U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

20–377—PDF 2016

S. HRG. 114–277 

REVIEWING 

HEALTHCARE.GOV 

CONTROLS 

HEARING 

BEFORE THE

COMMITTEE ON FINANCE 

UNITED STATES SENATE 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

JULY 16, 2015 

( 

Printed for the use of the Committee on Finance 

COMMITTEE ON FINANCE 

ORRIN G. HATCH, Utah, Chairman 

CHUCK GRASSLEY, Iowa 

MIKE CRAPO, Idaho 

PAT ROBERTS, Kansas 

MICHAEL B. ENZI, Wyoming 

JOHN CORNYN, Texas 

JOHN THUNE, South Dakota 

RICHARD BURR, North Carolina 

JOHNNY ISAKSON, Georgia 

ROB PORTMAN, Ohio 

PATRICK J. TOOMEY, Pennsylvania 

DANIEL COATS, Indiana 

DEAN HELLER, Nevada 

TIM SCOTT, South Carolina 

RON WYDEN, Oregon 

CHARLES E. SCHUMER, New York 

DEBBIE STABENOW, Michigan 

MARIA CANTWELL, Washington 

BILL NELSON, Florida 

ROBERT MENENDEZ, New Jersey 

THOMAS R. CARPER, Delaware 

BENJAMIN L. CARDIN, Maryland 

SHERROD BROWN, Ohio 

MICHAEL F. BENNET, Colorado 

ROBERT P. CASEY, Jr., Pennsylvania 

MARK R. WARNER, Virginia 

CHRIS CAMPBELL, Staff Director 

JOSHUA SHEINKMAN, Democratic Staff Director 

(II) 

C O N T E N T S 

OPENING STATEMENTS 

Page 

Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman, Committee on 

Finance .................................................................................................................. 1 

Wyden, Hon. Ron, a U.S. Senator from Oregon .................................................... 3 

WITNESS 

Bagdoyan, Seto J., Director, Forensic Audits and Investigative Service, 

Government Accountability Office, Washington, DC ........................................ 4 

ALPHABETICAL LISTING AND APPENDIX MATERIAL 

Bagdoyan, Seto J.: 

Testimony .......................................................................................................... 4 

Prepared statement .......................................................................................... 21 

Grassley, Hon. Chuck: 

Prepared statement .......................................................................................... 41 

Hatch, Hon. Orrin G.: 

Opening statement ........................................................................................... 1 

Prepared statement .......................................................................................... 42 

Wyden, Hon. Ron: 

Opening statement ........................................................................................... 3 

Prepared statement .......................................................................................... 43 

(III) 

(1) 

REVIEWING HEALTHCARE.GOV CONTROLS 

THURSDAY, JULY 16, 2015 

U.S. SENATE, COMMITTEE ON FINANCE, Washington, DC. 

The hearing was convened, pursuant to notice, at 10:02 a.m., in 

room SD–215, Dirksen Senate Office Building, Hon. Orrin G. Hatch 

(chairman of the committee) presiding. 

Present: Senators Grassley, Crapo, Thune, Burr, Portman, 

Toomey, Coats, Heller, Scott, Wyden, Cantwell, Brown, Bennet, 

and Casey. 

Also present: Republican Staff: Chris Campbell, Staff Director; 

Kimberly Brandt, Chief Healthcare Investigative Counsel; Christine Brudevold, Detailee; and Jill Wright, Detailee. Democratic 

Staff: Joshua Sheinkman, Staff Director; Michael Evans, General 

Counsel; Elizabeth Jurinka, Chief Health Advisor; David Berick, 

Chief Investigator; and Juan Machado, Professional Staff Member. 

OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. 

SENATOR FROM UTAH, CHAIRMAN, COMMITTEE ON FINANCE 

The CHAIRMAN. The committee will come to order. 

Good morning, everybody. Today’s hearing will address controls 

at the HealthCare.gov website. Specifically, the committee will hear 

from the Director of Audit Services at the Government Accountability Office, Seto Bagdoyan. 

Director Bagdoyan’s team has led an undercover ‘‘secret shopper’’ 

investigation to test the Internet controls of HealthCare.gov and to 

review the Centers for Medicare and Medicaid Services’ handling 

of this program. This investigation was designed to determine the 

degree to which the administration’s Federal health insurance exchange can protect against fraudulent applications, what happens 

when applicants provide false information and documentation, and 

whether the controls are successful in dealing with irregularities 

once they are found. 

Perhaps I should say ‘‘spoiler alert’’ before this next part. Today, 

Director Bagdoyan will explain how the Federal exchange failed 

spectacularly on virtually all relevant accounts tested by GAO. 

For this investigation, GAO created fictitious identities to apply 

for premium tax subsidies through the Federal health insurance 

exchange. We learned last year that 11 out of 12 fake applications 

were approved, and CMS accepted fabricated documentation with 

these applications without attempting to verify its authenticity and 

enrolled fake applicants while handing out thousands of dollars in 

premium tax subsidies. 

2 

Now, a year later, GAO has reported that nothing has changed 

and that, if anything, there are more problems. Worst of all, the 

administration has known about these problems for over a year 

now and has apparently not taken the necessary steps to rectify 

them. While CMS says that it is balancing consumer access to the 

system with program integrity concerns, I think it is pretty clear 

just what is going on here. 

Since the Federal exchange was first implemented, success has 

been measured by the number of applicants who have signed up for 

insurance. Indeed, last year when the administration reached its 

initial enrollment goal, critics of the law were told that we had 

been wrong all along and that the law was, despite all the evidence 

to the contrary, working just fine. 

However, with these findings from GAO, it seems obvious, at 

least to me, that the administration has been preoccupied with 

signing up as many applicants as possible, ignoring potential fraud 

and integrity issues along the way. 

Now, supporters of Obamacare often insist that it is ‘‘the law of 

the land’’ and that Congress should work to improve rather than 

repeal it. On the first point, these proponents are unfortunately 

correct. For the foreseeable future, the so-called Affordable Care 

Act is the law of the land. On the second point, Republicans in 

Congress continue to work toward repeal of the misguided law and 

its expensive mandates, regulations, penalties, and taxes, and replacement of it with patient-centered reforms that put patients, 

rather than Washington bureaucrats, in charge of their health care 

decisions. 

However, needless to say, that day will not come until there is 

a President who shares our goal. So until then, Obamacare will remain in place. In the meantime, Congress has an obligation to exercise rigorous oversight of the implementation of the law and to 

work to protect both beneficiaries and taxpayers from its negative 

consequences. 

That is what today’s hearing is about. We are here today to get 

an account of how things are working on the Federal health insurance exchange, and, once again, what we have heard thus far is not 

reassuring and does not speak well for CMS’s management of 

HealthCare.gov, the protection of taxpayer dollars, or the experience of enrollees. 

The GAO’s investigation exposes not only huge gaps in Federal 

exchange program integrity, but also flaws in how the exchange 

and CMS contractors treat Americans who are trying to file or correct legitimate applications. Time after time, the GAO team sent 

information to the exchange for verification, only to have it ignored 

or have the exchange respond as if something entirely different had 

been sent in. 

The fact that GAO encountered mind-boggling levels of incompetence and inefficiency at nearly every turn does not bode well for 

the experience of your average honest enrollee. I look forward to today’s hearing and what I hope will be a good discussion on program 

integrity at HealthCare.gov. 

Before I conclude, I want to note that, even though this GAO investigation was requested by this committee, CMS was less than 

cooperative. Indeed, throughout the entire endeavor, officials at 

3 

CMS appeared to be dragging their feet, blowing past deadlines 

and good-faith attempts to carry out this important work. 

Put simply, when Congress asks GAO to conduct an inquiry, no 

Federal agency should stand in the way of that work. By delaying 

the GAO and hampering their efforts, CMS has also delayed this 

committee’s work and hampered our efforts. This is unacceptable, 

and unfortunately, despite promises of increased transparency and 

cooperation from agencies throughout this administration, this type 

of stonewalling of legitimate oversight efforts is far, far too common. 

Acting CMS Administrator Andy Slavitt, who is now the President’s nominee to run the agency, was personally involved in this 

process. As the committee considers his nomination, I look forward 

to asking Mr. Slavitt about this investigation and why CMS has 

been interfering with our oversight efforts. Of course, that will all 

have to wait for another day and another time. 

[The prepared statement of Chairman Hatch appears in the appendix.] 

The CHAIRMAN. Today we have our hands full as we hear testimony about this important GAO investigation. So with that, I will 

turn it over to our ranking member, Senator Wyden, for his opening remarks. 

OPENING STATEMENT OF HON. RON WYDEN, 

A U.S. SENATOR FROM OREGON 

Senator WYDEN. Thank you very much, Mr. Chairman. 

On this side of the aisle, we do not take a back seat to anybody 

in fighting fraud and protecting taxpayer dollars. One dollar ripped 

off is one dollar too many. But let us be very clear this morning. 

The report up for discussion today is not about any real-world 

fraud. The study looks at a dozen fictitious cases, and not one of 

them was a real person who filed taxes or got medical services. No 

fast-buck fraudster got a government check sent to their bank account. 

Moreover, the government auditors acknowledge today, and I 

want to quote here, their work ‘‘cannot be generalized to the full 

population of applicants or enrollees.’’ None of the fictitious characters in this study stepped foot in a hospital or a doctor’s office. 

The fact is, when you actually show up for medical services, it is 

a lot harder to fake your way into receiving taxpayer-subsidized 

care. 

Often, before any services are delivered, providers ask for a photo 

ID with an insurance card. If you have stolen an identity, there is 

probably a medical history belonging to somebody else that ought 

to set off alarm bells. If you are a real person signing up in the 

insurance marketplace, you have to attest, under penalty of perjury, that the information you provide is correct. If you falsify the 

application, you face the prospect of a fine of up to $250,000. 

Another major anti-fraud check went untested in this study: that 

is, squaring up tax returns with the information from your insurance application. The Government Accountability Office testimony 

today calls it ‘‘a key element of back-end controls.’’ 

If your tax return and personal information do not match, the 

gambit is up. But the study before us today ignores that anti-fraud 

4 

check. It only looks at a part of the picture when it comes to stopping fraud. 

As I noted at the beginning, there are always methods of 

strengthening any program and rooting out the fraudsters and the 

rip-off artists. Part of any smart, ferocious strategy against fraud, 

on one hand, is drawing a distinction between aggressively going 

after the rip-off artists and, on the other, not harming a lawabiding American who has made an honest, and often technical, 

mistake. 

A retiree nearing Medicare age should not get kicked to the curb 

because he or she accidentally submitted an incorrect document. A 

transgender American should not lose health coverage after a name 

change because some forms do not match. I cannot imagine that 

anyone in the Congress or on this committee wants a system that 

nixes the health insurance coverage of Americans because of those 

kinds of issues. 

I will wrap up by saying that a recent Gallup report stated that 

the rate of Americans without health insurance is now the lowest 

that they have ever measured. This is the first Finance Committee 

hearing on health care since the Supreme Court’s landmark decision that upheld the law that made that possible. 

The fact is, the Affordable Care Act has extended health care 

coverage to more than 16 million real people who use their insurance coverage to see real doctors. Now at some point down the 

road, the GAO is expected to complete their report. At that time, 

let us work on a bipartisan basis to draw conclusions about how 

this committee can work together to improve American health care. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator. I appreciate it. 

[The prepared statement of Senator Wyden appears in the appendix.] 

The CHAIRMAN. Our witness today is Seto Bagdoyan, who is Director of Audit Services in GAO’s Forensic Audits and Investigative 

Service mission team. During his GAO career, Mr. Bagdoyan has 

served in a variety of positions, including as Legislative Advisor in 

the Office of Congressional Relations, and as Assistant Director for 

Homeland Security and Justice. He has also served on congressional details with the Senate Finance Committee and the House 

Committee on Homeland Security. 

In his private-sector career, Mr. Bagdoyan has held a number of 

senior positions in consultancies, most recently focusing on political 

risk and homeland security. He earned a BA degree in international relations and economics at Claremont McKenna College 

and an MBA in strategy from Pepperdine University. 

We welcome you to the committee, and we are interested in your 

statement here today. 

STATEMENT OF SETO J. BAGDOYAN, DIRECTOR, FORENSIC 

AUDITS AND INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE, WASHINGTON, DC 

Mr. BAGDOYAN. Thank you, Mr. Chairman. 

Chairman Hatch, Ranking Member Wyden, and members of the 

committee, I am pleased to be here today to discuss the final results of GAO’s undercover tests assessing the enrollment controls 

5 

of the Federal marketplace set up under the Affordable Care Act 

of 2010. 

As you mentioned, we reported our preliminary results during 

testimony in July of 2014. We performed 18 undercover tests, 12 

of which involved phone or online applications. Our tests were designed specifically to identify indicators of potential control weaknesses in the marketplace’s enrollment process, specifically for plan 

year 2014, and to inform our ongoing forensic audit of these controls. 

I would note that our test, while illustrative as Ranking Member 

Wyden mentioned, cannot be generalized to the population of applicants or enrollees. Further, we shared details of our observations 

with CMS during the course of our test to seek its responses to the 

issues we raised. 

In this regard, CMS officials stated that they had limited capacity to respond to attempts at fraud and they must balance consumers’ ability to access coverage with program integrity concerns. 

Without providing details on how and when, these officials stated 

that they intend to assess the marketplace’s eligibility determination process. 

In terms of context, health coverage offered through the marketplace is a significant expenditure for the Federal Government. Current levels of coverage involve several million enrollees, about 85 

percent of whom are estimated to be receiving subsidies. CBO pegs 

subsidy costs for fiscal year 2015 at $28 billion and a total of about 

$850 billion for fiscal years 2016 to 2025. 

A program of this scope and scale is inherently at risk for errors, 

including improper payments and fraudulent activity. Accordingly, 

it is essential that there are effective enrollment controls in place 

to help narrow the window of opportunity for such risks, hence the 

importance of our undercover tests. 

With this as backdrop, I will now discuss some of our test’s principle results. The marketplace approved subsidized coverage for 11 

of our 12 fictitious applicants. These applicants obtained about 

$30,000 in total annual advanced premium tax credits, plus eligibility for lower costs at time of service. 

For 7 of the 11 applicants, we intentionally did not submit all required verification documentation to the marketplace, but it did not 

cancel coverage or reduce or eliminate subsidies for these applicants. I would note that while subsidies, including those granted to 

our applicants, are not provided directly to enrollees, they nevertheless represent a financial benefit to consumers and a cost to the 

government. 

As part of its verification process, the marketplace did not accurately record all inconsistencies which occur when applicant information does not match information available from marketplace 

verification sources. Also, the marketplace resolved inconsistencies 

from our fictitious applications based on fabricated documentation 

we submitted. Further, the marketplace did not terminate any coverage for several types of inconsistencies, including Social Security 

data. 

We found errors in information reported by the marketplace for 

tax filing purposes for 3 of our 11 enrollees, such as incorrect coverage periods or subsidy amounts. Under the ACA, filing a Federal 

6 

income tax return is a key control element designed to ensure that 

premium subsidies granted at time of application are appropriate 

based on reported applicant earnings during the coverage year. 

The marketplace automatically re-enrolled coverage for all 11 applicants for plan year 2015. Later, based on what it said were new 

applications our enrollees had filed but which we had not actually 

made, the marketplace terminated coverage for 6 of the 11 enrollees, saying they had not provided necessary documentation. However, for 5 of the 6 terminations, we subsequently obtained reinstatements, including increases in monthly subsidies averaging 

about 10 percent. 

In closing, our test results highlight the need for CMS to have 

in place effective controls to help reduce the risks for potential improper payments and fraud, otherwise there is potential for such 

risks to be imbedded early in a major new benefits program. We 

plan to include initial recommendations regarding controls in a 

forthcoming report. 

Mr. Chairman, this concludes my statement. I look forward to 

the committee’s questions. 

The CHAIRMAN. Thank you, sir. 

[The prepared statement of Mr. Bagdoyan appears in the appendix.] 

The CHAIRMAN. It has come to my attention that GAO had difficulty obtaining plan year 2015 enrollment and related data from 

CMS, data that would allow GAO to conduct a full analysis of what 

really happened to enrollees from 2014. 

Now, this would have been helpful to GAO in providing explanations for things like those who were supposed to get dropped for 

failing to provide documents, to clear inconsistencies, among other 

things. Can you provide us with more detail about the difficulties 

GAO had in obtaining that information from CMS? I expect GAO 

to have the most recent and relevant data to inform its analysis, 

and expect that CMS would work with you and the committee to 

make that happen. 

Any information you can provide as to the problems experienced 

and what the committee can do to help address them would be very 

helpful to us in the committee now. 

Mr. BAGDOYAN. Thank you for your question, Mr. Chairman. I 

will just lay out, in a general sense, our experience in obtaining 

data. But in the beginning, I would like to establish a context in 

terms of—as I mentioned earlier, the reason why we did our undercover testing was to flag indicators of potential control weaknesses, 

and, at the same time, we had designed our forensic audit, which 

would have relied on the enrollee database, to map out what we 

were finding in the control environment against the actual enrollees that I believe Ranking Member Wyden mentioned earlier. 

That said, we began our informal meetings and consultations 

with CMS in April of 2014. We requested various data sets. We 

had some success obtaining some information in meetings over 

time. Then when we focused on the enrollee database, we submitted a written letter requesting that database in August of 2014, 

and then we subsequently engaged in additional discussions with 

CMS officials as they expressed some concerns about what we were 

7 

asking, what we planned to do with the data, as well as how the 

data would be safeguarded. 

Upon subsequent discussions through the early part of 2015, we 

submitted another letter to the current Acting Administrator, Mr. 

Slavitt, in April of 2015. As of a couple of days ago, we have been 

in contact with CMS, which advised that we should expect the data 

sometime next week, which is very good news for us, for our ability 

to continue the work. 

We look forward to obtaining the data and seeing whether it is 

actually what we asked for, and then conducting additional tests 

to determine whether the data is actually usable for our purposes. 

I apologize for the long story, but that gives you a context of where 

we have been. 

The CHAIRMAN. Sure. That is fine. I understand that the marketplace invoked this so-called ‘‘good faith exemption’’ for plan year 

2014 in not pursuing applicants who did not submit all of the requested documentation to reconcile inconsistencies between information they provided during the enrollment process and that available to the marketplace through government sources. 

Could you describe what the good faith exemption is all about, 

whether it has any basis in the Affordable Care Act or its implementing regulations, and the impact, if any, of its invocation on 

program controls and integrity? 

Mr. BAGDOYAN. Sure. The good faith provision is basically an interpretation by CMS of certain provisions in the statute itself and 

in its implementing regulations. Essentially, under this implementation, CMS deemed that as long as an enrollee or an applicant 

submits at least one document to support their application, they 

would have engaged in a good faith effort to meet the documentary 

request and accordingly remain a participant in their coverage. 

In terms of whether this has an impact on the controls, it is essentially one of the back-end controls—the document verification 

process, that is—and, depending on your point of view of whether 

that is adequate if someone is asked for seven documents and they 

only submit one document, that can create a control gap and raise 

questions about their eligibility for participation. 

The CHAIRMAN. Well, thank you. 

Senator Wyden, my time is up. 

Senator WYDEN. Thank you very much, Mr. Chairman. 

Mr. Bagdoyan, my time is short, so I would like you to give me 

‘‘yes’’ or ‘‘no’’ answers to four questions. 

Mr. BAGDOYAN. Sure. 

Senator WYDEN. Mr. Bagdoyan, as of this morning, can you generalize from the 11 fictitious cases what the fraud rate would be 

for the more than 10 million real Americans who actually receive 

health care coverage under the law, yes or no? 

Mr. BAGDOYAN. Not as of this morning. 

Senator WYDEN. Mr. Bagdoyan, you said in your testimony that 

tax returns are a ‘‘key element of back-end controls. It’s a major 

check that would shut down the fraudsters.’’ As of this morning, 

did you file tax returns for any of these individuals, yes or no? 

Mr. BAGDOYAN. We did not. 

8 

Senator WYDEN. Mr. Bagdoyan, as of this morning, have you uncovered any real individuals who fraudulently obtained health coverage using GAO’s techniques, yes or no? 

Mr. BAGDOYAN. No. 

Senator WYDEN. Mr. Bagdoyan, as of this morning, have you provided HHS with the fictitious identities from your inquiries so that 

they can address the problems that you say exist, yes or no? 

Mr. BAGDOYAN. We have not. 

Senator WYDEN. Mr. Bagdoyan and colleagues, I have reviewed 

this very carefully. Given the answers that we have just heard, it 

is clear to me that the auditors have much more work to do before 

the committee can draw useful conclusions on this matter. 

On this point with respect to the claims that the agency has not 

been responsive to the request for enrollment data, I very much respect the fact that Federal agencies need to be responsive to requests from Congress and the GAO for information. However, I 

also want to take note of the fact that these enrollment records 

contain personally identifiable information on more than 10 million 

Americans. Loss of their personally identifiable information is already becoming a nightmare for millions of Americans. 

Now, it is my understanding that the agency, CMS, and the 

auditors have worked out an agreement on how this information, 

(1) can be turned over to GAO and protected, and I think that is 

good; and (2) it is my understanding that the agency has turned 

over some 30,000 pages of documents to my colleague, Senator 

Portman, for his committee. 

So this notion that the government, the agency—in particular, 

CMS—is just spending its day, morning, noon, and night trying to 

stonewall the release of this information, I think, is not accurate, 

given the facts that I have just cited. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator. 

Senator Grassley, you are next. 

Senator GRASSLEY. In deference to my colleagues, and there are 

a lot here who want to ask you questions—and of course that is because we have our pending six votes this morning—I am going to 

ask just one of three questions, and I am going to put the lead-in 

up to my questions in the record. 

[The prepared statement of Senator Grassley appears in the appendix.] 

Senator GRASSLEY. You presented CMS with potential flaws. The 

flaws, as I understand what you said, did not get fixed. So my 

question is very simple: in your work with CMS, do you believe 

that CMS’s attitude is, enroll people first and worry about eligibility later, if at all? 

Mr. BAGDOYAN. Well, from where we stand currently, the CMS 

explanation has been that they have to balance the ease of access 

to coverage with program integrity controls. Based on our undercover work, I would say that there are gaps in these controls that 

have yet to be addressed. We continue to look at it through our forensic work, but as of now I think the balance would probably favor 

access over program integrity. 

Senator GRASSLEY. Yes. I yield back. 

Mr. BAGDOYAN. As we stand today, Senator. As we stand today. 

9 

Senator GRASSLEY. Thank you. I yield back my time. 

The CHAIRMAN. Thank you. 

Senator Thune? 

Senator THUNE. Thank you, Mr. Chairman. Thanks for holding 

the hearing. I think it is important—you were talking about taxpayer dollars here—that we make sure that we are doing everything to see that they are spent wisely and well. 

Mr. Bagdoyan, in your testimony you highlight that marketplaces are required by law to verify application information, yet it 

appears from your investigation and subsequent interactions with 

CMS that the buck stops with no one, especially since the very contractors hired to verify these documents are not required to detect 

fraud. 

So it begs the question of whether you are currently aware of any 

effective front- or back-end fraud detection program in use by the 

administration? 

Mr. BAGDOYAN. Again, I would couch my response to you, Senator Thune, in terms of our ongoing work. The forensic part of our 

work should be able to give us a good idea of what the controls are. 

We will take what we have learned from the undercover tests, map 

that out against the forensic audit, and then apply appropriate criteria, such as the internal control standards of the Federal Government, as well as a forthcoming GAO framework to manage fraud 

risk. Then we will be able to have a more comprehensive view of 

what the control environment is like. 

Senator THUNE. All right. 

Mr. BAGDOYAN. It is premature for me to make a judgment like 

that. 

Senator THUNE. You are not currently aware today, though, absent having completed your investigation, of any fraud detection 

program? 

Mr. BAGDOYAN. Based on our work to date, I am not aware of 

that. 

Senator THUNE. Additionally, has the administration provided 

you with any rationale as to why they would enter into contracts 

that do not require the contractors to have fraud detection capabilities? 

Mr. BAGDOYAN. As best as I can tell, the arrangement with a 

contractor is to process documents that are submitted in support 

of applications. The contractor confirmed with us that they are not 

required to detect fraud. That would be a whole different transaction at greater cost. 

Senator THUNE. So you said your work is ongoing. 

Mr. BAGDOYAN. Yes. 

Senator THUNE. But does GAO have any recommendations for 

how to improve the document verification process to actually sort 

out fraud as opposed to just accepting documents? 

Mr. BAGDOYAN. Sure. As I mentioned in my opening statement, 

we are working on a forthcoming report sometime in the fall time 

frame where we hope to have some initial recommendations, and 

those recommendations might indeed cover the matter that you 

mentioned. 

Senator THUNE. All right. But you do not now have any hard, 

fast information? 

10 

Mr. BAGDOYAN. Not right now. But as I mentioned earlier, we 

did speak with CMS officials about things that we were encountering. We had discussions about their view of that, and we continue to have those discussions and await some explanations in 

that regard. 

Senator THUNE. My understanding is, from your work, that several of the fictitious applications were approved and subsequently 

reapproved without ever submitting documentation to the marketplace. How can this be? 

Mr. BAGDOYAN. Well—— 

Senator THUNE. How can the marketplace continue disbursing 

taxpayer dollars without receiving any documentation in response 

to its request? 

Mr. BAGDOYAN. Well, we were automatically re-enrolled without 

any action on our part for all 11 applicants, and then subsequently 

we found out that 6 of them, as I mentioned in my statement, had 

been indeed dropped from coverage because they had not submitted 

any documents in response to that. Then to carry that one step further, acting again as typical consumers, we sought to restore our 

coverage, and we were successful five out of six times. 

Senator THUNE. Yes. All right. 

Mr. Chairman, I would just simply say that these, I think, are 

really troubling results, 11 out of 12. I would say to the Senator 

from Oregon, I mean, I think that we need to drill down and get 

to the bottom of this. I do not think you can discount or write off 

this kind of research and report. 

You couple that with, in June, the HHS OIG report revealed that the administration could not verify whether nearly $3 billion in 

subsidies was properly disbursed to insurance companies during 

the first 4 months of 2014. These are significant failures in this 

system. They need to be addressed. I appreciate the hearing here, 

Mr. Chairman, and I hope that we can continue this dialogue with 

you, Mr. Bagdoyan, as you continue your work to determine how 

to stop this sort of waste of taxpayer dollars in the future. 

Thank you, Mr. Chairman. 

The CHAIRMAN. We are going to turn to Senator Wyden for a 

question, and after that will be Senator Portman. 

Senator WYDEN. Mr. Chairman, I am not even going to ask a 

question. I just want to respond to my colleague, because he knows 

I am always willing to work with him, always willing to work in 

a bipartisan way. But let us review what has just happened. I 

asked Mr. Bagdoyan about whether he uncovered any real individuals who fraudulently obtained health coverage using these techniques. He answered ‘‘no.’’ 

During the two previous enrollment periods, the agency rescinded a quarter of a million individuals’ health insurance because 

they were not able to validate their documents. So we have to work 

together, there is no question here. 

I am willing to look at all the ramifications of these 11 applicants, but let us do it in a bipartisan way, and let us do it when 

we actually have some recommendations. Once again, Mr. Bagdoyan said he does not have any recommendations to give us. 

The CHAIRMAN. Well, I want to announce we are doing it in a bipartisan way. I do not think we can ignore some of this testimony. 

11 

Senator Portman? 

Senator PORTMAN. Thank you, Mr. Chairman. Mr. Bagdoyan, 

thank you for your help on this and your work with us on the PSI 

Subcommittee looking into the same thing. 

My friend, the ranking member, talked about how HHS has been 

responsive. You have indicated they have not been responsive in 

providing information. Since you mentioned that I have gotten 

30,000 pages of documents, I will tell you only 2,000 of those pages 

are responsive to anything we asked about, and we are still getting 

delay, delay, delay. 

All we are asking for right now is just a schedule to submit documents. If we have time, I would like to hear your response to that, 

but I know from talking to your folks that you have the same frustration. 

With regard to this issue, there is clearly a policy problem here, 

not just the fact that 11 of 12 of these fictitious people got through 

and were automatically re-upped, and then when some were kicked 

out of the system, five out of six were brought back in after a 

phone call to HHS when they should not have been. 

So, clearly we have a problem here. But I think the statistical 

example of 12 might not be as significant as what you found out 

in terms of policy, so let me ask you a couple of questions about 

that. Your statement mentions that GAO failed an initial identityproofing step in the application process. In other words, your people were fictitious so they could not get through the online application process. 

Mr. BAGDOYAN. That is right. 

Senator PORTMAN. But GAO was able to proceed past this step 

after calling HHS. Can you describe what GAO did to verify the 

identity for these applications and why that is significant? 

Mr. BAGDOYAN. Well, as I mentioned earlier, we were able to obtain coverage by essentially following the system’s own instructions. We failed the initial online test; we contacted the contractor 

who does the identity proofing, and they could not clear it; then 

they instructed us to call the marketplace, which we did; and then, 

based on self-attestation of information, we obtained coverage. 

Senator PORTMAN. So it was a phone call after getting denied 

twice, and through the self-attestation, people got back in. So, I 

mean, this is a policy issue. This is not, again, just a statistical 

quirk that somehow your people snuck in. This is an HHS policy. 

Mr. BAGDOYAN. Yes. We would view that, Senator, as at least an 

indicator of a control gap. I know it is a technical, nerdy kind of 

thing to say but—— 

Senator PORTMAN. Yes. Clearly a control gap. Self-attestation is 

a policy that they have. By a phone call, even though you get rejected, rejected, you can get in just by a self-attestation. 

Mr. BAGDOYAN. That is correct. 

Senator PORTMAN. With no proof. 

As another example, you noted that, in all 11 cases, GAO was 

asked to submit documents that showed eligibility for subsidies. In 

some cases, GAO submitted only some of the required documents 

but was nonetheless able to continue to receive coverage and subsidies. That was because of the so-called good faith exemption. 

12 

Could you describe that rule—again, it is a policy—and why it 

enabled GAO to receive coverage and subsidies, even when it submitted only some of the required documents, and the legal basis 

that HHS used in implementing it? 

Mr. BAGDOYAN. Right. In terms of the legal basis, Senator Portman, we are awaiting a response from CMS, and our attorneys 

have been in touch with their attorneys, have had some discussions. So, we are trying to get some clarity on that. 

So, under the good faith exemption or provision, whatever the 

term of art is, essentially the applicant is compliant with their obligation to submit documents as long as they submit one out of the 

however many they have been asked to submit. 

Senator PORTMAN. So again, your results indicate, as these applications show, that this is not a result of a statistical quirk that you 

found, it is the result of HHS policy being implemented as planned. 

I think anybody who cares about the Affordable Care Act should 

be concerned about this policy, because it allows people to continue 

receiving subsidies without HHS making a serious attempt to 

verify eligibility. So I know we should do more research into this— 

we are looking forward to your report—but these are policy issues 

that are being applied today as we talk. 

Finally, your statement notes that this investigation was conducted with limited back-stopping. Can you describe what backstopping is and why limited back-stopping is important? 

Mr. BAGDOYAN. Sure. Limited back-stopping essentially involves 

the extent to which we employ investigative techniques. This was 

pretty much—I do not want to speak for my colleague, Director 

McElrath, who runs the investigative side of things, but basically 

it was a pretty simple thing to do using commonly available software, materials, and other approaches. 

Senator PORTMAN. So in sum, you did not have any inside information that you used about how the ACA works or does not work. 

You came at it just as any consumer would—— 

Mr. BAGDOYAN. Right. 

Senator PORTMAN [continuing]. Which makes your results, again, 

more troubling than they might otherwise be. I think these are 

really important aspects to your report, and I think from a legislative perspective, an oversight perspective, it makes this much more 

serious. 

The final thing I will say is, the amount of confusion this is causing people who legitimately are trying to get a subsidy is unbelievable. H&R Block says two-thirds of people are either having their 

tax refunds cut or getting a tax bill. 

IRS has told me that half of the people this year are in that situation. So this is not just about verification flaws. As you have said, 

the lack of controls and this lack of balance between accessibility, 

pushing people to get enrollment numbers up, versus the verification, is also causing a lot of confusion for consumers. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you. 

Senator Scott? 

Senator SCOTT. Thank you, Mr. Chairman. 

Good morning. 

Mr. BAGDOYAN. Good morning, Senator. 

13 

Senator SCOTT. I have a quick question for you: did you look for 

any real people who attempted to deceive the system? 

Mr. BAGDOYAN. Good question. We did not, as I mentioned earlier. 

Senator SCOTT. Thank you. 

Is it your job to figure out the number of fraudulent accounts receiving subsidies and health care coverage on HealthCare.gov? 

Mr. BAGDOYAN. Not at this stage of our work. 

Senator SCOTT. All right. 

Of the 50,000 taxpayers who filed returns based on inaccurate 

subsidy data, how many of those did you review? 

Mr. BAGDOYAN. None. 

Senator SCOTT. Because you are not the IRS? 

Mr. BAGDOYAN. That is correct. 

Senator SCOTT. All right. 

There is no doubt that HealthCare.gov, in 2013, was a disaster, 

a $400-million website that became synonymous with failure. We 

had a constituent in South Carolina who was trying to figure out 

how to get his information off the website that was used erroneously. We could not get a response from CMS. We finally had a 

committee hearing and Administrator Tavenner was there, and we 

were able to get some information and help solve that problem. 

One of the things that concerns me the most about the challenges that we face is that, when you combine the subsidies, including the Medicaid subsidies, we are talking about $1.7 trillion 

of subsidies. In the year 2025, we will have about 31 million Americans still without coverage. Perhaps, after billions and billions of 

dollars of subsidies that have been received by people who do not 

deserve them, it may indicate why we will still have 31 million 

Americans without insurance. 

My question to you is, outside of your investigation, how easy is 

it for most consumers to falsify their information in order to receive 

higher subsidies, based on your fictitious individuals? 

Mr. BAGDOYAN. Well, as I mentioned earlier in response to Senator Portman, it was relatively straightforward for us. I certainly 

cannot project that to the typical consumer, but there is a lot of information out there available for people who are committed to performing fraudulent activities. 

Senator SCOTT. It appears to me that there seems to be almost 

a perverse incentive for relaxed accountability as it relates to internal controls because it seems to have led, and will continue to lead, 

towards higher enrollments. Thoughts? 

Mr. BAGDOYAN. I would take you to my opening statement regarding the balance between access and control. It appears, based 

on our limited results from our undercover tests, that the balance 

is more towards access than control. Our work continues. We will 

have more definitive views on that in the future. 

Senator SCOTT. Said in fewer words, if it is tilted more towards 

access than controls, the chances are pretty high that someone will 

be able to get on, as you did with 11 fictitious individuals, and get 

coverage even if they were doing it at home on HealthCare.gov 

versus the GAO doing it. Basically the same result. Is there anything that would lead to a different conclusion, from your experience so far? 

14 

Mr. BAGDOYAN. Well, I think the forensic audit that we will conduct on the entire population will give us a complete picture of 

what happened, whether there were additional red flags that we 

need to follow up on. But at this point I cannot really project one 

way or the other. 

Senator SCOTT. I would appreciate a follow-up of that information in writing, then. That would be wonderful. Thank you. 

I would say to my colleagues that the reality of it is, what happens when you have individuals receiving subsidies that they have 

not earned, do not have a right to, when it is $1.7 trillion over the 

next 8 or 9 years, what that results in in South Carolina, what we 

have seen this past year, is between a 31-percent and as high on 

some plans as a 50-percent increase in premiums. That is astounding. It is ridiculous. It is unaffordable. 

As those premiums continue to climb, what we have also seen is 

your deductibles get higher, more expensive. Your out-of-pocket expenses are higher, more expensive. The number of facilities, whether it is hospitals or doctors, that are available to use that access 

card continues to dwindle down, and down, and down. I am not 

sure what good access is if you have a card when there is not a 

health care provider on the other side. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator. 

Senator Coats? 

Senator COATS. Thank you, Mr. Chairman. 

I am not surprised with anything I have heard here this morning. I go to the Senate floor once a week to share with my colleagues proven waste, fraud, and abuse in any number of ways, in 

any number of agencies. 

We have a bloated, bureaucratic, dysfunctional government that 

tries to do—with real intent, good intent—more than it can handle. 

Thank God for GAO and for the nonpartisan work that you do to 

help us point out ways in which we can help a struggling taxpayer 

not have to pay so much money in to Washington to fund something that does not work. 

So I really appreciate your being here; I appreciate your candidness. How we can take this for anything other than the canary in 

the mine, saying, hey, there is a problem here, let us get after it, 

I just don’t know. What really is discouraging is, and I would like 

you to give me a little more detail on this, you take these findings 

to CMS, and CMS basically gives you a stall: we are waiting for 

the attorneys to respond. 

CMS should say, ‘‘Thank you, thank you, you have pointed out 

some weaknesses here that we were not aware of. We want to be 

efficient. Actually, we want to implement the President’s program, 

we want to sign up more people.’’ I mean, they are obviously following that mandate. ‘‘This will help us because, if this becomes 

public, the public is going to say it is just one more example of another government bloated, bureaucratic inefficiency, ineffectiveness, 

preventing people who need the insurance from getting the insurance, giving insurance to people who do not qualify, and it is fraudulent.’’ 

I hear that, ‘‘Well, we have to go through all this process and so 

forth before we even implement things.’’ They should not have to 

15 

wait for you for recommendations. You have told them: here is the 

problem. 

I would think they would say, ‘‘Thank you. We are going to go 

after this right now and try to fix some of these things.’’ You have 

pointed out something that obviously, sure, it is fictitious, but I 

mean, if this is not an alarm bell in terms of dysfunction, I do not 

know what is. 

So can you describe a little bit more your efforts with CMS to 

get them to say, ‘‘Thank you, yes, we see the weaknesses here, and 

we are going to take steps to go forward,’’ instead of some process 

that is going to go through the legal system and through the bureaucratic system that is going to take months, if not years, while 

more and more waste and fraud just continues. 

Mr. BAGDOYAN. Sure. Thank you for your question, Senator 

Coats. Our exchanges with CMS have been fruitful at times, and 

we have gotten their attention on some of the key issues that—— 

Senator COATS. But what about this issue? 

Mr. BAGDOYAN. Which one is that? 

Senator COATS. What you are presenting here. I wrote this down. 

You said you went to CMS and alerted them to the problem, and 

you are waiting for their response. 

Mr. BAGDOYAN. Well, that actually refers to the good faith exemption. We are waiting for their legal analysis, for their basis—— 

Senator COATS. Yes. Yes. Yes. We hear this all the time. 

Mr. BAGDOYAN. Yes. They are working through the document 

verification process. 

Senator COATS. Yes. 

Mr. BAGDOYAN. So that is just one matter. There are—— 

Senator COATS. Well, did it ring any alarm bells over at CMS? 

Did anybody say, ‘‘Wow, thanks so much for bringing this to our 

attention; we need to plug these holes right away’’? 

Mr. BAGDOYAN. I do not know whether ‘‘thank you’’ was used, 

but they are aware of the problems that we flagged. 

Senator COATS. But they did not just say, well, this is fictitious, 

so therefore what you are presenting us here is worthless? 

Mr. BAGDOYAN. No, I cannot say that that is what they said. 

Senator COATS. Well, I am happy to hear that. I could point out 

waste of the day, waste of the hour, or waste of the minute, thanks 

to GAO and other investigative agencies that have pointed out that 

we have a dysfunctional government and we are wasting taxpayer 

dollars faster than we can send them to Washington. 

Mr. Chairman, thank you. 

The CHAIRMAN. Thank you, Senator. 

Senator Burr, you are next. 

Senator BURR. Thank you, Mr. Chairman. Let me say thank you 

to you and all the folks at GAO for the great work that you do and 

for the difficult task that you are asked to do. 

According to your testimony, people applying for coverage are required to attest that the documents they are providing are not 

false. CMS officials say that contractors processing these documents are not required to verify that these documents are authentic, and that the contractor is not equipped to identify fraud. 

CMS has also stated that there is no indication of meaningful 

levels of fraud. Do you think CMS made this statement because noVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 R:\DOCS\20377.000 TIMD
16 

body is monitoring the enrollment process in a meaningful way to 

detect the fraud that is clearly occurring in the cases of fake GOA 

enrollees? 

Mr. BAGDOYAN. Yes. I think the statement from CMS is based on 

the fact that the contractor itself has not reported any fraud. But 

as you pointed out, they are not tasked with looking for fraud. That 

is not in their work order, that is not—— 

Senator BURR. So it is not dissimilar to the question that Senator 

Wyden asked you: how many people did you find? You had not 

been asked to go look, therefore you did not find any, right? 

Mr. BAGDOYAN. At this stage, that is correct. But once we move 

over to the forensic look at the entire enrollee database, then that 

might yield different results. 

Senator BURR. Mr. Bagdoyan, who is ultimately in charge of ensuring enrollment program integrity? Is it the CMS Administrator? 

Is it the CMS Deputy Administrator? Is it the Chief Information 

Officer? Who is actually the one on the hook for ensuring that 

fraud is not occurring within the enrollment process? 

Mr. BAGDOYAN. Sure. As a general proposition, I would say that 

the tone at the top is important, whether it is the Administrator 

who is responsible for CMS and his or her staff. It is leadership 

that sets the controls in place, ensures that they are working as 

intended, monitors their effectiveness, and then responds to any 

changes in the environment that may necessitate adjustments or 

changes. 

Senator BURR. Senator Wyden came to an interesting conclusion, 

that what you have testified on really is not valid because none of 

the individual enrollees filed an income tax return, therefore you 

did not allow the system as designed to catch that they should not 

be there. 

Mr. BAGDOYAN. Yes. 

Senator BURR. Well, your own testimony says that, in correspondence between the applicant and the marketplace, on four of 

the individuals, the marketplace’s correspondence to the applicant 

referred to their filed tax returns. In other words, the marketplace 

basically said four of your applicants filed income tax returns and 

that is what we make our judgment on, when in fact none of them 

filed tax returns. 

Mr. BAGDOYAN. That is correct. 

Senator BURR. And you stated that in your testimony. 

So let me just say to my colleagues, what is my take-away here? 

Not only do we have policy deficiencies, but we certainly have indications of incompetence or intent to ignore the law. That should be 

the concern of this committee, it should be the concern of the 

American people, and I hope that GAO will continue with the instructions from the chair to look deeply into this. Thank you for 

your work. 

Mr. BAGDOYAN. Thank you, Senator. 

The CHAIRMAN. Thank you, Senator. 

Senator Casey? 

Senator CASEY. Mr. Chairman, thanks very much. 

I want to say first to Mr. Bagdoyan that, in my experience as an 

elected official in Pennsylvania, one of the most significant parts of 

that time as a public official was as the State Auditor General. It 

17 

is an elected position. I was elected to two terms, so I spent 8 years 

doing it. I have some sense, even though I was overseeing a group 

of auditors or investigators, of the difficulty of your work and a 

good sense of the reaction you get when your work is completed. 

I respect and appreciate what you do; it is difficult. 

Mr. BAGDOYAN. Thank you. 

Senator CASEY. I want to ask you one question, more just to 

make sure the record is clear, and then I want to get into more of 

the specific health care issues. I want to make sure I have this 

right. Based upon your testimony, is it possible to make generalizations about the full population of applicants in the marketplace? 

Mr. BAGDOYAN. No, it is not, and that was not the intent of our 

undercover tests. 

Senator CASEY. I want to say, just preliminarily, we know, those 

of us who voted for the Affordable Care Act, that there are issues 

we have to correct. It is not perfect legislation, nor is any legislation of that complexity and impact on health care and our economy. 

A number of us have voted for, already, improvements to the law. 

I think what is indisputable, though, in addition to the fact that 

it is not perfect, is that there has been a substantial benefit conferred upon a lot of Americans that would not have it otherwise. 

I am not saying this for your benefit, really, just for the record: 

16.4 million people gained health insurance coverage in the time 

since 2010. 

In Pennsylvania, for example, 472,697 Pennsylvanians selected 

plans or were automatically re-enrolled through the health insurance marketplace. About 81 percent of Pennsylvanians who selected health insurance plans were determined eligible for financial 

assistance. There are lots of examples of individuals—— 

Two individuals from southeastern Pennsylvania, Jenny and 

David, are self-employed, have two sons in college. Jenny is a 

breast cancer survivor, worried about being denied health insurance because of her pre-existing condition. They were spending 

over $10,000 a year on health insurance. Thanks to their ACA plan 

purchased through HealthCare.gov, they now are spending about 

$3,000 per year, so the savings helps them on college costs. So that 

is just by way of background. 

But I want to ask you a specific question about your work. Do 

you think there are additional checks that can be imposed upon the 

system, so to speak, that could help identify fraud, which the GAO 

did not test? 

Mr. BAGDOYAN. Sure. Thank you for your question. That would 

be part, a major part, of our focus for the ongoing work. As I mentioned earlier in response to another Senator’s question, we will be 

applying a set of appropriate benchmarks to how we map out the 

current process with information that we obtained from our undercover work. The forensic work will inform that and go in tandem. 

Once we apply those criteria, we will be able to identify how to 

best respond to them: what are their risk assessments, their implementation of specific controls for specific parts of the enrollment 

process? That will be key, but that work is ongoing, so I cannot 

really say one way or the other which way it will go with the recommendations. 

18 

Senator CASEY. And part of that is, I guess—and I know this is 

always difficult in an auditing context—when you have a mandate 

but you also have limited resources, you cannot audit or review 

every transaction or every part of the system. So you do sometimes 

have to make a determination based upon risk: what is a higher 

risk, what is a—— 

Mr. BAGDOYAN. Sure. You prioritize where you attack first in 

terms of control gaps. Sure. 

Senator CASEY. I want to ask you too to what extent you believe 

the IRS has the capacity to identify fraudulent, so-called advance 

premium tax credit or APTC claims? Do you have any sense of 

that? 

Mr. BAGDOYAN. I do not. That is not part of our scope in this ongoing work, but I believe there are other mission teams within 

GAO that are taking a look at that. I do not know the specific aspects, but I believe IRS capacity and capability is part of that work. 

Senator CASEY. Well, we are grateful for your work. It is difficult, 

but it is essential. We want to make sure that we get this right 

over time. One of the ways to inform how we do our work in terms 

of legislative change or corrections is to have information from 

GAO and other sources. So we appreciate your work. Thank you. 

Mr. BAGDOYAN. Thank you, Senator. 

The CHAIRMAN. Senator Wyden would like to make a comment. 

Senator WYDEN. One last ‘‘yes’’ or ‘‘no’’ question, Mr. Bagdoyan. 

Is it correct that CMS asked for these 11 fictitious cases and GAO 

did not give them to the agency? 

Mr. BAGDOYAN. That is correct. 

Senator WYDEN. I would again say, colleagues, it is pretty hard 

to evaluate something you are not told about. You certainly cannot 

fix something you do not know about. By the way, on Senator 

Burr’s question, you could have gotten an answer to it if you had 

actually been able to get information about these 11 fictitious 

cases. And by the way, my staff asked for the information about 

these 11 fictitious cases. 

So to me the message here—and Chairman Hatch knows that I 

am interested in working with him in a bipartisan way. I think I 

am about as bipartisan on health care as anybody in the Senate. 

I just think that, without these recommendations—and we have 

been told they are not ready to go—this is premature. 

At some point, I believe GAO, because I have worked with them 

often in the past and admire their professionalism, will give us 

some recommendations. Then we can work in a bipartisan way. 

But I hope that people following this will recognize that, as of this 

morning, the Government Accountability Office has not uncovered 

any instances of real people committing fraud as part of this inquiry. I think that is the important take-away of this morning. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thanks. 

Mr. Bagdoyan, it is true that your job is to look for fraud. Your 

job is to look for misconceptions. Your job is to look for things that 

are wrong, or out of whack, or whatever you want to call it, and 

that is what you are doing, right? 

Mr. BAGDOYAN. That is correct, Senator. 

The CHAIRMAN. And you have done it honestly, right? 

19 

Mr. BAGDOYAN. Yes. 

The CHAIRMAN. And you are disturbed by the fact that these discrepancies exist, even though it has been a limited investigation. 

Is that right? 

Mr. BAGDOYAN. Well, we do have concerns about the red flags we 

have detected in terms of the control environment. 

The CHAIRMAN. Well, you are expressing those concerns here 

today. I have concerns too. A lot of people on our side do not believe 

that Obamacare is ever going to work and that it is just going to 

continue to take us downhill with more and more costs, more and 

more expenses, and more and more fraud. This is not the only instance of fraud either, is it? 

Mr. BAGDOYAN. Well, I cannot comment on that. 

The CHAIRMAN. All right. 

Mr. BAGDOYAN. That is out of our scope. But if I may, Mr. Chairman, try to explain our decision to decline—— 

The CHAIRMAN. What I do not want is, I do not want people just 

slapping this off like this is not important. It is very important—— 

Mr. BAGDOYAN. Right. I would like to, if I may, again—— 

The CHAIRMAN [continuing]. And I want you to tell us why it is 

so very important. 

Mr. BAGDOYAN. It is important in terms of getting the responses 

that we need as our work is ongoing. I would respectfully ask that 

I might explain why we declined to provide the identities of our 11 

applicants. 

The CHAIRMAN. Sure. I would like you to explain that. 

Mr. BAGDOYAN. It is fully consistent with GAO policy, protocols, 

and practice that we do not divulge any information related to our 

sources, methods, and investigative techniques to any entity so 

that we protect those for future use. So that is our perspective on 

that issue. 

The CHAIRMAN. Well, why is that? I mean, why can you not divulge—— 

Mr. BAGDOYAN. Well, we cannot because we have the sources and 

methods that I mentioned that need to stay confidential, that are 

in general use by GAO in certain circumstances. So revealing those 

would basically give up the ghost. 

The CHAIRMAN. Well, my understanding, through my service in 

the Senate, is that the GAO does a very good job of trying to get 

to the bottom of problems in our society. I think you are a good illustration of that effort by GAO. 

Now, this does not mean that you are going to cease trying to 

find fraud and mismanagement and so forth in the future, does it? 

Mr. BAGDOYAN. Well, this work is ongoing. 

The CHAIRMAN. Right. 

Mr. BAGDOYAN. I think we are in it for the long term. 

The CHAIRMAN. And we will probably have you back again so 

that we can figure out, what is our job up here? What can we do? 

We cannot just dismiss these type of things; we have to do something about them. Hopefully we can do that with your help. 

Mr. BAGDOYAN. Thank you. 

The CHAIRMAN. With that, we will recess until further notice. 

[Whereupon, at 11:05 a.m., the hearing was concluded.] 

(21) 

A P P E N D I X 

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

PREPARED STATEMENT OF SETO J. BAGDOYAN, DIRECTOR, FORENSIC AUDITS AND

INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE

GAO HIGHLIGHTS

Why GAO Did This Study 

PPACA provides for the establishment of health-insurance exchanges, or marketplaces, where consumers can compare and select private health-insurance plans. 

The act also expands the availability of subsidized health-care coverage. The Congressional Budget Office estimates the cost of subsidies and related spending under 

the act at $28 billion for fiscal year 2015. PPACA requires verification of applicant 

information to determine eligibility for enrollment or subsidies. 

GAO was asked to examine controls for application and enrollment for coverage 

through the federal Marketplace. This testimony describes (1) the results of GAO’s 

undercover testing of the Marketplace’s eligibility and enrollment controls, including 

opportunities for potential enrollment fraud, for the act’s first open-enrollment period; and (2) additional undercover testing in which GAO sought in-person application assistance. 

This statement is based on GAO undercover testing of the Marketplace application, enrollment, and eligibility-verification controls using 18 fictitious identities. 

GAO submitted or attempted to submit applications through the Marketplace in 

several states by telephone, online, and in-person. Details of the target areas are 

not disclosed, to protect GAO’s undercover identities. GAO’s tests were intended to 

identify potential control issues and inform possible further work. The results, while 

illustrative, cannot be generalized to the full population of applicants or enrollees. 

GAO provided details to CMS for comment, and made technical changes as appropriate. 

PATIENT PROTECTION AND AFFORDABLE CARE ACT

Observations on 18 Undercover Tests of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided Under the Act 

What GAO Found 

To assess the enrollment controls of the federal Health Insurance Marketplace 

(Marketplace), GAO performed 18 undercover tests, 12 of which focused on phone 

or online applications. During these tests, the Marketplace approved subsidized coverage under the Patient Protection and Affordable Care Act (PPACA) for 11 of the 

12 fictitious GAO applicants for 2014. The GAO applicants obtained a total of about 

$30,000 in annual advance premium tax credits, plus eligibility for lower costs due 

at time of service. For 7 of the 11 successful fictitious applicants, GAO intentionally 

did not submit all required verification documentation to the Marketplace, but the 

Marketplace did not cancel subsidized coverage for these applicants. While these 

subsidies, including those granted to GAO’s fictitious applicants, are paid to healthcare insurers, and not directly to enrolled consumers, they nevertheless represent 

a benefit to consumers and a cost to the government. GAO’s undercover testing, 

while illustrative, cannot be generalized to the population of all applicants or enrollees. GAO shared details of its observations with the Centers for Medicare and Medicaid Services (CMS) during the course of its testing, to seek agency responses to 

the issues raised. Other observations included the following: 

22 

1Pub. L. No. 111–148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and 

Education Reconciliation Act of 2010 (HCERA), Pub. L. No. 111–152, 124 Stat. 1029 (Mar. 30, 

2010). In this testimony, references to PPACA include any amendments made by HCERA. 2Specifically, our review covered the first open-enrollment period, from October 1, 2013 to 

March 31, 2014, as well as follow-on work through 2014 and into 2015 after close of the openenrollment period. 3GAO, Patient Protection and Affordable Care Act: Preliminary Results of Undercover Testing 

of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided Under the 

Act, GAO–14–705T (Washington, D.C.: July 23, 2014). 4 According to Department of Health and Human Services’ (HHS) Centers for Medicare & 

Medicaid Services (CMS) data, about 11.7 million people selected or were automatically reenrolled into a 2015 health insurance plan under the act. A high fraction of those enrollees— 

87 percent, in states using the HealthCare.gov system—qualified for the premium tax-credit subsidy provided by the act, which is described later in this statement. 

• The Marketplace did not accurately record all inconsistencies. Inconsistencies 

occur when applicant information does not match information available from 

Marketplace verification sources. Also, the Marketplace resolved inconsistencies 

from GAO’s fictitious applications based on fictitious documentation that GAO 

submitted. Overall, according to CMS officials, the Marketplace did not terminate any coverage for several types of inconsistencies, including Social Security 

data or incarceration status. 

• Under PPACA, filing a federal income-tax return is a key control element, designed to ensure that premium subsidies granted at time of application are appropriate based on reported applicant earnings during the coverage year. GAO, 

however, found errors in information reported by the Marketplace for tax filing 

purposes for 3 of its 11 fictitious enrollees, such as incorrect coverage periods 

and subsidy amounts. 

• The Marketplace automatically reenrolled coverage for all 11 fictitious enrollees 

for 2015. Later, based on what it said were new applications GAO’s fictional 

enrollees had filed—but which GAO did not itself make—the Marketplace terminated coverage for 6 of the 11 enrollees, saying the fictitious enrollees had 

not provided necessary documentation. However, for five of the six terminations, GAO subsequently obtained reinstatements, including increases in premium tax-credit subsidies. 

For an additional six applicants, GAO sought to test the extent to which, if any, 

in-person assisters would encourage applicants to misstate income in order to qualify for income-based subsidies during coverage year 2014. However, GAO was unable to obtain in-person assistance in 5 of the 6 undercover attempts. For example, 

an assister told GAO that it only provided help for those applying for Medicaid and 

not health-care insurance applications. Representatives of these organizations acknowledged the issues GAO raised in handling of the inquiries. CMS officials said 

that their experience from the first open-enrollment period helped improve training 

for the 2015 enrollment period. 

Chairman Hatch, Ranking Member Wyden, and Members of the Committee: 

I am pleased to be here today to discuss enrollment for health-care coverage obtained through the federal health-insurance exchange established under the Patient 

Protection and Affordable Care Act (PPACA),1 and in particular, to discuss results 

of our undercover testing of eligibility and enrollment controls for the 2014 coverage 

year.2 We presented preliminary results in July 2014.3 Among other things, PPACA 

provides subsidies to those eligible to purchase private health-insurance plans who 

meet certain income and other requirements, and with those subsidies and other 

costs, represents a significant, long-term fiscal commitment for the federal government. According to the Congressional Budget Office, the estimated cost of subsidies 

and related spending under the act is $28 billion for fiscal year 2015, rising to $103 

billion for fiscal year 2025, and totaling $849 billion for fiscal years 2016–2025. 

While subsidies under the act are not paid directly to enrollees, participants nevertheless benefit through reduced monthly premiums or lower costs due at time of 

service, such as copayments. Because subsidy costs are contingent on who obtains 

coverage, enrollment controls that help ensure only qualified applicants are approved for coverage with subsidies are a key factor in determining federal expenditures under the act.4

PPACA, signed into law on March 23, 2010, expands the availability of subsidized 

health-care coverage, and provides for the establishment of health-insurance exchanges, or marketplaces, to assist consumers in comparing and selecting among inVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00026 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD
23 

5Specifically, the act required, by January 1, 2014, the establishment of health-insurance exchanges in all states. In states not electing to operate their own exchanges, the federal government was required to operate an exchange. 6Specifically, in 34 states, the federal government operated individual exchanges. Two states 

operated their own exchanges, but applicants applied through HealthCare.gov. As of March 

2015, the number of states had grown to 37, according to HHS’s Office of the Assistant Secretary for Planning and Evaluation, with the Marketplace accounting for 76 percent (8.8 million) 

of consumers’ plan selections. 7 42 U.S.C. § 18081(c); 45 C.F.R. §§ 155.310, 155.315, 155.320. 

8 An exchange must require an applicant who has a Social Security number to provide the 

number. 42 U.S.C. § 18081(b)(2) and 45 CFR § 155.310(a)(3)(i). 9Our original requesters were: in the U.S. Senate, the then-ranking member of the Committee 

on Homeland Security and Government Affairs and the then-ranking member of the Committee 

on Finance; and in the U.S. House of Representatives, the then-chairman of the Committee on 

Ways and Means and the then-chairman of the Committee on Ways and Means, Subcommittee 

on Oversight. 10GAO–14–705T. 11For all our applicant scenarios, we sought to act as an ordinary consumer would in attempting to make a successful application. For example, if, during online applications, we were directed to make phone calls to complete the process, we acted as instructed. 

surance plans offered by participating private issuers of health-care coverage.5

Under PPACA, states may elect to operate their own health-care exchanges, or may 

rely on the federally facilitated exchange, known to the public as HealthCare.gov. 

These marketplaces were intended to provide a single point of access for individuals 

to enroll in private health plans, apply for income-based subsidies to offset the cost 

of these plans—which are paid directly to health-insurance issuers—and, as applicable, obtain an eligibility determination for other health coverage programs, such as 

Medicaid or the Children’s Health Insurance Program. The Department of Health 

and Human Services’ (HHS) Centers for Medicare and Medicaid Services (CMS) is 

responsible for overseeing the establishment of these online marketplaces, and the 

agency maintains the federally facilitated exchange. At the time we began the work 

described in this statement, CMS was operating HealthCare.gov, also known as the 

Health Insurance Marketplace (Marketplace) in about two-thirds of the states.6

To be eligible to enroll in a qualified health plan offered through a marketplace, 

an individual must be a U.S. citizen or national, or otherwise lawfully present in 

the United States; reside in the marketplace service area; and not be incarcerated 

(unless incarcerated while awaiting disposition of charges). Marketplaces, in turn, 

are required by law to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies.7

These verification steps include validating an applicant’s Social Security number, if 

one is provided; 8 verifying citizenship, status as a national, or lawful presence with 

the Social Security Administration (SSA) or the Department of Homeland Security 

(DHS); and verifying household income and family size against tax-return data from 

the Internal Revenue Service (IRS), as well as data on Social Security benefits from 

the SSA. 

My statement today presents results and analysis from work originally requested 

by a number of congressional requesters.9 Specifically, today’s statement (1) describes the final results of our undercover testing of the federal Marketplace’s application, enrollment, and eligibility verification controls, including opportunities for 

potential enrollment fraud, for the act’s first open-enrollment period ending March 

31, 2014; and (2) describes additional undercover testing in which we sought inperson consumer assistance for federal Marketplace applications. Our control testing 

began in January 2014 and concluded in April 2015. 

Our July 2014 testimony, which described the results of our work up to that time, 

focused on application for, and approval of, coverage for fictitious applicants.10 My 

statement today extends that work to the post-application process, including our 

maintenance of the fictitious applicant identities throughout 2014 and into 2015, 

payment of subsidized premiums on policies we obtained, and the Marketplace’s 

verification process for applicant documentation. Thus, taken together, our two 

statements now cover the entire process of first obtaining, and then continuing, coverage for our fictitious applicants, from early 2014 into 2015. 

To perform our undercover testing of the Marketplace application, enrollment, and 

eligibility-verification process, we created 18 fictitious identities for the purpose of 

making applications for individual health-care coverage by telephone, online, and inperson.11 Because the federal government, at the time of our review, operated a 

marketplace on behalf of the state in about two-thirds of the states, we focused our 

work on those states. We selected three of these states for our undercover applicaVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00027 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD
24 

12We based the state selections on factors including range of population size, mixture of population living in rural versus urban areas, and number of people qualifying for income-based subsidies under the act. We selected target areas within each state based on factors including community size. To preserve confidentiality of our applications, we do not disclose here the number 

or locations of our target areas. We generally selected our states and target areas to reflect a 

range of characteristics. 13We were aware of general eligibility requirements, however, from public sources such as 

websites. 14 As noted earlier, to be eligible to enroll in a qualified health plan offered through a marketplace, an individual must be a U.S. citizen or national, or otherwise lawfully present in the 

United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). Marketplaces, in turn, are required by law to verify 

application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies. 15To qualify for these income-based subsidies, an individual must be eligible to enroll in marketplace coverage; meet income requirements; and not be eligible for coverage under a qualifying 

plan or program, such as affordable employer-sponsored coverage, Medicaid, or the Children’s 

Health Insurance Program. Cost-sharing reduction (CSR) is a discount that lowers the amount 

consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. Because 

the benefit realized through the CSR subsidy can vary according to medical services used, the 

value to consumers of such subsidies can likewise vary. 16For the 2014 coverage year, CMS awarded $67 million in grants for ‘‘Navigators,’’ which 

are individuals or organizations that are to provide, without charge, impartial health-insurance 

information to consumers, and to help them complete eligibility and enrollment forms. In addition, such aid is also to be available from other in-person assisters (‘‘non-Navigators’’) who generally perform the same functions as Navigators, but are funded through separate grants or contracts. Navigators and non-Navigator assisters must complete comprehensive training, according 

to CMS. Through the HealthCare.gov website, CMS published a state-by-state list of where inperson assistance can be obtained. 

tions, and further selected target areas within each state.12 To maintain independence in our testing, we created our applicant scenarios without knowledge of specific 

control procedures, if any, that CMS or other federal agencies may use in accepting 

or processing applications. We thus did not create the scenarios with intent to focus 

on a particular control or procedure.13 The results obtained using our limited number of fictional applicants are illustrative and represent our experience with applications in the three states we selected. They cannot, however, be generalized to the 

overall population of all applicants or enrollees. In particular, our tests were intended to identify potential control issues and inform possible further work. We 

shared details of our work with CMS during the course of our testing, to seek agency responses to the issues we raised. We also provided details prior to this hearing, 

and made technical changes as appropriate. 

For 12 of the 18 applicant scenarios, we chose to test controls for verifications related to the identity or citizenship/immigration status of the applicant.14 This approach allowed us to test similar scenarios across different states. We made half of 

these applications online and half by phone. In these tests, we also stated income 

at a level eligible to obtain both types of income-based subsidies available under 

PPACA—a premium tax credit and cost-sharing reduction.15 Our tests included fictitious applicants who provided invalid Social Security identities, noncitizens claiming to be lawfully present in the United States, and applicants who did not provide 

Social Security numbers. As appropriate, in our applications for coverage and subsidies, we used publicly available information to construct our scenarios. We also 

used publicly available hardware, software, and materials to produce counterfeit or 

fictitious documents, which we submitted, as appropriate for our testing, when instructed to do so. We then observed the outcomes of the document submissions, such 

as any approvals received or requests to provide additional supporting documentation. We began this control testing in January 2014 and concluded it in April 2015. 

We also obtained data from CMS on applicant submission of required verification 

documentation. These data listed document submission status as of April 2015 for 

the act’s first open-enrollment period, including for our undercover applications. 

For the remaining 6 of our 18 applicant scenarios to examine enrollment through 

the Marketplace, we sought to test only income-verification controls. We randomly 

selected three ‘‘Navigator’’ and three non-Navigator in-person assisters in our target 

areas.16 For half of these 6 applications, our applicant planned to state income 

slightly above the maximum amount allowable for income-based subsidies, while for 

the others, our applicant planned to state income slightly below the range eligible 

for these subsidies. We sought to determine the extent to which, if any, in-person 

assisters might encourage our undercover applicants to misstate income in order to 

qualify for either of the income-based PPACA subsidies. We chose to limit our review of those providing in-person assistance to the extent we encountered these asVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00028 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD
25 

17 Because the benefit realized through the CSR subsidy can vary according to medical services used, the value to consumers of such subsidies can likewise vary. 18 Even if not obtaining subsidies, applicants can also benefit if they obtain coverage for which 

they would otherwise not qualify, such as by not being a U.S. citizen or national, or lawfully 

present in the United States. 19 According to CMS, the purpose of identity proofing is to prevent someone from creating an 

account and applying for health coverage based on someone else’s identity and without their 

knowledge. Although intended to counter such identity theft involving others, identity proofing 

thus also serves as an enrollment control for those applying online. 20 According to executives of the contractor that performs the identity proofing, about 78 percent of applicants overall that have attempted identity proofing online for the 2014 and 2015 

application cycles were successful, across the federal Marketplace and state exchanges combined. The contractor officials said that the 78 percent success rate is marginally lower than 

the general success rate for identity-proofing services the contractor provides. This lower rate, 

the contractor told us, is likely due to the health-care exchange population being less likely to 

have an ‘‘electronic footprint’’ upon which identity proofing is based. The contractor executives 

said that the remaining 22 percent did not necessarily fail the identity proofing. In many cases, 

the contractor was not able to locate the applicant in its records, or the applicant did not respond to the questions for identity verification. 21 According to the contractor, about 560,000 telephone inquiries were made to the contractor 

from October 2013 to April 1, 2015, after applicants did not pass the online identity proofing. 

In about 35 percent of those cases, identity could be verified. 

sisters as part of our enrollment control testing. A full examination of in-person assistance, including issues other than eligibility and enrollment, was beyond the 

scope of our work. Overall, our review covered the act’s first open-enrollment period, 

from October 1, 2013 to March 31, 2014, as well as follow-on work through 2014 

and into 2015 after close of the open-enrollment period. 

We plan to issue a final report, with recommendations, on our undercover 

eligibility- and enrollment-controls testing. We are conducting our audit work in accordance with generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence we obtained provides a reasonable 

basis for our findings and conclusions based on our audit objectives. We conducted 

our related investigative work in accordance with investigative standards prescribed 

by the Council of the Inspectors General on Integrity and Efficiency. 

THE FEDERAL MARKETPLACE APPROVED SUBSIDIZED COVERAGE FOR 11 OF 12 FICTITIOUS

APPLICANTS IN 2014, WITH COVERAGE CONTINUING INTO 2015

We Obtained Coverage for 11 of 12 Fictitious Applicants by Using the Telephone 

Application Process and Bypassing Online Identity Verification 

As we described in our July 2014 testimony, the federal Marketplace approved 

subsidized coverage for 11 of 12 fictitious applicants who initially applied online or 

by telephone. For the 11 approved applications, we paid the required premiums to 

put health-insurance policies into force. We obtained the advance premium tax credit (APTC) in all cases, totaling about $2,500 monthly or about $30,000 annually for 

all 11 applicants. After receiving these premium subsidies, our 11 fictitious applicants paid premiums at a total annual rate of about $12,000. We also obtained eligibility for cost-sharing reduction (CSR) subsidies.17 The APTC and CSR subsidies are 

not paid directly to enrolled consumers; instead, the federal government pays them 

to issuers of health-care policies on consumers’ behalf. However, they represent a 

benefit to consumers—and a cost to the government—by reducing out-of-pocket costs 

for medical coverage.18 To receive advance payment of the premium tax credit, applicants agree they will file a tax return for the coverage year, and must indicate 

they understand that the premium tax credits paid in advance are subject to reconciliation on their federal tax return. 

As we also reported in July 2014, for each of our 6 online applications (among 

the group of 12 applications made online and by phone), we failed to clear a required identity-checking step, and thus could not complete the process online. For 

online applications, the Marketplace employs a process known as ‘‘identity proofing’’ 

to verify an applicant’s identity.19 It does so by using personal and financial history 

on file with a credit reporting agency contracted by the Marketplace. The Marketplace generates questions, based on information on file with the contractor, that 

only the applicant is believed likely to know.20 If an applicant’s identity cannot be 

verified online, applicants are directed to call the credit reporting agency for assistance.21 If the credit reporting agency then cannot verify identity, applicants are 

26 

22 As shown in app. I, three of our applicants did not provide Social Security numbers. While 

one of them was not allowed to proceed, the other two were allowed to complete applications. 

Our purported rationale for not providing the numbers was concern about personal privacy. 23We shared with CMS details on our successfully obtaining coverage, during the course of 

our review, in March 2015. 24 According to CMS officials, the federal Marketplace makes eligibility determinations. Private insurers, also called ‘‘issuers,’’ provide coverage. 

typically told to contact the federal Marketplace or their state-based exchange, credit-reporting agency officials told us. 

We subsequently were able to obtain coverage for all six of these applications that 

we began online by completing them by phone. By following instructions to make 

telephone contact with the Marketplace, we circumvented the initial identityproofing control that had stopped our online applications. When we later asked CMS 

officials about this difference between online and telephone applications, they told 

us that unlike with online applications, the Marketplace allows phone applications 

to be made on the basis of verbal attestations by applicants, given under penalty 

of perjury, who are directed to provide supporting documentation. 

For our 6 phone applications, we successfully completed the application process, 

with the exception of one applicant who declined to provide a Social Security number and was not allowed to proceed.22 After being approved for coverage, we received 

enrollment material from insurers for each of our 11 successful fictitious applicants. 

Appendix I summarizes outcomes for all 12 of our phone and online applications.23

The Marketplace is required to seek post-approval documentation in the case of 

certain application ‘‘inconsistencies.’’ Inconsistencies occur in instances in which information an applicant has provided does not match information contained in data 

sources that the Marketplace uses for eligibility verification at time of application, 

or such information is not available. For example, an applicant might state income 

at a particular amount, but his or her federal tax return lists a different amount, 

or the applicant has no tax return on file. Likewise, the applicant may provide a 

Social Security number, but it does not match information on file with the SSA. If 

there is such an application inconsistency, the Marketplace is to determine eligibility using attestations of the applicant, and ensure that subsidies are provided on 

behalf of the applicant, if he or she is eligible to receive them, while the inconsistency is being resolved using ‘‘back-end’’ controls. Thus, the Marketplace was required to approve eligibility to enroll in health-care coverage and to receive subsidies for each of our 11 fictitious applicants while the inconsistencies were being 

addressed.24 At the time of our July 2014 testimony, we had begun to receive notifications from the Marketplace on the outcomes of our fictitious document submissions. As discussed later in this statement, we continued to receive additional notices about our applicants through 2014 and into 2015. 

Federal Marketplace Communications With Our 11 Successful Fictitious Enrollees 

About Their Applications Were Unclear or Incomplete 

In all 11 cases in which we obtained coverage, the Marketplace directed us, either 

orally or in writing, to send supporting documentation. However, the Marketplace 

did not always provide clear and complete communications. As a result, during our 

testing, we did not always know the current status of our applications or specific 

documents required in support of them. Examples include the following: 

• Unclear correspondence. Rather than stating a message directly, correspondence instead was conditional or nonspecific, stating the applicant may be affected by something, and then leaving it to the applicant to parse through details to see if they were indeed affected. 

• Inaccurate guidance. The Marketplace directed 8 of our 11 successful applicants to submit additional documentation to prove citizenship and identity—but 

an accompanying list of suitable documents that could be sent in response consisted of items for proving income. 

• Lack of Marketplace notice on document submissions. In five cases, we 

did not receive any indication on whether information sent in response to Marketplace directives was acceptable. As a result, we had to call the Marketplace 

to obtain status information. According to CMS, after documents are processed, 

consumers will receive a written notice. 

• Lack of written notice. In one case, the Marketplace did not provide us with 

any written correspondence directing we submit additional documentation. The 

Marketplace only requested documentation for the initial enrollment during our 

27 

25We shared with CMS details on communication issues we encountered, during the course 

of our review, in March 2015. 26 Any documentation we supplied was, like our initial applications, fictitious, having been 

fabricated by us using commercially available hardware, software, and materials. 

phone application for coverage. According to the Marketplace, applicants are to 

receive written notice of documentation required.25

CMS officials told us they are working to improve communication with consumers, 

and will make improvements in consumer notices. According to the officials, they 

are soliciting feedback from consumer advocates, call-center representatives, and application assisters to improve such communications. According to the officials, CMS 

has already made significant improvements that include adding a complete list of 

acceptable documents to resolve citizenship and immigration status inconsistencies, 

and consolidating warning notices to include all inconsistency issues. CMS is currently working on further improvements in notices, including those for eligibility 

and instances of insufficient documentation, according to the officials. 

Our 11 Fictitious Enrollees Maintained Subsidized Coverage Throughout 2014, Even 

Though We Sent Fictitious Documents, or No Documents, to Resolve Application 

Inconsistencies 

As part of our testing, and in response to Marketplace directives, we provided follow-up documentation, albeit fictitious.26 Overall, as shown in appendix II, we varied what we submitted by application—providing all, none, or only some of the material we were told to send—in order to test controls and note any differences in 

outcomes. Among the 11 applications for which we were directed to send documentation, we submitted 

• all requested documentation for four applications, 

• partial documentation for four applications, and 

• no documentation for the remaining three applications. 

Although our documentation was fictitious, and in some cases we submitted none, 

or only some, of the documentation we were directed to send, we retained our coverage for all 11 applicants through the end of the 2014 coverage year. As described 

earlier, APTC subsidies our applicants received totaled about $30,000 annually, and 

further financial benefit would have been available through CSR subsidies if we had 

obtained qualifying medical services. Following our document submissions, the Marketplace told us, either in writing or in response to phone calls, that the required 

documentation for all our approved applicants had been received and was satisfactory. In one case, when we called the Marketplace to inquire about the status of 

our documentation submission—but where we had not actually submitted any documents—a representative told our applicant that documents had been reviewed and 

processed, and, ‘‘There is nothing else to do at this time.’’ Figure 1 shows a portion 

of a call in which a Marketplace representative said our documentation was complete, even though we did not submit any documents. 

28 

27The inconsistency data we obtained listed status as of April 2015 for all inconsistencies generated during the first open-enrollment period, including those for our undercover applications. 

For this statement, we examined only inconsistency information for our applications, but we 

plan to make a broader analysis as part of ongoing work. 

For one applicant, the Marketplace did subsequently state in a November 2014 

letter that we would lose our subsidies, beginning in December 2014. However, 

there was no follow-up communication regarding the loss of our subsidies, and the 

subsidies were not terminated in December 2014. 

On the basis of applicant data we obtained from CMS, the Marketplace cleared 

inconsistencies for some of our 11 fictitious applications in instances where we submitted bogus documents.27 Appendix III contains a summary of our document requests and submissions. We also noted instances where the Marketplace either did 

not accurately capture all inconsistencies, or resolved inconsistencies based on suspect documentation, including the following: 

• Did not capture all inconsistencies. For 3 of the 11 applicants, while the 

Marketplace at the outset directed our applicants to provide documentation of 

citizenship/immigration status, the CMS applicant data we later received for 

these applicants do not reflect inconsistencies for the items initially identified. 

• Disqualifying income. For 2 of the 11 applicants, we reported income substantially higher than the amount we initially stated on our applications, and 

at levels that should have disqualified our applications from receiving subsidies. 

However, according to the CMS data, the Marketplace resolved our income inVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00032 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD

071615.001
29 

28Fraud involves obtaining something of value through willful misrepresentation. Whether 

conduct is in fact fraudulent is a determination to be made through the judicial or other adjudicative system. For information generally on fraud controls, see GAO, Individual Disaster Assistance Programs: Framework for Fraud Prevention, Detection, and Prosecution, GAO–06–954T 

(Washington, D.C.: July 12, 2006). 

consistencies and, as noted, our APTC and CSR subsidies for both applicants 

continued. 

In addition to having fictitious documentation approved, two of our applicants also 

received notices in early 2015 acknowledging receipt of documents recently submitted, when we had not sent any such documents. We do not know why we received these notices. 

The CMS Document-Verification Process Is Not Designed to Identify Fraudulent Applications 

We found that the CMS document-processing contractor is not required to seek 

to detect fraud.28 It is only required to inspect for documents that have obviously 

been altered. According to contractor executives we spoke with, the contractor personnel involved in the document-verification process are not trained as fraud experts and do not perform antifraud duties. In particular, the executives told us, the 

contractor does not certify the authenticity of submitted documents, does not engage 

in fraud detection, and does not undertake investigative activities. In the contractor’s standard operating procedures for its work for CMS, document-review workers 

are directed to ‘‘determine if the document image is legible and appears unaltered 

by visually inspecting it.’’ Further, according to the contractor, it is not equipped 

to attempt to identify fraud, and does not have the means to judge whether documents submitted might be fraudulent. 

CMS officials told us there have been no cases of fraudulent applications or documentation referred to the U.S. Department of Justice or the HHS Office of Inspector 

General, because its document-processing contractor has not identified any fraud 

cases to CMS. However, as noted earlier, the contractor is not required to detect 

fraud, nor is it equipped to do so. According to the CMS officials, there has been 

‘‘no indication of a meaningful level of fraud.’’ 

According to CMS officials, it would not be practical to have applicants show original documents at time of application. With the HealthCare.gov website, the agency 

decided to move away from in-person authentication, in order to avoid burden on 

consumers, the officials told us. They also said in-person presentation of documentation is not possible in the current structure, as there are insufficient resources to 

establish a system to do so. 

Overall, according to CMS officials, the agency has limited ability to respond to 

attempts at fraud. They told us CMS must balance consumers’ ability to ‘‘effectively 

and efficiently’’ select Marketplace coverage with ‘‘program-integrity concerns.’’ CMS 

places a strong emphasis on program integrity and builds program integrity features into all aspects of implementation of the law, according to CMS officials. In 

any case, the CMS officials said the design of the program does not allow for direct 

consumer profit from fraud, because APTC and CSR subsidies are paid to policy 

issuers, not consumers. We note, however, that even so, the subsidies nevertheless 

can produce direct financial benefits to consumers. For example, if consumers elect 

to receive the premium tax credit in advance, that lowers the cost of monthly coverage. A consumer could also receive the advance premium tax credit and not file 

a federal tax return, as required to ensure proper treatment of the credit. Likewise, 

CSR subsidies mean smaller out-of-pocket expenses when obtaining medical services. Accordingly, although subsidies may be paid directly to issuers, they still result 

in a cost to the government and a benefit to enrollees. 

CMS officials told us the agency plans to conduct an assessment of the Marketplace’s eligibility determination process, including the application process and the 

inconsistency resolution process. They did not provide a firm date for completion, 

saying the review would depend on obtaining IRS information for use as a reference. 

Four of Our 11 Applicants Continued to Receive Subsidized Coverage for 2014, 

Likely Because CMS Waived Documentation Requirements 

According to the applicant data we obtained from CMS, most of our applications 

had unresolved inconsistencies—indicating either that the Marketplace did not receive requested documentation or the documentation was not satisfactory. Specifically, as shown in appendix III, the CMS data indicate that, as of April 2015, 7 of 

our 11 applications had at least one inconsistency that remained unresolved. 

30 

29GAO’s standard practice is to not disclose identifiers associated with undercover identities 

and operatives, in order to protect use of this sensitive investigative technique, which can yield 

results not obtainable through other means. 30For example, in the case of an income inconsistency, contractor procedures stated there will 

not be action taken ‘‘if the consumer or anyone in the household has sent any supporting document . . . regardless of the relevance of the document to the Annual Income inconsistency.’’ For 

instance, there will be no action on the income issue ‘‘if the consumer or household member has 

sent a document relating to immigration, even though that document cannot be used to resolve 

the Annual Income inconsistency.’’ relieved of the obligation for submitting all documents for 

the 2014 plan year. 31 42 U.S.C. § 18081(e)(4)(A). 32 45 CFR § 155.315(f)(3). 33We did not find any public announcement of CMS’s decision to apply the good-faith provision. 

Because we did not disclose the specific identities of our fictitious applicants, CMS 

officials said they could not explain our findings on handling of inconsistencies for 

our applications.29 However, in general, they said our subsidized policies may have 

remained in effect during 2014 because CMS waived certain document filing requirements. Specifically, CMS directed its document contractor not to terminate 

policies or subsidies if an applicant submitted any documentation to the Marketplace. That is, if an applicant submitted at least one document, whether it resolved 

an inconsistency or not, that would be deemed sufficient so that the Marketplace 

would not terminate either the policy or subsidies of the applicant, even if other documentation had initially been required.30 For example, for one of our applicants, the 

Marketplace requested citizenship, income, and identity documents, but our applicant submitted only identity information. Under the CMS directive, the applicant’s 

policy and subsidies continued through 2014 because our applicant submitted at 

least one document to the Marketplace, but not all documents required. Thus, in 

the case of our four applicants that submitted partial documentation to the Marketplace, we likely were relieved of the obligation for submitting all documents for the 

2014 plan year. 

For the 2014 plan year, PPACA authorized CMS to extend the period for applicants to resolve inconsistencies unrelated to citizenship or lawful presence.31 Additionally, regulations state that CMS may extend the period for an applicant to resolve any type of inconsistency when the applicant demonstrates a ‘‘good faith effort’’ to submit documentation.32 CMS officials told us they relied upon these authorities to make a policy decision to broadly extend the period for resolving all 

types of inconsistencies in 2014. Under the policy, the officials told us, the submission of a single document served as evidence of a good faith effort by the applicant 

to resolve all inconsistencies, and therefore extended the resolution period through 

the end of 2014.33 As such, CMS did not terminate any applicant who ‘‘demonstrated a good faith effort’’ in 2014. The officials told us that CMS is enforcing 

the full submission requirement for 2015, and that any good-faith extensions granted in 2015 would be decided on a case-by-case basis and be limited in length. All 

consumers, regardless of whether they benefitted from the good-faith effort extension in 2014, will still be subject to deadlines for filing sufficient documentation, 

they said. In particular, according to the officials, those who made a good-faith effort 

by submitting documentation, but failed to clear their inconsistencies in 2014, were 

among the first terminations in 2015, which they said took place in February and 

early March. We are continuing to seek further information from CMS officials on 

their good-faith effort policy, as well as any 2015 terminations, as part of ongoing 

work. 

Although the good-faith effort policy could explain the handling of some of our applications, CMS officials could not provide a general explanation for the three applications for which we submitted no documentation but our subsidized coverage remained. However, based on our examination of applicant files at the CMS document 

contractor, this could be due to an error in the CMS enrollment system. Specifically, 

we found instances in which records we reviewed showed that applicants had not 

enrolled in a plan, when they actually had done so. Contractor officials told us that 

in such cases, they did not terminate the plans or subsidies because the applicants 

were shown as not enrolled. We plan to address this issue of tracking of inconsistencies in our ongoing work. 

Also included among the unresolved inconsistencies for our applicants were four 

for Social Security numbers. According to CMS officials, inconsistencies for Social 

Security numbers occur when an applicant’s name, date of birth, and Social Security 

number cannot be validated in an automated check with SSA. The officials told us 

that systems capability has not allowed CMS’s document contractor to make termiVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00034 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD
31 

34 CMS officials also told us the agency did not pursue terminations for inconsistencies involving American Indian status and presence of employer-sponsored or minimum essential coverage. 

For incarceration status (incarcerated individuals are generally not eligible for coverage), CMS 

officials said the agency accepted applicant attestations after determining that the SSA prisoner 

database was unreliable. 35 Under a CMS policy adopted in September 2014 for the 2015 coverage year, generally, if 

consumers do nothing, they will be automatically enrolled in the same plan with the same premium tax credit and other financial assistance. Consumers whose 2013 tax return indicates they 

had very high income, or who did not give the Marketplace permission to check updated tax 

information for annual eligibility redetermination purposes, were to be automatically enrolled 

but without financial assistance if they do not return to HealthCare.gov. CMS said this process 

provides continuity of coverage and safeguards public funds. See 

http://cms.gov/Newsroom/MediaReleaseDatabase/Fact-sheets/2014-Fact-sheets-items/2014- 

09-02.html?DLPage=1&DLSort=0&DLSortDir=descending, accessed July 8, 2015. 

nations for such inconsistencies. They also said the agency has done no analysis of 

the fiscal effect of not making such terminations. We plan to address this issue in 

ongoing work.34 In addition, CMS officials told us that although it checks applicants 

or enrollees against SSA’s Death Master File, it currently does not have the systems 

capability to change coverage if a death is indicated. Instead, the officials told us, 

the Marketplace has established a self-reporting procedure for individuals to report 

a consumer’s death in order to remove the consumer from coverage. The number of 

reported deaths from SSA is ‘‘very minimal,’’ according to CMS officials. 

The Marketplace Automatically Reenrolled Coverage for All 11 Fictitious Applicants 

for 2015 

The coverage we obtained for our 11 fictitious applicants contained an automatic 

reenrollment feature—both insurers and the Marketplace notified us that if we took 

no action, we would automatically be enrolled in the new coverage year (2015).35

In all 11 of our cases, we took no action and our coverage was automatically reenrolled in January 2015. We continued to make premium payments, in order to 

demonstrate continuation of subsidized coverage, which meant continuing costs for 

the federal government. Appendix IV summarizes our automatic reenrollments. 

Although we obtained automatic reenrollments, we found communications from 

the Marketplace leading up to the end of 2014 to be contradictory or erroneous. Examples include the following: 

• As noted earlier, our applicants were notified they would automatically be reenrolled for the new coverage year. But most of the applicants also received, to 

varying degrees, notices to reapply or to take some type of action. For example, 

we received notices stating: ‘‘Official Notice: Your 2015 application is ready,’’ 

‘‘Action Needed: Your 2015 health coverage,’’ and ‘‘Follow these steps to reenroll by December 15.’’ The message and frequency of these notices could create uncertainty among applicants who believed they need not take any action 

to remain enrolled. 

• In correspondence to our applicants, the Marketplace referred to things that 

could not have happened. In four cases in the latter part of 2014, Marketplace 

correspondence referred to the filing of federal tax returns of our applicants, 

even though our applicants never filed a tax return. 

• In four cases, our enrollees received notices directing them to send additional 

information in order to continue coverage, saying they could lose coverage if 

they did not—but the deadline for submission was a date that had passed 

months earlier. For example, one enrollee received such a notice in December 

2014, advising that coverage might be lost six months earlier, in June 2014. 

As mentioned previously, CMS officials told us they are working to improve communication with consumers, and will make improvements in consumer notices. 

CMS Provided Inaccurate Tax Information for 3 of 11 Fictitious Applicants 

Under PPACA, an applicant’s filing of a federal income-tax return is a key element of back-end controls. When applicants apply for coverage, they report family 

size and the amount of projected income. Based, in part, on that information, the 

Marketplace will calculate the maximum allowable amount of advance premium tax 

credit. An applicant can then decide if he or she wants all, some, or none of the 

estimated credit paid in advance, in the form of payment to the applicant’s insurer 

that reduces the applicant’s monthly premium payment. 

If an applicant chooses to have all or some of his or her credit paid in advance, 

the applicant is required to ‘‘reconcile’’ on his or her federal tax return the amount 

of advance payments the government sent to the applicant’s insurer on the appliVerDate Mar 15 2010 18:03 Jun 16, 2016 Jkt 000000 PO 00000 Frm 00035 Fmt 6601 Sfmt 6621 R:\DOCS\20377.000 TIMD
32 

36To receive advance payment of the tax credit at time of application, applicants must pledge 

to file a tax return. The actual premium tax credit for the year will differ from the advance 

tax credit amount calculated by the Marketplace if family size and income as estimated at the 

time of application are different from family size and household income reported on the tax return. If the actual allowable credit is less than the advance payments, the difference, subject 

to certain caps, will be subtracted from the applicant’s refund or added to the applicant’s balance due. On the other hand, if the allowable credit is more than the advance payments, the 

difference is added to the refund or subtracted from the balance due. 37The errors we encountered were of a different type than those announced by CMS in February 2015, when the agency said about 800,000 tax filers had received Forms 1095-A that listed incorrect benchmark plan premium amounts. For details, see 

http://blog.cms.gov/2015/02/20/what-consumers-need-to-know-about-corrected-form-1095-as/ 

accessed on June 30, 2015. 38We shared with CMS details on errors in our applicants’ 1095–A forms, during the course 

of our review, in March 2015. 39We shared with CMS details of our purported new applications, during the course of our 

review, in May 2015. 

cant’s behalf with the tax credit for which the applicant qualifies based on actual 

reported income and family size.36

To facilitate this reconciliation process, the Marketplace sends enrollees Form 

1095–A, which reports, among other things, the amount of advance premium tax 

credit paid on behalf of the enrollee. This information is necessary for enrollees to 

complete their tax returns. The accuracy of information reported on this form, then, 

is important for determining an applicant’s tax liability, and ultimately, government 

revenues. 

We found errors with the information reported on 1095–A forms for 3 of our 11 

fictitious applicants.37 In two cases, we received multiple forms containing different 

information for the same applicant. In all three cases, the forms did not accurately 

reflect the number of months of coverage, thus misstating the advance premium tax 

credits received. In one of the cases, for instance, the form did not include a couple 

of months of advance premium tax credit that was received and, as a result, understated the advance premium tax credit received by more than $600. Appendix V 

shows complete results for tax forms we received. Because we did not provide CMS 

with detailed information about the specific cases, CMS officials said they could not 

conduct research and explain why these errors occurred. In general, CMS officials 

told us the agency made quality checks on tax information before mailings to consumers.38

During our testing work, we also identified that unlike advance premium tax 

credits, CSR subsidies are not subject to a recapture process such as reconciliation 

on the taxpayer’s federal income-tax return. In discussions with CMS and IRS officials, we found that the federal government has not established a process to identify 

and recover the value of CSR subsidies that have been provided to our fictitious enrollees improperly. These subsidies increase government costs; and, according to 

IRS, excess CSR payments, if not recovered by CMS, would be taxable income to 

the individual for whom the payment was made. We are continuing to seek information from CMS on any efforts to recover costs associated with subsidy reductions or 

eliminations due to unresolved inconsistencies. 

The Marketplace Later Terminated Subsidized Coverage for 6 of Our 11 Applicants 

in Early 2015, but We Restored Coverage for 5 of These Applicants—With Larger 

Subsidies 

In December 2014, the Marketplace sent notifications to 5 of our 11 applicants, 

indicating that we had filed new applications for subsidized coverage. In four of 

these notices, the Marketplace stated our subsidies or coverage, or both, would be 

terminated if we failed to provide supporting documentation. However, we had not 

filed any such applications, nor, as described earlier, had we sought any redetermination of subsidies. Because each of our fictitious applicants earlier received either written or verbal assurances from the Marketplace that documentation had 

been received and no further action was necessary, we did not respond to these requests to submit supporting documentation. 

A few months later, the Marketplace terminated coverage or subsidies for six applicants, including four applicants who had received notice of new applications in 

December 2014, and two applicants who had not received notice of a new application. The termination notices cited failure to respond to requests to submit documentation in support of what were claimed to be the new applications we submitted. 

Our remaining five applicants continued receiving subsidized coverage without 

interruption.39 Following the termination notices, we elected to pursue continued 

33 

40 Although our other applicants did not receive notices of new applications being filed, CMS 

officials told us that each year, a new application for the upcoming coverage year is created for 

those who have coverage through the Marketplace. To lessen consumer burden, the Marketplace 

pre-populates a new application using existing information, they said. According to the officials, 

CMS encourages applicants who wish to continue Marketplace coverage to update their application information during open-enrollment and decide what coverage they will need for the next 

year. If applicants do not contact the Marketplace to choose coverage by December 15th, the 

Marketplace will automatically re-enroll them in their current plan or a similar one, the CMS 

officials told us. 41For the general situation for reenrollment, see Centers for Medicare and Medicaid Services, 

Bulletin #14: Guidance for Issuers on 2015 Reenrollment in the Federally-facilitated Marketplace 

(FFM), available at https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/ 

Downloads/Bulletin14_Reenrollment_120114.pdf, accessed July 2, 2015. 42 In seeking restoration of coverage, we did not request any change in subsidies. The Marketplace provided us with new subsidy amounts in approving our restored coverage. According to 

CMS officials, factors that could affect subsidy amounts include use of updated federal poverty 

level income information; a change in plans available in the market, which affects calculation 

of subsidies; and a consumer aging. We did not make premium payments for these five applicants following reinstatement because the reinstatements occurred at the end of our undercover 

testing period. 43 In these in-person applications, our planned approach was to discuss concerns about policy 

costs and to inquire whether there were ways to reduce the expenses, such as through incomebased PPACA subsidies. 

coverage for the six cases as part of our testing, even though we had not filed the 

claimed new applications. Each of our six fictitious applicants that lost coverage or 

subsidies made phone inquiries to the Marketplace for an explanation of the terminations. In three of these inquiries, the Marketplace representatives told our applicants that they were required to file a new application or supporting documentation 

each year. However, as described earlier, notifications we received earlier from the 

Marketplace and insurers told us that no actions were needed to automatically reenroll in our plans other than to continue to pay premiums. In addition, as noted, 

other applicants did not receive notices of new applications being filed.40 We are 

continuing to seek from CMS information on this treatment of our applicants.41

Next, for each of these six fictitious applicants, we requested in Marketplace 

phone conversations reinstatement of coverage or subsidies. For five of the six applicants, the Marketplace approved reinstatement of subsidized coverage, while in the 

process also increasing total premium tax credit subsidies for all these applicants 

combined by a total of more than $1,000 annually.42 For the sixth applicant, a Marketplace representative said a caseworker must evaluate our situation. We were told 

we could not speak with the caseworker, and it could take the caseworker up to 30 

days to resolve the issue. This applicant’s case was still pending at the time we concluded our undercover activity in April 2015. Appendix VI summarizes outcomes for 

the unknown applications and terminations that followed for six of our applicants. 

For three of the five applicants for whom we obtained reinstatement of subsidized 

coverage, we had open inconsistencies related to citizenship/immigration status remaining from our initial applications for 2014, according to CMS data. For each of 

these three applications, we had never submitted any citizenship or immigration 

documentation to the Marketplace for resolution. Nonetheless, we had subsidized 

coverage restored. We are continuing to seek from CMS any information on whether 

procedures allow repeated applications as a way to avoid document-filing requirements. 

We Were Unable To Obtain In-Person Assistance in Five of Six Undercover Attempts 

To Test Income-Verification Controls, and Application Assisters Subsequently Acknowledged Errors 

As described earlier, CMS has awarded grants for ‘‘Navigators,’’ which are to provide free, impartial health-insurance information to consumers. In addition, such 

aid is also to be available from other in-person assisters (‘‘non-Navigators’’) who generally perform the same functions as Navigators, but are funded through separate 

grants or contracts. 

As described in our July 2014 statement, in addition to the 12 online and telephone applications, we also attempted an additional 6 in-person applications, seeking to test income-verification controls only.43 During our testing, we visited one inperson assister and obtained information on whether our stated income would qualify for subsidy. In that case, as shown in Figure 2, a Navigator correctly told us 

that our income would not qualify for subsidy. However, for the remaining five inperson applications, we were unable to obtain such assistance. We encountered a 

34 

44For these six in-person applications, we randomly chose three Navigators and three nonNavigators in the target areas of our selected states. For the in-person applications, because our 

sole interest was any potential advice on reducing policy costs, we did not seek or obtain policies, as we did with our phone and online applications. 45These subsequent visits were not undercover, and we identified ourselves as being with 

GAO. 

variety of situations that prevented us from testing our planned scenarios.44 We 

later returned to the locations, seeking explanations on why we could not obtain the 

advertised assistance, which are also shown in figure 2.45 Representatives of these 

organizations generally acknowledged the issues we raised in handling of our application inquiries. 

We shared these results with CMS officials, who said they could not comment on 

the specifics of our cases without knowing details of our undercover applications. 

CMS officials said Navigators are required to accept all applicants, even if an organization’s mission is to work with specific populations. If Navigators cannot provide 

timely help themselves, they must refer applicants to someone who can give assistance. CMS officials also said that they can terminate grant agreements, among 

other enforcement actions, if Navigators do not comply with terms of their awards. 

They cited as an example a corrective action taken in March 2015 against a Navigator grantee operating in several states for not providing the full range of activities 

it promised. CMS officials stressed to us Navigator training and experience from the 

first open-enrollment period helped improve training for the second enrollment period ending in February 2015. As noted earlier, our review of in-person assistance 

was limited to the extent we encountered Navigators and non-Navigators as part 

of our enrollment control testing. A full examination of in-person assistance was beyond the scope of our work. 


071615.002
35 

CMS officials told us there is no formal policy or specific guidance for situations 

such as the one we encountered in a case described in figure 2, in which an applicant is asked if he or she wishes to perform a service, such as volunteering for union 

activities, at the time the applicant seeks assistance. Still, CMS officials said Navigators would be discouraged from such activities while applicants seek help. 

CMS officials told us it is reasonable for consumers to think that if an assister 

is listed on the federal website as providing help—as were the assisters we selected—that assistance should be available as indicated. CMS officials told us the 

agency recognizes challenges with its online tool to find local assistance, and has 

been working to make changes. We are continuing to seek written documentation 

on these planned improvements. 

Chairman Hatch, Ranking Member Wyden, and Members of the Committee, this 

concludes my statement. I would be pleased to respond to any questions that you 

may have. 

GAO CONTACT AND STAFF ACKNOWLEDGMENTS

GAO Contacts 

For questions about this statement, please contact Seto J. Bagdoyan at (202) 512– 

6722 or BagdoyanS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. 

Staff Acknowledgements 

Individuals making key contributions to this statement, or our 2014 statement reporting preliminary results, include: Matthew Valenta and Gary Bianchi, Assistant 

Directors; Maurice Belding; Mariana Caldero ́n; Marcus Corbin; Carrie Davidson; 

Paul Desaulniers; Colin Fallon; Suellen Foth; Sandra George; Robert Graves; Barbara Lewis; Maria McMullen; James Murphy; George Ogilvie; Shelley Rao; Ramon 

Rodriguez; Christopher H. Schmitt; Julie Spetz; Helina Wong; and Elizabeth Wood. 

36 

APPENDIX I: UNDERCOVER APPLICATION RESULTS

Figure 3 summarizes outcomes for all 12 of the undercover phone and online applications we made for coverage to the Health Insurance Marketplace (Marketplace) 

under the Patient Protection and Affordable Care Act, as part of our testing of eligibility and enrollment controls. 


071615.003
37 

APPENDIX II: FICTITIOUS APPLICANT DOCUMENTATION SUBMITTED

Figure 4 shows, by application, the documentation we submitted in support of the 

11 undercover applications that were successful. As part of our eligibility- and 

enrollment-controls testing, we varied what we submitted by application—providing 

all, none, or only some of the material we were told to send. 


071615.004
38 

APPENDIX III: MARKETPLACE CONSIDERATION OF DOCUMENTATION SUBMITTED

Figure 5 shows, by application, a summary of our document requests and submissions, with Marketplace communications on adequacy of the submissions, for the 11 

undercover applications that were successful. 

a CMS officials said that any ID documents requested and submitted are reported under the 

citizenship status inconsistency. They said this is because ID information is not a distinct inconsistency, and that any such information is used as part of evaluating citizenship inconsistencies. 

As a result, CMS-reported status of inconsistencies, as shown in the table, does not include a 

separate item for ID status. We note, however, that Marketplace representatives specifically 

cited ID documents to our applicants, and that CMS online information, as well as letters sent 

to applicants, likewise refer to ID or documents that can be submitted to resolve an ID issue. b Although GAO applicants were not specifically requested at time of application to provide 

confirmation of Social Security number, data obtained from CMS listed separately a Social Security number inconsistency. c CMS data did not show an inconsistency for this category. 

d Indicates case where GAO submitted income at a level substantially higher than the amount 

initially stated on fictitious applications, and at levels making the applicant ineligible for income-based subsidies. e Notwithstanding the status as reported by CMS, the applicant continued to receive coverage 

and subsidies. 


071615.005
39 

APPENDIX IV: AUTOMATIC REENROLLMENTS

Figure 6 summarizes automatic reenrollment activity at the end of the 2014 coverage year for the 11 undercover applications that were successful. 


071615.006
40 

APPENDIX V: ACCURACY OF TAX FORMS RECEIVED

Figure 7 summarizes receipt of Forms 1095–A, for reconciliation of advance premium tax credits received, for the 11 undercover applications that were successful. 


071615.007
41 

APPENDIX VI: RESTORATION OF SUBSIDIZED COVERAGE

Figure 8 summarizes outcomes for the six applicants for whom the Marketplace 

terminated subsidies or coverage in early 2015. Prior to termination, four of these 

applicants had received notices of new applications filed, although we did not file 

any such applications. Following notice of the terminations, we restored subsidized 

coverage in five of six cases, with one case pending at the time we concluded our 

undercover activity. 

PREPARED STATEMENT OF HON. CHUCK GRASSLEY, A U.S. SENATOR FROM IOWA

GAO conducted an undercover operation to sign up fictitious individuals in 

Obamacare’s marketplaces to try to determine if fictitious individuals could actually 

acquire Federal subsidies. A July 2014 GAO report concluded that the answer is 

‘‘yes.’’ 

GAO created 12 fake applicants, and, for 11 of 12 applications which were made 

by phone and online using fictitious identities, GAO obtained subsidized coverage. 

For three of the 12 applications, GAO did not submit any documents requested of 

them by CMS and yet still received subsidized coverage. 

CMS has been aware of this issue since July 2014. Even so, the 11 fake applicants 

were automatically re-enrolled. In 2015, coverage continued for all applicants until 

six were terminated for unclear reasons. However, GAO was able to reinstate five 

of the six with greater subsidy amounts. 


071615.008
42 

In addition, the administration has spent $120 million on ‘‘navigators’’ to help 

people to sign up. Five out of six applicants did not receive any help from the navigators. 

The undercover GAO operation illustrates, yet again, that the Federal Government—and Obamacare in particular—is not working in the people’s best interest. 

It is apparent that the Federal Government is not meeting the requirements of 

Federal law. For example, GAO provided false documentation, partial documentation, and sometimes no documentation to enroll in marketplaces. In response, CMS 

told GAO that the documents were satisfactory, and 10 out of 11 fictitious applicants continue to receive taxpayer subsidies. 

The GAO report noted that document processing contractors are not required to 

authenticate documentation. Marketplaces are required by law to verify applications 

to determine eligibility, not only for enrollment but also for subsidies. And CMS is 

allowing promises to take the place of paperwork. 

This GAO report documented systemic failures that leave the taxpayer on the 

hook for an even bigger bill. 

PREPARED STATEMENT OF HON. ORRIN G. HATCH, 

A U.S. SENATOR FROM UTAH

WASHINGTON—Senate Finance Committee Chairman Orrin Hatch (R–Utah) today 

delivered the following opening statement at a Committee hearing examining problems with HealthCare.gov enrollment controls: 

Good morning. 

Today’s hearing will address controls at the HealthCare.gov website. 

Specifically, the committee will hear from the Director of Audit Services at the 

Government Accountability Office, Seto Bagdoyan. Director Bagdoyan’s team has led 

an undercover ‘‘secret shopper’’ investigation to test the internal controls of 

HealthCare.gov and to review the Centers for Medicare & Medicaid Services’ handling of this program. 

This investigation was designed to determine the degree to which the administration’s federal health insurance exchange can protect against fraudulent applications, 

what happens when applicants provide false information and documentation, and 

whether the controls are successful in dealing with irregularities once they are 

found. 

Perhaps I should say ‘‘spoiler alert’’ before this next part. Today, Director 

Bagdoyan will explain how the federal exchange failed spectacularly on virtually all 

relevant accounts tested by GAO. 

For this investigation, GAO created fictitious identities to apply for premium tax 

subsidies through the federal health insurance exchange. We learned last year that 

11 out of 12 fake applications were approved. CMS accepted fabricated documentation with these applications without attempting to verify its authenticity and enrolled fake applicants while handing out thousands of dollars in premium tax subsidies. 

Now, a year later, GAO has reported that nothing has changed and that, if anything, there are more problems. 

Worst of all, the administration has known about these problems for over a year 

now and has apparently not taken the necessary steps to rectify them. While CMS 

says that it is balancing consumer access to the system with program integrity concerns, I think it’s pretty clear just what’s going on here. 

Since the federal exchange was first implemented, success has been measured by 

the number of applicants who have signed up for insurance. Indeed, last year, when 

the administration reached its initial enrollment goal, critics of the law were told 

that we had been wrong all along and that the law was, despite all the evidence 

to the contrary, working just fine. 

However, with these findings from GAO, it seems obvious, at least to me, that 

the administration has been preoccupied with signing up as many applicants as possible, ignoring potential fraud and integrity issues along the way. 

43 

Now, supporters of Obamacare often insist that it is ‘‘the law of the land,’’ and 

that Congress should work to improve, rather than repeal it. 

On the first point, these proponents are, unfortunately, correct. For the foreseeable future, the so-called Affordable Care Act is the law of the land. 

On the second point, Republicans in Congress continue to work toward repeal of 

the misguided law and its expensive mandates, regulations, penalties, and taxes, 

and replacement of it with patient-centered reforms that put patients, rather than 

Washington bureaucrats, in charge of their health care decisions. 

However, needless to say, that day will not come until there is a President who 

shares our goal. 

So until then, Obamacare will remain in place. In the meantime, Congress has 

an obligation to exercise rigorous oversight of the implementation of the law and 

to work to protect both beneficiaries and taxpayers from its negative consequences. 

That’s what today’s hearing is about. 

We’re here today to get an account of how things are working on the federal 

health insurance exchange. And, once again, what we’ve heard thus far is not reassuring and does not speak well for CMS’s management of HealthCare.gov, the protection of taxpayer dollars, or the experience of enrollees. 

The GAO’s investigation exposes not only huge gaps in federal exchange program 

integrity, but also flaws in how the exchange and CMS contractors treat Americans 

who are trying to file or correct legitimate applications. 

Time after time, the GAO team sent information to the exchange for verification 

only to have it ignored, or have the exchange respond as if something entirely different had been sent in. The fact that GAO encountered mind-boggling levels of incompetence and inefficiency at nearly every turn does not bode well for the experience of your average, honest enrollee. 

I look forward to today’s hearing and what I hope will be a good discussion on 

program integrity of HealthCare.gov. 

Before I conclude, I want to note that, even though this GAO investigation was 

requested by this committee, CMS was less than cooperative. Indeed, throughout 

the entire endeavor, officials at CMS appeared to be dragging their feet, blowing 

past deadlines and good-faith attempts to carry out this important work. 

Put simply, when Congress asks GAO to conduct an inquiry, no federal agency 

should stand in the way of that work. By delaying the GAO and hampering their 

efforts, CMS has also delayed this committee’s work and hampered our efforts. 

This is unacceptable. And, unfortunately, despite promises of increased transparency and cooperation from agencies throughout this administration, this type of 

stonewalling of legitimate oversight efforts is far, far too common. 

Acting CMS Administrator Andy Slavitt, who is now the President’s nominee to 

run the agency, was personally involved in this process. As the committee considers 

his nomination, I look forward to asking Mr. Slavitt about this investigation and 

why CMS has been interfering with our oversight efforts. 

Of course, that will all have to wait for another day and another time. Today, we 

have our hands full as we hear testimony about this important GAO investigation. 

PREPARED STATEMENT OF HON. RON WYDEN, A U.S. SENATOR FROM OREGON

Let me begin my remarks by saying that on this side of the aisle, we don’t take 

a back seat to anybody in fighting fraud and protecting taxpayer dollars. One dollar 

ripped off is one dollar too many. But let’s be perfectly clear about one thing: the 

report up for discussion today is not about any real-world fraud. 

This study looks at a dozen fictitious cases—and not one of them was a real person who filed taxes or got medical services. No fast-buck fraudster got a government 

check sent to their bank account. Moreover, the government auditors acknowledge 

today that their work, quote, ‘‘cannot be generalized to the full population of applicants or enrollees.’’ 

None of the fictitious characters in this study stepped foot in a hospital or a doctor’s office. And the fact is, when you actually show up for medical services, it’s a 

44 

lot harder to fake your way into receiving taxpayer-subsidized care. Often before 

any services are delivered, providers ask for a photo I.D. with an insurance card. 

And if you’ve stolen an identity, there’s probably a medical history belonging to 

somebody else that should set off alarm bells. 

If you’re a real person signing up in the insurance marketplace, you have to attest 

under penalty of perjury that the information you provide is correct. And if you falsify the application, you face the prospect of a fine of up to $250,000. 

Another big anti-fraud check went untested in this study. That is, squaring up 

tax returns with the information from your insurance application. The GAO’s testimony today calls it a, quote, ‘‘key element of back-end controls.’’ If your tax return 

and personal info don’t match, the gambit’s up. But the study before us today ignores that anti-fraud check. It looks at only part of the picture when it comes to 

stopping fraud. 

As I said at the beginning, there are always methods of strengthening any program and rooting out fraudsters and rip-off artists. Part of any smart, ferocious 

strategy against fraud, on one hand, is drawing a distinction between aggressively 

going after scammers and, on the other, not harming a law-abiding American who 

has made an honest, often technical mistake. 

A retiree nearing Medicare age shouldn’t get kicked to the curb because she accidentally submitted an incorrect document. A transgender American shouldn’t lose 

health coverage after a name change because some forms don’t match. I can’t imagine the Congress wants a system that nixes the health insurance coverage of Americans because of simple issues like those. 

A recent Gallup report stated that the rate of Americans without health insurance 

is the lowest they’ve ever measured. This is the first Finance Committee hearing 

on health care since the Supreme Court’s landmark decision upholding the law that 

made that possible. The fact is, the Affordable Care Act has extended health care 

coverage to more than 16 million real people who use their insurance to see real 

doctors. At some point down the road, GAO is expected to complete their report. At 

that time, let’s work responsibly to draw conclusions on a bipartisan basis about 

how the committee can work to improve American health care. 

Æ