GAO

United States General Accounting Office

Report to the Chairman, Committee on 

Energy and Commerce, House of 

Representatives

June 2001 MEDICAID

State Efforts to 

Control Improper 

Payments Vary

GAO-01-662

Page 1 GAO-01-662 State Efforts to Control Improper Payments Vary

Contents

Letter 3

Appendixes Appendix I: Scope and Methodology 32

Appendix II: Aggregated Results From State Medicaid Agency and

MFCU Questionnaires 34

Appendix III: Comments From the Department of Health and Human 

Services 66

Related GAO Products 69

Tables Table 1: Examples of Prepayment Reviews 16

Table 2: Selected State Efforts to Ensure Legitimacy of Providers 17

Table 3: National Medicaid Fraud and Abuse Initiative Activities 26

Abbreviations

DOJ Department of Justice

FBI Federal Bureau of Investigation

HCFA Health Care Financing Administration

HCFAC Health Care Fraud and Abuse Control Program

HHS Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act

MCFU Medicare Fraud Control Unit

MMIS Medicaid Management Information Systems

OIG Office of Inspector General

SURS Surveillance and Utilization Review Subsystem
Page 2 GAO-01-662 State Efforts to Control Improper Payments Vary
Page 3 GAO-01-662 State Efforts to Control Improper Payments Vary

United States General Accounting Office

Washington, D.C. 20548 Letr

June 7, 2001

The Honorable W. J. “Billy” Tauzin

Chairman, Committee on Energy and Commerce

House of Representatives

Dear Mr. Chairman:

Both the federal government and states have a strong financial interest in 

assuring accurate payments in the jointly funded Medicaid program. About 

40 million low-income Americans—parents and children, as well as elderly, 

blind, and disabled individuals—receive preventive, acute health care, and 

long-term care services paid through the Medicaid program, administered 

by the Health Care Financing Administration (HCFA). In fiscal year 2001, 

the program is projected to cost the federal government $124 billion, and 

the states about $95 billion, in program payments and administrative 

expenses. Within states, two agencies share responsibility for protecting 

the integrity of their state Medicaid programs. The state Medicaid agency is 

responsible for ensuring proper payment and recovering misspent funds, 

while the Medicaid Fraud Control Unit (MFCU) is responsible for 

investigating and ensuring prosecution of Medicaid fraud. 

Improper payments in government health programs such as Medicaid drain 

vital program dollars, hurting beneficiaries and taxpayers. Such payments 

include those made for treatments or services that are not covered by 

program rules, that are not medically necessary, or that were billed but 

never actually provided. Improper Medicaid payments can result from 

inadvertent errors as well as intended fraud and abuse. Unlike inadvertent 

errors, which are often due to clerical errors or a misunderstanding of 

program rules, fraud involves an intentional act to deceive for gain, while 

abuse typically involves actions that are inconsistent with acceptable 

business and medical practices.

Given the importance of Medicaid to millions of Americans and the 

financial resources at stake, in response to your request, we assessed 

whether the states had estimated the risk of, or losses due to, improper 

payments in the program. We also reviewed state Medicaid agencies’ 

activities to prevent or identify and respond to improper payments, and 

state MFCUs’ efforts to investigate and prosecute possible fraud. Finally, 

we reviewed the federal guidance and support provided to states as they 

pursue their program integrity efforts. 
Page 4 GAO-01-662 State Efforts to Control Improper Payments Vary

We specifically focused on efforts to safeguard fee-for-service payments, 

which represented 86 percent of program payments in fiscal year 1998 and 

are the focus of most state program integrity activities.1

 We reviewed state 

Medicaid payment accuracy measurement studies and conducted site visits 

to state Medicaid agencies and MFCUs in Georgia, New Jersey, Texas, and 

Washington. We chose these states to provide regional diversity and 

because agencies within those states were among the ones considered by 

federal officials to be particularly active in efforts to identify and respond 

to improper payment practices—either through the use of new technology 

or other means. In addition, we surveyed officials from all state Medicaid 

agencies and MFCUs. Fifty-three of the 56 state Medicaid agencies and 46 

of the 47 MFCUs responded to our surveys2

 (see aggregated survey results 

in appendix II). We also interviewed officials in other states and federal 

agencies, including HCFA, which oversees Medicaid at the federal level, 

and the Department of Health and Human Services (HHS) Office of 

Inspector General (OIG), which oversees MFCUs at the federal level. 

Finally, we interviewed health care provider, supplier, and insurer groups, 

and analyzed HCFA, state Medicaid agency, and MFCU program reports 

and other documents. Details of our scope and methodology are in 

appendix I. Our work was conducted from September 1999 through April 

2001 in accordance with generally accepted government auditing 

standards.

Results in Brief State Medicaid programs make a wide variety of payments to many 

individuals, institutions, and managed care plans for services provided to a 

beneficiary population whose eligibility status may fluctuate because of 

changes in income. Due to the size and nature of the program, Medicaid is 

at risk for billions of dollars in improper payments. The exact amount lost 

is not known because few states measure the overall accuracy of their 

payments. A portion of states’ improper Medicaid payments are made 

because of fraudulent activities on the part of those billing or participating 

1

 Under fee-for-service, Medicaid programs make payments to providers for specific services 

provided to eligible beneficiaries. To receive payment, a provider files a claim with the state 

that includes both the provider’s and the beneficiary’s identification numbers, a list of the 

treatments and services provided, and diagnostic information to justify the treatments and 

services being billed.

2

 An additional MFCU in the District of Columbia, which had lost its federal certification in 

1983, was recertified in March 2000 after we had fielded our survey; it was not included in 

our survey.
Page 5 GAO-01-662 State Efforts to Control Improper Payments Vary

in the program, but such improper payments are even harder to measure 

because of fraud’s covert nature. States’ efforts to identify billing mistakes 

or abuses of various kinds are limited—even with claims reviews and other 

screening efforts—because it is impossible to thoroughly check every 

claim and payment. However, lax administration increases the risk, as was 

seen in California, where investigations have revealed widespread payment 

for drugs, equipment, and supplies that were either not delivered or not 

needed. 

Efforts by state Medicaid programs to address improper payments are 

modestly and unevenly funded. Half of the states spend no more than onetenth of 1 percent of program expenditures on activities to safeguard 

program payments. Few secure all available federal funds earmarked for 

antifraud efforts because states would have to increase their own spending 

to do so. States also differ in their use of tools to help prevent improper 

payments, such as computerized checking of claims before payment is 

made and site visits to providers whose billing might be questionable, as 

well as the degree to which they coordinate their efforts to investigate and 

then prosecute fraud. There are, however, promising recent activities. 

Some states are devoting more resources to program integrity activities 

than they had previously and are obtaining more sophisticated computer 

analytic capacity to review payment trends and spot improper billing. 

Others are implementing stricter health care fraud and abuse control laws 

and policies. 

Federal efforts to help guide the states rely to a large extent on technical 

assistance, and to a lesser extent on guidance on how to conduct their 

activities. HCFA has recently taken a more active role to facilitate states’

efforts and provide a national forum for sharing information. The agency 

has helped states exchange best practices, held conferences on issues such 

as computer technology, and provided guidance on fraud and abuse in 

managed care. Until recently, HCFA has lacked consistent information on 

how states were conducting their program integrity efforts, which would 

be needed to actively guide their efforts, but it has begun to systematically 

review states’ activities. In regard to the MFCUs, the OIG annually reviews 

them to certify that they are in compliance with federal regulations and 

eligible for federal funding. It also assists MFCUs by providing technical 

assistance and training opportunities. In its written comments on a draft of 

this report, HHS provided information on the Department’s most recent 

efforts to control improper payments. 
Page 6 GAO-01-662 State Efforts to Control Improper Payments Vary

Background Medicaid is the third largest social program in the federal budget and is also 

one of the largest components of state budgets. Although it is one federal 

program, Medicaid consists of 56 distinct state-level programs—one for 

each state, District of Columbia, Puerto Rico, and each U.S. territory.3

 Each 

state has a designated Medicaid agency that administers its program under 

broad federal guidelines. The federal government matches state Medicaid 

spending for medical assistance according to a formula based on each 

state’s per capita income. The federal share can range from 50 cents to 83 

cents of each Medicaid dollar spent.

HCFA administers the Medicaid program at the federal level. In accordance 

with the Medicaid statute, it sets broad guidelines for the states, but within 

them, each state establishes its own eligibility standards; determines the 

type, amount, duration, and scope of covered services; sets payment rates; 

oversees the integrity of its program; and develops its administrative 

structure. States are required to describe the nature and scope of their 

program in a comprehensive written plan submitted to HCFA—with federal 

funding for state Medicaid services contingent on HCFA’s approval of the 

plan. HCFA is responsible for ensuring that state Medicaid programs meet 

all federal requirements. In addition to Medicaid, HCFA also has 

responsibility for administering Medicare, a federal health insurance 

program for certain disabled persons and those 65 years and older. While 

Medicaid and Medicare have different structures and governance, some 

low-income beneficiaries and many providers participate in both programs.

3

 Hereafter referred to as states.
Page 7 GAO-01-662 State Efforts to Control Improper Payments Vary

There are also—in 47 states and the District of Columbia—separate 

MFCUs4

 that are responsible for investigating and prosecuting Medicaid 

provider fraud, patient abuse, and financial fraud. In 1999, MFCUs received 

authority to investigate cases involving Medicare fraud as well.5

 Most 

MFCUs are part of the state Attorney General’s office, and most prosecute 

the cases they investigate. MFCUs that have been federally certified for 

more than 3 years receive 75 cents in federal funding for every dollar they 

spend, up to a limit established by federal regulations.6

 

4

 All states are required to have an MFCU or obtain a waiver from the HHS Secretary. 

Currently, Idaho, Nebraska, and North Dakota have such waivers. States granted waivers 

have similar units already in place. 

5

 Section 407 of the Ticket to Work and Work Incentives Improvement Act of 1999, P.L. 106-

170, expanded the jurisdiction of MFCUs to investigate Medicare fraud in cases primarily 

related to Medicaid and to investigate patient abuse or neglect in non-Medicaid board and 

care facilities. 

6

 The federal government pays 90 percent of a federally certified MFCU’s budget—up to a 

limit—for its first 3 years, and 75 percent thereafter. For an MFCU that has been operating 

for more than 3 years, the maximum federal budget contribution is the greater of $125,000 or 

one-fourth of 1 percent of the total federal, state, and local expenditures of a state Medicaid 

program during its previous quarter.
Page 8 GAO-01-662 State Efforts to Control Improper Payments Vary

In addition to state Medicaid agencies and MFCUs, other state and federal 

agencies assist in dealing with Medicaid improper payments. Because of 

their responsibilities to ensure sound fiscal management in their states, 

state auditors or state inspectors general may become involved in Medicaid 

payment safeguard activities through efforts such as testing payment 

system controls or investigating possible causes of mispayment. At the 

federal level, the Federal Bureau of Investigation (FBI) and the OIG 

investigate, and U.S. Attorneys prosecute, certain Medicaid fraud cases, 

such as those that involve multiple states or also involve fraud against 

other health care programs. Funding for these agencies to pursue fraud and 

abuse in federal health care programs is available from the Health Care 

Fraud and Abuse Control Program (HCFAC). Established in 1996 by 

Section 201 of the Health Insurance Portability and Accountability Act 

(HIPAA), it funds, consolidates, and strengthens federal fraud control 

efforts under the Department of Justice (DOJ) and HHS. This fund 

provided $154.3 million in fiscal year 2000 to the OIG and DOJ. Separately, 

the FBI received an additional $76 million in HIPAA-specified funding for 

fiscal year 2000. Medicare has been the major focus of this effort, but 

Medicaid has also benefited. In its joint report with DOJ on the HCFAC 

fund,7

 HHS reported returning nearly $45 million dollars to Medicaid as a 

result of these fraud control activities for fiscal years 1997 through 1999.

Medicaid Is at Risk for 

Improper Payments 

but the Amount Lost Is 

Unknown

With state and federal Medicaid payments projected to total $221.6 billion 

this fiscal year, even a small percentage loss due to improper payments 

represents a significant loss to taxpayers. The magnitude of improper 

payments throughout Medicaid is unknown, although a few states have 

attempted to determine the level by measuring the accuracy of their 

program’s payments. An even more difficult portion of improper payments 

to identify are those attributable to intentional fraud—recent cases in 

California and other states provide examples of losses due to fraudulent 

activities. 

Few States Have Measured 

Improper Payments

There are no reliable estimates of the extent of improper payments 

throughout the Medicaid program. However, at least three states have 

conducted studies to try to measure their program’s payment accuracy 

7

 For more detail, see The Department of Health and Human Services and the Department 

of Justice Health Care Fraud and Abuse Control Program Annual Report for FY 2000, 

January 2001.
Page 9 GAO-01-662 State Efforts to Control Improper Payments Vary

rates and pinpoint where payment vulnerability occurs, with varied 

success. 

• Illinois, in 1998, reported an estimated payment accuracy rate of

95.3 percent, with a margin of error of +/- 2.3 percentage points, of total 

dollars paid. The estimate was based on a sample of individual paid 

claims, for which the state reviewed medical records and interviewed 

patients to verify that services were rendered and medically necessary. 

As a result of this audit, the state identified key areas of weakness and 

targeted several areas needing improvement. For example, because the 

Illinois payment accuracy review indicated that nearly one-third of 

payments to nonemergency transportation providers were in error, the 

Illinois Medicaid program has taken a number of steps to improve the 

accuracy of payments to this provider type.

• Texas, also in 1998, reported an estimated payment accuracy rate of 

89.5 percent in the acute medical care fee-for-service portion of the 

program. However, in making that estimate, reviewers had trouble 

locating many patients and records due to statutorily imposed time 

constraints. Further work led the state, in 1999, to revise the estimate to 

between 93.2 and 94 percent. In developing the estimate, the state 

identified ways to reduce improper payments through expanded use of 

computerized fraud detection tools, such as matching Medicaid 

eligibility records with vital statistics databases to avoid payments for 

deceased beneficiaries. In January 2001, Texas reported that a more 

recent study estimated a payment accuracy rate of 92.8 percent in its 

acute medical care fee-for-service payments.

• Kansas, in 2000, reported an estimated payment accuracy rate of 

76 percent with a margin of error of +/- 9 percentage points. The 

estimate was based on a sample of individual paid claims, as in Illinois. 

The payment accuracy study recommended increased provider and 

consumer education, as well as improvements to computerized payment 

systems. In addition, Kansas officials undertook focused reviews of 

certain types of claims that were identified as vulnerable to abuse.

In their payment accuracy studies, these states commonly identified errors 

such as 

• missing or insufficient documentation to show whether the claim was 

appropriate;

• claims for treatments or services that were not medically necessary;

• claims that should have been coded for a lower reimbursement amount; 

and
Page 10 GAO-01-662 State Efforts to Control Improper Payments Vary

• claims for treatments or services that the program did not cover.

Because payment accuracy studies can provide useful guidance toward 

developing cost-effective measures to reduce losses, HCFA has sought 

HCFAC funding for grants to states for such efforts. HCFA also has 

established a workgroup to develop guiding principles, definitions, and 

reporting protocols for payment accuracy studies. HCFA and its workgroup 

of state officials are also trying to assess whether, given the many 

differences among the various Medicaid programs, a common methodology 

can be developed that would allow valid comparison of error rates across 

states.

Fraud and Abuse Represent 

a Portion of Improper 

Payments That Is Even 

More Difficult to Quantify

State payment accuracy studies may not fully identify improper payments 

that might be related to fraud, due primarily to fraud’s covert nature. Losses 

due to fraudulent billing and other related practices are difficult to quantify. 

However, these amounts can be significant, as was demonstrated recently 

in California’s program, in which millions of dollars were paid to numerous 

fraudulent providers. Since July 1999, a state-federal task force targeting 

questionable pharmaceutical and durable medical equipment suppliers for 

improper billing has charged 115 providers, wholesalers, and suppliers in 

cases involving about $58 million in fraud. At least 69 individuals have been 

convicted and paid about $20 million in restitution. An additional 300 

entities are being investigated for suspected fraud that could exceed 

$250 million. In one case, a family-run equipment company defrauded the 

program out of more than $9 million by submitting thousands of claims for 

equipment and supplies that were never delivered to patients. Investigators 

also found the following.

• “Bump and run” schemes in which individuals bill for a few months for 

services that are not rendered, stop billing before being detected, and 

then start again under a new name.

• Wholesalers who gave pharmacies and suppliers false invoices to 

substantiate false claims. 

• Use of “marketers” who recruit and pay beneficiaries $100 or more to 

lend their Medicaid identification cards for use in improper billing.

• Use of beneficiary identification numbers stolen from a hospital to bill 

for services not provided.

• Use of identification from providers who had retired or moved out of the 

state.

• Purchase of an established business in order to fraudulently bill under 

its name.
Page 11 GAO-01-662 State Efforts to Control Improper Payments Vary

Administrative weaknesses in the California Medicaid program made these 

activities easier to accomplish. For example, the program was issuing new 

billing numbers to individuals with demonstrated histories of current or 

past questionable billing practices. The program allowed providers to have 

multiple numbers, and applicants did not have to disclose past involvement 

in the program or any ongoing audits. As a result, in some cases, individuals 

who had past questionable billings applied for a new provider number and 

were reinstated with full billing privileges. In addition, applicants for a 

billing number for a business that needed a license—such as a pharmacy—

did not have to disclose that actual owners were not the licensed 

individuals. This allowed unlicensed individuals to pay medical 

professionals for the use of their licenses to obtain a provider number. 

California has taken steps to try to close such loopholes. 

In addition to single-state schemes, fraudulent activities sometimes involve 

large-scale multistate schemes. One case led to a $486 million civil 

settlement in early 2000—one of the largest health care settlements ever. It 

followed a 5-year investigation of a dialysis firm billing Medicare and 

several state Medicaid programs for intradialytic parenteral nutrition8

 that 

was not necessary or not provided in the quantity claimed. The company 

had an ownership interest in a laboratory that also double-billed for 

unnecessary tests and paid kickbacks to nephrologists and clinics that used 

the laboratory. In another case, a national laboratory headquartered in 

Michigan was ordered to pay $6.8 million in a multistate settlement for 

billing Medicare and five Medicaid programs for bogus medical tests.

Improper billing schemes such as the ones discussed above are the 

principal types of fraud cases developed by MFCUs, according to MFCU 

directors responding to our survey. Improper billing includes “upcoding,” in 

which the provider misrepresents treatment provided and bills for a more 

costly procedure; “ghost” or “phantom” billing, in which a provider bills for 

services never provided; and delivering more services than are either 

necessary or appropriate for the patient’s diagnosis. However, other types 

of fraud occur, including improper business practices—such as kickbacks 

for steering services to a provider—or misrepresentation of qualifications, 

such as an individual falsely claiming to be a physician. MFCU directors 

8

 Parenteral nutrition is a liquid food mixture given intravenously. Intradialytic parenteral 

nutrition is a form of parenteral nutritional therapy that is provided to a dialysis patient 

during the hemodialysis procedure. The nutrients are infused into the blood returning from 

the dialyzer to the patient.
Page 12 GAO-01-662 State Efforts to Control Improper Payments Vary

have found a wide variety of providers involved in fraud, including 

physicians, dentists, pharmacies, durable medical equipment providers, 

and transportation providers. Beneficiaries also engage in fraud, either by 

misrepresenting assets to become eligible for the program, lending or 

selling their identification numbers for another’s use, or obtaining products 

such as pharmaceuticals for resale.

Fraud is not merely a financial concern—it can also pose a risk to the 

physical health of beneficiaries. For example, providers have drawn blood 

unnecessarily in order to better substantiate billing for tests that were not 

performed, and dentists have conducted extensive unnecessary dental 

work on beneficiaries in order to bill the program.

States’ Efforts to 

Control Improper 

Payments Are Uneven

The amount of resources and effort that state Medicaid programs devote to 

protecting the integrity of their programs varies. Some states have focused 

their efforts on preventing improper payments by strengthening their 

prepayment claims checking. States’ abilities to detect improper payments 

also vary, in part because some lack sophisticated information technology 

that can help them analyze and track instances of inappropriate billing. 

Strong leadership in certain states is resulting in stricter laws and 

restructured operations to better ensure that the Medicaid program pays 

claims appropriately. 
Page 13 GAO-01-662 State Efforts to Control Improper Payments Vary

Resources Devoted to 

Program Protection Efforts 

Are Generally Modest

Resources for addressing improper Medicaid payments are generally 

modest. In our survey, 25 state Medicaid agencies reported spending onetenth of 1 percent or less of program expenditures on these efforts. Others, 

such as California, spend about one-fourth of 1 percent of program 

expenditures on preventing and detecting improper payments. However, 

this is not unique to Medicaid. As we recently reported, the Medicare 

program devotes little more than one-fourth of 1 percent of its program 

expenditures to safeguarding payments. As a result, we recommended that 

the Congress increase funding for these important activities.9

All states forgo some of the federal funds available to help their MFCUs 

investigate and prosecute fraud. MFCUs, once federally certified and in 

operation for 3 years, are eligible for 75 cents in federal funds for every 

dollar they spend, up to a maximum federal contribution of the greater of 

$125,000 per quarter or one-fourth of 1 percent of the state Medicaid 

program’s total expenditures in the previous quarter. However, only 10 

percent of MFCUs receive enough state funding to obtain even half of the 

allowed federal match. States ranged from having enough state funding to 

obtain less than 7 percent to having up to 86 percent of their allowed 

federal match.

Many Medicaid state agency fraud control and MFCU officials reported 

gaps in staff, staff training, or technology acquisition. Many state officials 

said that they wanted to increase their workforce by hiring staff with 

specific skills, such as auditing, computer analysis, and clinical knowledge, 

and adding the technology to analyze large amounts of claims data. For 

example, in our survey, only 14 of 53 state agencies reported that they have 

statisticians to help collect, organize, and analyze data to spot improper 

billing practices. Further, although information technology to store and 

analyze large amounts of data easily has improved significantly in recent 

years, some states reported using very old information technology to 

assess program billing. Four state Medicaid agencies reported using 

software that is at least 15 years old to assess claims before payment, and 

three state Medicaid agencies reported using software at least that old to 

analyze claims after payment to ensure the billings were proper. 

9 Medicare: HCFA Could Do More to Identify and Collect Overpayments

(GAO/HEHS/AIMD-00-304, Sept. 7, 2000).
Page 14 GAO-01-662 State Efforts to Control Improper Payments Vary

While about half of the state agencies and a third of MFCUs reported that 

their program integrity unit budgets were steady or declining in the 

previous 3 years,10 we did learn that other states showed a more promising 

trend. In our survey, 8 state Medicaid agencies and 4 MFCUs reported that 

their budgets for program integrity activities had increased significantly, 

while another 15 state agencies and 27 MFCUs reported that their budgets 

had increased somewhat. As a result, they reported that they were able to 

hire additional staff and increase program safeguards. For example, 

Connecticut’s increased funding allowed the state Medicaid agency to hire 

additional staff to increase audits and site visits to providers. Georgia’s 

state Medicaid agency also received increased funding, which allowed it to 

increase staffing levels and to make a number of additional improvements, 

such as opening an office to cover the southern part of the state. 

Prevention Efforts 

Emphasized in Certain 

States

Preventing improper payments can be a cost-effective way to protect 

program dollars. Prevention can help avoid what is known as “pay and 

chase” in which efforts must be made to detect and attempt to recover 

inappropriate payments after they have been made. Such postpayment 

efforts are often costly and typically recover only a small fraction of the 

identified misspent funds, although they can identify parts of the program 

where controls, such as on payments, may need strengthening. States use a 

variety of preventive approaches—such as prepayment computer “edits,”

manual reviews, provider education, and thoroughly checking the 

credentials of individuals applying to be program providers—and the scope 

and effectiveness of these activities varies among the states.

States Use Prepayment Edits and 

Reviews to Help Prevent 

Improper Payments 

All 41 of the state Medicaid agencies responding to our survey about 

prepayment claims review reported that they use such reviews to varying 

degrees. These include automated computer “edits” and manual reviews to 

help ensure payment accuracy. Typically, their edits check the 

mathematical accuracy of claims, the correct use of payment codes, and 

patients’ Medicaid eligibility. Such reviews help ensure that the services 

listed on the claim are covered, medically necessary, and paid in 

accordance with state and federal requirements. For example, an edit can 

be used to deny a claim for obstetrical care for a male beneficiary. Some 

states have thousands of such edits in their payment systems that identify 

10 This was current as of the dates of their completed surveys, which were generally 

completed by March 2000.
Page 15 GAO-01-662 State Efforts to Control Improper Payments Vary

duplicate claims, invalid dates, missing codes, or claims for services that 

conflict with previous care provided to the beneficiary. 

Although widely used, recent experiences from several states that are 

aggressively working to detect overpayments suggest that their existing 

prepayment edits have not been catching various types of improper 

payments. A few states have hired a private contractor to help analyze 

claims data to uncover overpayments. For example, with the aid of this 

contractor, Florida learned that it was paying some pharmacies 10 times 

more than it should for asthma inhalant because its edit did not stop claims 

listing the amount in unit doses rather than in grams, as required. Following 

this contractor’s overpayment review, Kentucky made edit changes it 

estimates will prevent $2 million in improper payments. This same 

contractor assisted Washington in making edit and other policy changes 

that are anticipated to save $4 million. 

Investigations in other states have also identified the need for new and 

revised edits. Some MFCU officials reported that they had advised their 

state agencies to strengthen certain edits based on the cases they had 

investigated. For example, the North Carolina MFCU suggested an edit to 

its state agency to identify and bundle laboratory services that should not 

have been billed separately.11 Also, the Louisiana MFCU reported that it had 

recommended that its Medicaid agency develop an edit to prevent 

duplicate payment of children’s medical screenings and physician visits and 

to ensure that physicians and certified nurse practitioners working 

together do not send in duplicate claims for the same services. 

Manual reviews before claims are paid can further help prevent improper 

payments, but they are resource-intensive, thus limiting the number of such 

reviews that can be done cost effectively. Manual reviews involve a trained 

specialist—such as a nurse—examining documentation submitted with a 

claim and possibly requesting additional information from providers, 

beneficiaries, and other related parties. Because of the cost and time 

involved, manual prepayment review is often targeted to certain providers. 

For example, if a provider’s claims pattern is substantially different from 

his or her peers, or if there is a sudden increase in claims volume for a 

given provider, or if there is substantial evidence of abuse or wrongdoing, 

11 From its work with several state Medicaid programs, one contractor estimates that use of 

the prepayment edits to address laboratory services unbundling would allow a Medicaid 

program with 800,000 enrollees to avoid costs of about $420,000 annually.
Page 16 GAO-01-662 State Efforts to Control Improper Payments Vary

payment may be withheld until a reviewer determines whether the 

aberrations or increases are appropriate and can be substantiated. Table 1 

shows examples of prepayment reviews currently being used by some 

states.

Table 1: Examples of Prepayment Reviews

Source: GAO.

Educating Providers Is Another 

Approach Used by States to 

Prevent Billing Errors 

Because billing mistakes can be inadvertent, educating providers on how to 

comply with program rules and file claims correctly can often prevent 

errors. For example, in our survey, almost all state Medicaid agencies 

reported initiating meetings with providers, usually to discuss coding and 

policy changes. Seventeen state Medicaid agencies reported that their staff 

met with providers to discuss safeguarding the confidentiality of provider 

and beneficiary Medicaid numbers. In addition, 17 state Medicaid programs 

alerted providers to prevalent fraud schemes.12 State Medicaid agencies 

also reported conveying information on proper billing procedures to 

providers through a variety of other means, such as letters, bulletins, 

Internet sites, and professional meetings. 

Action State efforts

Focused review of certain 

providers

California bars providers with previously questionable billing patterns from submitting claims 

electronically and performs a manual review before making payment. This saved more than

$17 million in fiscal 1998 and 1999.

Review checks prior to 

disbursement

California analyzes and refers questionable claims to audit and on-site review before payments are 

made.

New Jersey uses off-the-shelf software to analyze claims for aberrant patterns before payments are 

made.

Point of sale review system Washington uses an on-line drug claims management system to finalize pharmaceutical claims 

when the pharmacist fills the beneficiary’s prescription. The system screens for duplicate claims and 

drugs requiring prior authorization, and provides alerts to such factors as insufficient or excessive 

dosages and interactions with other drugs. If appropriate, it approves payment.

12 Eleven states reported both meeting with providers to discuss safeguarding provider and 

beneficiary numbers and alerting providers to fraud schemes.
Page 17 GAO-01-662 State Efforts to Control Improper Payments Vary

Provider Enrollment Screening 

Processes Are Often Limited

Some states use more extensive provider enrollment measures to help 

prevent dishonest providers from entering the Medicaid program and to 

ensure better control over provider billing numbers. While all states collect 

some basic information on providers, states have considerable latitude in 

how they structure their provider enrollment processes. In addition, states 

are required to check if those providers who should be licensed are 

licensed and whether the provider has been excluded from participating in 

other federal health programs. Checking a provider’s criminal record and 

business site has been found to be important by states such as Florida to 

ensure that providers entering the program are legitimate. Nine of the 

states responding to our survey reported having a provider enrollment 

process that included all four of these checks—licensure, excluded 

provider status, criminal record, and business location verification—in 

their provider enrollment processes. Table 2 provides examples of these 

activities.13

Table 2: Selected State Efforts to Ensure Legitimacy of Providers

Source: GAO.

13 For more detail, see Medicaid: HCFA and States Could Work Together to Better Ensure 

the Integrity of Providers (GAO/T-HEHS-00-159, July 18, 2000). 

Action State efforts

Enhanced background checks Florida requires providers such as physicians, pharmacists, dentists, and others who are not 

employees of institutions like hospitals, to undergo fingerprinting and criminal background screening. 

All officers, directors, managers, and owners of 5 percent or more of a provider business must be 

screened. Fingerprints are checked with both state and federal law enforcement agencies.

Strengthened provider 

agreements

Connecticut, Florida, Georgia, and Texas revised provider agreements so they can terminate 

providers from the program without cause, allowing for more expeditious removal of providers who 

are billing inappropriately.

Reenrollment under tightened 

standards

Florida and Texas tightened enrollment standards—through enhanced background checks and 

strengthened provider agreements as well as other methods—and has required existing providers to 

reenroll under the new standards. 

Special procedures for select 

providers 

New Jersey has more stringent enrollment procedures for provider categories with higher risk of 

payment problems, such as pharmacies, independent laboratories, and transportation companies.

Preenrollment site visits Some states—including Florida, Georgia, and New Jersey—conduct preenrollment site visits, 

usually to higher-risk provider types, such as pharmacies and durable medical equipment suppliers.
Page 18 GAO-01-662 State Efforts to Control Improper Payments Vary

Most Medicaid agencies reported checking whether applicants whose 

practice requires licensure had a valid license and whether they had been 

excluded from participating in other federal health programs.14 However, 

less than half of the states responding to our survey reported checking 

whether applicants have criminal records. While conducting such checks 

on a targeted basis might be useful in helping to protect the program, they 

can be time-consuming and difficult to perform, according to states that 

have attempted them. This is due in part to often inaccurate and 

incomplete statewide databases containing records on criminal 

convictions. Nineteen of 52 state Medicaid programs reported that they 

conducted site visits to determine if an applicant had a bona fide operation. 

Of those that do conduct site visits, most limit them to particular types of 

providers they believe have a greater likelihood of abusing the program. 

For example, Kansas Medicaid officials reported that, based on a risk 

analysis, there is a greater risk that durable medical equipment suppliers 

are not legitimate providers and, therefore, the Medicaid program 

conducted site visits of these applicants. 

Many states allow providers, once enrolled, to bill the program indefinitely 

without updating information about their status. Poor control over 

provider billing numbers can make Medicaid programs more vulnerable to 

improper payment. In our survey, 26 states reported allowing providers to 

continue to bill indefinitely while other states had an enrollment time limit, 

which often varied by provider type. However, 33 states reported that they 

cancel inactive billing numbers—generally for providers who have not 

billed the program for more than 1 to 3 years. Such efforts can be 

important, as questionable providers have been known to keep multiple 

billing numbers “in reserve” in case their primary billing number is 

suspended. In California, some individuals falsely billed the Medicaid 

program using the numbers of retired practitioners. 

States’ Postpayment 

Detection Activities and 

Capabilities Differ 

Just as states are uneven in their efforts to prevent improper payments, 

they also vary in their ability to detect improperly paid claims. Because 

prepayment reviews cannot catch all erroneous claims, Medicaid programs 

must have systems in place to retrospectively review paid claims. While 

some states are using software from the early 1980s to analyze paid claims, 

14 These two checks are related to federal requirements that states use only qualified 

providers and that the federal government not pay for medical services provided by 

excluded providers.
Page 19 GAO-01-662 State Efforts to Control Improper Payments Vary

other states—such as Texas and Washington—are implementing state-ofthe-art systems to improve their ability to detect and investigate potential 

improper payments. 

Each Medicaid state agency is required to have an automated claims 

processing and retrieval system that can be used to detect postpayment 

errors. These automated claims processing systems, known as Medicaid 

Management Information Systems (MMIS), contain a Surveillance and 

Utilization Review Subsystem (SURS) that state agency officials can use to 

identify providers with aberrant billing patterns. For example, these might 

include providers with a large increase in Medicaid activity or with billing 

patterns that are significantly different from their peers and that result in 

enhanced reimbursement. Almost all states reported conducting focused 

reviews or investigations when a provider’s billing was aberrant to 

determine if any improper payments had been made. State Medicaid 

officials told us that when their state Medicaid agency discovers that 

improper payments have been made, it takes action to recover the 

improper payment, and, if warranted, refers the provider to its state MFCU 

for possible criminal investigation and prosecution. Providers who have 

been identified as having significant billing problems generally receive 

continued scrutiny if they remain in the program. 

The systems used to uncover such aberrant billing—MMIS and SURS—

were developed in the early 1980s when computer algorithms to identify 

potentially inappropriate claims were less sophisticated and analysis 

required more programming skill. Newer systems allow staff to use 

desktop computers to directly query large databases of claim, provider, and 

beneficiary information, without requiring the assistance of data 

processing professionals. Several state officials reported that buying or 

leasing these upgraded computer systems and hiring staff skilled in their 

use would be their top priority if they had more funding. Other states are 

already purchasing or leasing such systems, as the following examples 

illustrate.

• Texas is using private contractors to design, develop, install, and train 

staff to use a state-of-the-art system intended to integrate detection and 

investigation capabilities. It is intended to allow the state to uncover 

potentially problematic payment patterns that old SURS profiling 

methodologies would have missed. It also includes a “neural network”

that is intended to “learn” from the data it analyzes and adjust its 

algorithms to identify previously overlooked aberrant payment patterns. 

The system is further enhanced with modules designed to help develop 
Page 20 GAO-01-662 State Efforts to Control Improper Payments Vary

cases for prosecution. The first 2 years of the project cost Texas

$5.8 million, but according to state Medicaid officials, Texas had already 

collected $2.2 million in overpayments in the system’s first year of 

operation.

• Kentucky has hired a private contractor to use an advanced computer 

system to analyze claims payment data. It is paying that contractor 

through contingency fees based on overpayment collections related to 

these efforts. Using claims data from January 1995 through June 1998, 

the contractor identified $137 million in overpayments, of which the 

state has collected between $4 and $5 million. That compares to 

previous recovery efforts by the state that, on average, netted about 

$75,000 a year.

• Under its new Payment Integrity Program, Washington is using a private 

contractor to design, develop, install, and train staff to analyze data on 

an advanced computer system. The system improves access to data and 

includes fraud and abuse identification software with prepackaged 

algorithms to analyze the data and identify overpayments, as well as 

develop leads that would need further investigation. It also allows 

agency staff to develop algorithms and perform their own online 

reviews. Since the program started in June 1999, the contractor and 

state agency staff have identified overpayments totaling more than 

$2.95 million. 

Some states have developed detection strategies that combine the use of 

advanced technology with special investigative protocols. For example, 

New Jersey conducted special audits of transportation services, crossmatching data on transportation claims to beneficiary medical 

appointments, and sometimes contacting providers to confirm that the 

beneficiary actually arrived and was treated. Also, using billing trend 

reports, New Jersey audited pharmacies with abnormally large numbers of 

claims for a newly covered high-priced drug, and then audited the 

pharmacies’ purchases from wholesalers, thus discovering that these 

pharmacies were billing for a larger amount of this drug than had been 

shipped to them. 

Beneficiaries can also play a role in helping state Medicaid agencies detect 

improper payments. Forty-two states reported having hotlines that 

beneficiaries could use to report suspected improprieties. Fourteen states 

reported alerting beneficiaries to certain types of fraudulent schemes. 

Twenty-seven reported taking other types of actions. For example, some 

states commented that they mail explanation-of-benefit statements to 

beneficiaries to increase awareness of the services being billed in their 
Page 21 GAO-01-662 State Efforts to Control Improper Payments Vary

names, so that if beneficiaries are not receiving billed services, they will be 

able to inform the state.

Fraud Investigation and 

Prosecution Is a Shared 

Responsibility

State Medicaid agencies are primarily responsible for conducting program 

integrity activities, but they share this responsibility with other agencies. 

For example, they are required to refer potential fraud cases to the MFCUs 

for investigation and prosecution. Cases that may involve improper billing 

of Medicare or private insurers as well as Medicaid may also require 

investigation by the OIG or the FBI, and may involve prosecution by DOJ. 

In addition, other state agencies, such as those responsible for licensure, 

can become involved in an investigative effort.

Federal regulations require Medicaid agencies and MFCUs to have an 

agreement to cooperate; however, the actual level of cooperation between 

state Medicaid agencies and MFCUs varies. State Medicaid agencies are 

required to refer suspected fraud cases to MFCUs for investigation and 

possible prosecution, provide needed records to the MFCUs, and enter into 

a Memorandum of Understanding establishing procedures for sharing 

information and referring cases.

In our survey, MFCUs generally reported that about one-third of the cases 

that they open are referred by their state Medicaid agency. The most 

common criterion reported by state agencies for referring cases to MFCUs 

was a belief of an intent to commit an impropriety on the part of a provider. 

The number of cases state agencies reported referring in their previous 

fiscal year varied substantially. This is not surprising because Medicaid 

agencies differ in size, organization, scope of services, and beneficiary 

eligibility requirements. They also operate in different states, each of which 

has its own legal system and business climate, differences that can affect 

the number and quality of fraud referrals made by the state agency. 

In addition to differences in referral patterns, the reported level of 

interaction between states’ Medicaid agencies and MFCUs also varied. For 

example, meetings between the two organizations to discuss pending cases 

are important for preventing agency actions that could compromise a fraud 

unit investigation or for alerting MFCU officials to cases the state agency is 

developing. Most state Medicaid agencies reported having joint meetings at 

least six times a year; however, eight states reported that they conduct such 

meetings only one to three times each year.
Page 22 GAO-01-662 State Efforts to Control Improper Payments Vary

New Jersey is a state where the Medicaid agency and MFCU have worked 

together to further each agency’s efforts through close cooperation. 

Medicaid agency staffers are sometimes detailed to the MFCU to continue 

working cases they have developed. The state agency and MFCU hold joint 

meetings monthly to discuss developing cases, case progress, and to plan 

strategies for investigations, prosecutions, and administrative actions. The 

MFCU tries to use search warrants and other methods to gather evidence in 

suspected fraud cases so that information can be shared with the Medicaid 

agency. This is in contrast to the use of another MFCU tool—grand jury 

investigations—which have secrecy rules to prevent disclosure of 

evidence. This level of cooperation allows the state Medicaid agency to 

take immediate administrative action to stop improper payments without 

disrupting criminal case development. The MFCU also works to have 

defendants who are pleading guilty sign a consent order debarring or 

disqualifying them from participating in Medicaid,15 eliminating the need 

for state agency debarment or disqualification proceedings. In contrast to 

New Jersey, in another state, the director of an MFCU reported to us that 

MFCU investigators were denied access to state Medicaid agency meetings, 

which made it more difficult for both agencies to develop potential fraud 

cases. 

State Medicaid and MFCU officials told us that close collaboration among 

state agencies or state and federal law enforcement agencies was 

particularly important for certain types of cases. In the handful of states 

whose MFCUs lack authority to serve warrants or prosecute cases, MFCUs 

must work with other agencies to ensure that these activities take place. 

When dealing with individuals whose fraudulent or abusive activities cross 

state lines, one MFCU may need to work with other states’ agencies or with 

federal officials. Some cases involve efforts to defraud both Medicare and 

Medicaid, which can require an MFCU to work with the OIG or FBI. Such 

interagency collaboration has been fostered by the HCFAC program, which 

has increased funding for federal health care law enforcement efforts. 

Implementing section 407 of the Ticket to Work and Work Incentives 

Improvement Act of 1999, which authorized MFCUs to address cases that 

involve Medicare as well as Medicaid fraud, will also likely necessitate 

enhanced cooperation between MFCUs and federal law enforcement 

officials. 

15 Debarred providers cannot participate in New Jersey’s Medicaid program for a period 

generally not to exceed 5 years; providers disqualified for an indefinite period of time 

cannot apply for reinstatement for a minimum of 8 years.
Page 23 GAO-01-662 State Efforts to Control Improper Payments Vary

Nearly all MFCUs responding to our survey reported that they have 

conducted joint investigations with other organizations in the last 3 years. 

Most commonly, this involved conducting joint investigations with their 

state agency, state licensing boards, the OIG, FBI, or a federal task force. 

Cooperative efforts have led to joint prosecutions. Twenty-seven states 

reported jointly prosecuting criminal cases with federal attorneys in the 

previous 3 years—about half doing so at least four times.

Such cooperation can augment state officials’ activities. This was 

demonstrated in California, where members of a task force created by the 

FBI, the U.S. Attorney’s office, the California State Controller’s office, the 

Attorney General’s office, and the state Department of Health uncovered 

numerous fraud and abuse cases in the Los Angeles area. The Controller’s 

staff audited suppliers and referred to the FBI those with insufficient 

inventories or purchase records to substantiate claims volume. The FBI 

investigated further and made referrals to the U.S. Attorney. Meanwhile, 

the governor created a fraud prevention bureau within the state agency that 

worked closely with on-site FBI agents to investigate provider operations. 

Once a case was developed, the FBI referred it to the MFCU and U.S. 

Attorney’s office for prosecution.

Some States Have Taken 

Additional Steps to Enhance 

Medicaid Program Integrity

During our review, we found that several states—including Georgia, New 

Jersey, North Carolina, and Texas—have enacted stricter rules or 

restructured operations to better ensure the integrity of their Medicaid 

programs. A few examples of their accomplishments follow.
Page 24 GAO-01-662 State Efforts to Control Improper Payments Vary

Legislative changes: Some states are enacting health-care-specific 

criminal and civil legislation—often modeled after federal law. With these 

statutes, prosecutors no longer must develop cases based on more generic 

mail fraud, racketeering, theft, or conspiracy statutes. For example, New 

Jersey enacted the Health Care Claims Fraud Act, which creates the 

specific crime of health care claims fraud and provides for 10-year prison 

sentences, fines of up to five times the amount gained through fraud, and 

professional license revocation.16 Meanwhile, civil statutes—such as one 

enacted in North Carolina and other states authorizing action against 

providers who “knowingly” submit false Medicaid claims for payment—

allow prosecutors to take advantage of less stringent evidentiary 

requirements than those required by criminal statutes.17

Restructuring operations: Some states are enhancing their program 

safeguard operations through restructuring. Texas created an Office of 

Investigations and Enforcement in 1997 within the state Medicaid agency, 

giving it power to take administrative actions against providers. These 

actions cannot be appealed when the Office has tangible evidence of 

potential fraud, abuse, or waste. It also can impose sanctions and recover 

improper payments. Meanwhile, Georgia established an MFCU in 1995 that 

differs from most in that it includes auditors from the state Department of 

Audits, investigators from the state Bureau of Investigation, and 

prosecutors from the state Attorney General’s office. They work together 

as a discreet entity under memoranda of understanding signed by the three 

agencies.

Current Federal Role 

Focuses on Technical 

Assistance

HCFA and the OIG—the agencies that are responsible for the Medicaid 

program at the federal level—are taking steps to promote effective 

Medicaid program integrity by providing technical help to the states to 

facilitate states’ efforts. These federal agencies also conduct some 

information gathering on state activities in order to guide state efforts. 

Many state agency and MFCU officials reported that their agencies had 

benefited greatly from federal technical assistance, guidance, and training, 

and would welcome more assistance. 

16 N.J. Stat. Ann. 2C§21-4.3, N.J. Stat. Ann. 2C§51-5.a.(1998).

17 North Carolina’s Medical Assistance Provider False Claims Act was signed into law by the 

governor July 25, 1997, (N.C. Gen. Stat. §108A-70.10 et seq.).
Page 25 GAO-01-662 State Efforts to Control Improper Payments Vary

HCFA Has Increased Efforts 

to Facilitate State Program 

Integrity Activities 

In 1997, HCFA began a new approach as a facilitator, enabler, and catalyst 

of states’ program integrity efforts. To do so, HCFA established the 

National Medicaid Fraud and Abuse Initiative, led by staff from HCFA’s 

southern consortium18 and headquarters, with designated, part-time 

coordinators for the Initiative in each of HCFA’s 10 regional offices. The 

strategy for the Initiative was to partner with the states and have state 

representatives work with HCFA staff to set the agenda and goals for the 

effort. The Initiative provides networking, information sharing, and training 

opportunities for state agencies and their program integrity partners. 

Participants in early Initiative meetings identified 10 major focus areas—

including payment accuracy measurement, managed care, and information 

technology. Workgroups are developing recommendations in each area. 

The Initiative also includes the Medicaid Fraud and Abuse Control 

Technical Advisory Group, consisting of HCFA and state officials, which 

serves as an ongoing forum for

• sharing issues, solutions, resources, and expertise among states;

• advising HCFA on policies, procedures, and program development; and

• making recommendations on federal policy and legislative changes.

The Initiative has resulted in several tangible products and events, 

including a fraud statute Web site, managed care guidelines, seminars on 

innovations and obstacles in safeguarding Medicaid, and a technology 

conference. These efforts are described in table 3. 

18This comprises the Atlanta and Dallas regional offices.
Page 26 GAO-01-662 State Efforts to Control Improper Payments Vary

Table 3: National Medicaid Fraud and Abuse Initiative Activities

Source: GAO. 

State Medicaid officials that we spoke with reported that Initiative 

activities are helping them with their program safeguard efforts by 

providing important networking, information sharing, and training 

opportunities. Our survey results indicated that staff from 41 state 

Medicaid agencies attended Initiative-sponsored training last year, and 

more than 40 percent of state agencies had staff serve on Initiative panels. 

In fact, nearly 75 percent of state Medicaid agency survey respondents 

would like more of the types of assistance HCFA has been providing, 

including additional

• training;

• technical assistance on use of technology;

• guidance on managed care fraud detection and prevention; and

• information on innovative practices in other states.

State fraud statutes Web site This Internet site—at http://fightfraud.hcfa.gov/mfs—includes a database of state statutes used to 

combat program fraud and abuse that other states can use as models.

Managed care guidelines HCFA issued Guidelines for Addressing Fraud and Abuse in Medicaid Managed Care, which 

includes information on how to identify managed care fraud and abuse, and outlines key 

components of an effective managed care fraud and abuse control program. 

Seminars on innovations and 

obstacles

HCFA sponsored four regional “executive seminars,” attended by program executives from 49 states 

and other program integrity partners, to discuss innovations and obstacles in safeguarding Medicaid. 

A report on the findings was published in 1999, and a follow-up “Commitment Conference” was held 

in the Washington, D. C. area in 2000.

Technology conference HCFA, with DOJ, cosponsored a conference, Combating Health Care Fraud & Abuse: Technologies 

and Approaches for the 21st Century, to advance understanding of how technological tools such as 

data mining and neural networks can help detect fraudulent or abusive payments.
Page 27 GAO-01-662 State Efforts to Control Improper Payments Vary

According to HCFA and some state officials, this approach has been more 

effective than previous efforts to guide state activities. Prior to 1997, HCFA 

reviewed information systems—including state SURS unit activities—

through formal “systems performance reviews” of program controls. These 

controls included those related to payment and program safeguard 

activities. HCFA could impose penalties on states that failed these reviews, 

and some HCFA and state officials told us that states found the reviews 

burdensome. Section 4753 of the Balanced Budget Act of 199719 repealed 

HCFA’s authority to conduct such reviews. State and federal officials agree 

that federal attention to state program protection efforts declined after 

these mandatory reviews were eliminated. HCFA officials told us that staff 

in HCFA’s regional offices continued to provide some oversight of state 

efforts, but not in a coordinated way. 

However, without a regular review of state activities to address improper 

payments, HCFA staff had little information with which to guide states 

where more effective efforts were needed. To get a more comprehensive 

and systematic view of state antifraud efforts, the regional Initiative 

coordinators conducted structured site reviews of certain program 

safeguards in eight states in fiscal year 2000. These reviews examined how 

state Medicaid agencies identify and address potential fraud or abuse, 

whether state agencies are complying with appropriate laws and 

regulations—such as how they check to ensure that only qualified 

providers participate in the program—and potential areas for 

improvement. Reviews in another eight states are being conducted in fiscal 

year 2001. However, these reviews, as with all of HCFA’s Initiative 

endeavors, focus only on state efforts to address potential fraud and abuse; 

they do not address all of the ways states may be trying to prevent or detect 

improper payments, and whether these efforts could be improved. 

OIG Reviews MFCUs’

Reported Activities and 

Provides Training 

Opportunities 

The OIG initially certifies, and each year recertifies, that MFCUs are 

complying with federal requirements and are eligible for federal funding.20

The OIG determines whether an MCFU should be recertified primarily 

based on reports the MFCUs submit on their activities. The OIG assesses 

these reports to determine whether each unit has used federal funds 

19 P. L. 105-33.

20 Initially, HCFA had responsibility for certifying MFCUs and monitoring their activities. In 

1979, the responsibility was transferred to the OIG because MFCU activities are more 

closely related to the OIG’s investigative functions.
Page 28 GAO-01-662 State Efforts to Control Improper Payments Vary

effectively and has met a set of 12 performance standards. These standards, 

which the OIG developed in conjunction with the National Association of 

Medicaid Fraud Control Units, cover areas such as staffing, training, types 

of cases (whether they constitute potential fraud or physical abuse of 

beneficiaries), case flow, and monitoring of case outcomes. For example, in 

the area of staffing, the OIG checks whether an MFCU has the minimum 

number of staff required. This includes at least one attorney experienced in 

investigating criminal cases or civil fraud, one experienced auditor capable 

of supervising financial records reviews and assisting in fraud 

investigations, and one senior investigator with substantial experience in 

conducting and supervising criminal investigations.

The OIG may also conduct site visits to observe MFCU operations or 

provide guidance. Eight MFCUs received such visits in fiscal year 1999. OIG 

officials said they rarely decertified MFCUs. If decertified, an MFCU can 

reapply for federal certification when officials believe it will meet the 

required standards. Such is the case with the District of Columbia’s MFCU, 

which was decertified in 1983 for “lack of productivity.” It was recertified 

in 2000.

The MFCUs generally reported being satisfied with OIG oversight and 

guidance, but indicated several areas where the OIG could provide more 

assistance—especially by providing more training. More than 45 percent of 

MFCUs reported that their staff attended OIG-sponsored training in the 

past fiscal year. MFCUs also would like the OIG to do the following.

• MFCU officials wanted the OIG to provide more training and assistance 

in their new authority to address cases that involve both Medicare and 

Medicaid fraud. Survey respondents were particularly interested in 

learning more about Medicare program rules, how Medicare claims 

processing contractors operate, and recent Medicare fraud schemes. 

They also wanted help in working with HCFA and Medicare claims 

processing contractors to get timely, online access to Medicare claims 

data. The OIG has begun to provide training on Medicare related issues.

• MFCUs would like the OIG to increase the number of OIG staff in 

regions and local areas to increase their participation in joint 

investigations.

Concluding 

Observations

Medicaid remains vulnerable to payment error and, while most states are 

taking steps to address their programs’ vulnerabilities, their efforts are 

uneven. Some states have worked diligently to prevent or detect improper 
Page 29 GAO-01-662 State Efforts to Control Improper Payments Vary

payments, while others have not been as proactive. The federal government 

has provided technical assistance and a forum for information exchange 

for the states, as well as some guidance. Given that states are responsible 

for administering Medicaid and investigating and prosecuting any 

fraudulent activities, states must set their own course to ensure the 

integrity of their Medicaid programs. But the federal government has a 

responsibility to actively partner with states to ensure that they succeed. In 

recent years, HCFA and other federal investigative organizations have 

played a more active role as partners in this endeavor.

Agency Comments and 

Our Evaluation

We provided draft copies of this report to HHS for comment. HHS officials 

provided written comments (see appendix III). We also provided excerpts 

from the draft report that dealt with state activities to states that we had 

visited. The reviewing officials suggested some technical corrections, 

which we incorporated into the report where appropriate.

In its written comments, HHS provided information on the Department’s 

most recent efforts to prevent improper payments and to combat fraud and 

abuse in the Medicaid program. Among other activities, these efforts 

include a resource guide for states, a summary report of the joint HHS-DOJ 

technology conference, and a data exchange project between Medicaid and 

Medicare. HHS highlighted efforts to review program integrity activities in 

states and indicated that it intends to broaden the scope of the review in 

future fiscal years. Both the OIG and HCFA have developed training for 

state officials, including training for MFCU officials on Medicare. Finally, 

HHS reported that it has established a Web site at 

www.hcfa.gov/medicaid/fraud to provide states with additional technical 

assistance and guidance in their efforts to prevent and detect improper 

payments and to address fraud and abuse. 

As agreed with your office, unless you announce this report’s contents 

earlier, we plan no further distribution until 30 days after the issue date. We 

will then send copies to the Honorable Tommy G. Thompson, Secretary of 

HHS; the Honorable Thomas Scully, Administrator of HCFA; Mr. Michael 

Mangano, Acting Inspector General; and other interested parties. We will 

make copies available to others upon request. If you or your staff have any 

questions about this report, please call me at (312) 220-7600 or Sheila K. 
Page 30 GAO-01-662 State Efforts to Control Improper Payments Vary

Avruch at (202) 512-7277. Other major contributors to this report were 

Barrett Bader, Bonnie Brown, Joel Grossman, and Elsie Picyk. 

Sincerely yours, 

Leslie G. Aronovitz

Director, Health Care—Program

Administration and Integrity Issues 
Page 31 GAO-01-662 State Efforts to Control Improper Payments Vary
Page 32 GAO-01-662 State Efforts to Control Improper Payments Vary

Appendix I

Scope and Methodology ApApenednxidexiIs

As we developed our work on this report, we focused on the risk of 

improper Medicaid fee-for-service payments, states’ efforts to address 

improper payments—including efforts to investigate and prosecute fraud—

and the guidance and oversight the states are receiving from federal 

oversight agencies. To do this work, we used information from our surveys, 

state visits, interviews, and analyses of agency program integrity 

documents and literature.

To address the risk of improper fee-for-service payments, we reviewed 

studies that Illinois, Kansas, and Texas have conducted to measure 

payment accuracy in their Medicaid programs, and we interviewed state 

officials on the studies’ methodologies, findings, and limitations. To gain 

information on the types of improper billing schemes and other types of 

fraud cases, we interviewed state officials and reviewed state and HCFA 

documents. We also used results from our state survey, described below.

To find out about state activities and federal oversight from the states’

perspective, we analyzed the results of surveys we sent to the 56 state 

Medicaid agencies and the 47 federally certified MFCUs then in existence. 

Fifty-three of the 56 state Medicaid agencies and 46 of the 47 MFCUs 

responded to our surveys. An additional MFCU in the District of Columbia, 

which had been decertified in 1983, was recertified in March 2000 after we 

sent out our survey. To facilitate their answering our questionnaire, we 

asked respondents, in several questions on the surveys, to base their 

answers on data from their most recently completed fiscal years, whether 

state or federal. (See appendix II for copies of our questionnaires and 

results.) 

To supplement the survey analyses, we visited state Medicaid programs and 

MFCUs in four states: Georgia, New Jersey, Texas, and Washington.1

 We 

chose these states to provide regional diversity, and because they were 

among the ones considered by federal officials to be particularly active in 

efforts to identify and respond to improper payment practices—either 

through the use of new technology or by other means. Also, by telephone, 

we interviewed Medicaid, MFCU, and state government officials in other 

states that have taken steps to strengthen their Medicaid program integrity 

efforts.

1

 We also conducted an initial visit in Tennessee.
Appendix I

Scope and Methodology

Page 33 GAO-01-662 State Efforts to Control Improper Payments Vary

To better understand efforts to control improper payments at the national 

level, we interviewed officials at HCFA’s Central Office and leaders of the 

agency’s National Medicaid Fraud and Abuse Initiative in HCFA’s Atlanta 

and Dallas regional offices, as well as officials at the OIG. To gain a more 

broad-based perspective on other joint agency investigations and 

prosecutions, we interviewed representatives of the FBI, the U.S. Attorneys 

office, and the Civil and Criminal Divisions of DOJ. In addition, we 

participated in several meetings on control of improper payments, 

including fraud, which were sponsored by HCFA and others. Finally, we 

interviewed representatives of provider and supplier groups and 

technology companies that have developed software that is useful in the 

detection of improper payments. In addition, we reviewed literature on 

health care fraud and abuse, including studies by the OIG, HCFA, and 

others. 

We performed our work from September 1999 through April 2001 in 

accordance with generally accepted government auditing standards.
Page 34 GAO-01-662 State Efforts to Control Improper Payments Vary

Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires ApendxiI
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 35 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 36 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 37 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 38 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 39 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 40 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 41 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 42 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 43 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 44 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 45 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 46 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 47 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 48 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 49 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 50 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 51 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 52 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 53 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 54 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 55 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 56 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 57 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 58 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 59 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 60 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 61 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 62 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 63 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 64 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix II

Aggregated Results From State Medicaid 

Agency and MFCU Questionnaires

Page 65 GAO-01-662 State Efforts to Control Improper Payments Vary
Page 66 GAO-01-662 State Efforts to Control Improper Payments Vary

Appendix III

Comments From the Department of Health 

and Human Services ApendxiI
Appendix III

Comments From the Department of Health 

and Human Services

Page 67 GAO-01-662 State Efforts to Control Improper Payments Vary
Appendix III

Comments From the Department of Health 

and Human Services

Page 68 GAO-01-662 State Efforts to Control Improper Payments Vary
Page 69 GAO-01-662 State Efforts to Control Improper Payments Vary

Related GAO Products

Major Management Challenges and Program Risks: Department of Health 

and Human Services (GAO-01-247, Jan., 2001).

National Practitioner Data Bank: Major Improvements Are Needed to 

Enhance Data Bank’s Reliability (GAO-01-130, Nov. 17, 2000).

Medicaid: State Financing Schemes Again Drive Up Federal Payments

(GAO/T-HEHS-00-193, Sept. 6, 2000).

Financial Management: Improper Payments Reported in Fiscal Year 

1999 Financial Statements (GAO/AIMD-00-261-R, July 27, 2000).

Medicaid: HCFA and States Could Work Together to Better Ensure the 

Integrity of Providers (GAO/T-HEHS-00-159, July 18, 2000).

Medicaid In Schools: Improper Payments Demand Improvements in 

HCFA Oversight (GAO/HEHS/OSI-00-69, Apr. 5, 2000).

Medicaid: Federal and State Leadership Needed to Control Fraud and 

Abuse (GAO/T-HEHS-00-30, Nov. 9, 1999).

Financial Management: Increased Attention Needed to Prevent Billions 

in Improper Payments (GAO/AIMD-00-10, Oct. 29, 1999).

(101880) Letr
Ordering Information The first copy of each GAO report is free. Additional copies of 

reports are $2 each. A check or money order should be made out to 

the Superintendent of Documents. VISA and MasterCard credit 

cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and 

testimony. To receive facsimile copies of the daily list or any list 

from the past 30 days, please call (202) 512-6000 using a touchtone 

phone. A recorded menu will provide information on how to obtain 

these lists.

Orders by Internet:

For information on how to access GAO reports on the Internet, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at: 

http://www.gao.gov

To Report Fraud, 

Waste, or Abuse in 

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Presorted Standard

Postage & Fees Paid

GAO

Permit No. GI00