MEDICAID 

PROGRAM 

INTEGRITY

CMS Should Build on 

Current Oversight 

Efforts by Further 

Enhancing 

Collaboration with 

States

Report to the Chairman, Committee on 

Finance, U.S. Senate

March 2017

GAO-17-277

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-277, a report to the 

Chairman, Committee on Finance, U.S. 

Senate

March 2017

MEDICAID PROGRAM INTEGRITY

CMS Should Build on Current Oversight Efforts by 

Further Enhancing Collaboration with States 

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) has tailored its state 

program integrity reviews—in which the agency reviews states’ program integrity 

activities—to states’ managed care delivery systems and other areas at high risk 

for improper payments. From 2014 through 2016, CMS conducted on-site 

reviews in 31 states. The reviews usually addressed state oversight of managed 

care plans, and some reviews addressed other high-risk areas such as provider 

enrollment. CMS and states have found the reviews to be beneficial in identifying

areas for improvement. To expand oversight to more states, CMS also began 

off-site desk reviews of certain state program integrity efforts.

Collaborative audits—in which CMS contractors and states work in partnership—

have identified substantial potential overpayments to providers, but barriers have 

limited their use. CMS encourages states to use collaborative audits, but states 

decide whether to pursue them. Several states reported positive collaborative 

audit experiences, while others cited barriers—such as staff burden or problems 

communicating with contractors—that prevented them from seeking audits or 

hindered the success of audits. Federal internal control standards indicate that 

organizations should identify and respond to risks related to achieving objectives. 

Absent additional CMS action to address barriers, some states may choose not 

to pursue collaborative audits, or may encounter challenges after doing so.

Collaborative Audits Assigned from Fiscal Year 2012 through June 2016

CMS lacks a systematic approach to collecting promising state progam integrity 

practices and communicating them to other states. CMS’s main approach—the 

state program integrity reviews—inconsistently identified promising practices,

and those identified are neither published in a timely way nor easily searched

electronically. Other CMS approaches, such as courses offered by the Medicaid 

Integrity Institute (a national training program for states), were not designed for 

sharing promising practices and do not systematically communicate them to all 

states. Both CMS and the states have a role in identifying promising program 

integrity practices. Absent further agency action, states may not have access to

the range of promising state program integrity practices, which is inconsistent 

with federal internal control standards on the use and external communication of 

necessary quality information to achieve program objectives. 

View GAO-17-277. For more information, 

contact Carolyn L. Yocom at (202) 512-7114 

or yocomc@gao.gov.

Why GAO Did This Study

Medicaid remains a high-risk program, 

partly due to concerns about improper 

payments. CMS oversees and 

supports states, in part, by reviewing 

their program integrity activities, hiring 

contractors to audit providers, and 

providing training. In recent years, 

CMS made changes to its Medicaid 

program integrity efforts, including a 

shift to collaborative audits.

GAO was asked to examine CMS’s 

oversight and support of states’ 

Medicaid program integrity efforts.

GAO examined, among other issues,

(1) how CMS tailors its reviews to

states’ circumstances; (2) states’

experiences with collaborative audits;

and (3) CMS’s steps to share 

promising program integrity practices. 

GAO reviewed CMS documents, 

including state program integrity 

reports, and data on collaborative

audits. GAO interviewed officials from 

CMS and eight states selected based 

on expenditures, managed care use, 

and number of collaborative audits, 

among other factors.

What GAO Recommends

To further improve its support of states’ 

Medicaid program integrity activities, 

CMS should identify opportunities to 

address barriers that limit states’ 

participation in collaborative audits, 

and, in collaboration with states, take 

additional steps to collect and share 

promising program integrity practices.

The Department of Health and Human 

Services concurred with GAO’s 

recommendations.
Page i GAO-17-277 Medicaid Program Integrity

Letter 1

Background 6

CMS Tailors Its Focused Reviews of State Program Integrity 

Efforts to Managed Care and Other High-Risk Areas 12

Collaborative Audits Identified Substantial Potential 

Overpayments, but Some States Reported Barriers to Audit 

Participation and Success 18

The Medicaid Integrity Institute Is an Important Training Resource, 

but State Demand Exceeded Institute Capacity 25

CMS Lacks a Systematic Approach to Collecting and 

Communicating States’ Promising Program Integrity Practices 29

Conclusions 33

Recommendations for Executive Action 34

Agency Comments and Our Evaluation 35

Appendix I Medicaid Integrity Institute Attendance for Fiscal 

Year 2012 through Fiscal Year 2015, by State 36

Appendix II Comments from the Department of Health and Human Services 38

Appendix III GAO Contacts and Staff Acknowledgments 42

Related GAO Products 43

Tables

Table 1: Number of States CMS Selected for Focused State 

Program Integrity Reviews, by High-Risk Area, Fiscal 

Years 2014-2016 13

Table 2: Program Integrity Efforts Examined in CMS Desk 

Reviews of 40 States, Calendar Year 2016 17

Table 3: Medicaid Integrity Institute Attendance for Fiscal Year 

2012 through Fiscal Year 2015, by State 36

Contents
Page ii GAO-17-277 Medicaid Program Integrity

Figures

Figure 1: Potential Overpayments Identified by Collaborative 

Audits in Fiscal Years 2012-2015 19

Figure 2: Number of Collaborative Audits Assigned from Fiscal 

Year 2012 through June 2016, by State 21

Figure 3: Participants in Medicaid Integrity Institute Training, 

Fiscal Year 2015 26

Abbreviations

CHIP Children’s Health Insurance Program

CMS Centers for Medicare & Medicaid Services

DOJ Department of Justice

HHS Department of Health and Human Services

MIC Medicaid Integrity Contractor 

MII Medicaid Integrity Institute 

PERM Payment Error Rate Measurement

PPACA Patient Protection and Affordable Care Act

TAG Technical Advisory Group

UPIC Unified Program Integrity Contractor

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-277 Medicaid Program Integrity

441 G St. N.W.

Washington, DC 20548

March 15, 2017

The Honorable Orrin G. Hatch

Chairman

Committee on Finance

United States Senate

Dear Mr. Chairman:

Improper payments are a significant and growing cost to the Medicaid 

program, most recently increasing from an estimated 9.8 percent ($29 

billion) of federal Medicaid expenditures in fiscal year 2015 to 10.5 

percent ($36 billion) in fiscal year 2016.1 Medicaid covered about 72 

million low-income and medically needy individuals in fiscal year 2016, 

and is the largest health insurance program by enrollment in the United 

States.2 In fiscal year 2016, federal and state Medicaid expenditures were 

projected to be $576 billion, with the federal government spending $363 

billion and states spending a combined $213 billion.3 Due to its size, 

diversity, and growth, we have had long-standing concerns about the 

integrity of the Medicaid program, and it has been on our list of high-risk 

programs since 2003.4

The federal government and the states play key roles in oversight of the 

Medicaid program. The Centers for Medicare & Medicaid Services (CMS), 

within the Department of Health and Human Services (HHS), is 

 1

An improper payment is any payment that should not have been made or that was made 

in an incorrect amount (including overpayments and underpayments) under statutory, 

contractual, administrative, or other legally applicable requirements. It includes any 

payment to an ineligible recipient, any payment for an ineligible service, any duplicate 

payment, payment for services not received (except where authorized by law), and any 

payment that does not account for credit for applicable discounts. Improper Payments 

Elimination and Recovery Act of 2010, Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 

(codified at 31 U.S.C. § 3321 note).

2

Medicaid is jointly funded by the federal government and the states. Department of 

Health and Human Services, Centers for Medicare & Medicaid Services, Office of the 

Actuary, 2016 Actuarial Report on the Financial Outlook for Medicaid, (Washington, D.C.: 

2017).

3

Centers for Medicare & Medicaid Services, 2016 Actuarial Report on the Financial 

Outlook for Medicaid.

4

See GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial 

Efforts Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017). 

Letter
Page 2 GAO-17-277 Medicaid Program Integrity

responsible for broad oversight of the program, while states are primarily 

responsible for administering their respective Medicaid programs’ day-today operations. Within federal requirements, states have significant 

flexibility to design and implement their programs, resulting in 56 distinct 

state-based programs.5 States have also had primary responsibility for 

ensuring the integrity of the Medicaid program by preventing, identifying, 

and correcting improper payments. They therefore remain the first line of 

defense against Medicaid improper payments.

The Deficit Reduction Act of 2005 established the Medicaid Integrity 

Program, under which CMS is required to use contractors to audit 

Medicaid claims for improper payments and provide education and 

training to states, providers, and others; develop and publish a 

comprehensive plan to address Medicaid program integrity; and report 

annually to Congress on the effectiveness and use of program funding.6

CMS hired contractors in 2007 to perform analyses and audits of 

Medicaid providers using federal data. In 2010, CMS revised its approach 

to these audits and adopted a new audit model in which its contractors 

and states may work in partnership on “collaborative audits.” As a result 

of the Deficit Reduction Act, CMS also established the Medicaid Integrity 

Institute (MII) in 2007, in collaboration with the Department of Justice. The 

MII is the first national training program for state program integrity 

officials.

You asked us to review CMS’s efforts to prevent and reduce improper 

payments, in particular its efforts to oversee and support states’ program 

integrity activities. In this report, we examine

1. how CMS tailors its reviews of states’ Medicaid program integrity 

activities to account for differences in states’ health care delivery 

systems and program integrity needs;

2. states’ experiences with collaborative audits;

3. how the Medicaid Integrity Institute supports states’ efforts to address 

program integrity vulnerabilities; and

 5

Medicaid programs are administered by the 50 states, the District of Columbia, and five 

territories—American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, 

Puerto Rico, and the U.S. Virgin Islands. This report examines 50 states, the District of 

Columbia, and Puerto Rico, which we will collectively refer to as “states” in this report.

6

See Pub. L. No. 109-171, § 6034(a), 120 Stat. 4, 74-76 (2006) (codified, as amended at 

42 U.S.C. § 1396u-6).
Page 3 GAO-17-277 Medicaid Program Integrity

4. the steps CMS has taken to share promising program integrity 

practices.

To examine how CMS tailors its reviews, we focused on CMS’s state 

program integrity reviews, which are intensive, on-site reviews of states’ 

program integrity efforts. These visits result in State Program Integrity 

Review Reports, which include information on state compliance with 

federal requirements and other information on states’ program integrity 

efforts. We reviewed all 30 of CMS’s State Program Integrity Review 

Reports for fiscal years 2013 through 2015 that were published on or 

before September 2, 2016, as well as CMS’s most recent Program 

Integrity Review Annual Summary Reports.7 We also reviewed CMS’s 

internal guidance for performing state program integrity reviews and 

documentation about its desk reviews, which are off-site reviews that

target specific aspects of states’ program integrity programs. In addition, 

we reviewed several published reports related to CMS’s Medicaid 

program integrity activities, including its Comprehensive Medicaid 

Integrity Plans and its reports to Congress.8 We interviewed officials from 

CMS’s Center for Program Integrity and state officials in eight selected 

states. The eight states we selected were Arizona, Colorado, 

Connecticut, Florida, Massachusetts, Michigan, New York, and 

Tennessee. This judgmental sample of states was chosen to reflect a 

range of different characteristics, including Medicaid expenditures, 

delivery systems (both fee-for-service and managed care), and 

geographic diversity.9 We also selected states based on the year they 

 7

While CMS’s State Program Integrity Review Reports are state-specific reports, its 

Program Integrity Review Annual Summary Reports compile information from CMS’s state 

program integrity reviews, and include information on state practices, areas of 

vulnerability, and areas of non-compliance with federal requirements. See 

https://www.cms.gov/medicare-medicaid-coordination/fraudprevention/fraudabuseforprofs/stateprogramintegrityreviews.html (accessed September 2, 

2016).

8

We reviewed CMS’s two most recent Comprehensive Medicaid Integrity Plans, of which 

one covered fiscal years 2009 to 2013, and one covered fiscal years 2014 to 2018. See 

https://www.cms.gov/regulations-and-guidance/legislation/deficitreductionact/cmip.html. 

(accessed January 12, 2017). We also reviewed three CMS reports to Congress on the 

Medicare and Medicaid integrity programs, one that covered fiscal year 2011, one that 

covered fiscal year 2012, and one that covered both fiscal years 2013 and 2014.

9

In a fee-for-service delivery system states pay individual health care providers for each 

service delivered (e.g., an office visit, test, or procedure); while in a managed care delivery 

system states typically contract with managed care plans to provide a specific set of 

Medicaid-covered services to beneficiaries and pay them a set amount per beneficiary per 

month to provide those services.
Page 4 GAO-17-277 Medicaid Program Integrity

had their most recent state program integrity review, and on the number 

of collaborative audits conducted by CMS’s audit contractors, known as 

Medicaid Integrity Contractors (MIC).10 We also included a mix of states 

that expanded their Medicaid programs as allowed under the Patient 

Protection and Affordable Care Act (PPACA) and those that did not.11 The 

experiences of the Medicaid officials in the eight selected states are not 

generalizable to other states.

To examine states’ experiences with the collaborative audits, we 

reviewed the materials noted above and discussed the audits with both 

CMS and state officials. In addition, we collected CMS data on each 

collaborative audit assigned from October 1, 2011, through June 30, 

2016. We also reviewed CMS information on potential overpayments 

identified through collaborative audits, from fiscal year 2012 through fiscal 

year 2015. We assessed the reliability of these data by talking with CMS 

and state officials, reviewing related documentation, and assessing the 

data for internal consistency and obvious errors, and determined that they 

were sufficiently reliable for the purposes of our reporting objective. We 

also assessed the degree to which the collaborative audit program is 

consistent with standards for internal controls in the federal government—

specifically those related to identifying and responding to risks, and to 

information and communication.12

 10We selected five states that had been reviewed by CMS in fiscal years 2014 or 2015, 

the most recent years for which CMS’s State Program Integrity Review Reports had been 

completed, and three that had not had such a recent review. We also selected states that 

varied in their use of collaborative audits, ranging from states with no collaborative audits 

to states that were among the most frequent users of collaborative audits.

11Pub. L. No. 111-148, 124 Stat. 119 (2010), as amended by the Health Care and 

Education Reconciliation Act of 2010 (HCERA), Pub. L. No. 111-152, 124 Stat. 1029 

(2010). For purposes of this report, references to PPACA include the amendments made 

by HCERA. Beginning in 2014, states may cover under their state plan non-elderly, nonpregnant adults with incomes at or below 133 percent of the federal poverty level. PPACA 

also permitted an early expansion option, whereby states could expand eligibility for this 

population (or a subset of this population) starting April 1, 2010. Additionally, PPACA 

provides for a 5 percent disregard when calculating income for determining Medicaid 

eligibility for this population, which effectively increases this income level to 138 percent of 

the federal poverty level. In this report, we refer to this population as “expansion 

enrollees.” 

12See GAO, Internal Control: Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov. 1, 1999). Internal control is a process 

effected by an entity’s oversight body, management, and other personnel that provides 

reasonable assurance that the objectives of an entity will be achieved.
Page 5 GAO-17-277 Medicaid Program Integrity

To examine how the MII supports states’ efforts to address program 

integrity vulnerabilities, we interviewed state officials in the eight selected 

states to learn the extent to which the MII courses were useful and 

addressed the states’ training needs. Further, we analyzed data on the 

MII course offerings and attendees by state from fiscal year 2012 through 

March 1, 2016. We assessed the reliability of these data by talking with 

CMS and state officials, reviewing related documentation, and checking 

the data for internal consistency and obvious errors, and determined that 

they were sufficiently reliable for the purposes of our reporting objective. 

We also reviewed summaries of participants’ initial course evaluations for 

a selection of seven courses offered in fiscal year 2015 and 2016, and 

60-day course evaluations for five of those seven courses.13 We also 

reviewed the two most recent versions of CMS’s Annual Summary Report 

of the Medicaid Integrity Institute and Related Educational Activities, 

published in 2013 and 2014, and interviewed officials from CMS and the 

Department of Justice’s (DOJ) National Advocacy Center. CMS and DOJ 

have an interagency agreement in which DOJ provides support for the 

institute and houses it at the National Advocacy Center.

To examine the steps CMS has taken to share promising program 

integrity practices, we reviewed the results from the analyses described 

above relating to the state program integrity reviews and the MII.14 In 

addition, we reviewed agendas from and documentation about the 

Medicaid Fraud, Waste and Abuse Technical Advisory Group’s (TAG) 

monthly calls with CMS, MII, and the states, and several program integrity 

 13These courses were offered in fiscal years 2015 and 2016 and were selected to capture 

a range of content from basic skills courses to more advanced and emerging trends 

courses. The courses were: Basic Skills and Techniques in Medicaid Fraud Detection, 

Program Integrity Fundamentals, Medicaid Provider Enrollment Seminar, Data Analysis 

Symposium, Specialized Skills and Techniques in Medicaid Fraud Detection, Managed 

Care Oversight Seminar, and Emerging Trends in Medicare and Medicaid.

14In state program integrity reviews, CMS lists both noteworthy and effective practices.

Noteworthy practices are identified by CMS during the state program integrity reviews as 

practices that they believe other states should consider emulating. Effective practices are 

identified by the states and reported to CMS. However, CMS does not assess the 

effectiveness of these practices; variations in states’ Medicaid programs mean that not all 

practices are viable for all states. CMS officials said that they and the states refer to both 

types of efforts as “best practices.” In this report, GAO uses the term “promising 

practices,” because we did not independently evaluate the effectiveness of these 

practices.
Page 6 GAO-17-277 Medicaid Program Integrity

toolkits developed by CMS.15 We also asked state officials in the eight 

selected states about CMS’s efforts to share promising practices and how 

they learned of other states’ strategies to improve program integrity. We 

assessed the extent to which CMS’s approaches for sharing promising 

program integrity practices is consistent with standards for internal 

controls in the federal government—specifically those related to 

information and communication.16

We conducted this performance audit from September 2015 to March 

2017 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

Medicaid is a significant and growing component of federal and state 

budgets. It is the second largest health insurance program after Medicare 

as measured by expenditures, and was estimated to account for the 

second largest share of total state spending as well, exceeded only by 

state spending on elementary and secondary education.

Further, Medicaid is undergoing a period of transformative change, as 

enrollment is growing under PPACA, and program spending is projected 

to increase 66 percent to over $950 billion by fiscal year 2025.

17 Growth 

in enrollment is primarily due to more than half of the states choosing to 

expand their Medicaid programs by covering certain low-income adults 

not historically eligible for Medicaid coverage, as authorized under 

PPACA. Growth in expenditures is due to a variety of factors, including 

 15The Center for Program Integrity provides educational resources for providers, 

beneficiaries, and other stakeholders in promoting best practices and awareness of 

Medicaid fraud, waste, and abuse. One of these resources is the toolkits on specific 

program integrity topics and they include fact sheets, presentations, booklets, and 

resource guides, among other things. Medicaid Fraud, Waste and Abuse TAG calls are 

between CMS, MII, and the states to discuss program integrity topics. There are several 

smaller Medicaid Fraud, Waste and Abuse TAG subgroups dedicated to specific program 

integrity topics.

16See GAO/AIMD-00-21.3.1. 

17Centers for Medicare & Medicaid Services, 2016 Actuarial Report on the Financial 

Outlook for Medicaid.

Background
Page 7 GAO-17-277 Medicaid Program Integrity

the expansion of eligibility, provider rate increases and the higher cost of 

health care, including prescription drugs. In addition, states’ use of 

managed care plans to deliver services has been growing.18 More than 

half of all Medicaid beneficiaries are now enrolled in managed care plans, 

and nearly 40 percent of expenditures are for health care services 

delivered through managed care.19

The Medicaid program allows for substantial flexibility for states to design 

and implement their programs, which has implications for program 

oversight. For example, in a fee-for-service delivery system, state 

oversight relies on claims data that health care providers submit to states 

in order to be paid for services. In general, this involves pre- and postpayment reviews of claims to identify payments that are improper, billing 

anomalies, or aberrant claims. In contrast, state oversight of managed 

care plans often occurs through contracts and reporting requirements, 

and may also involve encounter data.20 State oversight is different under 

the managed care delivery model, because the managed care plans are 

responsible for providing services and bear financial risk if spending on 

services and administration exceeds payments from the state.

In 2014, we found that the federal government and the states were not 

well positioned to identify improper payments made to, or by, managed 

care plans. For example, CMS had largely delegated program integrity 

oversight of managed care plans to the states, but states generally 

focused on fee-for-service claims. State officials told us that one reason

for not focusing on audits of services provided by managed care plans 

was that they were more complex than audits of fee-for-service claims.21

 18States may have different types of managed care arrangements in Medicaid. In this 

report, where we refer to Medicaid managed care plans, we are referring to managed care 

plans or organizations that provide services under a comprehensive, risk-based managed 

care arrangement, the most common type of managed care arrangement.

19See GAO, Medicaid Fee-For-Service: State Resources Vary for Helping Beneficiaries 

Find Providers, GAO-16-809 (Washington, D.C.: Aug. 29, 2016). 

20Encounter data are obtained from claims for reimbursement that providers submit to 

their managed care plans for services delivered, but typically do not include the same 

level of detail. Managed care plans are expected to report encounter data to state 

Medicaid programs so states can track the services received by beneficiaries enrolled in 

managed care. See GAO, Medicaid Information Technology: CMS Supports Use of 

Program Integrity Systems but Should Require States to Determine Effectiveness, 

GAO-15-207 (Washington, D.C.: Jan. 30, 2015).

21See GAO, Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity 

of Growing Managed Care Expenditures, GAO-14-341 (Washington, D.C.: May 19, 2014).
Page 8 GAO-17-277 Medicaid Program Integrity

We made three recommendations to improve federal and state oversight 

of Medicaid managed care expenditures. Since then, CMS has addressed 

these recommendations. CMS has, for example, issued a final rule on 

Medicaid managed care, which requires states to conduct periodic audits 

of financial data submitted by, or on behalf of, each Medicaid managed 

care plan.22

CMS’s Center for Program Integrity is the agency’s focal point for 

Medicaid and Medicare program integrity issues. Initially, CMS’s Medicaid 

program integrity activities were administered by a unit separate from its 

Medicare program integrity activities. In an effort to strengthen and better 

coordinate its program integrity efforts, CMS reorganized the Center for 

Program Integrity in 2014 to align functional activities and integrate 

Medicaid and Medicare program integrity efforts where possible.23 CMS 

has a range of program integrity activities that are important to overseeing 

and supporting states’ Medicaid programs. Several of its core activities 

have undergone changes in recent years. For example:

1. Reviews of state program integrity efforts. Each year, CMS selects 

a group of states and reviews aspects of their program integrity 

efforts. From 2007 to 2013, CMS conducted comprehensive, on-site 

regulation-based reviews of each state’s program integrity activities 

every 3 years. In fiscal year 2014, CMS shifted the focus of the state 

program integrity reviews from a comprehensive review approach to a 

“focused review” approach. According to CMS, this new approach to 

state program integrity reviews is intended to focus on high-risk areas 

of concern particular to each state, reduce the burden on states, and 

identify more opportunities to provide technical assistance to the 

states. Since 2014, CMS has conducted focused reviews on selected 

high-risk areas each year; although these reviews have been 

narrower in scope than the comprehensive regulatory reviews, they 

still involve on-site visits to states. As with previous reviews, CMS 

continues to publish its findings in state-specific review reports. CMS 

also publishes reports that compile findings from individual statespecific reports. States are required to submit corrective action plans 

 22Medicaid and Children’s Health Insurance Program (CHIP) Programs; Medicaid 

Managed Care, CHIP Delivered in Managed Care, and Revisions Related to Third Party 

Liability, 81 Fed. Reg. 27,498 (May 6, 2016).

23Medicare is the federally financed health insurance program for persons 65 years of age 

or over, certain individuals with disabilities, and individuals with end-stage renal disease.

CMS’s Oversight of 

Medicaid Program 

Integrity
Page 9 GAO-17-277 Medicaid Program Integrity

for addressing any areas of regulatory non-compliance that CMS 

identifies, and CMS follows up on states’ planned corrective actions. 

In 2016, CMS began off-site desk reviews of states’ program integrity 

efforts to supplement the focused reviews.

2. Collaborative federal-state audits. In accordance with the Deficit 

Reduction Act, CMS contracts with eligible entities to review the 

actions of Medicaid providers, and audit providers’ claims to identify 

overpayments. In 2012, we made several recommendations to 

improve the efficiency of these audits, and CMS took action to 

address our recommendations.24 For example, CMS has shifted from 

its previous audit approach—in which CMS contractors, the MICs, 

used extracts of often incomplete federal data to identify providers for 

audits—to a new “collaborative audit” model in which states agree to 

post-payment audits and provide state data to the MICs. As a part of 

the collaborative audit process, the state—together with CMS—

determines the audit processes the MICs follow. In some instances, 

the MIC conducts the entire audit; in other cases, it supplements state 

resources by providing medical review staff and other resources. 

States are responsible for collecting overpayments identified by the 

MICs, and are permitted 1 year from the date of discovery to return 

the federal share.25

Beginning in 2016, as a component of CMS’s efforts to strengthen 

and consolidate its program integrity efforts, CMS began shifting from 

the three regional MICs focused on Medicaid to five new regional 

Unified Program Integrity Contractors (UPIC) responsible for a range 

of Medicare and Medicaid program integrity activities previously 

performed by other contractors.26 According to CMS, the purpose of 

the UPICs is to coordinate provider investigations across Medicare 

 24See GAO, Medicaid Integrity Program: CMS Should Take Steps to Eliminate Duplication 

and Improve Efficiency, GAO-13-50 (Washington, D.C.: Nov. 13, 2012); and National 

Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit 

Collaboration with States, GAO-12-627 (Washington, D.C.: June, 14, 2012). 

25Federal law requires the state to return the federal share of the overpayment regardless 

of whether the state was able to recover it, unless the provider has been determined to be 

bankrupt or out of business. 42 U.S.C. § 1396b(d)(2)(C)-(D); 42 C.F.R. § 433.312(b)

(2016).

26These activities include the Medicaid collaborative audits conducted by the MICs; the 

work of CMS’s Zone Program Integrity Contractors, which identify and investigate cases of 

potential fraud in the Medicare program; and activities of the Medicare-Medicaid Data 

Match (Medi-Medi) program, in which Zone Program Integrity Contractors collaborate with 

state Medicaid agencies to generate leads for fraud and abuse investigations.
Page 10 GAO-17-277 Medicaid Program Integrity

and Medicaid; improve collaboration with states by providing a 

mutually beneficial service; and increase contractor accountability 

through coordinated oversight. According to CMS officials, aspects of 

the UPIC program—such as the goal of having contractors work 

collaboratively with states—reflect their prior experiences with the 

collaborative audits. CMS began awarding UPIC contracts in 2016; it 

plans to award all the contracts by the end of 2017, and ultimately 

phase out the MICs.

3. Medicaid Integrity Institute. In 2007, CMS established the MII, the 

first national Medicaid training program for state program integrity 

officials. CMS entered into an interagency agreement with the 

Department of Justice to house the MII at the National Advocacy 

Center, located at the University of South Carolina. The MII offers 

substantive training and support in a structured learning environment 

at no cost to the states, with the first trainings offered in fiscal year 

2008. The MII trainings include multi-day on-site courses and 

workgroups, as well as webinars.27 The MII has offered from 19 to 22 

on-site courses, 1 to 3 workgroups, and 2 to 13 webinars each year 

from fiscal years 2012 through 2015. In fiscal year 2015, individual 

course sizes ranged from 25 participants to the largest class 

accommodating over 70 participants. Almost 3,800 attendees 

participated in on-site courses from fiscal years 2012 through 2015.

(See app. I for attendance by state for fiscal years 2012 through 

2015.) In fiscal year 2013, the MII began the Certified Program 

Integrity Professional credentialing program.28 The MII also provides a 

secure online platform for state-to-state information sharing known as 

the Regional Information Sharing System. State officials must register 

to gain access to the Regional Information Sharing System, and 

participation is voluntary. Currently there are approximately 360 users.

4. State provider enrollment and screening. CMS has taken steps to 

support and oversee states’ efforts to enroll and screen providers for 

participation in Medicaid. For example, CMS has published guidance 

regarding the enhanced provider screening and enrollment 

 27The MII’s workgroups are invitation only events designed to bring specific state program 

integrity staff together to discuss a topic in depth and potentially work together to plan an 

MII course on the topic. In fiscal year 2015, the MII hosted an MII Advisory Group meeting 

for 12 state officials. 

28This certification program consists of three courses: Program Integrity Fundamentals, 

Basic Skill and Techniques in Fraud Detection, and Specialized Skills and Techniques in 

Fraud Detection. 
Page 11 GAO-17-277 Medicaid Program Integrity

requirements under PPACA.29 CMS has also conducted site visits to 

assist states with challenges in implementing these requirements, and 

has provided education, outreach, and assistance to states through 

webinars, training calls, an optional data compare service, and other 

means, according to CMS.30

In addition, CMS estimates the rate of improper payments in Medicaid, 

and provides information, guidance, and technical assistance to states. 

CMS’s Medicaid Payment Error Rate Measurement (PERM) program 

estimates improper payments in Medicaid in three component areas: (1) 

fee-for-service claims, (2) managed care, and (3) eligibility. CMS 

calculates a national Medicaid improper payment rate, as well as 

improper payment rates for each state.31

CMS also provides states with information and opportunities for 

collaboration with the federal government and other states in a number of 

ways, including through Medicaid Fraud, Waste and Abuse TAG 

meetings; quarterly teleconferences with regional program integrity 

directors; and webinars (separate from the training webinars of the MII) 

for state Medicaid program integrity staff on topics such as the use of the 

CMS Fraud Investigation Database. To support state program integrity 

efforts, CMS issues guidance and publishes educational toolkits for 

providers and beneficiaries and toolkits for state program integrity 

officials.32 Toolkits for state program integrity officials address issues such 

 29See, for example, Pub. L. No. 111-148, § 6401(b)(1), 124 Stat. 119, 751-53 (2010) 

(codified at 42 U.S.C. § 1396a(a)(77), (kk)).

30CMS offers states an optional data compare service in which states may submit their 

Medicaid provider enrollment information and receive results from CMS about how that 

information compares to related data sources such as Medicare enrollment records and 

HHS Office of Inspector General information on excluded providers, according to CMS. 

Medicaid provider enrollment and screening efforts are an important component of 

Medicaid program integrity, and were outside the scope of this report. For information on 

Medicaid provider enrollment and screening, see GAO, Medicaid Program Integrity:

Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers, 

GAO-16-402 (Washington, D.C.: April 22, 2016).

31States are responsible for developing and submitting corrective action plans to address 

specific errors identified during the PERM reviews, and CMS follows up on those 

corrective action plans.

32CMS considers education for providers and beneficiaries to be one of its core Medicaid 

program integrity activities. Educational toolkits for providers and beneficiaries cover 

topics such as dental compliance, managed care compliance, provider enrollment, and 

disclosures and fraud awareness. These toolkits include print and electronic media, trainthe-trainer guides, videos, and other strategies for promoting best practices and 

enhancing awareness of Medicaid fraud, waste, and abuse.
Page 12 GAO-17-277 Medicaid Program Integrity

as frequent findings from state program integrity reviews in the area of 

provider enrollment, provider payment suspension, and assessing data 

analytic capabilities.33 CMS also provides technical assistance in 

response to states’ needs, such as responses to state inquiries about 

specific program integrity areas and suggestions for resources to help 

address states’ program integrity concerns.

CMS has tailored its focused program integrity reviews to states’ 

managed care delivery systems and other areas that are at high risk for 

improper payments. CMS also recently began using targeted off-site desk 

reviews of certain state program integrity efforts to expand its oversight 

efforts.

From fiscal years 2014 through 2016, CMS conducted focused reviews of 

state program integrity efforts in 31 states, reviewing 10 or 11 states 

annually. CMS reviewed one or two high-risk areas per state, including 

states’ oversight of managed care plans in 28 states. (See table 1.) CMS 

selected which states to review based on factors such as whether a state 

contracted with a managed care plan to deliver services, and when the 

agency last conducted a program integrity review in a state.

 33See https://www.cms.gov/Medicare-Medicaid-Coordination/FraudPrevention/FraudAbuseforProfs/MedicaidGuidance.html (accessed January 4, 2017).

CMS Tailors Its 

Focused Reviews of 

State Program 

Integrity Efforts to 

Managed Care and 

Other High-Risk 

Areas

CMS’s Focused Reviews 

Have Emphasized 

Oversight of Managed 

Care and Other High-Risk 

Areas
Page 13 GAO-17-277 Medicaid Program Integrity

Table 1: Number of States CMS Selected for Focused State Program Integrity Reviews, by High-Risk Area, Fiscal Years 2014-

2016

High-risk areas reviewed Number of states reviewed, by fiscal year

2014 2015 2016 Total

Oversight of managed care plans 8 9 11 28

Provider enrollment and screeninga 9 0 0 9

Personal care services 1 1 0 2

Non-emergency medical transportation 0 3 0 3

Total number of states reviewed 10 10 11 31

Source: GAO analysis of Centers for Medicare & Medicaid Services (CMS) information. | GAO-17-277

Note: CMS focused on one or two tailored high-risk areas per state.

a

In 2015 and 2016, the agency assisted states with provider enrollment through other mechanisms, 

such as state site visits that focused solely on provider enrollment; webinars; and other training. CMS 

plans to conduct additional provider enrollment site visits in 2017.

For each state, CMS tailored its focused reviews to the states’ managed 

care plans and relevant other high-risk areas including provider 

enrollment and screening, personal care services, and non-emergency 

medical transportation. CMS identified these areas based on its 

assessment of high-risk program integrity areas nationwide and on input 

from state officials about important program integrity issues.

• Managed care. CMS assessed state oversight of managed care 

plans, and the program integrity activities of selected managed care 

plans that delivered services to Medicaid enrollees. For example, 

CMS reviewed state efforts to ensure plan compliance with 

contractual requirements for program integrity activities, and reviewed 

plans’ procedures for identifying, recovering, and reporting on 

overpayments made to providers.

• Provider enrollment and screening. CMS examined state 

implementation of enhanced provider enrollment and screening 

requirements under PPACA. For example, CMS reviewed whether 

states checked certain federal databases to determine providers’ 

eligibility to participate in Medicaid fee-for-service programs, and 

whether they terminated the participation of providers that had been 

revoked by Medicare or terminated by Medicaid and Children’s Health 

Insurance Program (CHIP) programs in other states.34

 34CHIP is an insurance program for certain low-income, uninsured children whose family 

income is too high for Medicaid. For information on Medicaid provider enrollment and 

screening requirements under PPACA, see GAO-16-402.
Page 14 GAO-17-277 Medicaid Program Integrity

• Personal care services. CMS assessed the extent of state oversight, 

including state processes for enrolling providers and monitoring 

services provided.

• Non-emergency medical transportation. CMS assessed the extent 

of state oversight and the program integrity activities of organizations 

that provide non-emergency medical transportation services.

CMS and state officials we spoke with told us that the tailored oversight of 

CMS’s focused reviews has been beneficial and helped identify areas for 

improvement. According to CMS officials, the reviews have allowed CMS 

to focus in-depth on important program integrity vulnerabilities, and have 

been less of a burden on state staff. Five of the eight states we selected 

had a focused review in fiscal year 2014 or fiscal year 2015. Officials from 

all five states said that CMS’s tailored approach was an improvement 

over the agency’s prior approach. They noted that CMS tailored the 

reviews to high-risk areas that were appropriate for their states, and that 

within each of those high-risk areas, CMS had focused on issues that 

were important to their program integrity efforts. State officials indicated 

that while the focused reviews still took a substantial amount of staff time, 

they were less of a burden on staff and they got feedback from CMS in a 

timely way. In addition, officials in two states added that they felt that 

CMS was now working with them more in partnership to address any 

vulnerabilities; they also appreciated that CMS shared feedback about 

what their states were doing well and did not focus solely on where their 

states needed to improve. 

CMS and state officials shared examples of how the focused reviews 

were beneficial to their program integrity efforts in their specific high-risk 

areas.

• Managed care reviews. CMS officials said that they found substantial 

variation across states’ managed care programs, but that their 

reviews identified some common issues, such as a low number of 

investigations conducted by managed care plans and a low amount of 

recoveries by plans. As a result, CMS officials recommended that 

states take steps to improve their oversight of plans. Officials from all 

four states we selected where CMS reviewed managed care 

programs cited benefits. For example, officials from three states noted 

that the meetings with CMS and managed care plan officials helped 

them learn more about the plans’ program integrity efforts. Further,

officials from three states said that CMS’s review gave them leverage 

in dealing with managed care plans or led plans to focus more on 

program integrity. Officials in one state noted that CMS provided 

State Comments on CMS’s Focused State 

Program Integrity Review 

Officials from one state said CMS’s focused 

review was a “huge improvement” over the 

prior approach. In the past they felt CMS 

reviewed too many issues with no depth, and 

there was a large burden on staff. In contrast, 

the focused review was in-depth and involved 

“tremendously less work” for staff. As a result 

of the review, officials felt CMS understood 

how their state operated and that CMS was 

“on our side,” and state officials “absolutely” 

saw benefits from the review.

Source: GAO summary of state information. | GAO-17-277

CMS’s State Program Integrity Review 

Findings on Managed Care

According to CMS, some states did not 

receive encounter data from managed care 

plans, or found that plans’ encounter data was 

of poor quality.

Source: GAO summary of CMS information. | GAO-17-277

State Officials’ Views on CMS’s Review of 

Managed Care

Officials from one state said that CMS’s 

review helped bring the state’s Medicaid 

program integrity staff and Medicaid program 

staff “in line” with each other in respect to 

managed care plan oversight, which was 

beneficial. They added that CMS’s reviews 

provide an opportunity to bring the state 

agencies and plans together to discuss 

program integrity issues.

Source: GAO summary of state information. | GAO-17-277
Page 15 GAO-17-277 Medicaid Program Integrity

helpful recommendations for how to improve state oversight of 

managed care plans, including plans’ fraud referrals.

• Provider enrollment and screening. CMS officials said that their 

fiscal year 2014 reviews in this area found that many states were not 

meeting requirements for checking certain federal provider databases 

or had not made much progress revalidating provider enrollment.35

CMS officials said they have since worked with states and there has 

been substantial improvement. State officials said that the reviews 

helped identify areas where they could improve. In addition, officials 

from one state whose focused review had not included provider 

enrollment and screening said they were concerned about this area, 

and that it would be helpful for CMS to review their provider 

enrollment and screening processes to help the state identify what 

they are doing well and what they need to improve.36

• Personal care services and non-emergency medical 

transportation. CMS officials said they generally found a lack of 

sufficient state oversight of personal care services and nonemergency medical transportation, and recommended states take 

action. For example, in one state, CMS found that there were limited 

program integrity requirements in the state’s contract with the 

organization that conducts program integrity activities related to 

personal care services. The contract did not require oversight that 

involved unannounced visits of personal care service providers, or 

provide sufficient direction about the re-enrollment of those providers. 

We spoke with officials in one state where CMS had reviewed 

personal care services. The state officials noted that this is a high-risk 

area in their state, and that due to CMS’s review, they would pay 

increased attention to certain vulnerabilities. These state officials 

added that CMS’s focused reviews can help bring program integrity 

 35Because provider actions can be a major factor behind improper payments, the integrity 

of the Medicaid program depends, in large part, on ensuring that only eligible providers 

participate in the program. Consequently, screening providers is important in helping 

prevent improper payments, including fraud and abuse. See GAO-16-402. States must 

revalidate the enrollment of all providers at least every 5 years. 42 C.F.R. § 455.414 

(2016).

36State officials said they had explored using a contractor to review their provider 

enrollment process, but they had been unable to pursue the review due to budgetary 

constraints. 
Page 16 GAO-17-277 Medicaid Program Integrity

vulnerabilities to the attention of state Medicaid staff responsible for 

administering the program, not just their program integrity staff.37

Although officials from our selected states generally had positive 

feedback about CMS’s focused reviews, some identified areas where 

CMS could make improvements. For example, officials in two states said 

that some CMS reviewers did not sufficiently understand aspects of the 

states’ program or policies. In one state, this created delays during the 

on-site portion of the review as state officials spent time clarifying reasons 

for certain state practices. Those officials suggested that CMS ensure 

that all of their reviewers are knowledgeable about the state by allowing 

more time for state officials to clarify state policy with all CMS reviewers 

before they arrive on-site. Officials with one state said that CMS could 

enhance the reviews by including state Medicaid Fraud Control Unit staff 

as part of their interviews about state program integrity issues.38

CMS officials told us that they plan to continue conducting focused 

reviews related to managed care and personal care services in fiscal year 

2017.39

To expand its oversight to conduct more frequent reviews of states, CMS 

recently began supplementing its focused reviews with targeted desk 

reviews—off-site reviews of certain program integrity efforts designed to 

address high-risk areas. According to CMS officials, CMS has conducted 

desk reviews of one or more efforts in 40 states in 2016. Desk reviews 

are intended to allow the agency to address additional potential 

vulnerabilities, and assess and assist more states each year, thus 

reviewing states more often than would otherwise be feasible using onsite focused reviews alone.

 37Our sample of states did not include any of the three states that had a focused review of 

non-emergency medical transportation.

38Medicaid Fraud Control Units are typically housed in the state’s attorney general’s office 

and are tasked with investigating Medicaid fraud and other health care law violations. See 

GAO-14-341.

39CMS also plans to conduct comprehensive state program integrity reviews in U.S. 

territories. For information on Medicaid program integrity efforts in the territories, see 

GAO, Medicaid and CHIP: Increased Funding in U.S. Territories Merits Improved Program 

Integrity Efforts, GAO-16-324 (Washington, D.C.: April 8, 2016).

CMS Uses Targeted Desk 

Reviews to Expand 

Oversight of High-Risk 

Areas
Page 17 GAO-17-277 Medicaid Program Integrity

For this first year of desk reviews, CMS officials targeted four program 

integrity efforts it determined important to mitigating risks and selected 

states based on a range of factors, including whether a state had recently 

had an on-site focused state program integrity review and whether a state 

had an active state Recovery Audit Contractor contract.40 In particular, 

CMS assessed how states implemented corrective action plans from the 

PERM program and state program integrity reviews, states’ use of 

Recovery Audit Contractors, or whether states had terminated certain 

providers from participating in Medicaid or CHIP. (See table 2.) The desk 

reviews were in progress in 2016, and CMS planned to conduct desk 

reviews in these same four areas in 2017. CMS officials said they will 

assess the results of their focused reviews and new desk reviews to see 

whether this combined approach is an effective and efficient strategy for 

overseeing and assisting states, and whether they could make 

improvements for future reviews.

Table 2: Program Integrity Efforts Examined in CMS Desk Reviews of 40 States, Calendar Year 2016 

Desk review topic

Number of reviews 

conducted

Status of implementation of corrective action plans from fiscal year 2013 state program integrity reviews 11

Status of implementation of corrective action plans from CMS’s Payment Error Rate Measurement program 17

State Medicaid Recovery Audit Contractorsa 19

Provider terminationsb 11

Source: GAO summary of Centers for Medicare & Medicaid Services (CMS) information. | GAO-17-277

a

States are required to contract with Recovery Audit Contractors to identify under- and over-payments 

as part of their program integrity activities. 42 U.S.C. § 1396a(a)(42)(B). These desk reviews 

examined states’ adherence to regulations, whether the contractors reviewed managed care claims, 

and whether states found their contractors to be effective, among other topics.

b

Provider termination desk reviews included the identification of providers that were participating in a 

state’s Medicaid program or Children’s Health Insurance Program (CHIP), but should have been 

terminated, and any potential overpayments associated with those providers.

 40States are required to contract with Recovery Audit Contractors to identify under- and 

over-payments as part of their program integrity activities. 42 U.S.C. § 1396a(a)(42)(B). 

CMS has granted time-limited exceptions to this requirement to certain states, such as 

those with small Medicaid fee-for-service populations. When selecting states for desk 

reviews, CMS considered that four states had such exceptions, and that three other states 

were in the process of reprocuring their Recovery Audit Contractor. 
Page 18 GAO-17-277 Medicaid Program Integrity

Collaborative audits identified substantial potential overpayments to 

health care providers. However, some states cited investment of staff 

time without commensurate benefit and communication issues as barriers 

to audit participation and success.

States’ collaborative audits with MICs have identified a substantial 

amount of potential overpayments to providers in recent years. 

Overpayments identified by collaborative audits increased from $2 million 

in fiscal year 2012 to $36 million in fiscal year 2015.41 (See fig. 1.) 

According to CMS officials, the increase in overpayments identified by 

collaborative audits was due to improved data, improved engagement 

and collaboration with states, increased state participation in audits, and 

to greater experience with targeting and conducting these audits.

 41During that time, overpayments identified by non-collaborative audits decreased from 

over $7 million to less than $100,000, as CMS transitioned to collaborative audits. The 

amount of potential overpayments identified is based on amounts reported in MICs’ Final 

Audit Reports to the states during a given fiscal year. Overpayments are considered 

potential at that point, because providers can appeal audit findings. States are not always 

able to recover the full amount of the overpayments identified by collaborative audits.

Collaborative Audits 

Identified Substantial 

Potential 

Overpayments, but 

Some States 

Reported Barriers to 

Audit Participation 

and Success

Collaborative Audits 

Continue to Identify 

Substantial Potential 

Overpayments, but State 

Participation Varied
Page 19 GAO-17-277 Medicaid Program Integrity

Figure 1: Potential Overpayments Identified by Collaborative Audits in Fiscal Years 

2012-2015

Note: The amount of overpayments identified is based on amounts reported in Medicaid Integrity 

Contractors’ Final Audit Reports to the states during a given fiscal year. Overpayments are 

considered potential at that point, because providers can appeal audit findings. CMS began assigning 

collaborative audits in 2010 and stopped assigning non-collaborative audits in February 2011. 

Overpayments identified by non-collaborative audits decreased from over $7 million to less than 

$100,000 from fiscal year 2012 to fiscal year 2015, as CMS transitioned to collaborative audits.

CMS encourages states to use collaborative audits, but states determine 

whether to have collaborative audits. CMS officials noted that they 

educate states on how MICs can provide audit assistance, conduct 

outreach to explore states’ interest in pursuing collaborative audits, and 

sometimes suggest that states consider certain types of audit targets. For 

example, CMS officials said that they have encouraged additional states 

to consider collaborative audits of hospice providers, based on prior 

collaborative audits that were successful in identifying overpayments to 

hospice providers. CMS does not require states to have collaborative 

audits, and while in the past the agency has independently identified and 

assigned MICs to conduct audits in states, it does not do so for 

collaborative audits.
Page 20 GAO-17-277 Medicaid Program Integrity

Although most states have participated in a collaborative audit, we found 

that states’ use of audits varied significantly—and many states have had 

few or no new collaborative audits assigned in recent years. Overall, 41 

states had at least one collaborative audit assigned from fiscal year 2012 

through June 2016, and the remaining 11 states had none.42 (See fig. 2.) 

Collaborative audits vary in their scope, complexity, and results, thus the 

number of audits in a state does not necessarily indicate the amount of 

contractor and state resources needed to complete the audits, or reflect 

the total amount of potential overpayments identified.43 However, these 

data illustrate states’ widely varying use of collaborative audits.

 42CMS assigned collaborative audits to a MIC after coordinating with the state and MIC 

and approving the plan for the audit.

43In addition, the number of assigned audits does not include potential audits that CMS 

and states may have discussed, but did not ultimately approve. CMS officials noted that 

sometimes CMS proposes ideas for audits to states, but they do not move forward with 

the audits because they would duplicate state audit efforts. CMS officials also noted that 

sometimes they determine that a potential audit might not yield enough benefits to merit 

conducting the audit, or that the audit might not yield evidence or support to survive a 

potential appeals process.
Page 21 GAO-17-277 Medicaid Program Integrity

Figure 2: Number of Collaborative Audits Assigned from Fiscal Year 2012 through June 2016, by State

Nearly all collaborative audits have been of Medicaid fee-for-service 

providers, but CMS would like to expand the use of these audits to 

examine services delivered under managed care. CMS officials told us 

that in three states there have been 14 collaborative audits of providers 

that are part of Medicaid managed care networks. There has also been a 
Page 22 GAO-17-277 Medicaid Program Integrity

collaborative audit of a managed care organization in one of those states. 

CMS officials said they are looking to build on these experiences and 

expand the use of audits in managed care environments. Officials from 

one state we spoke with said they discussed having collaborative audits 

of managed care network providers, but that there were challenges with 

how to select audit targets and conduct the audits, partly because they 

would be relying on different types of data—managed care encounter 

data—rather than fee-for-service data.

Officials from the eight states we interviewed reported mixed experiences 

with and interest in collaborative audits. Three states had positive 

experiences with collaborative audits and were likely to seek future 

audits. Two states had prior or ongoing collaborative audits, but were 

unlikely to seek future audits due to negative audit experiences. Two 

other states had not sought or participated in collaborative audits and 

were unlikely to seek them in the future. The remaining state had sought 

its first collaborative audits and was waiting for CMS approval to proceed. 

States’ negative audit experiences and reluctance to seek collaborative 

audits may limit CMS’s ability to fully leverage federal contractors to 

identify and recover improper payments in the future.

Officials from the three states with positive collaborative audit 

experiences said the MICs were valuable partners that had augmented 

their states’ audit resources and identified substantial overpayments to 

providers that posed program integrity concerns. Officials noted that 

collaborative audits allowed them to target audits to their specific needs, 

which in their view was a significant improvement over the earlier noncollaborative audit model. For example, officials in one state said that 

their MIC conducted collaborative audits in areas where the state had its 

own audits, but needed additional support, as well as audits in areas 

where the state did not have experience or expertise. The state’s 

collaborative audits identified over $5 million in potential overpayments in 

fiscal years 2014 and 2015. Another state’s first two collaborative audits 

identified over $2 million in potential overpayments related to personal 

care services in fiscal year 2015. All three states were likely to seek future 

collaborative audits. 

Officials from two states said that staff burden, communication issues, 

and other barriers had hindered the success of their collaborative audits, 

and made them unlikely to seek future collaborative audits. While officials 

from both states reported having positive experiences with other federal 

contractors that assisted them with program integrity audits or analysis, 

Several States Had 

Positive Collaborative 

Audit Experiences, While 

Others Reported Barriers 

that May Limit Audit 

Participation and Success

One State’s Positive Experience with 

Collaborative Audits

Officials from one state said their audit efforts 

“would not be complete” without their MIC 

supplementing the state’s own staff and audit 

efforts. This state used their MIC for “single 

issue” audits focusing on specific areas, which 

state officials said was more efficient than 

doing audits on a wider range of topics.

Source: GAO summary of state information | GAO-17-277
Page 23 GAO-17-277 Medicaid Program Integrity

they noted problems with collaborative audits. In particular, officials in 

both states said that it took a substantial amount of time for state staff to 

work with the MICs on the collaborative audits. These officials also 

indicated that their MICs had not communicated with them sufficiently 

about the collaborative audits. Officials from one of the states said the 

audits had limited success in identifying overpayments. Officials from the 

other state reported barriers to completing audits of high-risk providers 

where they expected to identify overpayments. For example, officials said 

that insufficient MIC staff and other factors led to lengthy audit delays. As 

of May 2016, the six collaborative audits that began in this state in 2014 

had not all been finalized, preventing the state from collecting 

overpayments in a timely way. Further, some providers went out of 

business before the audits were complete, preventing this state from 

recovering any overpayments.44 CMS officials stated that they work 

closely with states to determine audit plans and timeframes, but 

acknowledged that sometimes issues arise during audits or the appeals 

process that can create challenges. 

Officials from the two states that had not sought collaborative audits said 

that the potential burden on staff, MICs’ lack of familiarity with state 

programs or policy, and communication concerns were among the 

barriers that made them unlikely to seek collaborative audits. Officials 

said they believed that collaborative audits would lead to a burden for 

state staff without commensurate benefits and preferred to conduct audits 

themselves.45 Officials from one state said they had a well-established 

audit department with staff familiar with the state’s programs and 

regulations, and it would not be worth the effort to have those staff work 

with MICs on audits and deal with any resulting provider appeals. Officials 

in the other state said that their MIC had not taken the time to understand 

the state’s program and policies, and had approached the state with audit 

ideas geared more to Medicare or to another state. They also said the 

fact that the MIC would report potential program integrity vulnerabilities—

 44State officials said they reached out to CMS about the delays, and that CMS staff had 

participated in calls with the MIC and had encouraged it to use additional resources. CMS 

officials noted that they were aware of these audits, and that they had been challenging 

due to issues such as policy interpretations, audit strategies, and the large number of 

claims subject to review. In February 2017, CMS officials reported that they had been 

working with state officials to resolve issues with the audits, and the audits were 

proceeding.

45Although CMS covers the cost of the MICs, CMS officials noted that states must have 

staff available to work with MICs when needed—and that some states can commit staff to 

working with MICs, while others might not feel they can do so. 

One State’s Negative Experience with 

Collaborative Audits

Officials from one state found the audits had 

only limited success in identifying improper 

payments, and led to “an excessive amount” 

of administrative burden for state staff. 

Officials said their MIC did not communicate 

sufficiently about audits, and that they did not 

always agree with the MIC’s findings.

Source: GAO summary of state information. | GAO-17-277
Page 24 GAO-17-277 Medicaid Program Integrity

and any resulting findings—to CMS, rather than communicating primarily 

with the state, limited their interest in collaborative audits. These officials 

said improvements in collaboration and communication might increase 

their interest in having audits.

Finally, one state had requested its first collaborative audits, in which they

expected to identify substantial overpayments, but had encountered 

delays in obtaining CMS approval to start. These state officials said they 

began collaborating with their MIC on potential pharmacy audit targets in 

November 2015, but as of June 2016, were waiting for CMS approval to 

proceed with finalizing their agreement with the MIC to conduct the 

audits. CMS officials told us that they had not approved these audits 

because they did not want the MIC to start audits and then have to 

transfer them to the UPIC. CMS officials said they have since had 

conversations with this state about these audits and the role of the UPIC.

States’ varying experiences with collaborative audits indicates that there 

are opportunities for CMS to build upon its experience with these audits, 

and enhance its collaboration with states and contractors on future audits. 

Collaborative audits have been driven by states’ interest in and capacity 

for audits, and CMS’s collaborative approach to audits has yielded 

benefits for some states. However, four states we spoke with described 

barriers—such as staff burden, problems with MIC availability, or 

communication issues—that prevented them from seeking collaborative 

audits or from having audits that yield sufficient benefits. Federal internal

control standards indicate that organizations should identify, analyze, and 

respond to risks related to achieving objectives.46 CMS officials involved 

with collaborative audits said they had refined the collaborative audit 

program over time and that they would continue to explore ways to 

improve their audit support for states. CMS expects to continue the 

collaborative approach to audits.47 It is too soon to tell how states will 

view the collaborative audits once the transition to UPICs is complete, 

and whether states will encounter barriers similar to those that states 

reported to us. Unless CMS can successfully address the potential 

barriers encountered by states, some states may choose not to pursue 

collaborative audits—or may pursue audits only to encounter challenges 

 46See GAO/AIMD-00-21.3.1.

47CMS officials noted that UPICs are required to meet with each state in their jurisdiction, 

as part of the UPIC statement of work. They added that these meetings are to discuss 

how the UPICs can support state efforts and how the UPICs and states will work together.
Page 25 GAO-17-277 Medicaid Program Integrity

that were not effectively minimized or prevented. In both cases, states 

and CMS may not identify and recover additional overpayments. As such, 

CMS might be missing opportunities to better align collaborative audit 

efforts with states that could benefit from them.

The MII is an important source of program integrity training for many 

states; however, states’ demand for MII courses frequently exceeded the 

institute’s capacity. In fiscal year 2015, the MII hosted participants from all

states; the number from each state ranged from 2 in Puerto Rico to 54 in 

Florida.48 (See fig. 3.) Officials in all eight of our selected states identified 

the MII as one of their main resources for program integrity training. 

Officials from two of these states noted that their program integrity staff 

would have no or limited access to training without the MII.

 48As stated earlier, this report examines the 50 states, the District of Columbia, and Puerto 

Rico, which we collectively refer to as “states” in this report.

The Medicaid 

Integrity Institute Is an 

Important Training 

Resource, but State 

Demand Exceeded 

Institute Capacity
Page 26 GAO-17-277 Medicaid Program Integrity

Figure 3: Participants in Medicaid Integrity Institute Training, Fiscal Year 2015

The MII course offerings are generally well received by the states and 

participants. Of the eight selected states, officials in six states said that 

the MII courses aligned well with their program integrity needs, and the 

MII obtained state input regarding courses to offer. Officials from the two 
Page 27 GAO-17-277 Medicaid Program Integrity

other states indicated that MII courses do not always align with their 

current needs.

One of the important benefits of the MII reported by state officials and 

course participants in their course evaluations is the opportunity to meet 

with and learn from program integrity officials from across the country. 

Learning occurs on a formal and informal basis while on-site at the MII. In 

the classroom, participants learn from state officials who serve as faculty 

for the MII courses, and from each other through in-class discussions. 

While on-site at the MII, there are also informal opportunities for 

information sharing that can lead to further state-to-state collaboration. 

According to one state official we spoke with, when serving as MII faculty 

he discussed a problematic provider in his state. A participant recognized 

that they had a similar issue in their state. As a result of this conversation, 

the state official and participant learned that it was the same provider and 

a multi-state investigation resulted in the provider’s arrest. State officials 

in our sample also noted that collaboration and sharing continues once 

they leave the MII. Officials in one state mentioned the benefit of being 

on-site at the MII is that it is a safe place to raise program integrity 

questions and concerns without the fear of that resulting in a CMS audit. 

From fiscal year 2014 to fiscal year 2016, states’ demand for their staff to 

attend MII courses was high and frequently exceeded the institute’s 

capacity. Officials from six of our selected states indicated that they would 

like to send more program integrity staff to the MII, but are limited by the 

courses offered and MII’s limit on how many staff states can nominate to 

attend.49 Further, officials in three of these states said that they wanted 

additional staff to attend the certification courses, and one state official 

observed that due to high demand it might take several nominations 

before one of their staff is accepted into a course.50 The MII maintains a 

waitlist for each class with open enrollment. All but one course with open 

enrollment offered in fiscal year 2015 had a waitlist with between 2 to 41 

 49Officials from our other two selected states said that they send as many staff as they 

would like. Officials in one state said their program integrity staff is too small to allow more 

of their staff to attend. In the other state, officials thought that most of the courses were 

repeats of classes they had already attended. 

50The MII invites states to nominate up to three potential participants per course. MII 

officials select nominees from states in the order in which the nominations are received; 

they select the first nominee from each responding state before selecting the second 

nominee from any state. Due to class size limits, and the manner in which the MII selects 

nominees to participate, it may take an individual being nominated several times before 

they are selected to participate.

The Value of the Medicaid Integrity 

Institute to Attendees

One course participant commented that the 

training offered at the MII is the only job 

training they receive as program integrity 

professionals, besides on the job training, and 

the opportunity to attend these trainings has 

made the participant a more valuable 

employee.

Source: GAO review of MII course evaluations. | GAO-17-277

The Benefit of the Medicaid Integrity 

Institute

Officials from one state told GAO that the 

networking opportunities that present 

themselves at the MII allow program integrity 

staff to establish a network of resources that 

they can leverage once they have completed 

the training; state staff often reach out to 

people they have met at the MII, so the 

benefits last well beyond the actual training 

dates.

Source: GAO summary of state information. | GAO-17-277
Page 28 GAO-17-277 Medicaid Program Integrity

potential participants on it. Currently, if an individual is unable to attend a 

course, the open space is transferred to the next individual on the 

waitlist—who is not necessarily from that same state. MII officials said 

that they use the waitlist to fill spaces due to cancellations in the order on 

the list, precluding them from simply replacing cancellations with other 

nominees from the same state. Officials from one state, however, said 

that—in the event of an unexpected cancellation for a reserved slot—the 

state should be able to send a replacement. 

MII officials are aware of the demand for the MII offerings, but were 

limited in their ability to expand their capacity by classroom space 

constraints and staffing vacancies in fiscal year 2016.51 These constraints 

also limited the number and types of courses and webinars the institute 

could offer. MII officials noted that their fiscal year 2016 schedule 

included many “core” courses, such as Coding for Non-Coders and 

Managed Care Oversight Seminar (each offered twice) because the MII 

did not have staff to develop new courses. For example, the Pharmacy 

Symposium course was cancelled, because they did not have staff to 

develop the course. For fiscal year 2017, CMS officials indicated that 

there are 23 planned courses, and many of the courses contain updated 

agendas and course content. There will be courses focused on managed 

care oversight, provider audits, and provider enrollment, which will include 

opportunities to share best practices, among other things. CMS officials 

said that the courses on emerging trends in Medicaid will focus on 

personal care services and beneficiary fraud.

MII began webinar offerings in fiscal year 2011, with the goal of 

expanding MII capacity and bringing course content to a larger audience. 

However, the number of webinar offerings in fiscal year 2016 was also 

limited by MII staffing vacancies. MII officials indicated that they are in the 

process of hiring someone to expand their webinar offerings in fiscal year 

2017 and beyond to try to meet states’ demand for courses. States 

reported finding the webinars useful, as they can cover timely topics, 

reach a wider audience than the on-site courses, and do not require staff 

to travel to participate. However, state officials find that the webinar 

format is not as effective in encouraging questions and discussion as the 

51The MII shares space with several other training programs, which limits how much 

classroom space it can have during the year. In fiscal year 2016, the MII was in the 

process of hiring additional staff to fill vacancies to support the on-site courses and 

webinars.

States’ Demand for Medicaid Integrity 

Institute Exceeds Capacity

Officials in one state said it would be helpful to 

be able to have more than one or two people 

attend per class to benefit from what is being

taught, so they would send more people to 

the MII if they could. 

Source: GAO summary of state information. | GAO-17-277 
Page 29 GAO-17-277 Medicaid Program Integrity

on-site offerings, and they cannot replicate the benefits of the face-to-face 

interactions that occur at the MII.

CMS uses focused state program integrity reviews as its primary method 

of collecting and communicating promising program integrity practices; 

however, these practices are not collected in a consistent manner and the 

published reports are not timely nor easily searched electronically. Other 

mechanisms for collecting and sharing promising practices are available, 

but CMS designed them for other purposes and does not use them to 

broadly communicate promising practices.

CMS uses its focused reviews to collect and report promising program 

integrity practices, but these reviews do not result in the systematic 

inclusion of promising practices in state program integrity review 

reports.52 Both CMS and the states have a role in ensuring that promising 

program integrity practices are identified, collected, and shared.

According to CMS officials, its focused reviews of state program integrity 

activities are their primary method of collecting states’ promising 

practices; however, the number of CMS- and state-identified promising 

practices included in these reports has declined from fiscal years 2013 to 

2015. In the course of the review, CMS officials may or may not learn 

about a state’s promising practices through direct observation, input from 

the state, or prior experience with the state. In addition, CMS officials said 

that individuals who perform the reviews ask states to identify promising 

practices. Yet, officials from only one of the five states in our sample that 

CMS reviewed in fiscal year 2014 or fiscal year 2015 said reviewers 

asked them to identify promising practices.

In addition, due to the timing of the state program integrity reviews, CMS 

may not be aware of the promising program integrity practices that states 

implement in intervening years. According to CMS officials, the 

 52As noted earlier, we use the term “promising practices” to refer to CMS-identified 

noteworthy practices and state-identified effective practices that CMS includes in the state 

program integrity reviews.

CMS Lacks a 

Systematic Approach 

to Collecting and 

Communicating 

States’ Promising 

Program Integrity 

Practices

Focused Review Reports 

Do Not Always Include 

Promising Program 

Integrity Practices and Are 

Not Easily Searched
Page 30 GAO-17-277 Medicaid Program Integrity

combination of focused and desk reviews allows CMS to review more 

states more often. However, the focused reviews do not cover as many 

topic areas as prior reviews and desk reviews are scoped narrowly on 

specific areas of interest. It is not clear that CMS officials would be 

exposed to the full range of promising state practices. The number of 

state reviews that include promising practices has decreased significantly, 

from almost 80 percent of the published reviews in fiscal year 2013, to 25 

percent in each of fiscal years 2014 and 2015. As such, CMS may not be 

aware of the full range of promising practices that exist in states’ varied 

environments. Federal internal control standards stipulate that 

management should use quality information and externally communicate 

the necessary quality information to achieve the entity’s objectives.53

CMS publishes any identified promising program integrity practices in the 

focused review reports, which are intended to help promote promising 

practices among states. However, these reports are not a timely 

mechanism for sharing the practices, in part, because of the intervals 

between the reviews and publication.54 Although CMS officials said they 

are working to reduce the time it takes to complete and publish the 

focused review reports, the agency recently reported that the process still 

took 278 days, on average, in fiscal year 2015, down from 489 days in 

fiscal year 2014. Summaries of the state reviews, which include a section 

on promising practices, are further delayed. For example, the most recent 

summary was published in June 2014, and it included promising practices 

identified from December 1, 2011 through December 31, 2012, and CMS 

officials could not say when a more updated version would be published.

CMS officials said they are exploring ways to disseminate promising 

practices faster than the current reports allow. These delays can mean 

that identified promising practices may be outdated or no longer relevant 

by the time the report is published. For example, officials in one state said 

that the promising program integrity practice identified in their most recent 

review was no longer being used by the time their state report was 

published.

Once published, the usefulness of these focused review reports to 

communicate promising practices broadly to all states is limited by the 

inconsistent inclusion of promising practices, and the inability to search 

 53See GAO/AIMD-00-21.3.1.

54CMS officials noted that they do not share any identified promising practices until the 

report is publically published and uploaded to their website.
Page 31 GAO-17-277 Medicaid Program Integrity

electronically across published reports or view all promising practices in a 

single location. Of the reports published in fiscal years 2014 and 2015, 4 

of 16 reports included promising practices; when reports do not include 

promising practices is it unclear why. Currently, there is no search 

function or index to easily find practices that relate to a specific interest 

among the published reports; the only approach is to review each 

published report to see whether there are any identified practices relevant 

to a state. Officials from three of the eight selected states we interviewed 

said that they use these reports to learn about promising program 

integrity practices; the remaining five states did not comment on using 

these reports for this purpose. All states referred to other mechanisms 

that they use to learn about practices that have been effective in other 

states.

Beyond focused reviews, CMS officials said that they identify and 

communicate promising practices through a number of other 

mechanisms, such as the MII, Medicaid Fraud, Waste and Abuse TAG 

calls, Regional Information Sharing System, technical assistance to the 

states, and mass email distributions; however, for the most part, these 

mechanisms were not designed for the purposes of sharing promising 

practices, and none ensures that information about promising practices is 

communicated broadly to all states. Further, several mechanisms are 

limited in their distribution, and, as a result, the promising practices might 

not reach all relevant program integrity staff. While states have an interest 

in learning about promising practices used in states other than their own, 

the eight states in our sample did not have a uniform understanding of 

how to systematically share or access information about promising 

practices.

Medicaid Integrity Institute: State officials in seven of our eight selected 

states said that attending the MII helped them learn about promising 

program integrity practices used in other states, which is a part of CMS’s 

intent for some of the offered courses. While the MII is a useful resource 

for attendees—and state staff can, and in some cases are required to, 

share the knowledge they learned with their colleagues when they 

return— the information presented may not reach all state audiences that 

could benefit. Specifically, there are limits to the number of state staff who 

can participate in on-site MII courses, and participation and sharing is 

dependent on states’ staff being able to take part in relevant classes as 

participants or faculty.

CMS Does Not Broadly 

Communicate Promising 

Practices Identified 

through Other 

Mechanisms
Page 32 GAO-17-277 Medicaid Program Integrity

Regional Information Sharing System: The Regional Information 

Sharing System is DOJ’s secure, web-based system for information 

sharing between state officials. It is intended to be a safe space where 

state program integrity staff can discuss relevant issues without CMS 

monitoring them. According to CMS officials, the Regional Information 

Sharing System is a way CMS shares promising practices among state 

program integrity staff. According to CMS officials, as of December 2016, 

there were approximately 360 Regional Information Sharing System 

users in the states. However, actual use by Regional Information Sharing 

Systems users is unknown. Officials in one state thought that the 

Regional Information Sharing System was not consistently used by all 

states. No states in our sample identified the Regional Information 

Sharing System as one of the ways that they identify promising practices, 

although officials in one state did note that they use it to share promising 

practices with other states.

Medicaid Fraud, Waste and Abuse TAG calls: CMS officials reported 

that the monthly Medicaid Fraud, Waste and Abuse TAG calls between 

CMS, MII, and senior state officials are a venue for discussing promising 

state practices, among other program integrity issues. CMS officials said 

they work with states to develop TAG call presentations and content that 

helps states with program integrity administration. Officials from six of our 

selected states said the calls were useful in helping them learn about 

promising practices. However, topics that are discussed are dependent 

on CMS and the specific state individuals participating in the call. 

Medicaid Fraud, Waste and Abuse TAG calls are voluntary, and the 

information shared might not always reach a wide range of state program 

integrity officials.

Technical assistance to states: CMS shares relevant promising 

practices when it responds to states requesting technical assistance. 

CMS officials said that they are providing an increasing amount of 

technical assistance—responding to 26 inquiries in the first quarter of 

fiscal year 2016 to 96 inquiries in the fourth quarter. CMS officials 

indicated that they rely on staff experience and knowledge of state 

practices to make timely and relevant referrals.

Other mechanisms: CMS officials told us that they use mass email 

distributions to share new policies, guidance, and best practices. When 

we asked state officials in our eight selected states about other 

mechanisms for sharing, they reported learning about and sharing 

promising practices through online toolkits, at the annual National 
Page 33 GAO-17-277 Medicaid Program Integrity

Association for Medicaid Program Integrity conference, direct outreach to 

other states, and issuing press releases and reports.

Although CMS has a variety of mechanisms to share promising program 

integrity practices, states may not be able to easily and efficiently identify 

relevant practices, because they would need to monitor multiple 

communication mechanisms to ensure that they are receiving all 

potentially relevant information. Officials in one state said that while they 

do what they can to learn about promising practices from other states, 

CMS could do more to share practices and help states to learn about 

what is working well in other states. This statement is consistent with 

federal internal control standards that stipulate that agencies should use 

quality information to achieve the entity’s objectives and externally 

communicate necessary quality information.55 Despite CMS’s various 

efforts, none of these other communication mechanisms has a

consistently broad reach and the agency does not have a well-understood 

communication strategy for using these mechanisms. As such, CMS is 

missing an opportunity to support states’ program integrity efforts by 

making the range of potential solutions across states broadly known to 

states in a timely and efficient manner.

CMS has taken a number of important steps to tailor and improve its 

oversight and support of states’ Medicaid program integrity efforts. CMS’s 

use of focused reviews to address oversight of managed care plans and 

other high-risk areas has been beneficial, and generally an improvement 

over the agency’s earlier approach. It is too soon to tell how effective 

CMS’s new desk reviews will be in enhancing oversight, but CMS plans to 

assess how well these two types of reviews, together, meet the agency’s 

needs and whether additional changes could be useful.

CMS’s shift to collaborative audits has helped identify a substantial 

amount of potential overpayments and has yielded important benefits for 

some states, including those who told us they viewed collaborative audits 

as an important part of their program integrity efforts. Some states’ 

negative experiences with or reluctance to seek collaborative audits, 

however, highlight potential areas of improvement as CMS transitions 

Medicaid audits to the new UPICs. It is too soon to tell how and whether 

the UPIC program will address states’ needs and the barriers we 

 55See GAO/AIMD-00-21.3.1.

Conclusions
Page 34 GAO-17-277 Medicaid Program Integrity

identified, such as burden on state staff and communication issues. 

However, our findings illustrate that there are opportunities for CMS to 

build on both the successes and challenges states have experienced in 

collaborative audits to help enhance its collaboration with states and 

UPICs as it implements and oversees this new program. There are 

opportunities, for example, for collaborative audits to help enhance 

oversight of managed care expenditures.

Both CMS and the states have a role in identifying promising program 

integrity practices that can be shared in order to help improve oversight of 

the Medicaid program. Efforts that are based in the states—such as the 

Regional Information Sharing System—are not used consistently. CMS’s 

methods of collecting and communicating states’ promising program 

integrity practices have not always been systematic, and often are limited 

in their reach to state officials. Given the increasing improper payment 

rate in Medicaid, it is in the interest of both CMS and the states to identify 

and share practices that show promise in reducing improper payments in 

as efficient a manner as possible. CMS could take a more centralized role 

in collecting and communicating promising practices, providing a forum 

through which states could learn about what is working well in other 

states and consider whether such practices might succeed in their own 

states.

To build upon CMS’s collaborative audit efforts and help enhance future 

collaboration, CMS should identify opportunities to address barriers that 

limit states’ participation in collaborative audits. Such opportunities could 

include improving communication with states before, during, and after 

audits are completed; and ensuring that audits align with states’ program 

integrity needs, including the need for oversight of services provided in 

managed care delivery systems.

To better support states’ efforts to reduce improper payments and 

communicate effective program integrity practices across the states, CMS 

should collaborate with states to

• develop a systematic approach to collect promising state program 

integrity practices, and

• create and implement a communication strategy for sharing promising 

program integrity practices with states in an efficient and timely 

manner.

Recommendations for 

Executive Action
Page 35 GAO-17-277 Medicaid Program Integrity

We provided a draft of this report to HHS and DOJ for their review and 

comment. In written comments, HHS concurred with our 

recommendations. With regard to our recommendation that CMS identify 

opportunities to address barriers that limit states’ participation in 

collaborative audits, HHS noted that it continually seeks to collaborate 

with states on Medicaid provider audits, and seeks to work through issues 

so that actions to identify potentially improper payments may proceed. 

HHS added that as it transitions its anti-fraud work from the MICs and 

other contractors to the new UPICs, there will be opportunities for 

improving communication with states and aligning MIC audits with states’ 

program integrity needs. With regard to our recommendations that CMS 

collaborate with states on both collecting and sharing promising program 

integrity practices, HHS said it would work to systematize the collection of 

promising state program integrity practices, and to share such practices 

with states in an accelerated manner. HHS noted that it is strongly 

committed to program integrity efforts in Medicaid, and has a wide variety 

of activities to oversee and support states’ Medicaid program integrity 

efforts. HHS’s written comments are reproduced in appendix II. HHS also 

provided technical comments, which we incorporated as appropriate. DOJ 

did not provide formal written comments, but provided technical 

comments, which we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, the Administrator of CMS, appropriate 

congressional committees, and other interested parties. In addition, the 

report will be available at no charge on the GAO website at 

http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found 

on the last page of this report. GAO staff that made key contributions to 

this report are listed in appendix III.

Sincerely yours,

Carolyn L. Yocom

Director, Health Care

Agency Comments

and Our Evaluation
Appendix I: Medicaid Integrity Institute 

Attendance for Fiscal Year 2012 through Fiscal 

Year 2015, by State

Page 36 GAO-17-277 Medicaid Program Integrity

Table 3: Medicaid Integrity Institute Attendance for Fiscal Year 2012 through Fiscal Year 2015, by State 

State 2012 2013 2014 2015 Total

Alabama 16 13 4 6 39

Alaska 15 13 18 23 69

Arizona 29 33 33 41 136

Arkansas 18 17 12 8 55

California 6 18 21 32 77

Colorado 11 20 20 13 64

Connecticut 12 14 12 19 57

Delaware 13 11 11 9 44

District of Columbia 2 8 8 9 27

Florida 37 56 47 54 194

Georgia 34 33 38 31 136

Hawaii 9 2 4 4 19

Idaho 12 14 11 12 49

Illinois 19 18 29 34 100

Indiana 24 15 17 15 71

Iowa 5 7 5 4 21

Kansas 11 15 9 9 44

Kentucky 8 19 19 31 77

Louisiana 9 3 17 20 49

Maine 11 8 6 8 33

Maryland 18 16 14 21 69

Massachusetts 24 15 17 25 81

Michigan 16 44 35 45 140

Minnesota 20 16 18 20 74

Mississippi 19 16 19 38 92

Missouri 18 18 21 34 91

Montana 9 4 15 22 50

Nebraska 10 14 15 14 53

Nevada 14 13 16 13 56

New Hampshire 16 12 14 10 52

New Jersey 28 24 24 21 97

New Mexico 23 16 13 19 71

New York 56 40 25 34 155

North Carolina 25 21 29 37 112

North Dakota 22 6 8 5 41

Appendix I: Medicaid Integrity Institute 

Attendance for Fiscal Year 2012 through 

Fiscal Year 2015, by State
Appendix I: Medicaid Integrity Institute 

Attendance for Fiscal Year 2012 through Fiscal 

Year 2015, by State

Page 37 GAO-17-277 Medicaid Program Integrity

Ohio 20 8 12 20 60

Oklahoma 19 9 18 17 63

Oregon 24 18 18 5 65

Pennsylvania 38 36 27 31 132

Puerto Rico 1 6 2 2 11

Rhode Island 2 5 5 11 23

South Carolina 36 35 14 31 116

South Dakota 1 1 1 6 9

Tennessee 31 31 30 42 134

Texas 32 39 42 40 153

Utah 6 1 5 15 27

Vermont 15 14 20 20 69

Virginia 9 10 9 12 40

Washington 28 18 35 33 114

West Virginia 9 9 4 7 29

Wisconsin 21 28 28 34 111

Wyoming 9 15 12 6 42

Total 920 895 906 1072 3793

Source: GAO based on information from the Centers for Medicare & Medicaid Services. | GAO-17-277

Note: For the purposes of this report, we include the 50 states, the District of Columbia, and Puerto 

Rico, which we collectively refer to as “states.”
Appendix II: Comments from the Department 

of Health and Human Services

Page 38 GAO-17-277 Medicaid Program Integrity

Appendix II: Comments from the Department 

of Health and Human Services
Appendix II: Comments from the Department 

of Health and Human Services

Page 39 GAO-17-277 Medicaid Program Integrity
Appendix II: Comments from the Department 

of Health and Human Services

Page 40 GAO-17-277 Medicaid Program Integrity
Appendix II: Comments from the Department 

of Health and Human Services

Page 41 GAO-17-277 Medicaid Program Integrity
Appendix III: GAO Contacts and Staff 

Acknowledgments

Page 42 GAO-17-277 Medicaid Program Integrity

Carolyn L. Yocom, (202) 512-7114 or yocomc@gao.gov

In addition to the contact named above, Leslie V. Gordon (Assistant 

Director), Robin Burke (Analyst-in-Charge), Drew Long, Emily Loriso, and 

Elizabeth A. Miller made key contributions to this report. Also contributing 

were Vikki Porter and Jennifer Whitworth.

Appendix III: GAO Contacts and Staff 

Acknowledgments

GAO Contacts

Staff 

Acknowledgments 
Related GAO Products

Page 43 GAO-17-277 Medicaid Program Integrity

Medicaid Program Integrity: Improved Guidance Needed to Better 

Support Efforts to Screen Managed Care Providers. GAO-16-402. 

Washington, D.C.: April 22, 2016.

Medicaid and CHIP: Increased Funding in U.S. Territories Merits 

Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April 

8, 2016.

Medicaid: Additional Actions Needed to Help Improve Provider and 

Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 

2015.

Medicaid Information Technology: CMS Supports Use of Program 

Integrity Systems but Should Require States to Determine Effectiveness. 

GAO-15-207. Washington, D.C.: January 30, 2015.

Medicaid Program Integrity: Increased Oversight Needed to Ensure 

Integrity of Growing Managed Care Expenditures. GAO-14-341. 

Washington, D.C.: May 19, 2014.

Medicaid: CMS Should Ensure That States Clearly Report 

Overpayments. GAO-14-25. Washington, D.C.: December 6, 2013.

Medicaid: Enhancements Needed for Improper Payments Reporting and 

Related Corrective Action Monitoring. GAO-13-229. Washington, D.C.: 

March 29, 2013.

Medicaid Integrity Program: CMS Should Take Steps to Eliminate 

Duplication and Improve Efficiency. GAO-13-50. Washington, D.C.: 

November 13, 2012.

National Medicaid Audit Program: CMS Should Improve Reporting and 

Focus on Audit Collaboration with States. GAO-12-627. Washington, 

D.C.: June, 14, 2012.

Related GAO Products

(100350)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.