enrollment by eligibility type in the CMS-64, thus complicating 

its ability to identify erroneous expenditures due to incorrect eligibility 

determinations. For example

• We reviewed state eligibility reviews and noted that, in 8 of the 9 

states reviewed, the state identified errors that resulted in incorrect 

eligibility determinations, including enrollment of individuals with

 28See GAO, Medicaid: Improving Transparency and Accountability of Supplemental 

Payments and State Financing Methods, GAO-16-195T (Washington, D.C.: Nov. 3, 2015); 

Medicaid Financing: States’ Increased Reliance on Funds from Health Care Providers and 

Local Governments Warrants Improved CMS Data Collection, GAO-14-627 (Washington, 

D.C.: July 29, 2014); and Medicaid: Completed and Preliminary Work Indicate that 

Transparency around State Financing Methods and Payments to Providers Is Still Needed 

for Oversight, GAO-14-817T (Washington, D.C.: July 29, 2014). Also see MACPAC, 

Report to the Congress on Medicaid and CHIP (March 2016).

29States may, subject to certain requirements, receive funds to finance Medicaid 

payments from health care providers, through provider taxes—taxes levied on providers 

such as hospitals or nursing facilities. Under federal law, provider taxes must be broadbased, must be uniformly imposed, and must not hold providers harmless; that is, they 

must not provide a direct or indirect guarantee that providers will receive all or a portion of 

tax payments back. See GAO-16-195T; GAO-14-627; and CRS, Medicaid Provider Taxes, 

7-5700 (Washington, D.C.: March 15, 2012).
Page 13 GAO-17-173 Medicaid Data

incomes exceeding Medicaid standards—totaling up to $48,000 in 

improper payments identified in one state alone.30

• At the time of our review, CMS had not reviewed federal Medicaid 

eligibility determinations in the 10 states that had delegated authority 

to the federal government to make these determinations, thus creating 

a substantial gap in its oversight of Medicaid eligibility determinations.

MSIS is the primary data source available to CMS on beneficiaries’

utilization of services as it includes claims data submitted by FFS 

providers and encounter data submitted by MCOs.31 However, we and 

HHS-OIG have identified incomplete and untimely state MSIS data, 

particularly managed care encounter data. Without better MSIS data, 

CMS may not be able to identify billing patterns that indicate inappropriate

provider billing or ensure that beneficiaries have access to covered 

services.

• In July 2015, HHS-OIG reviewed states’ compliance with federal 

requirements regarding the submission of Medicaid encounter data 

and determined that 11 states did not report encounter data for all 

managed care plans operating in their states as required.32 In that 

same year, we could not assess utilization patterns for Medicaid 

managed care beneficiaries in 32 states, because MSIS data were 

 30See GAO-16-53.

31Encounter data refer to data on the utilization of services provided through Medicaid 

MCOs.

CMS also relies on other state data, such as the CMS-416 (the EPSDT Participation 

Report) to oversee beneficiaries’ utilization. In reviewing all states’ CMS-416 reports, we 

found that 10 states made reporting errors large enough to result in an overstatement of 

the extent to which children received EPSDT services and that states did not always 

report required data on the number of children referred for additional services. Even in 

states that included referral information, states did not identify whether those children 

actually received the services. See GAO, Medicaid and CHIP: Reports for Monitoring 

Children’s Care Services Need Improvement, GAO-11-293R (Washington, D.C.: April 5, 

2011). While CMS has taken steps to address reporting errors on the CMS-416, it has no 

plans to require states to submit data on whether children received the treatment services 

for which they were referred. 

32See HHS-OIG, Not All States Reported Medicaid Managed Care Encounter Data as 

Required, OEI-07-13-00120 (Washington, D.C.: July 2015). This report was an update to 

a 2009 review, which found that 15 states did not report any encounter data to MSIS. For 

all claims filed on or after January 1, 1999, states have been required to electronically 

transmit claims data, including detailed individual enrollee encounter data in a format 

consistent with MSIS. See 42 U.S.C § 1396b(r)(1)(F).

Utilization Data
Page 14 GAO-17-173 Medicaid Data

either not available or were unreliable.33 The lack of complete and 

reliable encounter data presents a significant oversight challenge for 

CMS given that over three-quarters of Medicaid beneficiaries were 

enrolled in managed care in 2014.

• We and HHS-OIG found evidence of states not reporting MSIS data 

on time. For example, in an October 2012 report examining 

consistencies between CMS-64 and MSIS data, we found that 37 

states were late reporting their quarterly MSIS data by six quarters in 

July 2012.34 Although CMS requires states to submit MSIS data within 

45 days of the end of a fiscal quarter, we found that states’ reporting 

of MSIS data and the subsequent validation process are up to 3 years 

late.35 Similarly, the July 2015 HHS-OIG report noted above, also 

identified 8 of the 38 states it reviewed as not reporting any MSIS 

encounter data by the required deadline.36

• In a 2015 review of Medicaid prescription-drug fraud controls, we also 

identified how inaccurate and incomplete encounter data can affect 

state program integrity efforts. Data from 4 of the 11 states we 

reviewed had missing or unreliable provider information or encounter 

data, thus affecting those states’ ability to identify incidents of fraud, 

waste, or abuse.37

 33Among other reasons, we determined that data were unreliable in states that reported 

that fewer than 30 percent of beneficiaries used at least one service, a threshold 

established by Mathematica for evaluating the completeness and usability of the data, and 

states that did not report services using a standard coding convention. See GAO, 

Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care, GAO-15-481 

(Washington, D.C.: May 29, 2015).

34See GAO-13-47.

35According to CMS officials, states that delay reporting can have issues with both the 

timeliness and quality of their submissions. If states submit poor quality data, CMS may 

reject the submission, resulting in further delays.

36HHS-OIG, OEI-07-13-00120.

37GAO, Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug Fraud 

Controls, GAO-15-390 (Washington, D.C.: July 8, 2015).
Page 15 GAO-17-173 Medicaid Data

CMS officials identified the Transformed Medicaid Statistical Information 

System (T-MSIS) initiative as the agency’s primary effort to improve 

Medicaid expenditure and utilization data, and highlighted aspects of the 

initiative intended to improve their accuracy, completeness, and 

timeliness. However, less than half of the states are submitting T-MSIS 

data files to CMS, and it is uncertain when the remaining states will 

submit these data or how CMS will ensure their quality or use them for 

oversight purposes.

CMS has acknowledged the need for improved Medicaid data, and has 

undertaken a number of steps aimed at streamlining and improving the 

quality of data currently reported by states and available to CMS for 

oversight purposes.38 For example, since 2011, CMS has been working to 

implement the T-MSIS initiative to increase and improve the data 

collected through MSIS. T-MSIS is to include data about enrollees, 

services, and costs, including FFS claims, managed care encounters, 

beneficiary eligibility and demographics, and provider enrollment.39

According to CMS officials, T-MSIS includes aspects designed to improve 

the completeness, accuracy, and timeliness of available state data, as

well as their utility for states.40

• Completeness: T-MSIS is designed to capture significantly more data 

from states than is the case with MSIS. CMS requires states to report 

data on approximately 550 variables across eight data files in T-MSIS, 

 38In its Comprehensive Medicaid Integrity Plan, CMS noted efforts to improve the quality 

and consistency of Medicaid data reported to CMS. See CMS, Comprehensive Medicaid 

Integrity Plan, Fiscal Years 2014-2018. 

39T-MSIS is a continuation of CMS’s efforts to improve MSIS data. CMS conducted pilot 

projects (MSIS Plus in 2009 and MSIS Redesign in 2011) to provide more complete, 

accurate, and timely national data, and to limit separate data requests to states. 

40CMS officials noted that the T-MSIS data initiative is part of a broader agency-wide 

initiative—the Medicaid and CHIP Business Information Solutions—that began in 2010 to 

improve Medicaid and CHIP data infrastructure and technology. Other components of this 

initiative include MACPro, which accepts and stores requests for state plan amendments, 

waivers, and other documents. 

CMS Has a Key 

Initiative to Improve 

Medicaid Data, but 

Uncertainty Exists 

Regarding its 

Implementation and 

Effect on Program 

Oversight

CMS Officials Cite T-MSIS 

as the Key Effort among

Several to Improve 

Medicaid Data and 

Program Oversight
Page 16 GAO-17-173 Medicaid Data

a significant contrast to the approximately 200 variables required in 

MSIS.

• T-MSIS requires states to report three additional data files, 

including specific files on providers, third-party liability, and 

MCOs, thus collecting data not previously reported that could 

provide CMS information to enhance its oversight efforts.41

• The provider file includes a unique identifier for each 

provider, as well as data fields to show provider specialty 

and practice locations. Each of these has the capacity to 

assist CMS oversight in terms of providing insight on 

provider referrals, Medicaid payments to specific providers, 

and identifying ineligible providers.

• The third party liability file includes data on whether a 

beneficiary has any health insurance in addition to 

Medicaid, which would provide CMS with data on 

potentially liable third parties.42

• The managed care file includes more detailed information 

on MCOs, such as type and name of managed care plans, 

covered eligibility groups, service areas, and 

reimbursement arrangements. In addition to identifying 

failure to report encounter data, this file could help CMS’s 

oversight by allowing the agency to identify excess plan 

profit and volatility of expenditures for some enrollee 

groups across states.

• In addition to the data variables associated with the three new 

files, CMS expanded the scope of data to be collected through 

the existing MSIS files. For example, according to CMS 

officials, T-MSIS is to collect more detailed information on 

enrollees, including their citizenship, immigration, and disability 

status, as well as expanded diagnosis and procedure codes 

associated with their treatments.

• Accuracy: Within T-MSIS, there exist aspects aimed at improving the 

accuracy of data initially submitted by states. For example, T-MSIS 

includes approximately 3,500 automated quality checks, which 

 41Five data files are collected through MSIS: an eligibility file and four claims files 

(inpatient, long-term care, pharmacy, and other). 

42See GAO, Medicaid: Additional Federal Action Needed to Further Improve Third-Party 

Liability Efforts, GAO-15-208 (Washington, D.C.: Jan. 28, 2015).
Page 17 GAO-17-173 Medicaid Data

provide states with feedback on data format and consistency, in 

contrast to MSIS, which has relatively few automated checks. T-MSIS 

quality checks include ensuring that a beneficiary’s date of birth is a 

valid date and that a beneficiary’s age is under a reasonable limit. 

Other quality checks are to ensure logical relationships across TMSIS files, such as ensuring that the beginning date of service on 

claims are on or after a beneficiary’s date of birth. According to 

agency officials, CMS accepts state data for subsequent processing, 

provided the data are correctly formatted. According to CMS officials, 

states have access to error reports that are generated as a result of

processing their T-MSIS data.

• Timeliness: CMS requires states to report T-MSIS data to CMS 

monthly, versus quarterly, as is the case with MSIS data.

• Utility for states: T-MSIS includes aspects aimed at improving state 

oversight and reducing state burden. For example, while states have 

not relied on MSIS data to oversee their Medicaid programs, T-MSIS 

is intended to eventually provide states with the capability to analyze 

and compare their program data to other states, potentially enhancing 

their ability to manage expenditures and identify concerns regarding 

access to care. According to CMS officials, the agency also intends to 

access certain state data directly through T-MSIS, rather than 

separately requesting such data from the states, thereby reducing the 

number of data requests that CMS makes to states.43

In addition to its ongoing implementation of T-MSIS, CMS has taken other 

actions—for example, issuing regulations and guidance—to improve data 

reporting and enhance available data; however, given the recent nature 

or future implementation dates of these actions, their effect on CMS’s 

ability to oversee the Medicaid program is not fully known.

• The May 2016 managed care rule includes provisions intended to 

strengthen data the agency collects on managed care utilization and 

relevant for program integrity, which could help improve MCO 

oversight, the need for which was identified in several GAO reports.44

For example, the rule requires states to include provisions regarding 

the maintenance of encounter data in contracts with MCOs and 

 43For example, CMS plans to use T-MSIS to obtain data on children referred to services 

under the EPSDT benefit, thus eliminating the need for states to submit the CMS 416 

reports. Similarly, CMS would no longer need to separately obtain data from the states for 

certain aspects of program integrity activities, such as calculating states’ PERM rates.

4481 Fed. Reg. 27498 (May 6, 2016).
Page 18 GAO-17-173 Medicaid Data

limited benefit plans, to have procedures in place to ensure that 

enrollee encounter data these entities submit are complete and 

accurate, and includes financial consequences for lack of 

compliance.45 Although MCOs have been expressly required to report 

encounter data under statute since 2010, CMS’s May 2016 rule 

provides more clarity regarding the format and collection of these 

data. However, because these rules will not take effect until 2017 and 

2018, their success in improving data is dependent on state and CMS 

implementation.46 In addition, the managed care rule increases and 

clarifies state responsibilities related to overseeing payments to and 

by MCOs, which addresses a GAO recommendation that CMS hold 

states accountable for managed care program integrity by requiring 

them to conduct audits of MCOs.47 In particular, the managed care 

rule requires that states, at least once every 3 years, audit encounter

and financial data submitted by MCOs.48

• A December 2015 final rule includes more targeted financial 

consequences for states that do not comply with data submission 

requirements, including T-MSIS.49 While CMS previously had the 

authority to reduce federal financial participation for system operations 

from 75 percent to 50 percent if any system failed to meet any or all 

requirements, the final rule provides CMS with the option to tailor the 

 45Limited benefit plans are paid on a per person basis to provide a defined set of services. 

Under the rule, CMS will assess the state’s submission of these entities’ enrollee 

encounter data. If, after being notified of compliance issues, the state is unable to submit 

compliant data, CMS will take appropriate steps to defer or disallow federal financial 

participation on all or part of an MCO’s contract based on the enrollee and specific service 

type of the non-compliant data. 81 Fed. Reg. at 27881, 27895 (to be codified at 42 C.F.R. 

§ 438.242, 438.818). 

46The provisions for maintaining encounter data and ensuring encounter data accuracy 

apply to contracts beginning in July 2017. The provision for financial consequences for 

lack of compliance with data submission requirements applies to contracts beginning in

July 2018.

47For example, states must require MCOs and limited benefit plans to implement 

procedures to detect and prevent fraud, waste, and abuse. Further, they must have 

procedures for prompt reporting to the state of all overpayments identified or recovered, 

specifying those due to potential fraud. See 81 Fed. Reg. at 27891 (to be codified at 42 

C.F.R. § 438.608).

See GAO, Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity of 

Growing Managed Care Expenditures, GAO-14-341 (Washington, D.C.: May 19, 2014).

48See 81 Fed. Reg. at 27890 (to be codified at 42 C.F.R. § 438.602(e)).

49See 80 Fed. Reg. 75817, 75834, 75843 (Dec. 4, 2015) (to be codified at 42 C.F.R. § 

433.120).
Page 19 GAO-17-173 Medicaid Data

federal matching rate reduction to the specific operational 

expenditures related to the system component that does not meet 

applicable requirements. Having the ability to impose more targeted 

funding reductions may enable CMS to more effectively leverage 

improved state compliance with reporting requirements.

• In December 2015, in response to a GAO recommendation to 

routinely monitor and share information regarding key third-party 

liability efforts and challenges across states, CMS provided states 

with an updated guide on Medicaid third-party liability practices with 

information to help make states more aware of such efforts and 

challenges. This updated guide is an important tool that could help 

states ensure that Medicaid pays only after other liable third parties.50

• In its Comprehensive Medicaid Integrity Plan for fiscal years 2014-

2018, CMS noted that it is leveraging available Medicare data to

assist states in identifying providers who are enrolled in both Medicare 

and Medicaid, and may be involved in fraudulent or abusive billing 

practices. CMS officials also reported they adjusted the CMS-64 to 

improve states’ reporting of eligibility categories and UPL 

supplemental payments and trained states on how to report UPL 

supplemental payments.

Although T-MSIS may ultimately provide CMS with improved data to 

enhance its oversight of the Medicaid program, it is unclear when T-MSIS 

data will be available from all states. Federal internal control standards 

require agency management to complete actions to improve deficiencies 

on a timely basis; however, T-MSIS implementation, which began in 

March 2011 as a pilot program in 12 states, has been delayed for several 

years. The original date for nationwide submission was July 2014; as of 

October 2016, 18 states were submitting T-MSIS data, and CMS officials 

were uncertain as to when the remaining 33 states would begin 

 50Centers for Medicare & Medicaid Services, “Coordination of Benefits and Third Party 

Liability (COB/TPL) in the Medicaid Program: A Guide to Effective and Innovative State 

Agency Practices. Update Issued December 2015”; and GAO-15-208.

Federal law requires state Medicaid programs to identify and seek payment from liable 

third parties before billing Medicaid. In contrast, Medicaid MCOs are typically responsible 

for third-party liability administration and activities, and states are responsible for 

overseeing these activities. However, neither the updated guide nor the May 2016 final 

Medicaid managed care rule provides guidance to states on their oversight of third-party 

liability efforts conducted by Medicaid MCOs.

Uncertainty Surrounds 

States’ T-MSIS 

Implementation and 

CMS’s Plans for These 

Data in Enhancing 

Program Oversight
Page 20 GAO-17-173 Medicaid Data

submitting these data.51 Agency officials stated that for a state to be 

considered submitting T-MSIS data, it must submit all eight data files, but 

not necessarily all data variables within each file. CMS officials currently 

estimate that states representing over 70 percent of the Medicaid 

population will be submitting T-MSIS data by the end of calendar year 

2016.

To expedite states’ implementation of T-MSIS, CMS officials noted that 

they are focusing their efforts on the states they have determined are 

closest to implementing T-MSIS. According to these officials, CMS has 

had calls with these states to inquire about their plans, including what 

help the state may need from the agency. CMS has categorized the 

remaining states according to their readiness to begin submitting T-MSIS 

data.

CMS and state officials identified several factors contributing to states’

delayed T-MSIS implementation. For example, in addition to requiring 

states to submit significantly more information than they have in the past, 

T-MSIS implementation also coincides with the ongoing efforts of over 30 

states to redesign or replace their Medicaid information technology 

systems—an effort that states are undertaking, in part, to facilitate their 

efforts to comply with a multitude of federal requirements, only one of 

which is T-MSIS.52 A group representing state Medicaid directors also 

noted that state efforts to implement T-MSIS have been hindered by 

unclear and changing federal requirements. According to this group, 

 51The12 states that participated in the pilot were Arizona, Arkansas, California, Michigan, 

Minnesota, New Jersey, New Mexico, North Carolina, Oregon, Tennessee, Texas, and 

Washington. Of the pilot states, Arkansas, North Carolina, Tennessee, and Washington 

are the only states currently submitting T-MSIS data. The other states submitting T-MSIS 

data are Alabama, Colorado, Connecticut, Delaware, District of Columbia, Florida, 

Georgia, Illinois, Nevada, New Hampshire, Pennsylvania (CHIP only), Rhode Island, 

South Carolina, and Virginia. 

52For example, state information technology systems must be capable of establishing a 

coordinated eligibility and enrollment process for Medicaid, CHIP, and health insurance 

exchanges. 
Page 21 GAO-17-173 Medicaid Data

CMS’s ongoing revisions to T-MSIS requirements have created 

challenges and costs for states.53

In addition to uncertainty regarding states’ implementation of T-MSIS, 

CMS has not fully developed its plans for assessing and ensuring the 

quality of state data and, according to agency officials, is still trying to 

determine the best way to summarize and communicate what it has 

learned about the data’s quality to internal users and to states. According 

to CMS officials, the agency is producing data quality reports for internal 

users and anticipates sharing such reports with the public in 2017. While 

CMS officials identified seven broad priority areas for assessing the 

quality of the data—eligibility, expenditures, all utilization, FFS utilization, 

managed care utilization, providers, and third party liability—they have 

not yet delineated priorities within these areas for further review or 

identified specific data variables for priority validation—associated with 

improper payments or otherwise. Nonetheless, CMS officials noted that 

they have taken some steps to address the quality of state data. For 

example, in addition to the automated front-end data quality checks, the 

agency’s contractor has developed 2,000 quality measures to determine 

whether data are within expected ranges. For instance, if a state’s data 

suggested a Medicaid population that is 70 percent male, CMS would 

examine the data further as its data indicate the Medicaid population is 

predominantly female. CMS officials emphasized that they continue to 

develop processes to ensure data quality and expect to identify trends in 

the data that would allow them to develop new quality checks or

determine which checks are no longer relevant. Without fully developing, 

implementing, and expediting efforts to assess the quality of T-MSIS data, 

CMS cannot ensure the accuracy and completeness of T-MSIS data that 

states submit.

CMS’s plans for using T-MSIS to oversee states’ Medicaid programs also 

remain preliminary, and the agency has not established specific time 

frames for their use. Officials report that the agency is currently examining 

available state T-MSIS data to identify any problematic trends and 

developing analytic tools designed to assist with monitoring and 

 53See National Association of Medicaid Directors’ Letter to the U.S. Senate Committee on 

Finance on Data Streamlining and Reporting, Jan. 8, 2016. 

http://medicaiddirectors.org/wp-content/uploads/2016/01/NAMD-Response-to-SFC-datarequest-160108-1.pdf, accessed September 29, 2016. According to this group, states are 

also concerned about the public availability of the T-MSIS data they submit and how CMS 

will account for significant variability between states’ populations and programs.
Page 22 GAO-17-173 Medicaid Data

oversight. For example, CMS’s Center for Program Integrity has begun to 

crosswalk T-MSIS provider data to Medicare data to develop an algorithm 

to assist with program integrity efforts. Additionally, CMS established the 

Division of Business and Data Analysis in 2015 to lead analysis and 

dissemination of Medicaid and CHIP data. Such efforts include working 

with states on improving the quality of their T-MSIS data and to support 

other CMS offices’ use of data for program management and monitoring. 

According to CMS officials, the improved data will be used by CMS, 

states, and researchers for program monitoring, policy implementation, 

improving beneficiary health care, and lowering costs. Officials reported 

they anticipate that as more states submit T-MSIS data, and both states 

and CMS gain more experience with the process, the agency will develop 

additional and more complex uses of T-MSIS for program oversight 

purposes.

The continuing increase in federal Medicaid improper payments—

estimated at over $36 billion in fiscal year 2016—underscores the need 

for improved program oversight. We and others have expressed longstanding concerns about the completeness, accuracy, and timeliness of

available Medicaid data, and the effect of these insufficiencies on CMS’s 

ability to ensure the fiscal integrity of the program. CMS’s continued 

reliance on inaccurate, incomplete, and untimely data, and the ongoing 

uncertainty about the scope and timing of its remedial actions, is

inconsistent with federal internal control standards. As a steward of the 

program, CMS must take immediate steps to ensure the appropriate use 

of scarce federal and state dollars.

CMS acknowledges the need for improved Medicaid data and is taking 

actions aimed at improving available data. Thus far, CMS actions have 

focused on guidance and regulations, continued oversight of program 

integrity, and improved reporting of specific expenditures, such as 

supplemental payments. It is unknown whether these actions, while 

important, will significantly improve CMS’s ability to oversee this complex 

and growing program. In the longer term, CMS cites T-MSIS as its 

primary effort to streamline and improve data. T-MSIS includes aspects 

aimed at improving the quality of state data available to CMS, yet 

uncertainty remains as to when these data will be available from all 

states; how CMS will ensure their quality; or how CMS will use these data 

for oversight purposes. Without an improved focus on ensuring the 

accuracy of data—and setting priorities for the data that are most likely to 

improve program oversight—the effectiveness of T-MSIS cannot be 

assured.

Conclusion
Page 23 GAO-17-173 Medicaid Data

We recommend that the Administrator of CMS take immediate steps to 

assess and improve the data available for Medicaid program oversight, 

including, but not limited to, T-MSIS. Such steps could include

• refining the overall data priority areas in T-MSIS to better identify 

those variables that are most critical for reducing improper payments, 

and

• expediting efforts to assess and ensure the quality of these T-MSIS 

data.

We provided a draft of this report to HHS for comment. In its written 

comments, HHS concurred with our recommendation and acknowledged 

the importance of having robust, timely, and accurate data to ensure the 

highest financial and program performance in the Medicaid program. HHS 

highlighted aspects of T-MSIS aimed at improving state data, which 

would strengthen program monitoring and oversight, policy 

implementation, and provide a framework for identifying potential areas of 

concern so that additional efforts may be taken that could reduce future 

instances of potential fraud, waste, and abuse. Further, HHS noted its 

ongoing efforts to work with states to ensure compliance with T-MSIS 

reporting requirements, reduce reporting errors, and improve the quality 

of their data submissions. HHS also provided a technical comment, which 

we incorporated. HHS’s comments are reproduced in appendix I.

Recommendation for 

Executive Action

Agency Comments 

and Our Evaluation
Page 24 GAO-17-173 Medicaid Data

As arranged with your offices, unless you publicly announce the contents 

of this report earlier, we plan no further distribution until 30 days after its 

issuance date. At that time, we will send copies of this report to the 

Secretary of Health and Human Services and other interested parties. In 

addition, the report will be available at no charge on the GAO website at

http://www.gao.gov.

If you or your staff members have any questions, please contact me at 

(202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. Major contributors to this report are listed in appendix II.

Carolyn L. Yocom

Director, Health Care
Page 25 GAO-17-173 Medicaid Data

List of Requesters

The Honorable Thomas Carper

United States Senate

The Honorable Orrin Hatch

United States Senate

The Honorable Claire McCaskill

United States Senate

The Honorable Ron Wyden

United States Senate

The Honorable Frank Pallone, Jr.

House of Representatives

The Honorable Fred Upton

House of Representatives
Appendix I: Comments from the Department of 

Health and Human Services

Page 26 GAO-17-173 Medicaid

Appendix I: Comments from the Department 

of Health and Human Services
Appendix I: Comments from the Department of 

Health and Human Services

Page 27 GAO-17-173 Medicaid
Appendix I: Comments from the Department of 

Health and Human Services

Page 28 GAO-17-173 Medicaid
Appendix II: GAO Contact and Staff 

Acknowledgements

Page 29 GAO-17-173 Medicaid

GAO Contact: Carolyn L. Yocom, (202) 512-7114 or yocomc@gao.gov

In addition to the contact named above, Susan Anthony (Assistant 

Director), Manuel Buentello (Analyst-in-Charge), Ricky Harrison Jr., and

Kate Nast Jones made key contributions to this report. Also contributing 

were Sandra George and Drew Long.

Appendix II: GAO Contact and Staff 

Acknowledgements

GAO Contact

Staff 

Acknowledgments
Related GAO Products

Page 30 GAO-17-173 Medicaid

The following are selected GAO products pertinent to the issues 

discussed in this report. Other products may be found at GAO’s web site 

at www.gao.gov.

Medicaid: Federal Guidance Needed to Address Concerns About 

Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: 

February 5, 2016.

Medicaid: Improving Transparency and Accountability of Supplemental 

Payments and State Financing Methods. GAO-16-195T. Washington, 

D.C.: November 3, 2015.

Medicaid: Additional Efforts Needed to Ensure that State Spending is 

Appropriately Matched with Federal Funds. GAO-16-53. Washington, 

D.C.: October 16, 2015.

Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, 

D.C.: July 30, 2015.

Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug 

Fraud Controls. GAO-15-390. Washington, D.C.: July 8, 2015.

Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. 

GAO-15-481. Washington, D.C.: May 29, 2015.

Medicaid: CMS Oversight of Provider Payments is Hampered by Limited 

Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 

11, 2015.

Medicaid: Additional Federal Action Needed to Further Improve ThirdParty Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015.

Medicaid Program Integrity: Increased Oversight Needed to Ensure 

Integrity of Growing Managed Care Expenditures. GAO-14-341. 

Washington, D.C.: May 19, 2014.

Medicaid Financing: States’ Increased Reliance on Funds from Health 

Care Providers and Local Governments Warrants Improved CMS Data 

Collection. GAO-14-627. Washington, D.C.: July 29, 2014.

Related GAO Products
Related GAO Products

Page 31 GAO-17-173 Medicaid

Medicaid: Completed and Preliminary Work Indicate that Transparency 

around State Financing Methods and Payments to Providers Is Still 

Needed for Oversight. GAO-14-817T. Washington, D.C.: July 29, 2014.

Medicaid: More Transparency and Accountability for Supplemental 

Payments are Needed. GAO-13-48. Washington, D.C.: November 26, 

2012.

Medicaid: Data Sets Provide Inconsistent Picture of Expenditures.

GAO-13-47. Washington, D.C.: October 29, 2012.

Medicaid: States Reported Billions More in Supplemental Payments in 

Recent Years. GAO-12-694. Washington, D.C.: July 20, 2012.

National Medicaid Audit Program: CMS Should Improve Reporting and 

Focus on Audit Collaboration with States. GAO-12-627. Washington, 

D.C.: June 14, 2012.

Medicaid and CHIP: Reports for Monitoring Children’s Health Care 

Services Need Improvement. GAO-11-293R. Washington, D.C.: April 5, 

2011.

(100650)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.