Department of Health & Human Services 

OFFICE OF

INSPECTOR GENERAL

 

 

MEDICAID MANAGED CARE: 

FRAUD AND ABUSE CONCERNS 

REMAIN DESPITE SAFEGUARDS 

Daniel R. Levinson 

Inspector General 

December 2011 

OEI-01-09-00550 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS i 

 EXECUTIVE SUMMARY

OBJECTIVES

To determine:

1. to what extent selected Medicaid managed care entities (MCE) took 

steps to meet Federal program integrity requirements, 

2. how States oversee MCEs’ fraud and abuse safeguards, and

3. what major concerns that MCEs and States have regarding fraud 

and abuse in Medicaid managed care. 

BACKGROUND

Medicaid expenditures almost doubled during the past decade, from 

over $200 billion in 2000 to $374 billion in 2009. States have 

increasingly adopted managed care as a response to these growing 

expenditures. States may contract with different types of MCEs to 

provide health care services on a statewide or a community basis. The 

Centers for Medicare & Medicaid Services (CMS) requires MCEs to 

meet specific program integrity requirements as a condition for 

receiving payment. These requirements include a written compliance 

plan, effective training and education for MCE employees, and internal 

monitoring and auditing. CMS also requires MCEs and other Medicaid 

providers to disclose to States certain information related to ownership 

and control. CMS’s Medicaid Integrity Group (MIG) conducts program 

integrity reviews of States and MCEs. In 2000, CMS issued guidelines 

for addressing Medicaid managed care fraud and abuse. States are 

directly responsible for monitoring MCE operations. 

We reviewed MIG’s files from its program integrity reviews of a 

purposive sample of 13 States and 46 MCEs. We sent a questionnaire 

to those 46 MCEs and received responses from 45. We also conducted 

structured telephone interviews with the 13 States, all 10 CMS regional 

offices, and MIG.

FINDINGS

All MCEs in our sample reported taking steps to meet Federal 

program integrity requirements. All 46 MCEs in our sample reported 

to MIG that they met Federal program integrity requirements. The 

45 MCEs that responded to our questionnaire provided fraud and abuse 

safeguard training to their staffs in 2010, and 41 also offered such 

training to providers in their networks in 2010. In 2009, 33 MCEs 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS ii

EXECUTIVE SUMMARY

reported cases of suspected fraud and abuse to their State Medicaid 

agencies, with a median of 9 cases. Twenty MCEs recovered payments 

from providers in 2009 that resulted from fraud and abuse.

All 13 States in our sample reported taking steps to oversee MCEs’ 

fraud and abuse safeguards. All 13 States conduct desk reviews of 

MCEs’ compliance plans, and 11 States conduct onsite MCE reviews. 

All 13 States reported requiring that MCEs disclose ownership 

information (8 of the States recently updated their reporting 

requirements as a result of MIG’s program integrity reviews). Eleven 

States hold recurring meetings with MCEs; these meetings often 

include fraud and abuse training.

Although MCEs and States are taking steps to address fraud and 

abuse in managed care, they remain concerned about their

prevalence. We asked MCEs, States, and CMS to identify their major 

concerns regarding Medicaid managed care fraud and abuse. The 

primary concern related to services billed but not rendered. MIG also

identified this vulnerability in its program integrity reviews. MCEs and 

States expressed concerns about provider and beneficiary fraud and 

abuse, including rendering services that are not medically necessary, 

upcoding by providers, questionable beneficiary eligibility, and 

prescription drug abuse by beneficiaries. The major concerns identified 

in our review largely reflect only one of six areas highlighted in CMS’s 

2000 guidelines. 

RECOMMENDATIONS

CMS should:

Require that State contracts with MCEs include a method to verify 

with beneficiaries whether services billed by providers were 

received. CMS could require States to implement one of several 

options, such as sending explanations of medical benefits to 

beneficiaries. Other options could include contacting beneficiaries by 

telephone or mailing them a questionnaire. 

Update guidance to reflect concerns expressed by MCEs and 

States. CMS could update and reissue the fraud and abuse guidelines 

it published in 2000. CMS could also share best practices and 

innovative methods that States and MCEs have used to address fraud 

and abuse concerns and strengthen program integrity oversight.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS iii

EXECUTIVE SUMMARY

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with both recommendations. CMS stated that it will 

advise States to work with their MCEs to determine and implement 

effective strategies for verifying that services billed by network 

providers are received. CMS also stated that it has been developing 

a strategy to effectively address managed care program integrity and 

will revise its guidelines once that strategy is complete. Finally, CMS 

stated that it provides a compendium of States’ noteworthy and 

effective practices in key program integrity areas, including Medicaid 

managed care, on its Web site. We made no changes to the report 

based on CMS’s comments. 

 
 

 TABLE OF CONTENTS

EXECUTIVE SUMMARY ................................ ..... i

INTRODUCTION ............................................ 1 

FINDINGS .................................................. 8 

All MCEs in our sample reported taking steps to meet 

Federal program integrity requirements ..................... 8 

All 13 States in our sample reported taking steps to oversee

MCEs’ fraud and abuse safeguards......................... 10

Although MCEs and States are taking steps to address fraud

and abuse in managed care, they remain concerned about their

prevalence ............................................ 12

 

RECOMMENDATIONS ..................................... 15

Agency Comments and Office of Inspector General Response.... 16

APPENDIXES ............................................. 17

A: Percentage of Medicaid Beneficiaries Enrolled in Managed

 Care Organizations as of June 30, 2008 .................. 17

B: Agency Comments ................................... 18

ACKNOWLEDGMENTS ..................................... 20
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 1 

 INTRODUCTION

OBJECTIVES 

To determine: 

1. to what extent selected Medicaid managed care entities (MCE) took 

steps to meet Federal program integrity requirements, 

2. how States oversee MCEs’ fraud and abuse safeguards, and

3. what major concerns that MCEs and States have regarding fraud 

and abuse in Medicaid managed care. 

BACKGROUND

Medicaid expenditures almost doubled in the past decade, from over 

$200 billion in 2000 to $374 billion in 2009.1 States have increasingly 

adopted managed care as a response to these growing expenditures. 

Managed care is a health delivery system that aims to maximize 

efficiency by negotiating rates, coordinating care, and managing the use

of services. State Medicaid agencies contract with MCEs to provide 

comprehensive health services in return for a fixed, prospective 

payment (capitated payment) for each enrolled beneficiary. 

Medicaid Managed Care

As of June 2009, 36 million Medicaid beneficiaries (72 percent) were 

enrolled in managed care.2 Some States, such as Tennessee, enroll all 

Medicaid beneficiaries in managed care, whereas others, such as 

Wyoming, do not enroll any.3

States may contract with different types of MCEs to provide health care 

services on a statewide or a community basis.4 Two types of MCEs are 

subject to specific Federal program integrity requirements: Managed 

Care Organizations (MCO) and Prepaid Inpatient Health Plans 

(PIHP).5 

1 Centers for Medicare & Medicaid Services (CMS), National Health Expenditures by 

Type of Service and Source of Funds, CY 1960–2009. Accessed at http://www.cms.gov on 

April 21, 2011.

2 CMS, Medicaid Managed Care Enrollment as of June 30, 2009. Accessed at 

http://www.cms.gov on April 14, 2011.

3 Ibid.

4 Social Security Act § 1932(a)(3). 

5 42 CFR § 438.608.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 2 

INTRODUCTION INTRODU CTION

An MCO provides comprehensive medical services through a prepaid 

risk contract with the State. Under a risk contract, the contractor 

assumes the risk for the cost of covered services and incurs a loss if the 

cost exceeds the payments under the contract.6 A PIHP generally 

provides inpatient hospital or institutional services and does not enter 

into a comprehensive risk contract with the State.7 For example, a 

mental health PIHP would provide only inpatient mental health 

services.8 In this report, we refer to MCOs and PIHPs collectively as 

managed care entities, or MCEs. 

Fraud and Abuse in Medicaid Managed Care 

In 2000, CMS issued Guidelines for Addressing Fraud and Abuse in 

Medicaid Managed Care.9 In the guidelines, CMS adapted the general 

Medicaid definitions of fraud and abuse10 to the managed care 

environment: 

• Fraud means any type of intentional deception or 

misrepresentation made by an entity or person with the knowledge 

that the deception could result in some unauthorized benefit to the 

entity, himself, or some other person.11 

• Abuse means practices that are inconsistent with sound fiscal, 

business, or medical practices and that result in unnecessary costs 

to Medicaid or reimbursement for services that are not medically 

necessary or that fail to meet professional standards or contractual 

obligations for health care.12

The guidelines also identified six areas of concern: (1) managed care 

contract procurement, (2) marketing and enrollment, 

(3) underutilization of services, (4) claims submission and billing

procedures, (5) fee-for-service payments within managed care, and 

6 42 CFR § 438.2.

7 Ibid.

8 Ibid. 

9 CMS, National Medicaid Fraud and Abuse Initiative, Guidelines for Addressing Fraud 

and Abuse in Medicaid Managed Care, pp. 10–11, October 2000. 

10 42 CFR § 455.2 defines fraud and abuse for general Medicaid purposes. 

11 Fraud or abuse can be committed by a contractor, a subcontractor, a provider, an 

MCE, a State employee, or a Medicaid beneficiary/enrollee. CMS, National Medicaid Fraud 

and Abuse Initiative, Guidelines for Addressing Fraud and Abuse in Medicaid Managed 

Care, pp. 10–11, October 2000, p. 12.

12 Ibid., p. 13. 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 3 

INTRODUCTION

(6) embezzlement and theft. They provided examples for each area, as 

well as some successfully prosecuted cases.13

The Florida Office of Inspector General noted “the need to recognize the 

distinctively different issues in fraud detection and prevention in a 

capitated environment versus the traditional fee-for-service

environment.”

 

14 For example, in a capitated system, providers could 

commit fraud by providing as few services as possible, or by treating 

only healthier patients.15 CMS also noted that fraud could harm States’ 

ability to operate managed care programs by threatening MCEs’ 

viability. Additionally, fraudulent MCE data could raise State costs. 

For example, if MCEs manipulate data to give the appearance of 

providing services to beneficiaries who are not enrolled, the MCEs 

would receive enhanced payments in the future.16

Medicaid Managed Care Program Integrity Requirements

To protect against fraud and abuse, Federal regulations require MCOs 

and PIHPs to comply with program integrity requirements as a 

condition of receiving payment.17 In establishing program integrity 

requirements, CMS viewed MCOs and PIHPs as larger, more complex 

types of MCEs with higher enrollment levels, greater administrative 

resources, and higher chances of needing sophisticated methods to 

combat fraud and abuse.18 They must have administrative and 

management procedures, including mandatory compliance plans, that 

contain the following seven program integrity provisions:

• written policies, procedures, and standards of conduct that 

articulate the organization’s commitment to comply with all 

applicable Federal and State standards;

• designation of a compliance officer and a compliance committee that 

are accountable to senior management;

13 Ibid, p. 13. 

14 Florida Agency for Health Care Administration, Office of Inspector General Annual 

Report 2010, p. 47. 

15 National Association of Medicaid Fraud Control Units, Model Criminal Enforcement 

Statutes For Managed Care, p. i, October 1996.

16 CMS, National Medicaid Fraud and Abuse Initiative, Guidelines for Addressing Fraud 

and Abuse in Medicaid Managed Care, pp. 10–11, October 2000. 

17 42 CFR § 438.602. This section also applies to two other types of MCEs.

18 67 Fed. Reg. 40989, 41066 (June 14, 2002). 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 4 

INTRODUCTION

• effective training and education for the compliance officer and the 

organization’s employees;

• effective lines of communication between the compliance officer and 

the organization’s employees;

• enforcement of standards through well-publicized disciplinary 

guidelines;

• internal monitoring and auditing; and

• prompt response to detected offenses, and for development of 

corrective actions relating to the MCO’s or the PIHP’s contract.19

Medicaid Disclosure Requirements

CMS also requires every provider to disclose certain information related 

to ownership and control, business transactions, and persons convicted 

of crimes. Each provider must furnish information to the State on:

• any person with an ownership or control interest or any 

subcontractor in which it has direct or indirect ownership of 

5 percent or more,20

• any subcontractor with which it had business transactions totaling 

more than $25,000 in the prior year,21 and

• any person with ownership or control interest who has been 

convicted of a criminal offense related to Federal health programs.22

State Medicaid Program Integrity Efforts

States are directly responsible for monitoring MCE operations.23 States

must have a method for verifying with beneficiaries whether services 

billed by providers were received.24, 25 As of 2007, 27 States 

incorporated program integrity activities under their State Medicaid 

19 42 CFR § 438.608.

20 42 CFR § 455.104. For purposes of provider disclosure requirements under this 

section, the definition of Medicaid provider under 42 CFR § 455.101 does not include 

individual practitioners or groups of practitioners.

21 42 CFR § 455.105.

22 42 CFR § 455.106.

23 42 CFR § 438.66.

24 42 CFR § 455.20. 

25 CMS’s Medicaid Integrity Group (MIG) does not interpret 42 CFR § 455.20 to apply to 

managed care entities. See: Medicaid Integrity Program, Florida Comprehensive Program 

Integrity Review Final Report, p. 7, September 2009 and Medicaid Integrity Program, 

Washington Comprehensive Program Integrity Review Final Report, p. 6.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 5 

INTRODUCTION

agencies, 7 used an Inspector General model, and 16 used a hybrid of 

both to monitor their Medicaid programs.26

In addition, every State must either create a State Medicaid Fraud 

Control Unit (MFCU) or demonstrate that operation of a MFCU would 

not be cost effective.

 

27 A MFCU’s mission is to investigate and 

prosecute Medicaid provider fraud and incidences of patient abuse and 

neglect.28

Federal Medicaid Program Integrity Efforts

 Forty-nine States and the District of Columbia operate 

MFCUs. The majority of MFCUs are located in Offices of State 

Attorneys General. 

CMS regional offices (RO) are responsible for reviewing all State 

contracts with MCEs.29

The Deficit Reduction Act of 2005 (DRA) created the Medicaid Integrity 

Program, operated by MIG.

 ROs review the contracts using a checklist to 

ensure that the contracts meet all applicable Federal criteria, including

program integrity provisions.

30 Since 2006, MIG has conducted triennial 

onsite reviews of States’ program integrity operations. In addition to 

assessing compliance with Federal requirements, the reviews identify 

vulnerabilities and effective practices, help States improve program 

integrity, and identify opportunities for CMS to provide technical 

assistance to States. After each review, MIG issues a report to the 

State.31

In 2007, CMS collaborated with the Department of Justice to develop 

the Medicaid Integrity Institute. The Institute’s mission is to provide 

effective training to meet the needs of State Medicaid program integrity 

staff, with the goal of raising national program integrity performance 

standards and professionalism. It offers training at no cost to States on 

26 CMS, Medicaid Integrity Group, State Program Integrity Assessment: Federal Fiscal 

Year 2007 Executive Summary, December 2009. Accessed at http://www.cms.gov on 

April 14, 2011.

27 Social Security Act § 1902(a)(61).

28 Social Security Act § 1903(q).

29 42 CFR § 438.6(a).

30 Social Security Act § 1936, added by section 6034 of the DRA, P.L. 109-171. 

31 CMS, Medicaid Integrity Program, Program Integrity Review Annual Summary,

May 2009. Accessed at http://www.cms.gov on April 15, 2011. 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 6 

INTRODUCTION

topics such as fraud investigation, data mining and analysis, and case 

development.32

METHODOLOGY

 

Scope

Our evaluation focused on MCEs that had Medicaid contracts in 

selected States in 2009 and the States that contracted with them. 

Sample

We identified 37 States and the District of Columbia (States) that 

contract with MCEs subject to the program integrity requirements in

42 CFR § 438.608. We divided these States into quartiles based on the 

percentage of their Medicaid beneficiaries enrolled in MCEs. We then 

took a purposive sample of 13 States by selecting 4 States from the top 

quartile and 3 States from each of the other quartiles so as to include 

States from every CMS region (see Appendix A). These 13 States were 

also subject to a MIG State program integrity review in fiscal year

2009 or 2010. From each of these 13 States, we chose up to 6 MCEs 

that were included in the MIG review; we purposively selected the 

MCEs so as to include both larger and smaller ones. In States with 

fewer than six MCEs, we included all of them. This resulted in a final 

sample of 46 MCEs.

Data Sources and Collection

MCEs. We mailed a questionnaire in October 2010 to the 46 MCEs in 

our sample asking about actions they take to protect against fraud and 

abuse in their organizations and networks and about their major 

concerns regarding fraud and abuse. Two of the forty-six MCEs were no 

longer in operation; we received completed questionnaires from the 

remaining 44 MCEs. One of these MCEs used two subcontractors for its 

fraud and abuse activities; each subcontractor completed its own

questionnaire, which we counted separately, for a total of 

45 respondents.

States. We conducted structured telephone interviews with Medicaid 

agency staff from the 13 States in our sample. We asked how they 

oversee MCEs and what other actions they take to prevent fraud and 

32 Medicaid Integrity Institute Fact Sheet. Accessed at http://www.justice.gov on 

April 13, 2011.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 7 

INTRODUCTION

abuse. We conducted the interviews between December 2010 and 

March 2011.

CMS ROs. We conducted structured telephone interviews with 

Medicaid staff at each of the 10 CMS ROs. We conducted the interviews 

between March and April 2011.

CMS MIG. We reviewed MIG’s program integrity review files for the 

States and MCEs in our sample. These files include survey modules 

completed by the States and MCEs, as well as additional supporting 

documentation. We reviewed the files to collect data on State 

requirements addressing Federal program integrity requirements, 

Federal disclosure requirements, MCE reporting of suspected fraud and 

abuse, and training and education that States provided to the MCEs. 

We also reviewed the MIG final reports on CMS’s Web site to identify 

areas of State noncompliance and vulnerabilities; MIG had issued final 

reports for 9 of the 13 States in our sample.

Analysis

We performed qualitative data analysis on responses from State and 

CMS interviews and on responses from the MCE questionnaires. For 

example, we reviewed the responses for common themes. We analyzed 

MIG data and MCE questionnaire responses by performing frequency 

counts of State and MCE responses. 

Limitations

The results of our State and MCE analyses are limited to the entities we 

reviewed; we cannot project the results on a national basis. We did not 

independently verify the data we collected.

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors 

General on Integrity and Efficiency.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 8 

 MCEs employed several 

All MCEs in our sample reported taking steps to 

meet Federal program integrity requirements 

 FINDINGS

All 46 MCEs in our sample 

reported to MIG that they had 

administrative and management

arrangements in place to prevent fraud and abuse, as required by 

Federal regulations.33

All MCEs provided fraud and abuse safeguard training to their staffs; most 

MCEs also offered this training to providers in their networks

 These arrangements included, but were not 

limited to, compliance plans, written policies and procedures, and 

training of MCE staff and providers. In our questionnaire, we asked 

MCEs for more detail about the type and extent of fraud and abuse 

safeguard training that MCEs provided and the extent to which MCEs 

reported suspected fraud and abuse cases to their States’ Medicaid 

Agencies. 

All 45 MCEs that responded to our questionnaire reported providing

fraud and abuse training to staff in 2010, as required by the program 

integrity regulations. The training provided by every MCE addressed 

identifying and reporting suspected fraud and abuse. Most MCEs also 

included training on protecting confidential beneficiary information and 

on ethics. See Table 1 for a list of topics included in MCE staff training. 

Table 1: Topics of MCE Staff Training on Fraud and Abuse 

Prevention (n=45)

Topic Number of MCEs

Identifying Suspected Fraud and Abuse 45

Reporting Suspected Fraud and Abuse 45

Ethics 43

Protecting Confidential Beneficiary Information 43

Compliance Plan Review 39

Other 20

Source: OIG survey of MCEs, 2010.

The program integrity regulations require training to be effective;

37 of the 45 MCEs that responded to our questionnaire reported 

evaluating the effectiveness of staff training.34

33 42 CFR § 438.608.

34 42 CFR § 438.608. Although the regulation requires training to be effective, it does 

not require MCEs to evaluate the effectiveness of training.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 9 

FINDINGS

methods to evaluate the effectiveness of training, such as surveying

(23 MCEs) and testing (20 MCEs) staff on the topics covered. Eight 

MCEs also analyzed staff job performance after the training, and five 

MCEs used some other method. 

Most MCEs also reported that they offered fraud and abuse safeguard 

training to providers in their networks in 2010 (41 of the 45 MCEs). 

The most common topics in provider training were coding accuracy, 

recognizing suspected beneficiary fraud, and protecting confidential 

beneficiary information. See Table 2 for a list of topics addressed 

during provider training.

Table 2: Topics of MCE Provider Training on Fraud and Abuse 

Prevention (n=41) 

Topic Number of MCEs

Coding Accuracy 36

Recognizing Suspected Beneficiary Fraud 31

Protecting Confidential Beneficiary Eligibility 31

Federal Fraud and Abuse Laws 30

Determining Beneficiary Eligibility 30

Other 13

Source: OIG survey of MCEs, 2010.

In contrast with staff training, only 15 MCEs evaluated the 

effectiveness of provider training. The most common method that 

MCEs used to measure effectiveness was claims analysis (seven MCEs). 

These MCEs conducted analyses to determine whether billing errors 

decreased following training. Other methods that MCEs used were 

conducting provider satisfaction surveys (six MCEs), performing audits 

(four MCEs), and measuring beneficiary satisfaction via surveys and 

appeal data (three MCEs). Four MCEs used other methods to evaluate 

provider training.

MCEs in our sample identified and reported cases of suspected fraud and 

abuse to their States and recovered payments from providers that resulted 

from fraud and abuse

In 2009, 33 of the 45 MCEs that responded to our questionnaire

reported cases of suspected fraud and abuse to their States’ Medicaid 

agencies, and 22 MCEs reported suspected cases to their States’

MFCUs. MCEs reporting to State Agencies ranged from 1 case of 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 10

FINDINGS

suspected fraud and abuse to 140 cases, with a median of 9 cases; MCE 

reporting to MFCUs ranged from 1 case to 290 cases, with a median of

7 cases. Twenty MCEs reported that they recovered payments from 

providers in 2009 ranging from $2,615 to $2,769,900, with a median 

recovery payment of $96,302. 

All 13 States in our sample reported taking 

steps to oversee MCEs’ fraud and abuse 

safeguards

States contract with MCEs to 

provide Medicaid services and are 

responsible for oversight of all 

contract provisions. Program 

integrity requirements are included in these contracts.

All 13 States conduct desk reviews of MCEs’ compliance plans 

Six States that we interviewed review compliance plans annually. The 

remaining seven States vary in when they conduct their reviews; most 

review plans when MCEs apply to Medicaid and when MCEs update 

their plans.

Regardless of the frequency of their reviews, all States assess whether 

compliance plans contain the relevant Federal requirements. Some 

States look for provisions that exceed Federal requirements and that 

address fraud and abuse. These include measures to ensure that 

providers have sound fiduciary practices, methods to identify providers 

with unusual billing patterns and beneficiaries with unusual usage 

patterns, and goals to improve program integrity for the upcoming year.

Eleven of the thirteen States conduct onsite reviews 

States told us that a compliance plan has little value if it is not 

implemented, so many conduct onsite reviews of MCEs to augment their 

desk reviews of compliance plans. Eleven States in our sample visit

MCEs to ensure they comply with Federal program integrity 

requirements. Seven of those States conduct the reviews themselves; 

the other four use an external quality review organization (EQRO) to 

conduct site visits and ensure program integrity compliance.35 Six of 

the eleven States conduct onsite reviews annually. The others vary in 

their onsite review cycles. 

35 EQROs are independent entities with which States contract to conduct statutorily 

mandated reviews of Medicaid MCE quality outcomes, timeliness, and access to items and 

service. Social Security Act § 1932(c)(2)(A)(i).
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 11

FINDINGS

During site visits, States ensure that MCEs implement the provisions of 

their compliance plans. For example, to assess the effectiveness of MCE

employee fraud and abuse training, States ask MCE staff where 

compliance plans are located and to whom staff report fraud. Some 

States also evaluate the timeliness and content of training by 

determining whether MCEs train employees upon hiring and annually 

thereafter, as well as whether training includes pertinent Federal 

requirements, such as the False Claims Act. To assess whether lines of 

communication are effective, States evaluate MCEs’ fraud hotlines. One 

State reviews MCE fraud and abuse safeguard materials provided to 

beneficiaries to ensure that the materials are appropriate and 

understandable.

All 13 States reported requiring that MCEs disclose ownership information 

Although all 13 States in our sample require MCEs to disclose required 

information on ownership and control, they vary in how often they 

require MCEs to submit data. Eight States require MCEs and 

providers to submit ownership information during their initial 

application to their States’ Medicaid programs but vary in their 

submission requirements thereafter. These States may subsequently 

require submission annually or as ownership changes. States that do 

not require ownership disclosure at enrollment typically require it

annually, monthly, or as changes occur.

Eight States in our sample recently updated their reporting 

requirements as a result of MIG’s program integrity review. Four 

strengthened reporting requirements, primarily by enhancing contract 

language to specifically address all ownership disclosure provisions, 

such as disclosure of owners’ siblings. Two States implemented new 

processes to require that MCEs report ownership information. Two

States amended their contracts to specify sanctions and other penalties 

for noncompliance.

Some States told us that they would like further guidance from CMS

regarding disclosure requirements. For example, one State reported 

that it is unclear how far downstream MCEs should disclose ownership 

information. Another State was unsure how to treat information about 

owners that are not individuals, such as publicly traded companies or 

large hospitals.

Most States found MCEs to be compliant with disclosure requirements 

(the two States that recently implemented ownership disclosure 

requirements had not yet evaluated compliance). Although States did 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 12

FINDINGS

not need to take action against noncompliant MCEs, they told us that

they would use corrective actions, if needed, including sanctions, 

contract termination, and corrective action plans. 

States reported interacting regularly with MCEs 

Eleven of thirteen States hold recurring meetings with MCEs. Nine 

States incorporate training into these meetings. The meetings typically 

involve MCE and State concerns, review of ongoing fraud and abuse 

cases, and provide training on identifying fraud and abuse and on

reporting requirements. 

MCE compliance officers typically attend these meetings; MFCU staff

sometimes attend, as well. Meetings typically are held monthly or 

quarterly. Five of the eleven States have more than one recurring 

meeting, such as quarterly meetings, which all their MCEs attend, and 

separate monthly meetings with each MCE. 

Ten of thirteen States interact with MCEs on an ad hoc basis, mostly to 

discuss specific fraud and abuse cases and other MCE concerns. One of 

the two States that does not have recurring meetings with MCEs 

reported that it interacts with them almost daily.

Although MCEs and States are taking steps to 

address fraud and abuse in managed care, 

they remain concerned about its prevalence 

We asked MCEs and States to 

identify their major concerns 

regarding Medicaid managed care 

fraud and abuse. These concerns 

included services billed but not rendered, medically unnecessary 

services, and questionable beneficiary eligibility. CMS has offered 

guidelines for addressing Medicaid managed care fraud and abuse in 

the past, although the major concerns identified in our review largely 

reflect only one area highlighted in CMS’s guidelines: claims 

submission and billing procedures.

The primary concern—shared by MCEs and States—relates to services 

billed but not rendered

MCEs and States reported concerns with providers that bill MCEs for 

medical services not actually provided to beneficiaries. Twenty-six 

MCEs and four States shared this concern. The MIG program integrity 

reviews identified services billed but not rendered as a vulnerability in 

eight of the nine States in our sample for which final reports were 

available. Further, MIG reviews found that only 19 of the 46 MCEs in 

our sample verified with beneficiaries that services were received. 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 13

FINDINGS

One tool MCEs can use to try to verify whether services were received is 

an explanation of medical benefits (EOMB). MCEs send EOMBs to 

beneficiaries, who can then inform the MCEs if they did not receive the 

listed services. MIG reviews found that 8 of the 46 MCEs in our sample 

used EOMBs to verify whether services were received. Two of these 

MCEs recovered payments as a result of this practice. 

Without such verification, States and MCEs have no way of knowing 

whether they are paying for fraudulent claims or whether beneficiaries 

are receiving services. Fraudulent claims unnecessarily inflate the 

capitation rate paid to MCEs. 

In responses to our questionnaire, MCEs reported using other means to 

address this concern, such as reviewing their payment systems and 

working with outside entities, for example, OIG or State medical boards. 

MCEs and States expressed concerns about provider and beneficiary fraud 

and abuse

MCEs reported additional concerns regarding provider fraud, such as 

services provided that were not medically necessary and upcoding. 

MCEs also reported concerns regarding beneficiary fraud, such as 

beneficiary eligibility and drug abuse. See Table 3 for these additional 

concerns. 

The most common method by which MCEs reported addressing 

medically unnecessary services and upcoding was through analysis of 

their payment systems, such as audits or claims analysis. MCEs also 

used prior authorization processes and medical record reviews. To 

address upcoding, MCEs educated providers about proper coding and 

alerted providers to atypical billing patterns.

Table 3: Additional MCE Concerns About Medicaid Managed

Care Fraud and Abuse

Concern Number of MCEs

Services Provided to Beneficiaries That Are Not 

Medically Necessary 16

Upcoding by Providers 10

Verifying Beneficiary Eligibility 8 

Beneficiary Drug Abuse and/or Diversion 7 

Source: OIG survey of MCEs, 2010.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 14

FINDINGS

To address beneficiary eligibility concerns, MCEs encouraged providers 

to verify eligibility when treating new patients and offered resources 

such as a provider Web portal and telephone line with eligibility 

verification capabilities. To address drug abuse and diversion, MCEs 

conducted monitoring activities, such as providing case management 

services to beneficiaries, analyzing data to identify high-volume 

prescription trends of providers, and investigating suspected cases. 

MCEs also collaborated with State and Federal agencies in reporting 

and monitoring suspected drug abuse and diversion cases. 

About half of the States we interviewed expressed concerns regarding

beneficiary fraud and abuse. Examples include beneficiaries’ fraudulently 

enrolling in Medicaid, abusing pharmaceuticals, and excessively visiting 

hospital emergency rooms. States expressed frustration that they could 

not apply the same sanctions to address beneficiary fraud as they could 

provider fraud. 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 15

 RECOMMENDATIONS

Managed care presents challenges in addressing fraud that differ from 

those in fee-for-service Medicaid. For example, managed care’s

capitated payments create incentives for providers to render fewer 

services to beneficiaries, and States must bear financial risk that could 

threaten the viability of their Medicaid managed care programs. CMS

guidelines on addressing Medicaid managed care fraud and abuse have 

not been updated since 2000.

As States increasingly use managed care to deliver Medicaid services, 

implementing safeguards to protect against fraud and abuse remains 

essential. MCEs, States, and CMS all have a stake in protecting the 

integrity of the program. Overall, we found that MCEs and States

reported taking steps to monitor and protect against fraud and abuse. 

However, they also expressed major concerns. 

More than half of the MCEs in our sample reported concerns with 

services billed but not provided to beneficiaries. CMS’s MIG similarly 

identified this vulnerability, finding that most States and MCEs in our 

sample do not verify with managed care beneficiaries whether services 

were received, despite regulations requiring States to do so for fee-forservice Medicaid. 

CMS guidelines on addressing Medicaid managed care fraud and abuse

identified six areas of concern. However, the majority of concerns 

identified in our review fall under only one of these six areas: claims 

submission and billing procedures. The other five areas were seldom, if 

at all, reflected in the concerns. Therefore, we recommend that CMS:

Require that State contracts with MCEs include a method to verify with 

beneficiaries whether they received services billed by providers

CMS could require States to implement one of several options. One is 

for MCEs to send EOMBs to beneficiaries. As one State Agency told us, 

EOMBs are the “best, most effective tool” to determine whether billed 

services were actually received. Other options include contacting 

beneficiaries by telephone or mailing them a questionnaire. To 

minimize the cost of verifying services, MCEs could contact a 

representative sample of beneficiaries. MCEs could also sample 

beneficiaries based on billing analyses. 

Update guidance to reflect concerns expressed by MCEs and States

CMS could update and reissue its Guidelines for Addressing Fraud and 

Abuse in Medicaid Managed Care. Because most of the concerns 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 16

RECOMMENDATIONS

reported to us fall under the “Claims Submission and Billing 

Procedures” section, CMS could use that as a starting point from which 

to expand. CMS could also share best practices and innovative methods 

that States and MCEs have used to address fraud and abuse concerns 

and strengthen program integrity oversight. CMS could also share best 

practices via the Medicaid Integrity Institute and its Technical Advisory 

Groups (TAG). CMS has two relevant TAGs—one focused on Medicaid 

managed care and one on fraud and abuse—that could collaborate to 

share best practices across all their member States.

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with both recommendations, stating that it will 

advise States to work with their MCEs to determine and implement 

effective strategies for verifying that services billed by network 

providers are received. CMS will work with States to identify 

efficient and effective strategies based on States’ and MCEs’

experiences. CMS also stated that it has been developing a strategy 

to effectively address managed care program integrity and will revise 

its guidelines once that strategy is complete. Finally, CMS stated 

that it provides a compendium of States’ noteworthy and effective

practices in key program integrity areas, including Medicaid managed 

care, on its Web site. We made no changes to the report based on 

CMS’s comments. See Appendix B for the full text of CMS’s 

comments.
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 17

 APPENDIX ~ A

Percentage of Medicaid Beneficiaries Enrolled in Managed Care Organizations 

as of June 30, 2008

State CMS Region Medicaid 

Enrollment

Medicaid 

Managed Care 

Enrollment

Percentage 

Enrolled in 

Managed Care

Tennessee Region IV 1,207,136 1,207,136 100%

Vermont Region I 141,260 128,571 91%

Arizona* Region IX 1,048,635 949,404 91%

Hawaii Region IX 211,105 166,948 79%

Oregon Region X 417,946 306,957 73%

New Jersey* Region II 914,503 659,586 72%

Ohio* Region V 1,783,993 1,274,549 71%

Delaware* Region III 152,899 106,267 70%

Maryland* Region III 710,790 491,274 69%

Indiana* Region V 881,888 582,714 66%

Alabama Region IV 764,914 504,466 66%

Connecticut Region I 435,419 284,465 65%

New York Region II 4,147,101 2,685,186 65%

Michigan Region V 1,547,246 993,832 64%

District of Columbia Region III 146,072 92,985 64%

Minnesota Region V 617,397 385,025 62%

New Mexico Region IV 472,629 292,456 62%

Rhode Island* Region I 178,119 110,195 62%

Georgia Region IV 1,271,355 723,621 57%

Virginia Region III 753,714 419,904 56% 

Washington* Region X 960,881 515,545 54%

Pennsylvania Region III 1,833,489 968,887 53%

Wisconsin Region V 907,455 472,612 52%

California Region IX 6,606,893 3,388,651 51%

Kansas Region VII 278,705 132,832 48%

Nevada* Region IX 188,831 88,871 47%

West Virginia Region III 311,064 138,699 45%

Texas* Region VI 3,041,201 1,311,046 43%

Missouri Region IV 833,112 345,868 42%

Florida* Region IV 2,276,014 878,067 39%

Massachusetts Region I 1,155,134 402,469 35%

Utah Region VIII 208,009 59,904 29%

South Carolina Region IV 689,338 184,526 27%

Kentucky Region IV 731,911 145,066 20%

Nebraska* Region VII 202,297 32,716 16%

Colorado* Region VIII 429,895 59,989 14%

Illinois Region V 2,106,700 164,100 8%

Iowa Region VII 362,807 4,764 1%

Note: States with an * are included in this evaluation.

 Source: Office of Inspector General Analysis of Centers for Medicare & Medicaid Services Medicaid Enrollment data as of June 30, 2008.
A P PEN D x B 

Agency Comments 

..........'.,.,.... (4­ DEPARTMENT OF HEALTH & HUMAN SERVICES Centers for Medicare & Medicaid Services 

Administrator 

Washinglon. DC 20201 

DATE: OCT 2 6 2011 

TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	 Donald M. Berwick, M.D. 

Administrator 

SUBJECT: 	 Dffice ofInspector General (DIG) Draft Report: Medicaid Managed Care: Fraud 

and Abuse Concerns Remain Despite Safeguards (DEI-OI-09-00550) 

Thank you for the opportunity to review and comment on the DIG Draft Report entitled, 

"Medicaid Managed Care: Fraud and Abuse Concerns Remain Despite Safeguards (DEI-OJ-09. 

00550)." The objectives of the report are to determine--(I) To what extent selected Medicaid 

managed care entities (MCEs) took steps to meet Federal program integrity requirements; (2) 

How States oversee MCEs' fraud and abuse safeguards; and (3) The major concerns that MCEs 

and States have regarding fraud and abuse in Medicaid managed care. The DIG reviewed CMS' 

program integrity reviews for a sample of 13 States and 46 MCEs, collected questionnaires from 

45 MCEs, and conducted structured interviews with the 13 States and CMS. 

The DIG's report found that all MCEs in the sample reported taking steps to meet the Federal 

program integrity requirements, and all 13 States reported taking steps to oversee MCEs' fraud 

and abuse safeguards. However, MCEs and States remain concerned about the prevalence of 

fraud and abuse in managed care. 

OIG Recommendation 

The CMS should require that State contracts with MCEs include a method to verify with 

beneficiaries whether services billed by providers were received. 

CMS Response 

The CMS concurs with DIG's recommendation to implement a mechanism for verifying that 

billed services are delivered. Title 42 CFR §455.20 already requires States to implement a 

method for verifying with recipients whether services billed by providers were actually received, 

but the regulation does not prescribe the method States must use. This language gives the States 

flexibility to determine the most effective -. and cost·effective·· mechanisms for accomplishing 

this, consistent with their administrative infrastructure, delivery systems and beneficiary 

popUlations. Consistent with DIG's recomtnendation, CMS will advise States to work with their 

MCEs to determine and implement effective strategies for verifying that services billed by 

network providers are received and CMS will work with States to identify efficient and effective 

strategies based on States and MCE experiences. CMS appreciates the work of the DIG in 

OEI·01·09·00550 MEDICAID MANAGED CARE: FRAUD AND ABUSE CONCERNS REMAIN DESPITE SAFEGUARDS 18 
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 19

APPENDIX~B
 

 

OEI - 0 1 - 0 9 - 00550 MEDICAID MANAGED C ARE : F RAUD A ND A BUSE C ONCERNS R EMAIN DESPITE S AFEGUARDS 20

 ACKNOWLEDGMENTS

This report was prepared under the direction of Joyce M. Greenleaf, 

Regional Inspector General for Evaluation and Inspections in the 

Boston regional office, and Russell W. Hereford, Deputy Regional 

Inspector General.

Ivan Troy served as the team leader for this study. Other principal 

Office of Evaluation and Inspections staff from the Boston regional 

office who contributed to the report include Alyson J. Cooper and 

Shreya M. Patel; other central office staff who contributed include Kevin 

Manley and Tasha Trusty. 
 

Office of Inspector General http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health & Human Services (HHS) 

programs, as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by the following operating components:

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS.

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties.

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.