Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

JUNE GIBBS BROWN 

Inspector General 

JUNE 1999 

OEI-07-96-00250 

MEDICAID MANAGED CARE 

FRAUD AND ABUSE 
OFFICE OF INSPECTOR GENERAL 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, is to 

protect the integrity of the Department of Health and Human Services programs as well as the 

health and welfare of beneficiaries served by them. This statutory mission is carried out through a 

nationwide program of audits, investigations, inspections, sanctions, and fraud alerts. The 

Inspector General informs the Secretary of program and management problems and recommends 

legislative, regulatory, and operational approaches to correct them. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) is one of several components of the Office of 

Inspector General. It conducts short-term management and program evaluations (called 

inspections) that focus on issues of concern to the Department, the Congress, and the public. The 

inspection reports provide findings and recommendations on the efficiency, vulnerability, and 

effectiveness of departmental programs. 

OEI's Kansas City Regional Office prepared this report under the direction of James H. Wolf, 

Regional Inspector General. Principal OEI staff included: 

REGION HEADQUARTERS 

Jennifer King, Project Leader Wynethea Walker, Program Specialist

Perry Seaton, Program Analyst Stuart Wright, Associate Director

Linda Paddock, Program Analyst Barbara Tedesco, Mathematical Statistician

To obtain copies of this report, please call the Kansas City Regional Office at (816)426-3697. 

Reports are also available on the World Wide Web at our home page address: 

http://www.dhhs.gov/progorg/oei 
EXECUTIVE SUMMARY

To describe and assess the manner in which Medicaid Section 1115 Waiver States detect, review, 

and refer for investigation fraud and abuse cases in managed care programs. 

BACKGROUND 

Medicaid is a Federal-State matching entitlement program which provides medical assistance to 

families and individuals below certain income and resource levels. As costs increase, States are 

looking to managed care organizations (also referred to as managed care plans) to provide costeffective medical care while preventing unnecessary medical treatment. They contract with States 

to provide all or part of the Medicaid benefit package on a prepaid risk basis. 

Fraud and abuse in Medicaid programs threatens States’ capability to pay for services and provide 

quality care for beneficiaries. To address this, Medicaid State agencies are required to have an 

integrity program dedicated to detecting and reviewing suspected fraud and abuse cases. Because 

abuse can entail patient abuse or egregious forms that may represent fraudulent activity, we have 

referenced fraud and abuse cases together in this study. 

In hopes of learning how States are coping with fraud and abuse emerging in managed care 

settings, we examined detection and referral processes, provisions, and data in 10 States operating 

with 1115 Waivers for managed care at the time we started our study. We collected information 

through surveys, site visits, and interviews of responsible officials in the Medicaid State agencies, 

fraud control units, and 85 managed care organizations. This study is a preliminary review of 

fraud and abuse detection and referral in managed care settings and does not address related 

aspects such as investigation and prosecution of cases. 

FINDINGS 

Two States have active programs which result in case detection and referral of fraud and 

abuse; others do not 

While 8 of the 10 States in our study report detection and referral of cases, 2 States (Arizona and 

Tennessee) accounted for almost all managed care case referrals (97 percent, or 490 out of 

504 cases) and produced recoveries of over $4.3 million during a 12-month period. Fraud control 

units in these States employ extensive proactive efforts to detect fraud and abuse cases. The 

remaining eight States’ fraud units do not have such extensive activities and protocols. 

There is no general agreement about roles and requirements to detect and refer fraud and 

abuse in the managed care setting 

Theoretically, the current program integrity requirements in the fee-for-service Medicaid program 

also legally apply with equal force in the managed care program. However, Medicaid State 

agencies, fraud control units, and managed care organizations have differing opinions concerning 

))))))))))) i 
who should have the responsibility for detecting and referring managed care fraud and abuse cases 

for investigation. States also vary in establishing and applying detection and referral requirements 

for managed care organizations, with four States having no specified requirements. Where 

requirements are established, fraud units and managed care plans are confused or unaware of 

them. Approximately half of the managed care plans report they have established a coordinator or 

integrity program to proactively detect fraud and abuse. While Medicaid State agency officials 

generally believe that managed care plans appropriately refer cases, fraud control unit officials do 

not. 

Medicaid State agencies and fraud control units differ in the intensity and the nature of 

oversight activities 

The majority of Medicaid State agencies and fraud units report limited oversight and fraud 

identification efforts. Officials in two States indicate they have routine or systematic protocols in 

place to identify managed care fraud and abuse. Two of the 10 States note having provisions to 

penalize plans for non-referral of detected fraud and abuse cases. Also, few Medicaid State 

agency officials report they conduct reviews of managed care provider contracts and managed 

care plans’ internal detection and referral efforts. 

Medicaid State agencies, fraud control units, and managed care organizations identify a 

number of tools they believe they need to address fraud and abuse in managed care 

Medicaid State agencies, fraud units, and managed care organizations identify a number of tools 

needed including detection and referral guidelines, training on detection techniques, reliable 

encounter data, and computer systems. Responding officials also report the need for a centralized 

information resource comprising a national database of detected cases and their outcomes, a 

compendium of best practices, a list of knowledgeable contacts, and additional staffing. All 10 

fraud units and 41 of the 85 managed care organizations in our study report they do not have staff 

specifically assigned to investigate managed care fraud and abuse. Likewise, three Medicaid State 

agencies’ officials note they do not have staff assigned to conduct oversight of internal plan 

detection and referral efforts. 

RECOMMENDATIONS 

We recognize that fraud and abuse in managed care is a newly emerging area of concern for the 

healthcare community. We conducted this study in hopes of learning how States are coping with 

fraud and abuse, how they detect cases, and what they do with them once detected. Overall, there 

is confusion and disagreement on how to address fraud and abuse and there is limited activity in 

developing or actively pursuing and referring cases in the Medicaid managed care program. 

However, we have learned that States with proactive efforts are detecting and resolving cases. 

We believe the information obtained in this study provides an opportunity for Medicaid State 

agencies, fraud units, and managed care organizations to learn from those that have established 

proactive managed care fraud and abuse programs. 

))))))))))) ii 
<

It is important for all entities involved to have an effective fraud and abuse detection and referral 

system to protect the integrity of the Medicaid program and, as fraud in many cases can impact 

quality, to ensure high quality health care for beneficiaries. We recognize that HCFA initiated a 

number of efforts in this area in 1997, including the formation of the Medicaid Fraud in Managed 

Care Workgroup initiative to develop a model fraud and abuse system for the States, the 

coordination of National Medicaid Consortium meetings to discuss these issues, and participation 

in the Department of Justice Managed Care Work Group. Beginning in 1998, HCFA also 

initiated a series of four “Fraud and Abuse in Medicaid” executive-level seminars for state 

decision-makers to discuss strategies and solutions in their efforts to control fraud and abuse. 

However, we believe that implementation of the following recommendations can promote or 

further enhance Medicaid State agency, fraud control unit, and managed care organizations’ 

efforts to address fraud and abuse in managed care. To that extent, we recommend HCFA, in 

coordination with the OIG, 

< establish guidelines for States and managed care organizations to follow in 

developing and carrying out proactive fraud and abuse detection and referral 

activities. 

< ensure that States monitor managed care organizations’ fraud and abuse programs 

for compliance with its guidelines. 

< continue to develop, sponsor, and emphasize detection and referral training for 

States and Medicaid managed care organizations. 

AGENCY COMMENTS 

The HCFA concurs with recommendations in the report and describes their various efforts and 

initiatives in technical assistance, development of guidelines, consultation with States, and 

detection and referral training. We are encouraged that the agency reports it is focusing attention 

and efforts in these important areas. Also, we are pleased that it intends to share the guidelines 

and other fraud and abuse detection and referral products for the OIG’s review and comment. 

We note the first recommendation was revised in response to HCFA’s comment regarding the 

OIG’s use of “guidelines” and “requirements” interchangeably. 

))))))))))) iii 
TABLE OF CONTENTS

PAGE 

EXECUTIVE SUMMARY 

INTRODUCTION .......................................................... 1

FINDINGS ................................................................ 6

Two States with Active Fraud and Abuse Programs ................................ 6

Disagreement About Roles and Requirements ..................................... 9

Variations in Oversight and Penalties. .......................................... 13

Tools Needed to Address Fraud and Abuse ..................................... 14

RECOMMENDATIONS ..................................................... 16

ENDNOTES .............................................................. 18

APPENDICES 

A: Medicaid Section 1115 Waiver States. ....................................... A-1

B: Types of Suspected Fraud and Abuse Cases ................................... B-1

C: Fraud and Abuse Referrals to Fraud Units ..................................... C-1

D: Agency Comments ..................................................... D-1
INTRODUCTION

PURPOSE 

To describe and assess the manner in which Medicaid Section 1115 Waiver States detect, review, 

and refer for investigation fraud and abuse cases in managed care programs. 

BACKGROUND 

Medicaid 

Medicaid is a Federal-State entitlement program which provides medical assistance to families and 

individuals below certain income and resource levels. Each State, within national guidelines 

established by the Federal Government, can develop its own eligibility standards; determine the 

type, amount, duration, and scope of services; set the rate of payment for services; and 

administers its own program. 

For Fiscal Year (FY) 1996, the Health Care Financing Administration (HCFA), the Federal 

agency responsible for overseeing the Medicaid program, reported that the program served a total 

of 36 million children, elderly, blind and disabled individuals. Also in 1996, Medicaid costs for 

health care totaled approximately $153 billion, with the States paying $66 billion and the Federal 

government $87 billion. 

Medicaid Managed Care 

As costs increase, States are looking to managed care organizations (also referred to as managed 

care plans) to provide cost-effective medical care while enhancing access to quality care. The 

purpose of managed care is to control excess costs by using a “gatekeeper” or primary care 

physician to manage or coordinate beneficiary access to services, while preventing unnecessary 

medical treatment. Under this concept, plans contract with States to provide all or part of the 

Medicaid benefit package on a prepaid risk basis. States must operate their Medicaid programs 

under the traditional fee-for-service system unless the State amends its State Plan or obtains a 

HCFA “1115 waiver” or “1915 waiver.” Under the Balanced Budget Act of 1997, States are 

permitted to mandatorily enroll Medicaid beneficiaries into managed care by amending its State 

Plan. If a State opts to incorporate Medicaid managed care permanently into the State Plan, it is 

not necessary to obtain an 1115 Waiver. 

Under section 1115(a) waivers, States can conduct time-limited projects allowing broad new 

initiatives which demonstrate program features that have not been tried or proposed on a 

widespread basis. This waiver allows States to cover new services, offer different service 

packages, and test reimbursement methods, and may require Medicaid beneficiaries to enroll in 

managed care plans. Many of the States' approaches are aimed at saving money which enables 

them to cover additional low-income recipients and the uninsured. Under section 1915(b) 

waivers, States can also cover specific populations in managed care programs, but are generally 

more narrowly focused and are confined to specific Federal Medicaid requirements. 

))))))))))) 1 
As of February 1998, there were 16 States that have implemented 1115 State-wide waivers, 

2 States with approved waivers awaiting implementation, and 8 others pending approval. There 

are other 1115 waivers proposed, approved, or implemented but they involve localized programs 

for special populations or geographic areas. These 1115 demonstration projects are monitored 

and evaluated by HCFA. 

The concept of managed care is growing rapidly within the Medicaid program. The HCFA 

reported as of June 30, 1996, that enrollment in Medicaid managed care increased by 

177 percent since June 30, 1993, which includes a 36 percent increase in 1996 alone. From 

June 30, 1995, to June 30, 1996, the number of beneficiaries enrolled in Medicaid managed care 

grew from 9.8 million to approximately 13.3 million, approximately 40 percent of the total 

Medicaid population. This trend continues as more States establish 1115 waivers or amend their 

State plans. 

Fraud in Traditional Medicaid Programs 

Fraud in Medicaid programs threatens States’ capability to pay for services and the quality of 

services to beneficiaries. To address this fraud, specific requirements exist under the traditional 

Medicaid program for the States’ detection and investigation of individuals and providers 

violating State and Federal law. These functional requirements cover three primary State 

components: Medicaid State agencies; Surveillance and Utilization Review Subsystems (S/URS); 

and Medicaid fraud control units. 

Medicaid State Agencies - The Medicaid State agency is authorized by law and regulation and is 

part of the State’s implementation of a Medicaid State Plan. The Medicaid State agency 

establishes rules and regulations that it uses for administration of the plan. The agency must have 

a program integrity component within its domain which is dedicated to detecting and investigating 

suspected cases of fraud. 

Surveillance and Utilization Review Subsystems Units - Under a fee-for-service program, the 

S/URS component within the Medicaid State agency is responsible for detecting and referring 

potential fraud and abuse cases for investigation. The S/URS unit uses the Medicaid Management 

Information System to apply automated post-payment screens to Medicaid claims and conducts 

preliminary reviews of aberrant providers and beneficiaries to determine whether they substantiate 

a pattern of criminal fraud. When potential cases are detected, the S/URS refers the cases to 

assigned components within the States that pursue investigation of criminal fraud. In most cases, 

these are the Medicaid fraud control units. 

Medicaid Fraud Control Units - These fraud units are part of the State Attorney General or 

other State agency which are separate and distinct from the Medicaid State agency. All States are 

required to have a fraud control unit unless they obtain a waiver. The scope of their authority is 

to investigate and prosecute suspected cases of fraud in connection with any aspect of the 

provision of medical assistance and to review complaints of abuse and neglect of patients in health 

care facilities which received payments under the State plan. The fraud units are also responsible 

for investigating suspected cases of fraud which occur within the Medicaid State agency. There 

are currently 47 States which have established fraud control units as of April 1998. 

))))))))))) 2 
Fraud in Managed Care 

Fraud in managed care is a newly emerging area of concern to the healthcare community. As a

result, there are few who have extensive experience on how to address managed care fraud. 

Although requirements exist for detection and investigation of claims related fraud cases

occurring in traditional Medicaid programs, there have been few requirements 1 developed to

specifically address fraud detection and referral in the managed care setting. One reason for this

could be the belief of some policy makers, government agency officials, health care insurers, and

providers that the introduction of managed care would all but eliminate fraud in the health field. 

However, there are increasing numbers of officials who believe this is not so. The National

Association of Medicaid Fraud Control Units notes in the President's Task Force Report, “While

many proponents of managed care believe that the very nature of the system prevents fraud, the

experience of the fraud control units proves otherwise....no health care plan is immune from fraud,

but rather that fraud will simply take different forms.” 2 In addition, the National Health Care

Anti-Fraud Association (NHCAA) further noted this misconception in a Report to the National

Health Care Anti-Fraud Association Board of Governors by the NHCAA Task Force on Fraud in

Managed Care, by stating, “Contrary to the perceptions of some in government and in the health

care reform arena....and even in the health insurance industry.... fraud does not disappear in a

managed care or ‘managed-competition’ environment.” 3

In fully capitated managed care organizations, there is a fixed amount of money paid for the care

of patients and no claims are submitted as in the traditional Medicaid program. As a result, there

are no State claims review processes through which charges are filtered before payment is made

and, as such, regulations and HCFA requirements have not revised or specified a role for S/URS

units as part of the Medicaid managed care program. The risk for managed care organizations is

that the capitated rates will not cover all the costs of treating beneficiaries. Consequently, there

are incentives to provide less than necessary care to recover losses or to increase the plans'

earnings. Also, capitated managed care has opened the door for less obvious forms of fraud

including:

! underutilization and denial of necessary covered medical care;

! exclusion of certain groups from services;

! failure to provide beneficiaries' services advertised or mandated by law;

! unreasonable times and distances for appointments to prevent beneficiaries from obtaining

services; 

! illegal marketing tactics; 

! enrolling fictitious enrollees or those ineligible for enrollment; 

! submission of falsely elevated cost data to justify higher capitation payments; and 

! fraudulent subcontracts. 

In addition, most Medicaid managed care plans themselves face the same kind of fraud threats 

faced by traditional fee-for-service programs. For example, a plan may contract with physicians 

who may then sub-contract with other physicians and suppliers who could be paid on a 

fee-for-service basis. It can also receive a capitated rate for managing all beneficiaries’ services 

and may then compensate 100 percent of its providers on a claims basis. Therefore, it is likely 

))))))))))) 3 
that traditional forms of fee-for-service fraud also impacts managed care operations. Some

examples of traditional fraud that may also occur include:

! fraudulent related party transactions;

! kickbacks;

! rebates and other illegal economic arrangements; and

! fraud in the administration of the program. 

Medicaid State agencies are not only dealing with fee-for-service fraud, but also the newly

emerging types occurring in managed care settings. As the provision of services is 

sub-contracted out from the managed care organizations, the ability to detect fraud becomes

increasingly problematic.

Fraud activity has shifted from the provider level to the corporate managed care level. The

National Association of Attorneys General, in a report entitled Health Care Fraud In A Managed

Care Environment, discusses the inherent problems with this shifting of responsibility noting,

“The managed care organizations (MCO), being the entity closest to the provider, would be in the

best position to monitor the activities of the providers and to match services to costs through a

reporting process. But this has not always been the case....In some instances it is the MCO itself

that is attempting to cap services to save money. There would be a natural reluctance with the

MCO to make the effort to police itself and its providers.” 4 It seems the responsibility should

evolve for the managed care plans to detect and refer cases of suspected fraud and abuse

committed by plan providers, members, or by the plan’s themselves.

Abuse in the Medicaid Program 

The subject of the report is managed care fraud and abuse; however, the latter term carries with it 

certain ambiguities. First, abuse can relate to physical abuse, failure to provide services, or 

neglect of patients in the Medicaid program. In addition, abuse or exploitation occurs through 

questionable billing, treatment, or other programmatic practices. Further complicating the issue, 

it is sometimes difficult to make a clear distinction between fraud and abuse. While neglect of a 

patient or underutilization in the treatment of a patient might traditionally have been considered 

patient abuse, it might also be treated as a fraudulent activity. Billing practices and other activities 

can be considered programmatic abuse but, upon investigation, may cross the line to criminal 

fraud. In both scenarios, the Medicaid fraud control units are responsible for investigating cases 

of patient abuse and all areas of egregious activity that might evolve to a fraudulent level. 

Because of these issues, we have been unable to always clearly distinguish between abuse and 

fraud in responses provided to our surveys. We include data on fraud and abuse cases separately 

where we could make the distinctions. Where it is not possible, we include abuse with fraud cases 

in the survey and in reporting the results of this study. 

This report does not focus specifically on patient abuse. The OIG, however, is concerned with 

such abuses and has conducted several studies on patient abuse in home health care and is 

undertaking a number of other studies that addresses this important subject. 

))))))))))) 4 
METHODOLOGY 

This study is intended to provide an initial examination of fraud and abuse detection and referral 

activities in Medicaid managed care organizations, Medicaid State agencies, and Medicaid fraud 

control units. We conducted this study in hopes of learning how States are coping with this newly 

emerging managed care fraud and abuse, how they detect it, and what they do with cases once 

detected. While managed care fraud and abuse detection is evolving, we hope the information 

provided in this report may contribute insights to policy makers as future efforts are taken to 

address fraud and abuse. 

To accomplish this goal, we examined the fraud and abuse detection and referral processes in the 

10 Medicaid State agencies that were operating under an 1115 waiver at the time the study began 

(See Appendix A). We chose to focus on 1115 waiver States as they are waived from many of 

the Federal Medicaid requirements and are allowed to require the broad range of Medicaid 

beneficiaries to enroll in managed care organizations. We collected information through surveys, 

site visits, and interviews of responsible officials in the Medicaid State agencies, fraud units, and 

95 Medicaid managed care plans. We made site visits to three Medicaid State agencies, three 

fraud units, and six managed care organizations to ensure quality data was collected through the 

survey process. We received responses from all Medicaid State agencies and fraud units, and 

85 of the 95 managed care plans surveyed. We compiled data into frequency distributions and 

conducted a content analysis of narrative responses. We also reviewed fraud and abuse 

processes, guidelines, provisions and other information provided by these entities, and obtained 

data on the number, type, and outcomes of potential fraud and abuse cases detected and referred 

for investigation. We note that one State, Arizona, has had extensive experience with the 

Medicaid managed care program and might provide a particular fertile ground to obtain 

operational information. 

We emphasize that this study is a review of detection and referral processes only. It does not 

cover other important aspects of fraud and abuse, such as investigations, prosecutions, civil 

monetary penalties, or the roles of other governmental entities involved with fraud and abuse. 

Although the Office of Inspector General’s Office of Investigations and Office of Counsel for the 

Inspector General, as well as the Department of Justice, U.S. Attorneys, and others have 

important roles in investigation and prosecution of cases, these entities are not included as part of 

this study. 

We plan to continue to look at potential fraud and abuse in the managed care setting and efforts 

being made to address it. 

This inspection was conducted in accordance with the Quality Standards for Inspections issued 

by the President’s Council on Integrity and Efficiency. 

))))))))))) 5 
FINDINGS

Two States Have Active Programs Which Result in Case Detection and Referral of 

Fraud and Abuse; Others Do Not 

While officials in 8 States report detection and referral of managed care fraud and abuse cases, 

2 States (Arizona and Tennessee) accounted for almost all cases referred (97 percent of 

504 cases) for investigation in 1996. As shown in the following table, these States also had case 

resolutions that exceeded $4.3 million in recoveries, overpayments, and fines. We chose to 

highlight Arizona and Tennessee as these are the States that have yielded outcomes from their 

proactive efforts in this area. The remaining eight States accounted for three percent of case 

referrals, with fraud units in two States having no referrals. 5 

CASE REFERRALS RECEIVED BY FRAUD UNITS IN 1996 

Number of Cases Arizona Fraud Unit Tennessee Fraud Unit 

Referrals Received of Potential Fraud and Abuse 164 326 

Fraud Referrals Opened for Investigation 37 35 

Abuse Referrals Opened for Investigation 38 39 

RESOLUTION OF CASES REFERRALS RECEIVED 

Criminal Indictments 15 6 

Criminal Convictions 17 7 

Global Settlements * 3 

Patient Abuse Indictments 17 15 

Patient Abuse Convictions * 11 

Recoveries from Overpayments, Fines, Civil Penalties, 

etc. $860,473 $3,485,450 

* Information unavailable. 

We found that most fraud units report receipt of some managed care fraud and abuse cases. A 

few States specifically identify patient physical abuse. In most cases, however, they are simply 

reported as referrals of fraud and abuse, as specific breakouts are not made. Where abuse has 

been specifically broken out, as in Arizona and Tennessee, we have reported the case numbers in 

the table. 

)))))))))))

6 
Type of Cases Detected 

The types of cases detected include situations normally associated with a fee-for-service program 

(i.e., billing for services not rendered, upcoding, and duplicate billing) and those that relate to 

managed care (i.e., underutilization where services or referrals are denied as a practice, an 

ineligible person using a member’s identification card for services, and enrollment fraud). See 

Appendix B for further details on the types of fraud and abuse suspected by reporting entities. 

Case Referral Data 

Through our evaluation of self-reported data on the number of cases referred and the number 

received by the Medicaid State agency, the fraud units, and the managed care organizations, we 

found some inconsistencies in the data. Data provided by the fraud units indicate they received 

4 referrals from managed care plans during our study period, however, the plans report they 

referred 137 cases to the fraud units. Likewise, the Medicaid State agencies report they referred 

125 cases to the fraud units, however, the fraud units indicate they received 219 cases from them. 

We acknowledge these inconsistencies in the data and believe there may be several reasons for 

these differences. In some States, the fraud units meet with the managed care plans and the 

Medicaid State agencies to discuss potential cases. Discussions of a case may be considered a 

referral by the managed care plan, however, it may not be considered a referral by the fraud unit 

or Medicaid State agency. In this situation, the case may be determined to be neither fraudulent 

or abusive, or the fraud unit may request the managed care plan conduct further investigation of 

the case. In one State, the fraud unit receives so many potential cases that they are initially placed 

in a suspended file until a second complaint is received, thus warranting an open investigation. 

While we acknowledge the difficulties in obtaining consistent data on the number of referrals 

made for investigation, we believe it is significant that Medicaid State agencies, fraud units, and 

managed care plans report that fraud and abuse is being detected in the managed care programs 

and that cases are being referred and accepted for investigation. 

We also note that efforts in Arizona and Tennessee have resulted in recoveries and indictments, 

however, data on case referrals to the fraud units in Appendix C indicates that neither unit reports 

receiving case referrals from managed care plans. In Arizona, managed care plans are required to 

refer cases to the Medicaid State agency where a preliminary investigation is conducted. If the 

agency believes the case warrants further investigation, it then refers the case to the fraud unit. In 

other words, the managed care plans are instructed to refer cases directly to the Medicaid State 

agency and not the fraud unit. In Tennessee, the fraud unit staff meets with the managed care 

plans throughout the year, however, the unit did not maintain data on the number of cases that 

were referred to them by the plans during our data collection period. 

)))))))))))

7 
Proactive Efforts in Arizona and Tennessee 

While both Arizona and Tennessee note that further improvements are needed, their receipt of 

97 percent of all referrals to fraud units, and recoveries of over $4 million, invites inquiry into 

their proactive efforts to foster detection and referral. We note that these fraud units report 

conducting routine, proactive efforts to assist in detection of potential managed care fraud and 

abuse. Both fraud units conduct extensive training for the managed care plans and hold regularly 

scheduled meetings with them to discuss potential fraud and abuse cases. The Tennessee fraud 

unit provides substantial opportunity for the plans to receive training by holding annual seminars, 

quarterly “round table” sessions, and monthly meetings. In Arizona, the fraud unit makes 

presentations and prepares extensive informational documents on problems inherent in managed 

care fraud and abuse detection in addition to having quarterly meetings and providing training for 

the plans. Information reported shows that the remaining eight fraud units do not have such 

extensive activities and protocols. 

In Tennessee and Arizona, the fraud units are specifically designated through policy as the 

investigative component of potential fraud and abuse in their respective Medicaid managed care 

programs. The Tennessee fraud unit is highlighted under the fraud and abuse section of the 

managed care organization contracts as the State agency responsible for investigation of fraud and 

abuse in the managed care program. In Arizona, the fraud unit is authorized, through a 

Memorandum of Understanding with Medicaid State agency, to carry out investigation and 

criminal prosecution of provider fraud and abuse, abuse or neglect of patients, and fraud in the 

administration managed care program. 

In addition, the Arizona Medicaid State agency conducts proactive efforts in detecting fraud and 

abuse. It has developed an initiative to educate the public about fraud and abuse through 

television, radio, posters, public forums, and newspapers. Its program integrity staff meets 

monthly with managed care plans to discuss fraud and abuse and provides instruction on what to 

look for and what to do when cases are detected. The managed care plans are required to have a 

fraud policy, educate employees on fraud and abuse, and have a fraud contact. The Medicaid 

State agency reviews the policy on an annual basis and interviews plans’ staff to ensure they have 

received required fraud training and know what to do when cases surface. Also, the Medicaid 

State agency has negotiated basic guidelines with the managed care plans that cover detection and 

referral. The guidelines detail what should be in the fraud policies, definitions of fraud and abuse, 

specify detection activities and how cases may result from them, and include printed forms that 

should be used to refer potential cases to the Medicaid State Agency. 

These proactive efforts, in effect, complement some of the processes discussed by HCFA during 

nation-wide Consortium meetings that were held in 1997. In addition to increasing awareness, 

the meetings were designed to emphasize coordination among the various State components. 

Such endeavors by HCFA correlate to the perceived needs reported in this inspection. 

))))))))))) 8 
There Is No General Agreement About Roles And Requirements to Detect And Refer 

Fraud And Abuse in The Managed Care Setting 

Perceptions of Roles and Responsibilities 

Medicaid State agencies have differing opinions concerning who should have the responsibility for 

detecting and referring managed care cases for investigation. This is despite the fact that 

theoretically the current program integrity requirements in the fee-for-service Medicaid program 

legally apply with equal force in the managed care program. As part of the fee-for-service 

program, Medicaid State agencies are required to have a S/URS unit that detects aberrancies 

through post-payment reviews of claims. Potential fraud cases detected through these reviews are 

referred to the fraud units for investigation. In Medicaid managed care, no additional guidance 

has been provided. However, managed care is a new area of concern that seems to be a source of 

confusion and less certainty of which entity(s) is responsible for detection and referral of cases. In 

fact, three Medicaid State agencies have indicated in their survey responses that they do not 

believe that it is their responsibility. One reports that detecting fraud and abuse committed by 

beneficiaries, providers, or by individuals operating within managed care is the responsibility of 

the managed care organizations. The Medicaid State agency officials believe they should not 

duplicate detection efforts and that fraud or abuse occurring in or against managed care plans 

does not impact the Medicaid capitated rates or expenditures. Also, two other Medicaid State 

agencies explain since the monies are capitated, there is no reason for them to be concerned with 

fraud and abuse. From their perspective, it impacts the managed care organization’s cost of doing 

business and, therefore, is their responsibility. 

Most fraud control units believe, however, that increased costs incurred by managed care plans 

from fraudulent billings will ultimately raise Medicaid costs and therefore are a Medicaid State 

agency’s responsibility. When managed care plans’ annual expenditure reviews reveal that costs 

are higher than anticipated, capitation rates may be increased by the State for the next year. If 

fraud and abuse causes managed care costs to increase each year, capitation rates may also be 

increased, resulting in the escalation of Medicaid program expenditures. 

One fraud unit’s perspective is that the Medicaid State agency does not address fraud and abuse 

in managed care due to a general feeling that emphasis upon these issues would “interfere with the 

implementation of the Medicaid managed care program.” Six of the 10 officials responding to our 

survey of Medicaid fraud control units believe Medicaid State agencies are not focused on fraud 

and abuse. In this regard, some fraud unit officials indicate that the Medicaid State agencies do 

not mention them in their communication or direction to the managed care plans, with one noting 

that the plans do not know it exists unless it is investigating a case and contacts them. In fact, out 

of the 85 managed care organizations surveyed, 27 percent (23) report they were not even aware 

a fraud unit is in their State. 

One managed care organization respondent states “it does not perform any routine activities 

specifically to detect potential fraud and abuse as this is a function that the State has reserved 

))))))))))) 9 
for itself and the plan is not required or expected to perform activities to detect fraud and abuse.” 

In contrast, a fraud unit official suggests it is crucial for managed care organizations to be a part 

of detection and the organizations’ role is essential in ferreting out fraud and abuse. Further, they 

need to know the existence and functions of the fraud unit. 

These differences in role perceptions may also account for variations in requirements and actions 

to detect and refer potential managed care fraud and abuse situations. 

Detection and Referral Requirements 

Some States have not made explicit requirements for managed care plans to detect and refer fraud 

and abuse cases for investigation. Officials in four States indicate they have no requirements in 

contracts with managed care plans or in State law specifying managed care plans to detect 

potential fraud and abuse cases or refer them to Medicaid fraud units, or other appropriate law 

enforcement authorities, for further investigation. An additional two States require managed care 

organizations to refer cases to the fraud unit but do not require them to detect fraudulent and 

abusive situations. Despite lack of detection requirements in the six States, the managed care 

organizations, Medicaid fraud units, and Medicaid State agencies report that they have identified 

inaccurate billing, upcoding and unbundling, billing for services not rendered, enrollment fraud, 

beneficiary fraudulent stealing or forging of prescription drugs, ineligible individuals’ fraudulently 

using member identification cards, and other situations. 

Our survey results also show that in some States with managed care plan detection and referral 

requirements, fraud units and plans are unaware of them, or they disagree there are such explicit 

requirements. 

Detection Requirements 

Fraud control units and managed care plans in 3 of the 10 States are consistent in their awareness 

of detection requirements, or the absence of them. Medicaid State agencies, managed care plans, 

and fraud units in the remaining seven States report differing views or they are not sure that 

requirements exist. Forty-two percent of the managed care plans’ responses either are 

inconsistent with those of the Medicaid State agencies or are not aware of the requirements to 

detect cases. Two of the fraud units are also unaware of plans’ requirements to detect program 

fraud and abuse. 

In one State, the Medicaid State agency officials report that managed care plans are required to 

detect cases while the fraud unit officials disagree, stating that this is not required of the plans. 

To understand possible reasons for this discrepancy in the Medicaid State agency and fraud unit 

responses, we reviewed information provided on managed care organization requirements. 

))))))))))) 10 
We found the plans are required by law and through contracts to have an anti-fraud plan. More 

specifically, both the law and contracts require them to provide as part of their plan: 

! the name of the person responsible for administering the anti-fraud plan; 

! procedures to prevent fraud, including fraudulent claims and internal fraud 

involving officers, employees, or agents, and fraud resulting from 

misrepresentations on applications for coverage; 

! procedures reporting fraud to the appropriate law enforcement authorities; and 

! procedures for cooperation with the prosecution of insurance fraud cases. 

While this may imply that the managed care organizations are required to detect cases, it does not 

specifically state that detection is a requirement. The fraud unit and one managed care plan in this 

State contend that plans are not required to detect potential fraud and abuse cases. It should also 

be noted that of the 51 managed care plans reporting there are detection requirements in their 

States, 4 indicate that this requirement is not documented in State law or their contracts with the 

Medicaid State agency. 

In addition to some of the States requiring managed care plans to detect cases, one Medicaid 

State agency also indicates it requires the plans to review complaints from any source for fraud 

and abuse. Three other State agencies indicate that the fraud unit, the agency, or other state 

component reviews these complaints for potential fraud and abuse. While not required in most 

States, 71 percent of the plans (60) report they conduct such reviews. Forty-seven of 85 

managed care plans (55 percent) report validating encounter data to ensure that services are 

actually provided (e.g., looking for impossible services such as pregnant males, reconciliation with 

medical charts, and through contacting the beneficiaries to ensure services were provided). 

Thirty-six of them review this data for aberrancies. Approximately half of them (41 out of 85) 

report they have an established fraud and abuse coordinator or program integrity department that 

is responsible for proactively detecting potential managed care fraud and abuse. 

Referral Requirements 

Six of the Medicaid State agencies report that managed care plans are required to refer potential 

fraud and abuse cases for investigation. Our review reveals that the fraud units’ and plans’ 

responses in two States agree that there is such a requirement. In the remaining 8 States, 

34 percent of the managed care plans’ responses are inconsistent with those of the Medicaid State 

agencies, or the plans are not knowledgeable of these provisions. One fraud unit is also not aware 

of the referral requirements. Of the 55 managed care organizations stating they are required to 

refer cases, 6 of them agree but report that neither State law, procedure, or contracts document 

the requirement to refer suspected fraud and abuse cases. 

One Medicaid State agency and six fraud control units acknowledge the need for specific 

documented requirements for detection and referral of fraud and abuse cases, with two fraud units 

requesting sanctions be attached for failure to comply. One fraud unit believes penalties should be 

placed on managed care organizations which are equal to the amount of money involved in 

fraudulent cases that they fail to report to the units. Another believes, at a 

))))))))))) 11 
minimum, these organizations should be obligated through contracts or State law to report 

confirmed fraud and abuse cases. 

Six of the fraud units believe current State statutes that may be applicable to managed care are 

insufficient and need improvement to be effective as a basis for criminal charges. As an example, 

one fraud unit explains that the State statutes addressing theft by swindle and theft by false 

representation only apply to vendors of health care. It indicates managed care plans are not 

considered vendors, therefore, they cannot be charged with theft under current State law. In 

addition to problems with State statutes, four units believe that the Code of Federal Regulations is 

inadequate when applied to fraud and abuse in managed care since they were written to address 

fraud and abuse occurring in fee-for-service types of cases. 

Case Referrals 

In four States, we found differences in perspectives between the Medicaid State agencies and 

fraud units regarding whether managed care plans are appropriately referring fraud and abuse 

cases. The Medicaid State agencies’ officials believe that the managed care plans are referring 

cases while the fraud units officials suspect they are either resolving or disposing of these cases 

internally rather than referring them to the fraud units. One Medicaid State agency contends there 

are added assurances and specific requirements on reporting in the new contract. Despite the new 

contract being in place, the fraud unit reports receiving only one case referral from the seven 

managed care plans. In another State where the Medicaid State agency believes cases are 

appropriately being referred, it notes there is a hotline where enrollees can call with problems 

which will be quickly addressed. While a quick resolution may or may not be the appropriate 

method for processing cases, the fraud unit reports they have not received any cases from the 

Medicaid State agency or managed care plans. We also note in one State the fraud unit stresses 

that the managed care organizations are unaware they can refer cases to them and are reluctant to 

call other enforcement authorities [i.e., the Police or Federal Bureau of Investigation (FBI)] when 

cases occur. The fraud unit believes that the plans’ tendency is to eliminate the problem by 

terminating the provider rather than reporting it for investigation. 

We believe it is significant that there is agreement among the Medicaid State agency and fraud 

unit in just one State. In this instance, both components believe that managed care organizations, 

rather than appropriately referring cases for investigation, are resolving them internally. The 

Medicaid State agency reports that managed care plans are not proactively reviewing their 

provider networks nor are they making referrals of fraud and abuse cases to the fraud unit. 

Likewise, the fraud unit indicates that in a 12-month period, it had received a total of 5 referrals 

from the 11 managed care plans. One reason for the low number of referrals given by a managed 

care medical director is that its staff is reluctant to report any cases to the fraud unit because they 

do not want to be known as “hard-nosed.” The managed care plan staff believes that physicians 

will leave the network and enrollees will join other plans if it reports cases to the unit. 

))))))))))) 12 
Medicaid State Agencies and Fraud Control Units Differ in the Intensity and the 

Nature of Oversight Activities 

Oversight and Detection Activities 

While all Medicaid State agencies report conducting special or periodic reviews of Medicaid 

plans, two indicate that these reviews include internal evaluations of the managed care 

organizations’ fraud and abuse detection and referral processes. Fraud unit investigative staff 

participate in such reviews in one State. In addition, two of the 10 fraud units also report 

conducting routine activities to identify potential managed care fraud and abuse. Eight Medicaid 

State agencies require managed care plans to report contractual agreements or affiliations with 

subcontractors with three reporting they review one or more of these contracts for potential fraud 

and abuse. Reviews of contracts may reveal fraudulent arrangements such as illegal kickbacks or 

other schemes. 

Officials in six Medicaid State agencies indicate they have monitoring protocols or systematic 

screening in place to detect aberrancies in providing services and to identify Medicaid managed 

care fraud and abuse cases. For example, four Medicaid State agencies report they review 

encounter data (statistical data on medical services rendered) for potential fraud and abuse. Five 

Medicaid State agencies respond that their data reporting systems and fraud and abuse review 

processes are in developmental stages and one other agency indicates that the encounter data is 

not available in a usable format to review for potential fraud and abuse. 

S/URS Involvement in Managed Care 

Six Medicaid State agencies indicate that the S/URS, or like components, are involved in 

managed care reviews, with four focusing on fraud and abuse detection. Two have systematic 

screening or monitoring protocols in place to identify potential cases. Additionally, one unit 

studies patterns of care in individual cases, two investigate managed care providers, two conduct 

onsite reviews of a statistically valid sample of claims, and three review and validate random 

samples of encounter data. 

Penalties for Not Referring Fraud Cases 

We found two States include penalties in contracts or provisions for those managed care 

organizations that fail to refer detected cases. In one, the Medicaid State agency has general 

authority to sanction, fine, or place a cap on enrollment for breach of contract, however, it does 

not specifically cite it as a basis for referral of fraud and abuse cases. The other reports that fraud 

and abuse is part of the managed care contract. In it, failure to fulfill contractual agreements 

means material non-compliance with sanctions of up to $2,500 per day. Although one other 

Medicaid State agency notes it has the authority to terminate contracts with managed care plans 

and physicians, no such actions have been taken when problem providers or plans have been 

identified. Penalties for failure to comply with referral requirements is supported by the fraud 

units. One fraud unit explains that without such penalties, there are no “hammers to force” 

managed care organizations to refer cases. 

))))))))))) 13 
Medicaid State Agencies, Fraud Control Units, and Managed Care Organizations 

Identify a Number of Tools They Believe They Need to Address Fraud and Abuse in 

Managed Care 

During our review, Medicaid State agencies, fraud control units, and managed care plans report 

specific obstacles that inhibit the detection and referral of fraud and abuse. Noting varying levels 

of experience and requirements, the Medicaid State agencies and managed care plans report the 

need for greater information sharing related to fraud and abuse occurring in Medicaid programs. 

Four Medicaid State agencies indicate a need to collaborate with managed care plans, HCFA, and 

other States on fraud and abuse issues in managed care. Another explains that this type of 

coordinated effort “is vital.” Also, one Medicaid State agency reports that it would be helpful to 

learn how other States have detected fraud and abuse. The primary categories and circumstances 

that relate to their resource needs are summarized below. 

Fraud and Abuse Detection Guidelines 

Over half of the all entities surveyed do not have guidelines on how to detect potential Medicaid 

managed care fraud or abuse cases and refer them to the appropriate authorities. Six of the 

Medicaid State agencies, 8 of the fraud units, and 55 percent of the managed care plans (47) 

report that they do not have such guidelines. Managed care organizations cite the need for a 

clearer understanding of how the State fraud and abuse program works and how they can 

coordinate their processes with them. 

Training Needs 

Medicaid State agencies, fraud units, and managed care plans report the need for training on 

detection techniques and examples of fraud and abuse cases. Five Medicaid State agencies, four 

fraud units, and over half of the managed care plans note they have not received training 

specifically on managed care fraud and abuse detection and investigation. Five managed care 

plans also indicate they need definitions of fraud and abuse, and guidance from the State on what 

is required, including the systems plans should have in place. One believes that greater guidance 

would allow “the plans more participation in the detection and investigation of the fraud and 

abuse process.” Overall, 80 percent of Medicaid State agencies, fraud units, and managed care 

plans report that training would be beneficial in the following areas: 

- Managed Care Operations; 

- Fraud and Abuse Detection in Managed Care Settings; 

- Computer and Data Manipulation Training; 

- Investigative Techniques; 

- Application of Regulations and Statutes; 

- Definitions of Fraud and Abuse in Managed Care; 

- How Fraud and Abuse Manifests Itself; 

- Software Parameters that Indicate Potential Fraud and Abuse; 

- Clarification of Roles and Responsibilities; and 

- Activities Conducted by the FBI, Office of Inspector General (OIG), etc. 

))))))))))) 14 
Encounter Data and Computer Technology 

Many of the entities report there are limited data and technological tools for detecting fraud and 

abuse. In addition, Medicaid State agencies and fraud units indicate a need for reliable encounter 

data, adequate computer systems, management information systems, claims processing software, 

tools for detection of fraud and abuse, and software to evaluate data for potential cases. 

Half of the fraud units report problems accessing State and managed care plan data, information, 

and documents for their review. As an example, during one fee-for-service investigation, the 

fraud unit attempted to find out if the provider was also contracting with managed care plans to 

see if the provider might be committing the same fraud in managed care. The Medicaid State 

agency, however, was unable to provide the fraud unit with this information. Also, while all 

managed care organizations report collecting encounter data, Medicaid State agencies and fraud 

units indicate that it is in the developmental stages or may not be readily available for investigative 

purposes. One fraud unit notes it is forced to go directly to the suspected provider under 

investigation to obtain encounter data as there is no other way to acquire this information. 

Centralized Information Resource 

Medicaid State agencies, fraud units, and managed care organizations report a general need for a 

centralized point of reference for information relating to managed care fraud and abuse. Managed 

care organizations indicate the need for a uniform national database on cases reported, an 

interstate transfer of information on providers, a list of best practices, general information on 

fraud and abuse such as suggestions for trade journals, notification when cases are reported, 

feedback on outcomes of cases, and a list of knowledgeable contacts. 

Staffing Needs 

Fraud control units, managed care organizations, and Medicaid State agencies note the need for 

additional staff to proactively detect cases and investigate referrals. Ten fraud units and 

48 percent of managed care plans (41) report they do not have specific staff assigned the 

responsibility of conducting investigations of potential fraud and abuse in managed care. Three 

Medicaid State agencies also report that no staff have been assigned the responsibility for 

conducting oversight of internal fraud and abuse detection efforts being made within the managed 

care plans. 

))))))))))) 15 
!

RECOMMENDATIONS

We recognize that fraud and abuse in the managed care setting is a newly emerging area for 

Medicaid State agencies, fraud control units, and managed care organizations. We conducted this 

study in hopes of learning how States are coping with managed care fraud and abuse, how they 

detect it, and what they do with cases once detected. Overall, there is confusion and 

disagreement on how to address fraud and abuse and there is limited activity in developing or 

actively pursuing and referring cases in the Medicaid managed care program. However, we have 

learned that States with proactive efforts are detecting and resolving cases. We believe the 

information obtained in this study provides an opportunity for others to learn from those that have 

established proactive managed care fraud and abuse programs. 

It is important for all entities involved to have an effective fraud and abuse detection and referral 

system to protect the integrity of the Medicaid program and, as fraud in many cases can impact 

quality, to ensure high quality health care for beneficiaries. We recognize that HCFA initiated a 

number of efforts in this area in 1997, including the formation of the Medicaid Fraud in Managed 

Care Workgroup initiative to develop a model fraud and abuse system for the States, the 

coordination of National Medicaid Consortium meetings to discuss these issues, and participation 

in the Department of Justice Managed Care Work Group. Beginning in 1998, HCFA also 

initiated a series of four “Fraud and Abuse in Medicaid” executive-level seminars for state 

decision-makers to discuss strategies and solutions in their efforts to control fraud and abuse. 

However, we believe that implementation of the following recommendations can promote or 

further enhance Medicaid State agency, fraud control unit, and managed care organizations’ 

efforts to address fraud and abuse in managed care. To that extent, we recommend HCFA, in 

coordination with the OIG, 

! establish guidelines for States and managed care organizations to follow in 

developing and carrying out proactive fraud and abuse detection and referral 

activities. 

HCFA should consider including the following guidelines in the State plan, HCFA 1115 

Waivers, and managed care contracts: 

- definitions of roles and responsibilities for Medicaid State agencies, fraud control 

units, and managed care organizations; 

- guidelines for managed care plans and Medicaid State agencies to have processes 

to detect and refer fraud and abuse cases to the Medicaid fraud control units for 

investigation; 

- specification of when an internal managed care plan investigation is needed or 

immediate referral for investigation is warranted; and 

- guidelines for managed care organizations to document and maintain records on 

detected cases of potential fraud and abuse, maintain a database and monitor it, and 

periodically submit reports to the Medicaid State agencies. 

))))))))))) 16 
!

We believe it is important that the managed care plans acknowledge they are aware of 

these particular guidelines and certify their understanding in writing by signing contractual 

agreements with the Medicaid State agency. 

ensure that States monitor managed care organizations’ fraud and abuse programs 

for compliance with its guidelines. 

To ensure plans have an effective detection and referral system, HCFA should consider 

establishing provisions that require States to conduct oversight of managed care plans’ 

fraud and abuse detection and referral activities. In addition, we believe it may be 

beneficial for Medicaid State agencies to conduct onsite reviews of plans and, to the 

extent possible, involve fraud units in the evaluation and monitoring of fraud and abuse 

efforts. Reviews should focus on the processes managed care plans have established and 

the effectiveness of them. Also, to ensure managed care plans follow the required 

processes, consideration should be given to penalties for those that fail to comply. In 

providing guidance, HCFA may need to develop model protocols for use in review and 

oversight of plans’ fraud and abuse detection processes. 

! continue to develop, sponsor, and emphasize detection and referral training for 

States and Medicaid managed care organizations. 

We believe that HCFA should continue to broaden efforts to formally train Medicaid State 

agencies, fraud control units, and managed care organizations on program fraud and abuse 

in managed care. Identified training needs to be addressed include: 

- basic program contracting and provisions for managed care; 

- fundamental instruction on Medicaid State agency and managed care operations; 

- definitions of fraud and abuse that can occur in the managed care setting; 

- examples of cases and how fraud and abuse manifests itself; 

- techniques for detection and referral of fraud and abuse cases; 

- parameters and standards of what is considered acceptable levels of care; and 

- information and feedback on States’ activities and experiences in detected and 

resolved cases. 

AGENCY COMMENTS 

The HCFA concurs with recommendations in the report and describes their various efforts and 

initiatives in technical assistance, development of guidelines, consultation with States, and 

detection and referral training. We are encouraged that the agency reports it is focusing attention 

and efforts in these important areas. Also, we are pleased that it intends to share the guidelines 

and other fraud and abuse detection and referral products for the OIG’s review and comment. 

We note the first recommendation was revised in response to HCFA’s comment regarding the 

OIG’s use of “guidelines” and “requirements” interchangeably. The full text of HCFA’s 

comments are included in Appendix D. 

))))))))))) 17 
ENDNOTES

1. The 1997 Balanced Budget Act (BBA) requires States to establish by August 1998, a 

mechanism to receive reports from beneficiaries and compile data on alleged instances of waste, 

fraud, and abuse in the Medicaid Program. However, approximately one-third (17) of the States 

are exempted from this provision, and all other provisions related to managed care as part of the 

BBA, for up to 3 years. 

2. Medicaid Fraud and Patient Abuse: A Review of the State Medicaid Fraud Control Unit 

Program, National Association of Medicaid Fraud Control Units (MFCUs), p. 75. At the 

request of the President's Task Force on National Health Care Reform the National Association of 

Medicaid Fraud Control Units prepared a paper which described the MFCUs' experience with 

health care fraud in both the traditional health care delivery system and in a system of managed 

care. 

3. Fraud in Managed Health Care Delivery and Payment, Report to the National Health Care 

Anti-Fraud Association Board of Governors by the NHCAA Task Force on Fraud in Managed 

Care, p. 2, December 1994. 

4. Thomas R. Judd and Sarah Elizabeth Jones, Health Care Fraud in a Managed Care 

Environment, National Association of Attorneys General, April 1996, pp. 23-24. 

5. The two fraud units that report not receiving cases indicate that the managed care programs in 

their States are too new. In one State, the program was implemented in January 1996 and the 

other State implemented the program in April 1997. 

))))))))))) 18 
APPENDIX A

Medicaid Section 1115 Waiver States 

1115 Waiver States Implemented 

Date 

Enrollment 

Managed care 1 

Arizona- Arizona Health Care Cost Containment System (AHCCCS) 10/01/82 81% 

Delaware- Diamond State Health Plan (DHSP) 01/01/96 81% 

Hawaii- Hawaii Quest 08/01/94 81% 

Minnesota- MinnesotaCare Health Plan and Long Term Care Options 07/01/95 42% 

Ohio- OhioCare 07/01/96 32% 

Oklahoma- SoonerCare 01/01/96 51% 

Oregon- Oregon Health Plan Demonstration 02/01/94 83% 

Rhode Island- Rite Care 08/01/94 62% 

Tennessee- TennCare 01/01/94 100% 

Vermont- Vemont Health Access Plan 01/01/96 24% 

Percentage of Medicaid enrollment in managed care programs. Data based on HCFA’s report which 1 

identifies States with Comprehensive Statewide Health Care Reform Demonstrations on June 30, 1997. 

))))))))))) A - 1
APPENDIX B

Types of Suspected Fraud and Abuse Cases 

in Medicaid Managed Care 

The following table details the types of fraud and abuse situations suspected by Medicaid State Agencies (MSA) 

and Medicaid Fraud Control Units (MFCU) and the 85 managed care organizations (MCO) included in this study. 

The numbers in the table indicate how many State entities and managed care plans suspect that these fraudulent or 

abusive situations are occurring within the 10 States surveyed. 

ISSUE REPORTED 

ENTITIES REPORTING ISSUES 

MSAs MFCUs MCOs 

Medicaid Managed Care Subcontractor Fraud 1 4 4 

Inaccurate Billing - Upcoding/Unbundling 0 3 20 

Billing for Services Not Rendered 1 2 13 

Failure to Reimburse Subcontractors or Provider Network 0 2 0 

Kickback Schemes 1 2 0 

Traditional False Claims 1 0 1 

Embezzlement 1 0 0 

Provider’s Accepting Out-of-Network Payment 0 0 1 

Improper Billing for Physician Assistants 0 0 1 

Provider Billing for Expired Member 0 0 1 

Provider Balance Billing or Double Billing 2 0 4 

Provider Not Reporting Overpayment 0 0 1 

Provider Not Contracting in Medicaid Program Billed for Services 1 0 0 

Member Submitting Incorrect Billing 0 0 1 

All Types of Fee-For-Service Fraud 1 1 0 

Underutilization 1 3 0 

Enrollment Fraud 3 1 0 

Charging Medicaid Enrollees Co-Payments 0 2 1 

Drug/Pharmacy Related Fraud 0 1 4 

Complaints of No Access to Services 0 1 0 

Home Care Fraud 0 1 0 

False Provider Network 0 1 0 

An Ineligible Fraudulently Using Member ID Card for Services 2 0 15 

Beneficiary Fraudulent Stealing or Forging of Prescription Drugs 2 0 11 

))))))))))) B - 1 
ISSUE REPORTED 

ENTITIES REPORTING ISSUES 

MSAs MFCUs MCOs 

Falsification of Information on Eligibility for Dates of Uninsurability for 

Enrollment 1 0 5 

Beneficiary Enrolled - Not Eligible -Living in Another State 0 0 4 

Beneficiary Selling Drugs 0 0 1 

Managed Care Organization Employee Fraud 0 0 2 

Beneficiary with Double Coverage - Commercial/Medicaid 0 0 4 

Controlled Substance Abuse 0 0 2 

Beneficiary Drug Overutilization - Fabricating Condition to Obtain 

Drugs 0 0 8 

Illegal Methadone Treatment Program 0 0 3 

Family Fraudulently Listing Dependents Not Eligible 0 0 2 

Patient Physical Abuse or Neglect 1 0 1 1 

See page 4 of the report for a discussion on patient abuse. 1 

))))))))))) B - 2
APPENDIX C

Fraud And Abuse Referrals to Fraud Units 

SOURCE AND NUMBER OF CASE REFERRALS RECEIVED BY FRAUD UNITS 1 

ENTITIES REFERRING 

CASES AZ 2 DE HI MN OH OK OR RI TN 2 VT TOTAL 

Medicaid State Agency 49 1 169 219 

Relatives, Friends, Private 

Citizens 11 49 60 

Governmental Agencies 41 17 58 

Providers 10 2 2 20 34 

Sources Not Provided 8 19 27 

Local/Statewide Police 3 19 22 

Medical Facilities 13 13 

Insurance Companies 12 12 

Prosecutors 11 11 

Victims 9 9 

Licensing Board 6 6 

Anonymous Referrals 6 6 

Board of Nursing 5 5 

Office of Inspector General 2 2 4 

Managed Care Plans 1 3 4 

Other Fraud Units or 

National Association of 

Medicaid Fraud Control Units 

4 4 

Qui Tam Suits 2 2 

Attorney General Elder Affair 

Project 2 2 

Department of Insurance 2 2 

Federal Bureau of 

Investigation 1 1 

Social Services 1 1 

Board of Medical Examiners 1 1 

Surveillance Units 1 1 

Totals 164 3 2 1 2 0 5 1 326 0 504 

Data was reported for cases received during Calendar Year 1996 except for Arizona where data was reported for the time period 1 

July 1995 to June 1996. 

AZ and TN fraud units reported no managed care referrals in 1996. AZ managed care plans are required to refer cases directly to 2 

the Medicaid State agency, which then refers cases to the fraud unit if further investigation is needed. The TN fraud unit did not 

report cases referred from plans as they did not maintain data during our study period. 

))))))))))) C - 1
APPENDIX D

Agency Comments

Health Care Financing Administration

))))))))))) D - 1