PATIENT PROTECTION 

AND AFFORDABLE 

CARE ACT

Preliminary Results of 

Undercover Testing of the 

Federal Marketplace and 

Selected State 

Marketplaces for 

Coverage Year 2015

Statement of Seto Bagdoyan, Director, Forensic Audits 

and Investigative Service

Testimony 

Before the Subcommittee on Health, 

Committee on Energy and Commerce, 

House of Representatives

For Release on Delivery 

Expected at 9:00 a.m. ET

Friday, October 23, 2015

GAO-16-159T

United States Government Accountability Office
Highlights of GAO-16-159T, a testimony 

before the Subcommittee on Health, 

Committee on Energy and Commerce, House 

of Representatives

October 23, 2015

PATIENT PROTECTION AND AFFORDABLE 

CARE ACT

Preliminary Results of Undercover Testing of the 

Federal Marketplace and Selected State Marketplaces 

for Coverage Year 2015 

Why GAO Did This Study

PPACA provides for the establishment 

of health-insurance marketplaces 

where consumers can, among other 

things, select private health-insurance 

plans or apply for Medicaid. The 

Congressional Budget Office estimates 

the cost of subsidies and related 

spending under PPACA at $60 billion 

for fiscal year 2016. PPACA requires 

verification of applicant information to 

determine enrollment or subsidy 

eligibility. In addition, PPACA provided 

for the expansion of the Medicaid 

program. GAO was asked to examine 

application and enrollment controls for 

the marketplaces and Medicaid.

This testimony provides preliminary 

results of undercover testing of the 

federal and selected state 

marketplaces during the 2015 openenrollment period, for both private 

health-care plans and Medicaid. GAO 

submitted, or attempted to submit, 18 

fictitious applications by telephone and

online, 10 of which tested controls 

related to obtaining subsidized healthplan coverage available through the 

federal Marketplace in New Jersey and 

North Dakota, and through state

marketplaces in California and 

Kentucky. GAO chose these four 

states based partly on a range of 

population sizes and whether the state 

had expanded Medicaid eligibility

under terms of the act. The other 8 

applications, among the 18 GAO 

made, tested marketplace and state

controls under the marketplace system 

for determining Medicaid eligibility in 

these four states. The undercover 

results, while illustrative, cannot be 

generalized to the full population of 

enrollees. GAO discussed the results 

of its testing with CMS and state 

officials to obtain their perspectives. 

What GAO Found

Under the Patient Protection and Affordable Care Act (PPACA), health-insurance 

marketplaces are required to verify application information to determine eligibility 

for enrollment and, if applicable, determine eligibility for income-based subsidies 

or Medicaid. These verification steps include reviewing and validating information 

about an applicant’s Social Security number, if one is provided; citizenship, 

status as a national or lawful presence; and household income and family size.

For 10 fictitious applicants, GAO tested application and enrollment controls for 

obtaining subsidized health plans available through the federal Health Insurance 

Marketplace (Marketplace) (for New Jersey and North Dakota) and two selected 

state marketplaces (California and Kentucky). Although 8 of these 10 fictitious 

applications failed the initial identity-checking process, all 10 were subsequently 

approved by the federal Marketplace or the selected state marketplaces. Four 

applications used Social Security numbers that, according to the Social Security 

Administration (SSA), have never been issued, such as numbers starting with 

“000.” Other applicants had duplicate enrollment or claimed their employer did 

not provide insurance that meets minimum essential coverage.

For 8 additional fictitious applicants, GAO tested enrollment into Medicaid 

through the same federal Marketplace and the two selected state marketplaces, 

and was able to obtain either Medicaid or alternative subsidized coverage for 7 of 

the 8 applicants. Specifically:

• Three were approved for Medicaid, which was the health-care program for 

which GAO originally sought approval. In each case, GAO provided identity 

information that would not have matched SSA records. For two applications, 

the marketplace directed the fictitious applicants to submit supporting 

documents, which GAO did (such as a fake immigration card), and the 

applications were approved. For the third, the marketplace did not seek 

supporting documentation, and the application was approved by phone.

• For four, GAO did not obtain approval for Medicaid; however, GAO was 

subsequently able to gain approval of subsidized health plans based on the 

inability to obtain Medicaid coverage. In 1 case, GAO falsely claimed that it 

was denied Medicaid in order to obtain the subsidized health plan when in 

fact no Medicaid determination had been made by the state at that time.

• For one, GAO was unable to enroll into Medicaid, in California, because 

GAO declined to provide a Social Security number. According to California 

officials, the state marketplace requires a Social Security number or 

taxpayer-identification number to process applications. 

According to officials from the Centers for Medicaid & Medicare Services (CMS), 

California, Kentucky, and North Dakota, the marketplaces and Medicaid offices 

only inspect for supporting documentation that has obviously been altered. Thus, 

if the documentation submitted does not show such signs, it would not be 

questioned for authenticity. GAO’s work is continuing, and GAO plans to issue a 

final report at a later date.

View GAO-16-159T. For more information, 

contact Seto Bagdoyan at (202) 512-6722 or 

BagdoyanS@gao.gov.

United States Government Accountability Office
Letter

Chairman Pitts, Ranking Member Green, and Members of the 

Subcommittee:

I am pleased to be here today to discuss enrollment for health-care 

coverage obtained through the health-insurance exchanges, or 

marketplaces, established under the Patient Protection and Affordable 

Care Act (PPACA) and, in particular, to discuss the preliminary results of 

our undercover testing of eligibility and enrollment controls for the federal 

Health Insurance Marketplace (Marketplace) and selected state 

marketplaces for the 2015 coverage year. PPACA provides subsidies to 

those eligible to purchase private health-insurance plans who meet 

certain income and other requirements. With those subsidies and other 

costs, the act represents a significant, long-term fiscal commitment for the 

federal government. According to the Congressional Budget Office, the 

estimated cost of subsidies and related spending under the act is $60 

billion for fiscal year 2016, rising to $105 billion for fiscal year 2025, and 

totaling $880 billion for fiscal years 2016–2025.1

While subsidies under the act are not paid directly to enrollees, 

participants nevertheless benefit financially through reduced monthly 

premiums or lower costs due at time of service, such as copayments.2

Because subsidy costs are contingent on who obtains coverage, 

enrollment controls that help ensure only qualified applicants are 

approved for subsidized coverage are a key factor in determining federal 

expenditures under the act.3 In addition, PPACA provided for the 

expansion of the Medicaid program.4 Under the expansion, states may 

1

Related spending includes marketplace grants to states and other items. 

2

Enrollees can pay lower monthly premiums by virtue of a tax credit the act provides. They 

may elect to receive the tax credit in advance, to lower premium cost, or to receive it at 

time of income-tax filing, which reduces tax liability. 

3

According to Department of Health and Human Services’ (HHS) Centers for Medicare & 

Medicaid Services (CMS) data, about 11.7 million people selected or were automatically 

reenrolled into a 2015 health insurance plan under the act. A large share of those 

enrollees—87 percent, in states using the HealthCare.gov system—qualified for the 

advance premium tax-credit subsidy provided by the act, which is described later in this 

statement. 

4

PPACA provides states with additional federal funding to expand their Medicaid 

programs to cover adults under 65 with income up to 133 percent of the federal poverty 

level. Because of the way the limit is calculated, using what is known as an “income 

disregard,” the level is effectively 138 percent of the federal poverty level. 

Letter

Page 1 GAO-16-159T 

 
choose to provide Medicaid coverage to nonelderly adults who meet 

income limits and other criteria. Under PPACA, the federal government is 

to fully reimburse states through fiscal year 2016 for the Medicaid 

expenditures of “newly eligible” individuals who gained Medicaid eligibility 

through the expansion.5 According to the Office of the Actuary of the 

Centers for Medicare & Medicaid Services (CMS), federal expenditures 

for the Medicaid expansion are estimated at $430 billion from 2014 

through 2023.6

PPACA provides for the establishment of health-insurance marketplaces 

to assist consumers in comparing and selecting among insurance plans 

offered by participating private issuers of health-care coverage.7 Under 

PPACA, states may elect to operate their own health-care marketplaces, 

or they may rely on the federal Marketplace, known to the public as 

HealthCare.gov.8 These marketplaces were intended to provide a single 

point of access for individuals to enroll in private health plans, apply for 

income-based subsidies to offset the cost of these plans—which, as 

noted, are paid directly to health-insurance issuers—and, as applicable, 

obtain an eligibility determination or assessment of eligibility for other 

health-coverage programs, such as Medicaid or the Children’s Health 

Insurance Program.9 CMS, a unit of the Department of Health and Human 

5

The “newly eligible” reimbursement rate drops to 95 percent in calendar year 2017, 94 

percent in calendar year 2018, 93 percent in calendar year 2019, and 90 percent 

afterward.

6

According to the CMS Office of the Actuary, an average of 4.3 million newly eligible 

adults are projected to have been enrolled in Medicaid in 2014, with newly eligible adult 

enrollment projected to reach 12.0 million people by 2023—representing 7 percent and 15 

percent, respectively, of total projected program enrollment. Expenditures for newly 

eligible adults are estimated to have been $23.7 billion in 2014 and are projected to total 

$460 billion over 2014 through 2023, according to the actuary. About $430 billion, or 93 

percent, of these costs are expected to be paid by the federal government.

7

Specifically, the act required, by January 1, 2014, the establishment of health-insurance 

marketplaces in all states. In states not electing to operate their own marketplaces, the 

federal government was required to operate a marketplace.

8

As of March 2015, 37 states were using HealthCare.gov, according to HHS’ Office of the 

Assistant Secretary for Planning and Evaluation, with the federal Marketplace accounting 

for 76 percent (8.8 million) of consumers’ plan selections.

9

Individuals may also continue to apply for Medicaid coverage or the Children’s Health 

Insurance Program through direct application to their respective state agencies. According 

to CMS officials, eligibility requirements are generally the same for both programs. In this 

statement, our testing was only for Medicaid eligibility. 

Page 2 GAO-16-159T 

 
Services (HHS), is responsible for overseeing the establishment of these 

online marketplaces, and the agency maintains the federal Marketplace.

To be eligible to enroll in a “qualified health plan” offered through a 

marketplace—that is, one providing essential health benefits and meeting 

other requirements under PPACA—an individual must be a U.S. citizen or 

national, or otherwise lawfully present in the United States; reside in the 

marketplace service area; and not be incarcerated (unless incarcerated 

while awaiting disposition of charges).10 To be eligible for Medicaid, 

individuals must meet federal requirements regarding residency, U.S. 

citizenship or immigration status, and income limits, as well as any 

additional state-specific criteria that may apply.

Marketplaces are required by PPACA to verify application information to 

determine eligibility for enrollment and, if applicable, determine eligibility 

for the income-based subsidies or Medicaid. These verification steps 

include validating an applicant’s Social Security number, if one is 

provided;11 verifying citizenship, status as a national, or lawful presence 

by comparison with Social Security Administration or Department of 

Homeland Security records; and verifying household income and family 

size by comparison with tax-return data from the Internal Revenue 

Service, as well as data on Social Security benefits from the Social 

Security Administration.12

In light of the government’s substantial fiscal commitment under the act, 

congressional requesters originally asked us to examine enrollment and 

10In this statement, we use “qualified health plan” to refer to coverage obtained from 

private insurers, as distinguished from enrollment in a public health program such as 

Medicaid.

11A marketplace must require an applicant who has a Social Security number to provide 

the number. 42 U.S.C. § 18081(b)(2) and 45 C.F.R. § 155.310(a)(3)(i). However, having a 

Social Security number is not a condition of eligibility.

12For further background, see Department of Health and Human Services, Office of 

Inspector General, Not All of the Federally Facilitated Marketplace’s Internal Controls 

Were Effective in Ensuring That Individuals Were Properly Determined Eligible for 

Qualified Health Plans and Insurance Affordability Programs, A-09-14-01011 

(Washington, D.C.: Aug. 6, 2015); GAO, Patient Protection and Affordable Care Act: IRS 

Needs to Strengthen Oversight of Tax Provisions for Individuals, GAO-15-540

(Washington, D.C.: July 29, 2015); and GAO, Healthcare.gov: CMS Has Taken Steps to 

Address Problems, but Needs to Further Implement Systems Development Best 

Practices, GAO-15-238 (Washington, D.C.: Mar. 4, 2015).

Page 3 GAO-16-159T 

 
verification controls of the federal Marketplace.13 In July 2014, we 

presented testimony on the results of our initial work, which focused on 

application for, and approval of, coverage for fictitious applicants for the 

2014 coverage year—the first under the act—through the federal 

Marketplace.14 In July 2015, we testified on the final results of that work, 

including the maintenance of the fictitious applicant identities and 

extension of coverage through 2014 and into 2015, payment of federally 

subsidized premiums on policies we obtained, and the Marketplace’s 

verification process for applicant documentation.15 We plan to issue a 

final report on the results of our undercover eligibility and enrollment 

controls testing for the 2014 coverage year shortly.

Following the original request, you and other congressional requesters 

asked us to continue to examine enrollment and verification controls of 

the federal Marketplace and state marketplaces as well, for the 2015 

coverage year—the second under the act. My statement today is based 

on the preliminary results and analysis from this ongoing work.

16

Specifically, today’s statement describes the preliminary results of our 

undercover testing of the federal Marketplace and selected state 

marketplaces, for application, enrollment, and eligibility-verification 

controls, for both qualified health-care plans and Medicaid, during the 

13Our original requesters were: in the U.S. Senate, the then–Ranking Member of the 

Committee on Homeland Security and Government Affairs and the then–Ranking Member 

of the Committee on Finance; and in the House of Representatives, the then-Chairman of 

the Committee on Ways and Means and the then-Chairman of the Subcommittee on 

Oversight, Committee on Ways and Means.

14GAO, Patient Protection and Affordable Care Act: Preliminary Results of Undercover 

Testing of Enrollment Controls for Health Care Coverage and Consumer Subsidies 

Provided Under the Act, GAO-14-705T (Washington, D.C.: July 23, 2014). 

15GAO, Patient Protection and Affordable Care Act: Observations on 18 Undercover Tests 

of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided 

under the Act, GAO-15-702T (Washington, D.C.: July 16, 2015).

16Our original requesters are: in the U.S. Senate, the Chairman of the Committee on

Finance; and in the House of Representatives, the Chairman of the Committee on Energy 

and Commerce, the Chairman of the Subcommittee on Health, Committee on Energy and 

Commerce; the former Chairman of the Committee on Ways and Means and the former 

Chairman of the Subcommittee on Oversight, Committee on Ways and Means.

Page 4 GAO-16-159T 

 
act’s second open-enrollment period ending February 2015.17 We plan to 

issue a final report at a later date.

To perform our undercover testing of the federal and selected state 

eligibility and enrollment processes for the 2015 coverage year, we 

created 18 fictitious identities for the purpose of making applications for 

health-care coverage by telephone and online.18 The undercover results, 

while illustrative, cannot be generalized to the full population of enrollees. 

For all 18 applications, we used publicly available information to construct 

our scenarios. We also used publicly available hardware, software, and 

materials to produce counterfeit or fictitious documents, which we 

submitted, as appropriate for our testing, when instructed to do so. We 

then observed the outcomes of the document submissions, such as any 

approvals received or requests to provide additional supporting 

documentation.

Because the federal government, at the time of our review, operated a 

marketplace on behalf of the state in about two-thirds of the states, we 

focused part of our work on two states using the federal Marketplace—

New Jersey and North Dakota. We chose these two states because they 

had expanded Medicaid eligibility and also delegated their Medicaid 

eligibility determinations to the federal Marketplace at the time of our 

testing.19 In addition, we chose two state marketplaces, California and 

Kentucky, for our undercover testing. We chose these two states, in part, 

based on the states having expanded Medicaid eligibility and differences 

in population.

For 10 applicant scenarios, we tested controls for verifications related to 

qualified health-plan coverage. Specifically, we created application 

17Our testing included only applications through a marketplace and did not include, for 

example, applications for Medicaid made directly to a state Medicaid agency.

18For all our applicant scenarios, we sought to act as ordinary consumers might in 

attempting to make a successful application. For example, if, during online applications, 

we were directed to make phone calls to complete the process, we acted as instructed.

19According to CMS officials, for states that have delegated the determinations, the 

federal Marketplace will make an eligibility determination if there are no application 

“inconsistencies”—instances in which information an applicant has provided does not 

match information contained in data sources used for eligibility verification at the time of 

application, or such information is not available. If there are inconsistencies, state 

Medicaid agencies make the determination.

Page 5 GAO-16-159T 

 
scenarios with fictitious applicants claiming to have impossible Social 

Security numbers;20 claiming to be working for an employer that offers 

health insurance, but not coverage that meets “minimum essential”

standards; or already having existing qualified health-plan coverage.

21 We 

made 4 of these 10 applications online and the other 6 applications by 

phone. In these tests, we also stated income at a level eligible to obtain 

both types of income-based subsidies available under PPACA—a 

premium tax credit, to be paid in advance, and cost-sharing reduction.22

For 8 additional applicant scenarios, we tested controls for verifications 

related to Medicaid coverage.23 Specifically, our fictitious applicants 

provided invalid Social Security identities, where their information did not 

match Social Security Administration records, or claimed they were 

noncitizens lawfully present in the United States and declined to provide 

Social Security numbers.24 In situations where we were asked to provide 

immigration document numbers, we provided impossible immigration 

20According to the Social Security Administration Program Operations Manual System, the 

Social Security Administration has never issued a Social Security number with the first 

three digits as “000,” “666,” or in the 900 series; the second group of two digits as “00”; or 

the third group of four digits as “0000.”

21In the case of the employer-provided coverage, we created a fictitious company with 

fictitious employer contact information. For the existing-coverage testing, we used an 

identity that had previously obtained coverage during our testing of enrollment for 

coverage-year 2014; see GAO-15-702T.

22To qualify for these income-based subsidies, an individual must be eligible to enroll in 

marketplace coverage; meet income requirements; and not be eligible for coverage under 

a qualifying plan or program, such as affordable employer-sponsored coverage, Medicaid, 

or the Children’s Health Insurance Program. Cost-sharing reduction is a discount that 

lowers the amount consumers pay for out-of-pocket charges for deductibles, coinsurance, 

and copayments. Because the benefit realized through the cost-sharing reduction subsidy 

can vary according to medical services used, the value to consumers of such subsidies 

can likewise vary.

23According to CMS officials, when an individual applies through a marketplace for 

coverage with financial assistance, they complete a single application that is an 

application for all insurance affordability programs; that is, individuals do not apply 

specifically for individual programs such as Medicaid. For our Medicaid testing, we applied 

using an income level we selected as eligible for Medicaid coverage. On that basis, we 

refer to our “Medicaid applications” throughout this statement. The application is signed 

under penalty of perjury, the officials noted.

24Note that we distinguish between impossible Social Security numbers—numbers never 

issued—and invalid Social Security identities—in which applicant-submitted information 

does not match Social Security Administration records. 

Page 6 GAO-16-159T 

 
document numbers.25 We made half of these applications online and half 

by phone. In these tests, we also stated income at a level eligible to 

qualify for coverage under the Medicaid expansion, where the federal 

government is responsible for reimbursing the states for 100 percent of 

the Medicaid costs in 2015. In cases where we did not obtain approval for 

Medicaid, we instead attempted, as appropriate, to obtain coverage for 

subsidized qualified health plans in the same manner as described 

earlier.

After concluding our undercover testing, we briefed officials from CMS; 

officials from the state marketplaces; and Medicaid officials from 

California, Kentucky, and North Dakota on our results. We asked to brief 

Medicaid officials from New Jersey but they declined our request. To 

protect our undercover identities, we did not provide the marketplaces 

with specific applicant identity information. CMS and selected state 

officials generally told us that without such information, they could not 

fully research handling of our applicants. We also reviewed laws, 

regulations, and other policy and related information.

We are conducting the work upon which this statement is based in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. We are conducting our related 

investigative work in accordance with investigative standards prescribed 

by the Council of the Inspectors General on Integrity and Efficiency.

25Specifically, we provided numbers that did not match the format for the document(s) at 

issue.

Page 7 GAO-16-159T 

 
Our undercover testing for the 2015 coverage year found that the healthcare marketplace eligibility determination and enrollment process remains 

vulnerable to fraud.26 As shown in figure 1, the federal Marketplace or 

selected state marketplaces approved each of our 10 fictitious 

applications for subsidized qualified health plans.27 We subsequently paid 

premiums to put these policies into force.

26As noted earlier, we conducted similar undercover testing for the first open-enrollment 

period. See GAO-15-702T.

27For our testing involving applications for qualified health-plan coverage, our fictitious 

applicants initially applied online or by telephone.

Preliminary Results of 

Undercover Attempts 

to Obtain Qualified 

Health-Plan 

Coverage from the

Federal Marketplace 

and Selected State 

Marketplaces

Page 8 GAO-16-159T 

 
Figure 1: Summary of Outcomes for 10 Fictitious Applications for Subsidized Qualified Health-Plan Coverage

a

We initially applied by phone for coverage. At the time of application, the call representative stated 

that the data hub was not working and that we could send in the application by mail, fax it, or visit in 

person. We chose to mail the application with supporting documentation (for example, driver’s 

license) to the state marketplace. We subsequently obtained coverage.

b

In addition to obtaining coverage under a subsidized qualified health plan, we were also 

subsequently approved for Medicaid.

As the figure shows, for these 10 applications, we were approved for 

subsidized coverage—the premium tax credit, paid in advance, and costPage 9 GAO-16-159T 
sharing reduction subsidies—for all cases.28 The monthly amount of the 

advance premium tax credit for these 10 applicants totaled approximately 

$2,300 per month, or about $28,000 annually, equal to about 70 percent 

of total premiums. For 4 of these applications, we used Social Security 

numbers that could not have been issued by the Social Security 

Administration.29 For 4 other applications, we said our fictitious applicants 

worked at a company—which we also created—that offered health 

insurance, but the coverage did not provide required minimum essential 

coverage under PPACA. For the final 2 applications, we used an identity 

from our prior undercover testing of the federal Marketplace to apply for 

coverage concurrently at two state marketplaces.30 Thus, this fictitious 

applicant received subsidized qualified health-plan coverage from the 

federal Marketplace and the two selected state marketplaces at the same 

time.

For 8 applications among this group of 10, we failed to clear an identitychecking step during the “front end” of the application process, and thus 

could not complete the process.31 In these cases, we were directed to 

contact a contractor that handles identity checking. The contractor was 

unable to resolve the identity issues and directed us to call the 

appropriate marketplace. We proceeded to phone the marketplaces and 

28To receive advance payment of the premium tax credit (described earlier), applicants 

agree they will file a tax return for the coverage year, and must indicate they understand 

that the premium tax credits paid in advance are subject to reconciliation on their federal 

tax return, based on actual income earned. Cost-sharing reduction is a discount that 

lowers the amount consumers pay for out-of-pocket charges for deductibles, coinsurance, 

and copayments. 

29As noted earlier, the Social Security Administration does not issue Social Security 

numbers with certain strings of digits.

30See GAO-15-702T.

31Known as “identity proofing,” the process uses personal and financial history on file with 

a credit-reporting agency. The marketplace generates questions that only the applicant is 

believed likely to know. According to CMS, the purpose of identity proofing is to prevent 

someone from creating an account and applying for health coverage based on someone 

else’s identity and without their knowledge. Although intended to counter such identity 

theft involving others, identity proofing thus also serves as an enrollment control for those 

applying online.

Page 10 GAO-16-159T 

 
our applications were subsequently approved. The other two applicants 

were accepted by phone.32

For each of the 10 undercover applications where we obtained qualified 

health-plan coverage, the respective marketplace directed that our 

applicants submit supplementary documentation. The marketplaces are 

required to seek postapproval documentation in the case of certain 

application “inconsistencies”—instances in which information an applicant 

has provided does not match information contained in data sources that 

the marketplace uses for eligibility verification at the time of application, or 

such information is not available. If there is an application inconsistency, 

the marketplace is to determine eligibility using the applicant’s 

attestations and ensure that subsidies are provided on behalf of the 

applicant, if qualified to receive them, while the inconsistency is being 

resolved using “back-end” controls. Under these controls, applicants will 

be asked to provide additional information or documentation for the 

marketplaces to review in order to resolve the inconsistency.

As part of our testing, and to respond to the marketplace directives, we 

provided counterfeit follow-up documentation, such as fictitious Social 

Security cards with impossible Social Security numbers, for all 10 

undercover applications.33

For all 10 of these undercover applications, we maintained subsidized 

coverage beyond the period during which applicants may file supporting 

documentation to resolve inconsistencies. In one case, the Kentucky 

marketplace questioned the validity of the Social Security number our 

applicant provided, which was an impossible Social Security number. In 

fact, the marketplace told us the Social Security Administration reported 

that the number was not valid. Despite this, however, the Kentucky 

marketplace notified our fictitious applicant that the applicant was found 

eligible for coverage. For the four fictitious applicants who claimed their 

employer did not provide minimum essential coverage, the marketplace 

32We were not required to go through the contractor identity proofing for the two phone 

applications through the federal Marketplace. All phone and online applications to the 

state marketplaces, and the online applications to the federal Marketplace, did require the 

contractor identity proofing.

33CMS officials said provision of a Social Security number is not a condition of eligibility, 

but we note the number is nevertheless important for identity verification and tax 

reconciliation.

Page 11 GAO-16-159T 

 
did not contact our fictitious employer to confirm the applicant’s account 

that the company offers only substandard coverage.

In August 2015, we briefed CMS and California and Kentucky state 

officials on the results of our undercover testing, to obtain their views. 

According to these officials, the marketplaces only inspect for documents 

that have obviously been altered. Thus, if the documentation submitted 

does not appear to have any obvious alterations, it would not be 

questioned for authenticity. In addition, according to Kentucky officials, in 

the case of the impossible Social Security number, the identity-proofing 

process functioned correctly, but a marketplace worker bypassed identityproofing steps that would have required a manual verification of the 

fictitious Social Security card we submitted. The officials told us they plan 

to provide training on how to conduct manual verifications to prevent this 

in the future.

As for our employer-sponsored coverage testing, CMS and California 

officials told us that during the 2015 enrollment period, the marketplaces 

accepted applicants’ attestation on lack of minimum essential coverage. 

As a result, the marketplaces were not required to communicate with the 

applicant’s employer to confirm whether the attestation is valid. Kentucky 

officials told us that applicant-provided information is entered into its 

system to determine whether the applicant’s claimed plan meets 

minimum essential coverage standards. If an applicant receives a 

qualified health-plan subsidy because the applicant’s employersponsored plan does not meet the guidelines, the Kentucky marketplace 

sends a notice to the employer asking it to verify the applicant 

information. The officials told us the employer letter details, among other 

things, the applicant-provided information and minimum essential 

coverage standards. However, our fictitious company did not receive such 

notification.

CMS, California, and Kentucky officials also told us there is no current 

process to identify individuals with multiple enrollments through different 

marketplaces. CMS officials told us it was unlikely an individual would 

seek to obtain subsidized qualified health-plan coverage in multiple 

states. We conducted this portion of our testing, however, to evaluate 

whether such a situation, such as a stolen identity, would be possible.

CMS officials told us the agency would need to look at the risk associated 

with multiple coverage.

Kentucky officials told us that in response to our findings, call center staff 

have been retrained on identity-proofing processes, and that they are 

Page 12 GAO-16-159T 
improving training for other staff as well. They also said they plan 

changes before the next open-enrollment period so that call center 

representatives cannot bypass identity-proofing steps, as occurred with 

our applications. Further, they said they plan to improve the process for 

handling of applications where employer-sponsored coverage is at issue. 

Also in response to our findings, California officials said they are 

developing process improvements and system modifications to address 

the issues we raised, and would share details later.

Finally, in the case of the federal Marketplace in particular, for which, as 

noted, we conducted undercover testing previously, we asked CMS 

officials for their views on our second-year results compared to the first 

year. They told us the eligibility and enrollment system is generally 

performing as designed. According to the officials, a key feature of the 

system, when applicant information cannot immediately be verified, is 

whether proper inconsistencies are generated, in order that they can be 

addressed later, after eligibility is granted at time of application. Earlier, 

CMS officials told us the overall approach is that CMS must balance 

consumers’ ability to effectively and efficiently select Marketplace 

coverage with program-integrity concerns.

In addition to our applications for subsidized private health plans, we also 

made eight additional fictitious applications for Medicaid coverage in 

order to test the ability to apply for that program through the 

marketplaces. As shown in figure 2, in these tests, we were approved for 

subsidized health-care coverage for seven of the eight applications. For 

three of the eight applications, we were approved for Medicaid, as 

originally sought. For four of the eight applications, we did not obtain 

Medicaid approval, but instead were subsequently approved for 

subsidized qualified health-plan coverage.34 The monthly amount of the 

advance premium tax credit for these four applicants totaled 

approximately $1,100 per month, or about $13,000 annually.35 For one of 

34Thus, while we did not obtain Medicaid coverage as initially sought, we nevertheless 

obtained federally subsidized coverage instead.

35Thus, our total advance premium tax credit subsidies received—for the qualified healthplan applications described earlier and the initial Medicaid applications described here that 

ultimately produced qualified health-plan coverage—totaled approximately $3,400 per 

month, or about $41,000 annually.

Preliminary Results of 

Undercover Attempts 

to Obtain Medicaid 

Coverage through the 

Federal Marketplace 

and Selected State 

Marketplaces

Page 13 GAO-16-159T 

 
the eight applications, we could not obtain Medicaid coverage because 

we declined to provide a Social Security number.

Figure 2: Summary of Outcomes for Eight Fictitious Applications for Medicaid Coverage

Page 14 GAO-16-159T 
As with our applications for qualified health plans described earlier, we 

also failed to clear an identity-checking step for six of eight Medicaid 

applications.36 In these cases, we were likewise directed to contact a 

contractor that handles identity checking. The contractor was unable to 

resolve the identity issues and directed us to call the appropriate 

marketplace. We proceeded to phone the marketplaces. However, as 

shown in figure 2, the California marketplace did not continue to process 

one of our Medicaid applications. In this case, our fictitious phone 

applicant declined to provide what was a valid Social Security number, 

citing privacy concerns. A marketplace representative told us that, to 

apply, the applicant must provide a Social Security number. The 

representative suggested that as an alternative, we could apply for 

Medicaid in person with the local county office or a certified enrollment 

counselor.37

After we discussed the results of our undercover testing with California 

officials, they told us their system requires applicants to provide either a 

Social Security number or an individual taxpayer-identification number to 

process an application. As a result, because our fictitious applicant 

declined to provide a Social Security number, our application could not be 

processed.

For the four Medicaid applications submitted to the federal Marketplace, 

we were told that we may be eligible for Medicaid but that the respective 

Medicaid state offices might require more information. For three of the 

four applications, federal Marketplace representatives told us we would 

be contacted by the Medicaid state offices within 30 days. However, the 

Medicaid offices did not notify us within 30 days for any of the 

applications. As a result, we subsequently contacted the state Medicaid 

36We were not required to go through identity proofing for the two phone applications that 

went through the federal Marketplace. All phone and online applications from the state 

marketplaces and the online applications from the federal Marketplace required identity

proofing.

37Because this was outside the scope of our review of the marketplaces, we did not follow 

this avenue.

Details of Medicaid 

Applications through the 

Federal Marketplace

Page 15 GAO-16-159T 

 
offices and the federal Marketplace to follow up on the status of our 

applications.

For the two New Jersey Medicaid applications, we periodically called the 

state Medicaid offices over approximately 4 months, attempting to 

determine the status of our applications. In these calls, New Jersey 

representatives generally told us they had not yet received Medicaid 

information from the federal Marketplace and, on several occasions, said 

they expected to receive it shortly. After our calls to New Jersey Medicaid 

offices, we phoned the federal Marketplace to determine the status of our 

Medicaid applications.

• In one case, the federal Marketplace representative told us New 

Jersey determined that our applicant did not qualify for Medicaid.38 As 

a result, the phone representative stated that we were then eligible for 

qualified health-plan coverage. We subsequently applied for coverage 

and were approved for an advance premium tax credit plus the costsharing reduction subsidy.

• In the other case, the federal Marketplace representative told us the 

Marketplace system did not indicate whether New Jersey received the 

application or processed it. The representative advised we phone the 

New Jersey Medicaid agency. Later on that same day, we phoned the 

federal Marketplace again and falsely claimed that the New Jersey 

Medicaid office denied our Medicaid application. Based on this claim, 

the representative said we were eligible for qualified health-plan 

coverage. We subsequently applied for coverage and were approved 

for an advance premium tax credit plus the cost-sharing reduction 

subsidy. The federal Marketplace did not ask us to submit 

documentation substantiating our Medicaid denial from New Jersey.

We asked to meet with New Jersey Medicaid officials to discuss the 

results of our testing, but they declined our request. CMS officials told us 

that New Jersey had system issues that may have accounted for 

problems in our Medicaid application information being sent to the state. 

CMS officials told us that this system issue is now resolved. In addition, 

CMS officials told us they do not require proof of a Medicaid denial when 

processing qualified health-plan applications; nor does the federal 

38Earlier that day, in a phone call with the New Jersey Medicaid agency, a representative 

said—contrary to the federal Marketplace statement—that the agency had not received 

application information from the federal Marketplace. 

Page 16 GAO-16-159T 

 
Marketplace verify the Medicaid denial with the state. CMS officials said 

that instead, they accept the applicant’s attestation that the applicant was 

denied Medicaid coverage.

For our North Dakota Medicaid application in which we did not provide a 

Social Security number but did provide an impossible immigration

document number, we called the North Dakota Medicaid agency to 

determine the status of our application. An agency representative told us 

the federal Marketplace denied our Medicaid application and therefore did 

not forward the Medicaid application file to North Dakota for a Medicaid 

eligibility determination.39 We did not receive notification of denial from 

the federal Marketplace. Subsequently, we called the federal Marketplace 

and applied for subsidized qualified health-plan coverage. The federal 

Marketplace approved the application, granting an advance premium tax 

credit plus the cost-sharing reduction subsidy. Because we did not 

disclose the specific identities of our fictitious applicants, CMS officials 

could not explain why the federal Marketplace originally said our 

application may be eligible for Medicaid but subsequently notified North 

Dakota that it was denied.

For the North Dakota Medicaid application for which we did not provide a 

valid Social Security identity, we received a letter from the state Medicaid 

agency about a month after we applied through the federal Marketplace. 

The letter requested that we provide documentation to prove citizenship, 

such as a birth certificate. In addition, it requested a Social Security card 

and income documentation. We submitted the requested documentation, 

such as a fictitious birth certificate and Social Security card. The North 

Dakota Medicaid agency subsequently approved our Medicaid application 

and enrolled us in a Medicaid plan.

After our undercover testing, we briefed North Dakota Medicaid officials 

and obtained their views. They told us the agency likely approved the 

Medicaid application because our fake Social Security card would have 

cleared the Social Security number inconsistency. The officials told us 

they accept documentation that appears authentic. They also said the 

agency is planning to implement a new system to help identify when 

39As noted earlier, the federal Marketplace representative stated that our application may 

be eligible for Medicaid but more information may be needed by the Medicaid state 

offices.

Page 17 GAO-16-159T 

 
applicant-reported information does not match Social Security 

Administration records.

As with our applications for coverage under qualified health plans, 

described earlier, the state marketplace for Kentucky directed two of our 

Medicaid applicants to submit supplementary documentation. As part of 

our testing and in response to such requests, we provided counterfeit 

follow-up documentation, such as a fake immigration card with an 

impossible numbering scheme for these applicants. The results of the 

documentation submission are as follows:

• For the application where the fictitious identity did not match Social 

Security records, the Kentucky agency approved our application for 

Medicaid coverage. In our discussions with Kentucky officials, they 

told us they accept documentation submitted—for example copies of 

Social Security cards—unless there are obvious alterations.

• For the Medicaid application without a Social Security number and 

with an impossible immigration number, the Kentucky state agency 

denied our Medicaid application. A Kentucky representative told us 

the reason for the denial was that our fictitious applicant had not been 

a resident for 5 years, according to our fictitious immigration card. The 

representative told us we were eligible for qualified health-plan 

coverage. We applied for such coverage and were approved for an 

advance premium tax credit and the cost-sharing reduction subsidy. In 

later discussions with Kentucky officials, they told us the 

representative made use of an override capability, likely based on 

what the officials described as a history of inaccurate applicant 

immigration status information for a refugee population. Kentucky 

officials also said their staff accept documentation submitted unless 

there are obvious alterations, and thus are not trained to identify 

impossible immigration numbers. Finally, Kentucky officials said they 

would like to have a contact at the Department of Homeland Security 

with whom they can work to resolve immigration-related 

inconsistencies, similar to a contact that they have at the Social 

Security Administration to resolve Social Security-related 

inconsistencies.

By contrast, during the Medicaid application process for one applicant, 

California did not direct that we submit any documentation. In this case, 

our fictitious applicant was approved over the phone even though the 

fictitious identity did not match Social Security records. We shared this 

result with California officials, who said they could not comment on the 

Details of Medicaid 

Applications through State 

Marketplaces

Page 18 GAO-16-159T 
specifics of our case without knowing details of our undercover 

application.

As noted earlier, the findings discussed in this statement are preliminary, 

and we plan to issue a final report later, upon completion of our work.

Chairman Pitts, Ranking Member Green, and Members of the 

subcommittee, this concludes my statement. I look forward to the 

subcommittee’s questions.

For questions about this statement, please contact Seto Bagdoyan at 

(202) 512-6722 or BagdoyanS@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement.

Individuals making key contributions to this statement include Matthew 

Valenta and Gary Bianchi, Assistant Directors; Maurice Belding, Jr.; 

Mariana Calderón; Ranya Elias; Suellen Foth; Maria McMullen; James 

Murphy; George Ogilvie; Ramon Rodriguez; Christopher H. Schmitt; Julie 

Spetz; and Elizabeth Wood.

GAO Contact and 

Staff 

Acknowledgments

(192466) Page 19 GAO-16-159T 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.