```

[Senate Hearing 114-277]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 114-277

                               REVIEWING
                             HEALTHCARE.GOV
                                CONTROLS

=======================================================================

                                HEARING

                               before the

                          COMMITTEE ON FINANCE
                          UNITED STATES SENATE

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION
                               __________

                             JULY 16, 2015
                               __________

   
   
   
   
   [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
   
   
   
   
   
   
   
   
                                     

            Printed for the use of the Committee on Finance
                                   ______

                         U.S. GOVERNMENT PUBLISHING OFFICE 

20-377 PDF                     WASHINGTON : 2016 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001            
            
            
            
            
            
            
            
            
            
            
            
            
            
            

                          COMMITTEE ON FINANCE

                     ORRIN G. HATCH, Utah, Chairman

CHUCK GRASSLEY, Iowa                 RON WYDEN, Oregon
MIKE CRAPO, Idaho                    CHARLES E. SCHUMER, New York
PAT ROBERTS, Kansas                  DEBBIE STABENOW, Michigan
MICHAEL B. ENZI, Wyoming             MARIA CANTWELL, Washington
JOHN CORNYN, Texas                   BILL NELSON, Florida
JOHN THUNE, South Dakota             ROBERT MENENDEZ, New Jersey
RICHARD BURR, North Carolina         THOMAS R. CARPER, Delaware
JOHNNY ISAKSON, Georgia              BENJAMIN L. CARDIN, Maryland
ROB PORTMAN, Ohio                    SHERROD BROWN, Ohio
PATRICK J. TOOMEY, Pennsylvania      MICHAEL F. BENNET, Colorado
DANIEL COATS, Indiana                ROBERT P. CASEY, Jr., Pennsylvania
DEAN HELLER, Nevada                  MARK R. WARNER, Virginia
TIM SCOTT, South Carolina

                     Chris Campbell, Staff Director

              Joshua Sheinkman, Democratic Staff Director

                                  (ii)

                            C O N T E N T S

                              ----------                              

                           OPENING STATEMENTS

                                                                   Page
Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman, 
  Committee on Finance...........................................     1
Wyden, Hon. Ron, a U.S. Senator from Oregon......................     3

                                WITNESS

Bagdoyan, Seto J., Director, Forensic Audits and Investigative 
  Service, 
  Government Accountability Office, Washington, DC...............     4

               ALPHABETICAL LISTING AND APPENDIX MATERIAL

Bagdoyan, Seto J.:
    Testimony....................................................     4
    Prepared statement...........................................    21
Grassley, Hon. Chuck:
    Prepared statement...........................................    41
Hatch, Hon. Orrin G.:
    Opening statement............................................     1
    Prepared statement...........................................    42
Wyden, Hon. Ron:
    Opening statement............................................     3
    Prepared statement...........................................    43

                                 (iii)
 
                   REVIEWING HEALTHCARE.GOV CONTROLS

                              ----------                              

                        THURSDAY, JULY 16, 2015

                                       U.S. Senate,
                                      Committee on Finance,
                                                    Washington, DC.
    The hearing was convened, pursuant to notice, at 10:02 
a.m., in room SD-215, Dirksen Senate Office Building, Hon. 
Orrin G. Hatch (chairman of the committee) presiding.
    Present: Senators Grassley, Crapo, Thune, Burr, Portman, 
Toomey, Coats, Heller, Scott, Wyden, Cantwell, Brown, Bennet, 
and Casey.
    Also present: Republican Staff: Chris Campbell, Staff 
Director; Kimberly Brandt, Chief Healthcare Investigative 
Counsel; Christine Brudevold, Detailee; and Jill Wright, 
Detailee. Democratic Staff: Joshua Sheinkman, Staff Director; 
Michael Evans, General Counsel; Elizabeth Jurinka, Chief Health 
Advisor; David Berick, Chief Investigator; and Juan Machado, 
Professional Staff Member.

 OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM 
              UTAH, CHAIRMAN, COMMITTEE ON FINANCE

    The Chairman. The committee will come to order.
    Good morning, everybody. Today's hearing will address 
controls at the HealthCare.gov website. Specifically, the 
committee will hear from the Director of Audit Services at the 
Government Accountability Office, Seto Bagdoyan.
    Director Bagdoyan's team has led an undercover ``secret 
shopper'' investigation to test the Internet controls of 
HealthCare.gov and to review the Centers for Medicare and 
Medicaid Services' handling of this program. This investigation 
was designed to determine the degree to which the 
administration's Federal health insurance exchange can protect 
against fraudulent applications, what happens when applicants 
provide false information and documentation, and whether the 
controls are successful in dealing with irregularities once 
they are found.
    Perhaps I should say ``spoiler alert'' before this next 
part. Today, Director Bagdoyan will explain how the Federal 
exchange failed spectacularly on virtually all relevant 
accounts tested by GAO.
    For this investigation, GAO created fictitious identities 
to apply for premium tax subsidies through the Federal health 
insurance exchange. We learned last year that 11 out of 12 fake 
applications were approved, and CMS accepted fabricated 
documentation with these applications without attempting to 
verify its authenticity and enrolled fake applicants while 
handing out thousands of dollars in premium tax subsidies.
    Now, a year later, GAO has reported that nothing has 
changed and that, if anything, there are more problems. Worst 
of all, the administration has known about these problems for 
over a year now and has apparently not taken the necessary 
steps to rectify them. While CMS says that it is balancing 
consumer access to the system with program integrity concerns, 
I think it is pretty clear just what is going on here.
    Since the Federal exchange was first implemented, success 
has been measured by the number of applicants who have signed 
up for insurance. Indeed, last year when the administration 
reached its initial enrollment goal, critics of the law were 
told that we had been wrong all along and that the law was, 
despite all the evidence to the contrary, working just fine.
    However, with these findings from GAO, it seems obvious, at 
least to me, that the administration has been preoccupied with 
signing up as many applicants as possible, ignoring potential 
fraud and integrity issues along the way.
    Now, supporters of Obamacare often insist that it is ``the 
law of the land'' and that Congress should work to improve 
rather than repeal it. On the first point, these proponents are 
unfortunately correct. For the foreseeable future, the so-
called Affordable Care Act is the law of the land. On the 
second point, Republicans in Congress continue to work toward 
repeal of the misguided law and its expensive mandates, 
regulations, penalties, and taxes, and replacement of it with 
patient-centered reforms that put patients, rather than 
Washington bureaucrats, in charge of their health care 
decisions.
    However, needless to say, that day will not come until 
there is a President who shares our goal. So until then, 
Obamacare will remain in place. In the meantime, Congress has 
an obligation to exercise rigorous oversight of the 
implementation of the law and to work to protect both 
beneficiaries and taxpayers from its negative consequences.
    That is what today's hearing is about. We are here today to 
get an account of how things are working on the Federal health 
insurance exchange, and, once again, what we have heard thus 
far is not reassuring and does not speak well for CMS's 
management of HealthCare.gov, the protection of taxpayer 
dollars, or the experience of enrollees.
    The GAO's investigation exposes not only huge gaps in 
Federal exchange program integrity, but also flaws in how the 
exchange and CMS contractors treat Americans who are trying to 
file or correct legitimate applications. Time after time, the 
GAO team sent information to the exchange for verification, 
only to have it ignored or have the exchange respond as if 
something entirely different had been sent in.
    The fact that GAO encountered mind-boggling levels of 
incompetence and inefficiency at nearly every turn does not 
bode well for the experience of your average honest enrollee. I 
look forward to today's hearing and what I hope will be a good 
discussion on program integrity at HealthCare.gov.
    Before I conclude, I want to note that, even though this 
GAO investigation was requested by this committee, CMS was less 
than cooperative. Indeed, throughout the entire endeavor, 
officials at CMS appeared to be dragging their feet, blowing 
past deadlines and good-faith attempts to carry out this 
important work.
    Put simply, when Congress asks GAO to conduct an inquiry, 
no Federal agency should stand in the way of that work. By 
delaying the GAO and hampering their efforts, CMS has also 
delayed this committee's work and hampered our efforts. This is 
unacceptable, and unfortunately, despite promises of increased 
transparency and cooperation from agencies throughout this 
administration, this type of stonewalling of legitimate 
oversight efforts is far, far too common.
    Acting CMS Administrator Andy Slavitt, who is now the 
President's nominee to run the agency, was personally involved 
in this process. As the committee considers his nomination, I 
look forward to asking Mr. Slavitt about this investigation and 
why CMS has been interfering with our oversight efforts. Of 
course, that will all have to wait for another day and another 
time.
    [The prepared statement of Chairman Hatch appears in the 
appendix.]
    The Chairman. Today we have our hands full as we hear 
testimony about this important GAO investigation. So with that, 
I will turn it over to our ranking member, Senator Wyden, for 
his opening remarks.

             OPENING STATEMENT OF HON. RON WYDEN, 
                   A U.S. SENATOR FROM OREGON

    Senator Wyden. Thank you very much, Mr. Chairman.
    On this side of the aisle, we do not take a back seat to 
anybody in fighting fraud and protecting taxpayer dollars. One 
dollar ripped off is one dollar too many. But let us be very 
clear this morning. The report up for discussion today is not 
about any real-world fraud. The study looks at a dozen 
fictitious cases, and not one of them was a real person who 
filed taxes or got medical services. No fast-buck fraudster got 
a government check sent to their bank account.
    Moreover, the government auditors acknowledge today, and I 
want to quote here, their work ``cannot be generalized to the 
full population of applicants or enrollees.'' None of the 
fictitious characters in this study stepped foot in a hospital 
or a doctor's office. The fact is, when you actually show up 
for medical services, it is a lot harder to fake your way into 
receiving taxpayer-subsidized care.
    Often, before any services are delivered, providers ask for 
a photo ID with an insurance card. If you have stolen an 
identity, there is probably a medical history belonging to 
somebody else that ought to set off alarm bells. If you are a 
real person signing up in the insurance marketplace, you have 
to attest, under penalty of perjury, that the information you 
provide is correct. If you falsify the application, you face 
the prospect of a fine of up to $250,000.
    Another major anti-fraud check went untested in this study: 
that is, squaring up tax returns with the information from your 
insurance application. The Government Accountability Office 
testimony today calls it ``a key element of back-end 
controls.''
    If your tax return and personal information do not match, 
the gambit is up. But the study before us today ignores that 
anti-fraud check. It only looks at a part of the picture when 
it comes to stopping fraud.
    As I noted at the beginning, there are always methods of 
strengthening any program and rooting out the fraudsters and 
the rip-off artists. Part of any smart, ferocious strategy 
against fraud, on one hand, is drawing a distinction between 
aggressively going after the rip-off artists and, on the other, 
not harming a law-
abiding American who has made an honest, and often technical, 
mistake.
    A retiree nearing Medicare age should not get kicked to the 
curb because he or she accidentally submitted an incorrect 
document. A transgender American should not lose health 
coverage after a name change because some forms do not match. I 
cannot imagine that anyone in the Congress or on this committee 
wants a system that nixes the health insurance coverage of 
Americans because of those kinds of issues.
    I will wrap up by saying that a recent Gallup report stated 
that the rate of Americans without health insurance is now the 
lowest that they have ever measured. This is the first Finance 
Committee hearing on health care since the Supreme Court's 
landmark decision that upheld the law that made that possible.
    The fact is, the Affordable Care Act has extended health 
care coverage to more than 16 million real people who use their 
insurance coverage to see real doctors. Now at some point down 
the road, the GAO is expected to complete their report. At that 
time, let us work on a bipartisan basis to draw conclusions 
about how this committee can work together to improve American 
health care.
    Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator. I appreciate it.
    [The prepared statement of Senator Wyden appears in the 
appendix.]
    The Chairman. Our witness today is Seto Bagdoyan, who is 
Director of Audit Services in GAO's Forensic Audits and 
Investigative Service mission team. During his GAO career, Mr. 
Bagdoyan has served in a variety of positions, including as 
Legislative Advisor in the Office of Congressional Relations, 
and as Assistant Director for Homeland Security and Justice. He 
has also served on congressional details with the Senate 
Finance Committee and the House Committee on Homeland Security.
    In his private-sector career, Mr. Bagdoyan has held a 
number of senior positions in consultancies, most recently 
focusing on political risk and homeland security. He earned a 
BA degree in international relations and economics at Claremont 
McKenna College and an MBA in strategy from Pepperdine 
University.
    We welcome you to the committee, and we are interested in 
your statement here today.

 STATEMENT OF SETO J. BAGDOYAN, DIRECTOR, FORENSIC AUDITS AND 
   INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE, 
                         WASHINGTON, DC

    Mr. Bagdoyan. Thank you, Mr. Chairman.
    Chairman Hatch, Ranking Member Wyden, and members of the 
committee, I am pleased to be here today to discuss the final 
results of GAO's undercover tests assessing the enrollment 
controls of the Federal marketplace set up under the Affordable 
Care Act of 2010.
    As you mentioned, we reported our preliminary results 
during testimony in July of 2014. We performed 18 undercover 
tests, 12 of which involved phone or online applications. Our 
tests were designed specifically to identify indicators of 
potential control weaknesses in the marketplace's enrollment 
process, specifically for plan year 2014, and to inform our 
ongoing forensic audit of these controls.
    I would note that our test, while illustrative as Ranking 
Member Wyden mentioned, cannot be generalized to the population 
of applicants or enrollees. Further, we shared details of our 
observations with CMS during the course of our test to seek its 
responses to the issues we raised.
    In this regard, CMS officials stated that they had limited 
capacity to respond to attempts at fraud and they must balance 
consumers' ability to access coverage with program integrity 
concerns. Without providing details on how and when, these 
officials stated that they intend to assess the marketplace's 
eligibility determination process.
    In terms of context, health coverage offered through the 
marketplace is a significant expenditure for the Federal 
Government. Current levels of coverage involve several million 
enrollees, about 85 percent of whom are estimated to be 
receiving subsidies. CBO pegs subsidy costs for fiscal year 
2015 at $28 billion and a total of about $850 billion for 
fiscal years 2016 to 2025.
    A program of this scope and scale is inherently at risk for 
errors, including improper payments and fraudulent activity. 
Accordingly, it is essential that there are effective 
enrollment controls in place to help narrow the window of 
opportunity for such risks, hence the importance of our 
undercover tests.
    With this as backdrop, I will now discuss some of our 
test's principle results. The marketplace approved subsidized 
coverage for 11 of our 12 fictitious applicants. These 
applicants obtained about $30,000 in total annual advanced 
premium tax credits, plus eligibility for lower costs at time 
of service.
    For 7 of the 11 applicants, we intentionally did not submit 
all required verification documentation to the marketplace, but 
it did not cancel coverage or reduce or eliminate subsidies for 
these applicants. I would note that while subsidies, including 
those granted to our applicants, are not provided directly to 
enrollees, they nevertheless represent a financial benefit to 
consumers and a cost to the government.
    As part of its verification process, the marketplace did 
not accurately record all inconsistencies which occur when 
applicant information does not match information available from 
marketplace verification sources. Also, the marketplace 
resolved inconsistencies from our fictitious applications based 
on fabricated documentation we submitted. Further, the 
marketplace did not terminate any coverage for several types of 
inconsistencies, including Social Security data.
    We found errors in information reported by the marketplace 
for tax filing purposes for 3 of our 11 enrollees, such as 
incorrect coverage periods or subsidy amounts. Under the ACA, 
filing a Federal income tax return is a key control element 
designed to ensure that premium subsidies granted at time of 
application are appropriate based on reported applicant 
earnings during the coverage year.
    The marketplace automatically re-enrolled coverage for all 
11 applicants for plan year 2015. Later, based on what it said 
were new applications our enrollees had filed but which we had 
not actually made, the marketplace terminated coverage for 6 of 
the 11 enrollees, saying they had not provided necessary 
documentation. However, for 5 of the 6 terminations, we 
subsequently obtained reinstatements, including increases in 
monthly subsidies averaging about 10 percent.
    In closing, our test results highlight the need for CMS to 
have in place effective controls to help reduce the risks for 
potential improper payments and fraud, otherwise there is 
potential for such risks to be imbedded early in a major new 
benefits program. We plan to include initial recommendations 
regarding controls in a forthcoming report.
    Mr. Chairman, this concludes my statement. I look forward 
to the committee's questions.
    The Chairman. Thank you, sir.
    [The prepared statement of Mr. Bagdoyan appears in the 
appendix.]
    The Chairman. It has come to my attention that GAO had 
difficulty obtaining plan year 2015 enrollment and related data 
from CMS, data that would allow GAO to conduct a full analysis 
of what really happened to enrollees from 2014.
    Now, this would have been helpful to GAO in providing 
explanations for things like those who were supposed to get 
dropped for failing to provide documents, to clear 
inconsistencies, among other things. Can you provide us with 
more detail about the difficulties GAO had in obtaining that 
information from CMS? I expect GAO to have the most recent and 
relevant data to inform its analysis, and expect that CMS would 
work with you and the committee to make that happen.
    Any information you can provide as to the problems 
experienced and what the committee can do to help address them 
would be very helpful to us in the committee now.
    Mr. Bagdoyan. Thank you for your question, Mr. Chairman. I 
will just lay out, in a general sense, our experience in 
obtaining data. But in the beginning, I would like to establish 
a context in terms of--as I mentioned earlier, the reason why 
we did our undercover testing was to flag indicators of 
potential control weaknesses, and, at the same time, we had 
designed our forensic audit, which would have relied on the 
enrollee database, to map out what we were finding in the 
control environment against the actual enrollees that I believe 
Ranking Member Wyden mentioned earlier.
    That said, we began our informal meetings and consultations 
with CMS in April of 2014. We requested various data sets. We 
had some success obtaining some information in meetings over 
time. Then when we focused on the enrollee database, we 
submitted a written letter requesting that database in August 
of 2014, and then we subsequently engaged in additional 
discussions with CMS officials as they expressed some concerns 
about what we were asking, what we planned to do with the data, 
as well as how the data would be safeguarded.
    Upon subsequent discussions through the early part of 2015, 
we submitted another letter to the current Acting 
Administrator, Mr. Slavitt, in April of 2015. As of a couple of 
days ago, we have been in contact with CMS, which advised that 
we should expect the data sometime next week, which is very 
good news for us, for our ability to continue the work.
    We look forward to obtaining the data and seeing whether it 
is actually what we asked for, and then conducting additional 
tests to determine whether the data is actually usable for our 
purposes. I apologize for the long story, but that gives you a 
context of where we have been.
    The Chairman. Sure. That is fine. I understand that the 
marketplace invoked this so-called ``good faith exemption'' for 
plan year 2014 in not pursuing applicants who did not submit 
all of the requested documentation to reconcile inconsistencies 
between information they provided during the enrollment process 
and that available to the marketplace through government 
sources.
    Could you describe what the good faith exemption is all 
about, whether it has any basis in the Affordable Care Act or 
its implementing regulations, and the impact, if any, of its 
invocation on program controls and integrity?
    Mr. Bagdoyan. Sure. The good faith provision is basically 
an interpretation by CMS of certain provisions in the statute 
itself and in its implementing regulations. Essentially, under 
this implementation, CMS deemed that as long as an enrollee or 
an applicant submits at least one document to support their 
application, they would have engaged in a good faith effort to 
meet the documentary request and accordingly remain a 
participant in their coverage.
    In terms of whether this has an impact on the controls, it 
is essentially one of the back-end controls--the document 
verification process, that is--and, depending on your point of 
view of whether that is adequate if someone is asked for seven 
documents and they only submit one document, that can create a 
control gap and raise questions about their eligibility for 
participation.
    The Chairman. Well, thank you.
    Senator Wyden, my time is up.
    Senator Wyden. Thank you very much, Mr. Chairman.
    Mr. Bagdoyan, my time is short, so I would like you to give 
me ``yes'' or ``no'' answers to four questions.
    Mr. Bagdoyan. Sure.
    Senator Wyden. Mr. Bagdoyan, as of this morning, can you 
generalize from the 11 fictitious cases what the fraud rate 
would be for the more than 10 million real Americans who 
actually receive health care coverage under the law, yes or no?
    Mr. Bagdoyan. Not as of this morning.
    Senator Wyden. Mr. Bagdoyan, you said in your testimony 
that tax returns are a ``key element of back-end controls. It's 
a major check that would shut down the fraudsters.'' As of this 
morning, did you file tax returns for any of these individuals, 
yes or no?
    Mr. Bagdoyan. We did not.
    Senator Wyden. Mr. Bagdoyan, as of this morning, have you 
uncovered any real individuals who fraudulently obtained health 
coverage using GAO's techniques, yes or no?
    Mr. Bagdoyan. No.
    Senator Wyden. Mr. Bagdoyan, as of this morning, have you 
provided HHS with the fictitious identities from your inquiries 
so that they can address the problems that you say exist, yes 
or no?
    Mr. Bagdoyan. We have not.
    Senator Wyden. Mr. Bagdoyan and colleagues, I have reviewed 
this very carefully. Given the answers that we have just heard, 
it is clear to me that the auditors have much more work to do 
before the committee can draw useful conclusions on this 
matter.
    On this point with respect to the claims that the agency 
has not been responsive to the request for enrollment data, I 
very much respect the fact that Federal agencies need to be 
responsive to requests from Congress and the GAO for 
information. However, I also want to take note of the fact that 
these enrollment records contain personally identifiable 
information on more than 10 million Americans. Loss of their 
personally identifiable information is already becoming a 
nightmare for millions of Americans.
    Now, it is my understanding that the agency, CMS, and the 
auditors have worked out an agreement on how this information, 
(1) can be turned over to GAO and protected, and I think that 
is good; and (2) it is my understanding that the agency has 
turned over some 30,000 pages of documents to my colleague, 
Senator Portman, for his committee.
    So this notion that the government, the agency--in 
particular, CMS--is just spending its day, morning, noon, and 
night trying to stonewall the release of this information, I 
think, is not accurate, given the facts that I have just cited.
    Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator.
    Senator Grassley, you are next.
    Senator Grassley. In deference to my colleagues, and there 
are a lot here who want to ask you questions--and of course 
that is because we have our pending six votes this morning--I 
am going to ask just one of three questions, and I am going to 
put the lead-in up to my questions in the record.
    [The prepared statement of Senator Grassley appears in the 
appendix.]
    Senator Grassley. You presented CMS with potential flaws. 
The flaws, as I understand what you said, did not get fixed. So 
my question is very simple: in your work with CMS, do you 
believe that CMS's attitude is, enroll people first and worry 
about eligibility later, if at all?
    Mr. Bagdoyan. Well, from where we stand currently, the CMS 
explanation has been that they have to balance the ease of 
access to coverage with program integrity controls. Based on 
our under-cover work, I would say that there are gaps in these 
controls that have yet to be addressed. We continue to look at 
it through our forensic work, but as of now I think the balance 
would probably favor access over program integrity.
    Senator Grassley. Yes. I yield back.
    Mr. Bagdoyan. As we stand today, Senator. As we stand 
today.
    Senator Grassley. Thank you. I yield back my time.
    The Chairman. Thank you.
    Senator Thune?
    Senator Thune. Thank you, Mr. Chairman. Thanks for holding 
the hearing. I think it is important--you were talking about 
taxpayer dollars here--that we make sure that we are doing 
everything to see that they are spent wisely and well.
    Mr. Bagdoyan, in your testimony you highlight that 
marketplaces are required by law to verify application 
information, yet it appears from your investigation and 
subsequent interactions with CMS that the buck stops with no 
one, especially since the very contractors hired to verify 
these documents are not required to detect fraud.
    So it begs the question of whether you are currently aware 
of any effective front- or back-end fraud detection program in 
use by the administration?
    Mr. Bagdoyan. Again, I would couch my response to you, 
Senator Thune, in terms of our ongoing work. The forensic part 
of our work should be able to give us a good idea of what the 
controls are. We will take what we have learned from the 
undercover tests, map that out against the forensic audit, and 
then apply appropriate criteria, such as the internal control 
standards of the Federal Government, as well as a forthcoming 
GAO framework to manage fraud risk. Then we will be able to 
have a more comprehensive view of what the control environment 
is like.
    Senator Thune. All right.
    Mr. Bagdoyan. It is premature for me to make a judgment 
like that.
    Senator Thune. You are not currently aware today, though, 
absent having completed your investigation, of any fraud 
detection program?
    Mr. Bagdoyan. Based on our work to date, I am not aware of 
that.
    Senator Thune. Additionally, has the administration 
provided you with any rationale as to why they would enter into 
contracts that do not require the contractors to have fraud 
detection capabilities?
    Mr. Bagdoyan. As best as I can tell, the arrangement with a 
contractor is to process documents that are submitted in 
support of applications. The contractor confirmed with us that 
they are not required to detect fraud. That would be a whole 
different transaction at greater cost.
    Senator Thune. So you said your work is ongoing.
    Mr. Bagdoyan. Yes.
    Senator Thune. But does GAO have any recommendations for 
how to improve the document verification process to actually 
sort out fraud as opposed to just accepting documents?
    Mr. Bagdoyan. Sure. As I mentioned in my opening statement, 
we are working on a forthcoming report sometime in the fall 
time frame where we hope to have some initial recommendations, 
and those recommendations might indeed cover the matter that 
you mentioned.
    Senator Thune. All right. But you do not now have any hard, 
fast information?
    Mr. Bagdoyan. Not right now. But as I mentioned earlier, we 
did speak with CMS officials about things that we were 
encountering. We had discussions about their view of that, and 
we continue to have those discussions and await some 
explanations in that regard.
    Senator Thune. My understanding is, from your work, that 
several of the fictitious applications were approved and 
subsequently reapproved without ever submitting documentation 
to the marketplace. How can this be?
    Mr. Bagdoyan. Well----
    Senator Thune. How can the marketplace continue disbursing 
taxpayer dollars without receiving any documentation in 
response to its request?
    Mr. Bagdoyan. Well, we were automatically re-enrolled 
without any action on our part for all 11 applicants, and then 
subsequently we found out that 6 of them, as I mentioned in my 
statement, had been indeed dropped from coverage because they 
had not submitted any documents in response to that. Then to 
carry that one step further, acting again as typical consumers, 
we sought to restore our coverage, and we were successful five 
out of six times.
    Senator Thune. Yes. All right.
    Mr. Chairman, I would just simply say that these, I think, 
are really troubling results, 11 out of 12. I would say to the 
Senator from Oregon, I mean, I think that we need to drill down 
and get to the bottom of this. I do not think you can discount 
or write off this kind of research and report.
    You couple that with, in June, the HHS OIG report revealed 
that the administration could not verify whether nearly $3 
billion in subsidies was properly disbursed to insurance 
companies during the first 4 months of 2014. These are 
significant failures in this system. They need to be addressed. 
I appreciate the hearing here, Mr. Chairman, and I hope that we 
can continue this dialogue with you, Mr. Bagdoyan, as you 
continue your work to determine how to stop this sort of waste 
of taxpayer dollars in the future.
    Thank you, Mr. Chairman.
    The Chairman. We are going to turn to Senator Wyden for a 
question, and after that will be Senator Portman.
    Senator Wyden. Mr. Chairman, I am not even going to ask a 
question. I just want to respond to my colleague, because he 
knows I am always willing to work with him, always willing to 
work in a bipartisan way. But let us review what has just 
happened. I asked Mr. Bagdoyan about whether he uncovered any 
real individuals who fraudulently obtained health coverage 
using these techniques. He answered ``no.''
    During the two previous enrollment periods, the agency 
rescinded a quarter of a million individuals' health insurance 
because they were not able to validate their documents. So we 
have to work together, there is no question here.
    I am willing to look at all the ramifications of these 11 
applicants, but let us do it in a bipartisan way, and let us do 
it when we actually have some recommendations. Once again, Mr. 
Bagdoyan said he does not have any recommendations to give us.
    The Chairman. Well, I want to announce we are doing it in a 
bipartisan way. I do not think we can ignore some of this 
testimony.
    Senator Portman?
    Senator Portman. Thank you, Mr. Chairman. Mr. Bagdoyan, 
thank you for your help on this and your work with us on the 
PSI Subcommittee looking into the same thing.
    My friend, the ranking member, talked about how HHS has 
been responsive. You have indicated they have not been 
responsive in providing information. Since you mentioned that I 
have gotten 30,000 pages of documents, I will tell you only 
2,000 of those pages are responsive to anything we asked about, 
and we are still getting delay, delay, delay.
    All we are asking for right now is just a schedule to 
submit documents. If we have time, I would like to hear your 
response to that, but I know from talking to your folks that 
you have the same frustration.
    With regard to this issue, there is clearly a policy 
problem here, not just the fact that 11 of 12 of these 
fictitious people got through and were automatically re-upped, 
and then when some were kicked out of the system, five out of 
six were brought back in after a phone call to HHS when they 
should not have been.
    So, clearly we have a problem here. But I think the 
statistical example of 12 might not be as significant as what 
you found out in terms of policy, so let me ask you a couple of 
questions about that. Your statement mentions that GAO failed 
an initial identity-proofing step in the application process. 
In other words, your people were fictitious so they could not 
get through the online application process.
    Mr. Bagdoyan. That is right.
    Senator Portman. But GAO was able to proceed past this step 
after calling HHS. Can you describe what GAO did to verify the 
identity for these applications and why that is significant?
    Mr. Bagdoyan. Well, as I mentioned earlier, we were able to 
obtain coverage by essentially following the system's own 
instructions. We failed the initial online test; we contacted 
the contractor who does the identity proofing, and they could 
not clear it; then they instructed us to call the marketplace, 
which we did; and then, based on self-attestation of 
information, we obtained coverage.
    Senator Portman. So it was a phone call after getting 
denied twice, and through the self-attestation, people got back 
in. So, I mean, this is a policy issue. This is not, again, 
just a statistical quirk that somehow your people snuck in. 
This is an HHS policy.
    Mr. Bagdoyan. Yes. We would view that, Senator, as at least 
an indicator of a control gap. I know it is a technical, nerdy 
kind of thing to say but----
    Senator Portman. Yes. Clearly a control gap. Self-
attestation is a policy that they have. By a phone call, even 
though you get rejected, rejected, you can get in just by a 
self-attestation.
    Mr. Bagdoyan. That is correct.
    Senator Portman. With no proof.
    As another example, you noted that, in all 11 cases, GAO 
was asked to submit documents that showed eligibility for 
subsidies. In some cases, GAO submitted only some of the 
required documents but was nonetheless able to continue to 
receive coverage and subsidies. That was because of the so-
called good faith exemption.
    Could you describe that rule--again, it is a policy--and 
why it enabled GAO to receive coverage and subsidies, even when 
it submitted only some of the required documents, and the legal 
basis that HHS used in implementing it?
    Mr. Bagdoyan. Right. In terms of the legal basis, Senator 
Portman, we are awaiting a response from CMS, and our attorneys 
have been in touch with their attorneys, have had some 
discussions. So, we are trying to get some clarity on that.
    So, under the good faith exemption or provision, whatever 
the term of art is, essentially the applicant is compliant with 
their obligation to submit documents as long as they submit one 
out of the however many they have been asked to submit.
    Senator Portman. So again, your results indicate, as these 
applications show, that this is not a result of a statistical 
quirk that you found, it is the result of HHS policy being 
implemented as planned. I think anybody who cares about the 
Affordable Care Act should be concerned about this policy, 
because it allows people to continue receiving subsidies 
without HHS making a serious attempt to verify eligibility. So 
I know we should do more research into this--we are looking 
forward to your report--but these are policy issues that are 
being applied today as we talk.
    Finally, your statement notes that this investigation was 
conducted with limited back-stopping. Can you describe what 
back-stopping is and why limited back-stopping is important?
    Mr. Bagdoyan. Sure. Limited back-stopping essentially 
involves the extent to which we employ investigative 
techniques. This was pretty much--I do not want to speak for my 
colleague, Director McElrath, who runs the investigative side 
of things, but basically it was a pretty simple thing to do 
using commonly available software, materials, and other 
approaches.
    Senator Portman. So in sum, you did not have any inside 
information that you used about how the ACA works or does not 
work. You came at it just as any consumer would----
    Mr. Bagdoyan. Right.
    Senator Portman [continuing]. Which makes your results, 
again, more troubling than they might otherwise be. I think 
these are really important aspects to your report, and I think 
from a legislative perspective, an oversight perspective, it 
makes this much more serious.
    The final thing I will say is, the amount of confusion this 
is causing people who legitimately are trying to get a subsidy 
is unbelievable. H&R Block says two-thirds of people are either 
having their tax refunds cut or getting a tax bill.
    IRS has told me that half of the people this year are in 
that situation. So this is not just about verification flaws. 
As you have said, the lack of controls and this lack of balance 
between accessibility, pushing people to get enrollment numbers 
up, versus the verification, is also causing a lot of confusion 
for consumers.
    Thank you, Mr. Chairman.
    The Chairman. Thank you.
    Senator Scott?
    Senator Scott. Thank you, Mr. Chairman.
    Good morning.
    Mr. Bagdoyan. Good morning, Senator.
    Senator Scott. I have a quick question for you: did you 
look for any real people who attempted to deceive the system?
    Mr. Bagdoyan. Good question. We did not, as I mentioned 
earlier.
    Senator Scott. Thank you.
    Is it your job to figure out the number of fraudulent 
accounts receiving subsidies and health care coverage on 
HealthCare.gov?
    Mr. Bagdoyan. Not at this stage of our work.
    Senator Scott. All right.
    Of the 50,000 taxpayers who filed returns based on 
inaccurate subsidy data, how many of those did you review?
    Mr. Bagdoyan. None.
    Senator Scott. Because you are not the IRS?
    Mr. Bagdoyan. That is correct.
    Senator Scott. All right.
    There is no doubt that HealthCare.gov, in 2013, was a 
disaster, a $400-million website that became synonymous with 
failure. We had a constituent in South Carolina who was trying 
to figure out how to get his information off the website that 
was used erroneously. We could not get a response from CMS. We 
finally had a committee hearing and Administrator Tavenner was 
there, and we were able to get some information and help solve 
that problem.
    One of the things that concerns me the most about the 
challenges that we face is that, when you combine the 
subsidies, including the Medicaid subsidies, we are talking 
about $1.7 trillion of subsidies. In the year 2025, we will 
have about 31 million Americans still without coverage. 
Perhaps, after billions and billions of dollars of subsidies 
that have been received by people who do not deserve them, it 
may indicate why we will still have 31 million Americans 
without insurance.
    My question to you is, outside of your investigation, how 
easy is it for most consumers to falsify their information in 
order to receive higher subsidies, based on your fictitious 
individuals?
    Mr. Bagdoyan. Well, as I mentioned earlier in response to 
Senator Portman, it was relatively straightforward for us. I 
certainly cannot project that to the typical consumer, but 
there is a lot of information out there available for people 
who are committed to performing fraudulent activities.
    Senator Scott. It appears to me that there seems to be 
almost a perverse incentive for relaxed accountability as it 
relates to internal controls because it seems to have led, and 
will continue to lead, towards higher enrollments. Thoughts?
    Mr. Bagdoyan. I would take you to my opening statement 
regarding the balance between access and control. It appears, 
based on our limited results from our undercover tests, that 
the balance is more towards access than control. Our work 
continues. We will have more definitive views on that in the 
future.
    Senator Scott. Said in fewer words, if it is tilted more 
towards access than controls, the chances are pretty high that 
someone will be able to get on, as you did with 11 fictitious 
individuals, and get coverage even if they were doing it at 
home on HealthCare.gov versus the GAO doing it. Basically the 
same result. Is there anything that would lead to a different 
conclusion, from your experience so far?
    Mr. Bagdoyan. Well, I think the forensic audit that we will 
conduct on the entire population will give us a complete 
picture of what happened, whether there were additional red 
flags that we need to follow up on. But at this point I cannot 
really project one way or the other.
    Senator Scott. I would appreciate a follow-up of that 
information in writing, then. That would be wonderful. Thank 
you.
    I would say to my colleagues that the reality of it is, 
what happens when you have individuals receiving subsidies that 
they have not earned, do not have a right to, when it is $1.7 
trillion over the next 8 or 9 years, what that results in in 
South Carolina, what we have seen this past year, is between a 
31-percent and as high on some plans as a 50-percent increase 
in premiums. That is astounding. It is ridiculous. It is 
unaffordable.
    As those premiums continue to climb, what we have also seen 
is your deductibles get higher, more expensive. Your out-of-
pocket expenses are higher, more expensive. The number of 
facilities, whether it is hospitals or doctors, that are 
available to use that access card continues to dwindle down, 
and down, and down. I am not sure what good access is if you 
have a card when there is not a health care provider on the 
other side.
    Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator.
    Senator Coats?
    Senator Coats. Thank you, Mr. Chairman.
    I am not surprised with anything I have heard here this 
morning. I go to the Senate floor once a week to share with my 
colleagues proven waste, fraud, and abuse in any number of 
ways, in any number of agencies.
    We have a bloated, bureaucratic, dysfunctional government 
that tries to do--with real intent, good intent--more than it 
can handle. Thank God for GAO and for the nonpartisan work that 
you do to help us point out ways in which we can help a 
struggling taxpayer not have to pay so much money in to 
Washington to fund something that does not work.
    So I really appreciate your being here; I appreciate your 
candidness. How we can take this for anything other than the 
canary in the mine, saying, hey, there is a problem here, let 
us get after it, I just don't know. What really is discouraging 
is, and I would like you to give me a little more detail on 
this, you take these findings to CMS, and CMS basically gives 
you a stall: we are waiting for the attorneys to respond.
    CMS should say, ``Thank you, thank you, you have pointed 
out some weaknesses here that we were not aware of. We want to 
be efficient. Actually, we want to implement the President's 
program, we want to sign up more people.'' I mean, they are 
obviously following that mandate. ``This will help us because, 
if this becomes public, the public is going to say it is just 
one more example of another government bloated, bureaucratic 
inefficiency, ineffectiveness, preventing people who need the 
insurance from getting the insurance, giving insurance to 
people who do not qualify, and it is fraudulent.''
    I hear that, ``Well, we have to go through all this process 
and so forth before we even implement things.'' They should not 
have to wait for you for recommendations. You have told them: 
here is the problem.
    I would think they would say, ``Thank you. We are going to 
go after this right now and try to fix some of these things.'' 
You have pointed out something that obviously, sure, it is 
fictitious, but I mean, if this is not an alarm bell in terms 
of dysfunction, I do not know what is.
    So can you describe a little bit more your efforts with CMS 
to get them to say, ``Thank you, yes, we see the weaknesses 
here, and we are going to take steps to go forward,'' instead 
of some process that is going to go through the legal system 
and through the bureaucratic system that is going to take 
months, if not years, while more and more waste and fraud just 
continues.
    Mr. Bagdoyan. Sure. Thank you for your question, Senator 
Coats. Our exchanges with CMS have been fruitful at times, and 
we have gotten their attention on some of the key issues that--
--
    Senator Coats. But what about this issue?
    Mr. Bagdoyan. Which one is that?
    Senator Coats. What you are presenting here. I wrote this 
down. You said you went to CMS and alerted them to the problem, 
and you are waiting for their response.
    Mr. Bagdoyan. Well, that actually refers to the good faith 
exemption. We are waiting for their legal analysis, for their 
basis----
    Senator Coats. Yes. Yes. Yes. We hear this all the time.
    Mr. Bagdoyan. Yes. They are working through the document 
verification process.
    Senator Coats. Yes.
    Mr. Bagdoyan. So that is just one matter. There are----
    Senator Coats. Well, did it ring any alarm bells over at 
CMS? Did anybody say, ``Wow, thanks so much for bringing this 
to our attention; we need to plug these holes right away''?
    Mr. Bagdoyan. I do not know whether ``thank you'' was used, 
but they are aware of the problems that we flagged.
    Senator Coats. But they did not just say, well, this is 
fictitious, so therefore what you are presenting us here is 
worthless?
    Mr. Bagdoyan. No, I cannot say that that is what they said.
    Senator Coats. Well, I am happy to hear that. I could point 
out waste of the day, waste of the hour, or waste of the 
minute, thanks to GAO and other investigative agencies that 
have pointed out that we have a dysfunctional government and we 
are wasting taxpayer dollars faster than we can send them to 
Washington.
    Mr. Chairman, thank you.
    The Chairman. Thank you, Senator.
    Senator Burr, you are next.
    Senator Burr. Thank you, Mr. Chairman. Let me say thank you 
to you and all the folks at GAO for the great work that you do 
and for the difficult task that you are asked to do.
    According to your testimony, people applying for coverage 
are required to attest that the documents they are providing 
are not false. CMS officials say that contractors processing 
these documents are not required to verify that these documents 
are authentic, and that the contractor is not equipped to 
identify fraud.
    CMS has also stated that there is no indication of 
meaningful levels of fraud. Do you think CMS made this 
statement because nobody is monitoring the enrollment process 
in a meaningful way to detect the fraud that is clearly 
occurring in the cases of fake GOA enrollees?
    Mr. Bagdoyan. Yes. I think the statement from CMS is based 
on the fact that the contractor itself has not reported any 
fraud. But as you pointed out, they are not tasked with looking 
for fraud. That is not in their work order, that is not----
    Senator Burr. So it is not dissimilar to the question that 
Senator Wyden asked you: how many people did you find? You had 
not been asked to go look, therefore you did not find any, 
right?
    Mr. Bagdoyan. At this stage, that is correct. But once we 
move over to the forensic look at the entire enrollee database, 
then that might yield different results.
    Senator Burr. Mr. Bagdoyan, who is ultimately in charge of 
ensuring enrollment program integrity? Is it the CMS 
Administrator? Is it the CMS Deputy Administrator? Is it the 
Chief Information Officer? Who is actually the one on the hook 
for ensuring that fraud is not occurring within the enrollment 
process?
    Mr. Bagdoyan. Sure. As a general proposition, I would say 
that the tone at the top is important, whether it is the 
Administrator who is responsible for CMS and his or her staff. 
It is leadership that sets the controls in place, ensures that 
they are working as intended, monitors their effectiveness, and 
then responds to any changes in the environment that may 
necessitate adjustments or changes.
    Senator Burr. Senator Wyden came to an interesting 
conclusion, that what you have testified on really is not valid 
because none of the individual enrollees filed an income tax 
return, therefore you did not allow the system as designed to 
catch that they should not be there.
    Mr. Bagdoyan. Yes.
    Senator Burr. Well, your own testimony says that, in 
correspondence between the applicant and the marketplace, on 
four of the individuals, the marketplace's correspondence to 
the applicant referred to their filed tax returns. In other 
words, the marketplace basically said four of your applicants 
filed income tax returns and that is what we make our judgment 
on, when in fact none of them filed tax returns.
    Mr. Bagdoyan. That is correct.
    Senator Burr. And you stated that in your testimony.
    So let me just say to my colleagues, what is my take-away 
here? Not only do we have policy deficiencies, but we certainly 
have indications of incompetence or intent to ignore the law. 
That should be the concern of this committee, it should be the 
concern of the American people, and I hope that GAO will 
continue with the instructions from the chair to look deeply 
into this. Thank you for your work.
    Mr. Bagdoyan. Thank you, Senator.
    The Chairman. Thank you, Senator.
    Senator Casey?
    Senator Casey. Mr. Chairman, thanks very much.
    I want to say first to Mr. Bagdoyan that, in my experience 
as an elected official in Pennsylvania, one of the most 
significant parts of that time as a public official was as the 
State Auditor General. It is an elected position. I was elected 
to two terms, so I spent 8 years doing it. I have some sense, 
even though I was overseeing a group of auditors or 
investigators, of the difficulty of your work and a good sense 
of the reaction you get when your work is completed. I respect 
and appreciate what you do; it is difficult.
    Mr. Bagdoyan. Thank you.
    Senator Casey. I want to ask you one question, more just to 
make sure the record is clear, and then I want to get into more 
of the specific health care issues. I want to make sure I have 
this right. Based upon your testimony, is it possible to make 
generalizations about the full population of applicants in the 
marketplace?
    Mr. Bagdoyan. No, it is not, and that was not the intent of 
our undercover tests.
    Senator Casey. I want to say, just preliminarily, we know, 
those of us who voted for the Affordable Care Act, that there 
are issues we have to correct. It is not perfect legislation, 
nor is any legislation of that complexity and impact on health 
care and our economy. A number of us have voted for, already, 
improvements to the law.
    I think what is indisputable, though, in addition to the 
fact that it is not perfect, is that there has been a 
substantial benefit conferred upon a lot of Americans that 
would not have it otherwise. I am not saying this for your 
benefit, really, just for the record: 16.4 million people 
gained health insurance coverage in the time since 2010.
    In Pennsylvania, for example, 472,697 Pennsylvanians 
selected plans or were automatically re-enrolled through the 
health insurance marketplace. About 81 percent of 
Pennsylvanians who selected health insurance plans were 
determined eligible for financial assistance. There are lots of 
examples of individuals----
    Two individuals from southeastern Pennsylvania, Jenny and 
David, are self-employed, have two sons in college. Jenny is a 
breast cancer survivor, worried about being denied health 
insurance because of her pre-existing condition. They were 
spending over $10,000 a year on health insurance. Thanks to 
their ACA plan purchased through HealthCare.gov, they now are 
spending about $3,000 per year, so the savings helps them on 
college costs. So that is just by way of background.
    But I want to ask you a specific question about your work. 
Do you think there are additional checks that can be imposed 
upon the system, so to speak, that could help identify fraud, 
which the GAO did not test?
    Mr. Bagdoyan. Sure. Thank you for your question. That would 
be part, a major part, of our focus for the ongoing work. As I 
mentioned earlier in response to another Senator's question, we 
will be applying a set of appropriate benchmarks to how we map 
out the current process with information that we obtained from 
our undercover work. The forensic work will inform that and go 
in tandem.
    Once we apply those criteria, we will be able to identify 
how to best respond to them: what are their risk assessments, 
their implementation of specific controls for specific parts of 
the enrollment process? That will be key, but that work is 
ongoing, so I cannot really say one way or the other which way 
it will go with the recommendations.
    Senator Casey. And part of that is, I guess--and I know 
this is always difficult in an auditing context--when you have 
a mandate but you also have limited resources, you cannot audit 
or review every transaction or every part of the system. So you 
do sometimes have to make a determination based upon risk: what 
is a higher risk, what is a----
    Mr. Bagdoyan. Sure. You prioritize where you attack first 
in terms of control gaps. Sure.
    Senator Casey. I want to ask you too to what extent you 
believe the IRS has the capacity to identify fraudulent, so-
called advance premium tax credit or APTC claims? Do you have 
any sense of that?
    Mr. Bagdoyan. I do not. That is not part of our scope in 
this ongoing work, but I believe there are other mission teams 
within GAO that are taking a look at that. I do not know the 
specific aspects, but I believe IRS capacity and capability is 
part of that work.
    Senator Casey. Well, we are grateful for your work. It is 
difficult, but it is essential. We want to make sure that we 
get this right over time. One of the ways to inform how we do 
our work in terms of legislative change or corrections is to 
have information from GAO and other sources. So we appreciate 
your work. Thank you.
    Mr. Bagdoyan. Thank you, Senator.
    The Chairman. Senator Wyden would like to make a comment.
    Senator Wyden. One last ``yes'' or ``no'' question, Mr. 
Bagdoyan. Is it correct that CMS asked for these 11 fictitious 
cases and GAO did not give them to the agency?
    Mr. Bagdoyan. That is correct.
    Senator Wyden. I would again say, colleagues, it is pretty 
hard to evaluate something you are not told about. You 
certainly cannot fix something you do not know about. By the 
way, on Senator Burr's question, you could have gotten an 
answer to it if you had actually been able to get information 
about these 11 fictitious cases. And by the way, my staff asked 
for the information about these 11 fictitious cases.
    So to me the message here--and Chairman Hatch knows that I 
am interested in working with him in a bipartisan way. I think 
I am about as bipartisan on health care as anybody in the 
Senate. I just think that, without these recommendations--and 
we have been told they are not ready to go--this is premature.
    At some point, I believe GAO, because I have worked with 
them often in the past and admire their professionalism, will 
give us some recommendations. Then we can work in a bipartisan 
way. But I hope that people following this will recognize that, 
as of this morning, the Government Accountability Office has 
not uncovered any instances of real people committing fraud as 
part of this inquiry. I think that is the important take-away 
of this morning.
    Thank you, Mr. Chairman.
    The Chairman. Thanks.
    Mr. Bagdoyan, it is true that your job is to look for 
fraud. Your job is to look for misconceptions. Your job is to 
look for things that are wrong, or out of whack, or whatever 
you want to call it, and that is what you are doing, right?
    Mr. Bagdoyan. That is correct, Senator.
    The Chairman. And you have done it honestly, right?
    Mr. Bagdoyan. Yes.
    The Chairman. And you are disturbed by the fact that these 
discrepancies exist, even though it has been a limited 
investigation. Is that right?
    Mr. Bagdoyan. Well, we do have concerns about the red flags 
we have detected in terms of the control environment.
    The Chairman. Well, you are expressing those concerns here 
today. I have concerns too. A lot of people on our side do not 
believe that Obamacare is ever going to work and that it is 
just going to continue to take us downhill with more and more 
costs, more and more expenses, and more and more fraud. This is 
not the only instance of fraud either, is it?
    Mr. Bagdoyan. Well, I cannot comment on that.
    The Chairman. All right.
    Mr. Bagdoyan. That is out of our scope. But if I may, Mr. 
Chairman, try to explain our decision to decline----
    The Chairman. What I do not want is, I do not want people 
just slapping this off like this is not important. It is very 
important----
    Mr. Bagdoyan. Right. I would like to, if I may, again----
    The Chairman [continuing]. And I want you to tell us why it 
is so very important.
    Mr. Bagdoyan. It is important in terms of getting the 
responses that we need as our work is ongoing. I would 
respectfully ask that I might explain why we declined to 
provide the identities of our 11 applicants.
    The Chairman. Sure. I would like you to explain that.
    Mr. Bagdoyan. It is fully consistent with GAO policy, 
protocols, and practice that we do not divulge any information 
related to our sources, methods, and investigative techniques 
to any entity so that we protect those for future use. So that 
is our perspective on that issue.
    The Chairman. Well, why is that? I mean, why can you not 
divulge----
    Mr. Bagdoyan. Well, we cannot because we have the sources 
and methods that I mentioned that need to stay confidential, 
that are in general use by GAO in certain circumstances. So 
revealing those would basically give up the ghost.
    The Chairman. Well, my understanding, through my service in 
the Senate, is that the GAO does a very good job of trying to 
get to the bottom of problems in our society. I think you are a 
good illustration of that effort by GAO.
    Now, this does not mean that you are going to cease trying 
to find fraud and mismanagement and so forth in the future, 
does it?
    Mr. Bagdoyan. Well, this work is ongoing.
    The Chairman. Right.
    Mr. Bagdoyan. I think we are in it for the long term.
    The Chairman. And we will probably have you back again so 
that we can figure out, what is our job up here? What can we 
do? We cannot just dismiss these type of things; we have to do 
something about them. Hopefully we can do that with your help.
    Mr. Bagdoyan. Thank you.
    The Chairman. With that, we will recess until further 
notice.
    [Whereupon, at 11:05 a.m., the hearing was concluded.]

                            A P P E N D I X

              Additional Material Submitted for the Record

                              ----------                              

 Prepared Statement of Seto J. Bagdoyan, Director, Forensic Audits and 
        Investigative Service, Government Accountability Office
                             gao highlights
Why GAO Did This Study
    PPACA provides for the establishment of health-insurance exchanges, 
or marketplaces, where consumers can compare and select private health-
insurance plans. The act also expands the availability of subsidized 
health-care coverage. The Congressional Budget Office estimates the 
cost of subsidies and related spending under the act at $28 billion for 
fiscal year 2015. PPACA requires verification of applicant information 
to determine eligibility for enrollment or subsidies.

    GAO was asked to examine controls for application and enrollment 
for coverage through the federal Marketplace. This testimony describes 
(1) the results of GAO's undercover testing of the Marketplace's 
eligibility and enrollment controls, including opportunities for 
potential enrollment fraud, for the act's first open-enrollment period; 
and (2) additional undercover testing in which GAO sought in-person 
application assistance.

    This statement is based on GAO undercover testing of the 
Marketplace application, enrollment, and eligibility-verification 
controls using 18 fictitious identities. GAO submitted or attempted to 
submit applications through the Marketplace in several states by 
telephone, online, and in-person. Details of the target areas are not 
disclosed, to protect GAO's undercover identities. GAO's tests were 
intended to identify potential control issues and inform possible 
further work. The results, while illustrative, cannot be generalized to 
the full population of applicants or enrollees. GAO provided details to 
CMS for comment, and made technical changes as appropriate.
_______________________________________________________________________
               patient protection and affordable care act
Observations on 18 Undercover Tests of Enrollment Controls for Health-
        Care Coverage and Consumer Subsidies Provided Under the Act
What GAO Found
    To assess the enrollment controls of the federal Health Insurance 
Marketplace (Marketplace), GAO performed 18 undercover tests, 12 of 
which focused on phone or online applications. During these tests, the 
Marketplace approved subsidized coverage under the Patient Protection 
and Affordable Care Act (PPACA) for 11 of the 12 fictitious GAO 
applicants for 2014. The GAO applicants obtained a total of about 
$30,000 in annual advance premium tax credits, plus eligibility for 
lower costs due at time of service. For 7 of the 11 successful 
fictitious applicants, GAO intentionally did not submit all required 
verification documentation to the Marketplace, but the Marketplace did 
not cancel subsidized coverage for these applicants. While these 
subsidies, including those granted to GAO's fictitious applicants, are 
paid to health-care insurers, and not directly to enrolled consumers, 
they nevertheless represent a benefit to consumers and a cost to the 
government. GAO's undercover testing, while illustrative, cannot be 
generalized to the population of all applicants or enrollees. GAO 
shared details of its observations with the Centers for Medicare and 
Medicaid Services (CMS) during the course of its testing, to seek 
agency responses to the issues raised. Other observations included the 
following:

    The Marketplace did not accurately record all inconsistencies. 
        Inconsistencies occur when applicant information does not match 
        information available from Marketplace verification sources. 
        Also, the Marketplace resolved inconsistencies from GAO's 
        fictitious applications based on fictitious documentation that 
        GAO submitted. Overall, according to CMS officials, the 
        Marketplace did not terminate any coverage for several types of 
        inconsistencies, including Social Security data or 
        incarceration status.
    Under PPACA, filing a federal income-tax return is a key control 
        element, designed to ensure that premium subsidies granted at 
        time of application are appropriate based on reported applicant 
        earnings during the coverage year. GAO, however, found errors 
        in information reported by the Marketplace for tax filing 
        purposes for 3 of its 11 fictitious enrollees, such as 
        incorrect coverage periods and subsidy amounts.
    The Marketplace automatically reenrolled coverage for all 11 
        fictitious enrollees for 2015. Later, based on what it said 
        were new applications GAO's fictional enrollees had filed--but 
        which GAO did not itself make--the Marketplace terminated 
        coverage for 6 of the 11 enrollees, saying the fictitious 
        enrollees had not provided necessary documentation. However, 
        for five of the six terminations, GAO subsequently obtained 
        reinstatements, including increases in premium tax-credit 
        subsidies.

    For an additional six applicants, GAO sought to test the extent to 
which, if any, in-person assisters would encourage applicants to 
misstate income in order to qualify for income-based subsidies during 
coverage year 2014. However, GAO was unable to obtain in-person 
assistance in 5 of the 6 undercover attempts. For example, an assister 
told GAO that it only provided help for those applying for Medicaid and 
not health-care insurance applications. Representatives of these 
organizations acknowledged the issues GAO raised in handling of the 
inquiries. CMS officials said that their experience from the first 
open-enrollment period helped improve training for the 2015 enrollment 
period.

_______________________________________________________________________

    Chairman Hatch, Ranking Member Wyden, and Members of the Committee:

    I am pleased to be here today to discuss enrollment for health-care 
coverage obtained through the federal health-insurance exchange 
established under the Patient Protection and Affordable Care Act 
(PPACA),\1\ and in particular, to discuss results of our undercover 
testing of eligibility and enrollment controls for the 2014 coverage 
year.\2\ We presented preliminary results in July 2014.\3\ Among other 
things, PPACA provides subsidies to those eligible to purchase private 
health-insurance plans who meet certain income and other requirements, 
and with those subsidies and other costs, represents a significant, 
long-term fiscal commitment for the federal government. According to 
the Congressional Budget Office, the estimated cost of subsidies and 
related spending under the act is $28 billion for fiscal year 2015, 
rising to $103 billion for fiscal year 2025, and totaling $849 billion 
for fiscal years 2016-2025. While subsidies under the act are not paid 
directly to enrollees, participants nevertheless benefit through 
reduced monthly premiums or lower costs due at time of service, such as 
copayments. Because subsidy costs are contingent on who obtains 
coverage, enrollment controls that help ensure only qualified 
applicants are approved for coverage with subsidies are a key factor in 
determining federal expenditures under the act.\4\
---------------------------------------------------------------------------
    \1\ Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended 
by the Health Care and Education Reconciliation Act of 2010 (HCERA), 
Pub. L. No. 111-152, 124 Stat. 1029 (Mar. 30, 2010). In this testimony, 
references to PPACA include any amendments made by HCERA.
    \2\ Specifically, our review covered the first open-enrollment 
period, from October 1, 2013 to March 31, 2014, as well as follow-on 
work through 2014 and into 2015 after close of the open-enrollment 
period.
    \3\ GAO, Patient Protection and Affordable Care Act: Preliminary 
Results of Undercover Testing of Enrollment Controls for Health-Care 
Coverage and Consumer Subsidies Provided Under the Act, GAO-14-705T 
(Washington, D.C.: July 23, 2014).
    \4\ According to Department of Health and Human Services' (HHS) 
Centers for Medicare & Medicaid Services (CMS) data, about 11.7 million 
people selected or were automatically reenrolled into a 2015 health 
insurance plan under the act. A high fraction of those enrollees--87 
percent, in states using the HealthCare.gov system--qualified for the 
premium tax-credit subsidy provided by the act, which is described 
later in this statement.

    PPACA, signed into law on March 23, 2010, expands the availability 
of subsidized health-care coverage, and provides for the establishment 
of health-insurance exchanges, or marketplaces, to assist consumers in 
comparing and selecting among insurance plans offered by participating 
private issuers of health-care coverage.\5\ Under PPACA, states may 
elect to operate their own health-care exchanges, or may rely on the 
federally facilitated exchange, known to the public as HealthCare.gov. 
These marketplaces were intended to provide a single point of access 
for individuals to enroll in private health plans, apply for income-
based subsidies to offset the cost of these plans--which are paid 
directly to health-insurance issuers--and, as applicable, obtain an 
eligibility determination for other health coverage programs, such as 
Medicaid or the Children's Health Insurance Program. The Department of 
Health and Human Services' (HHS) Centers for Medicare and Medicaid 
Services (CMS) is responsible for overseeing the establishment of these 
online marketplaces, and the agency maintains the federally facilitated 
exchange. At the time we began the work described in this statement, 
CMS was operating HealthCare.gov, also known as the Health Insurance 
Marketplace (Marketplace) in about two-thirds of the states.\6\
---------------------------------------------------------------------------
    \5\ Specifically, the act required, by January 1, 2014, the 
establishment of health-insurance exchanges in all states. In states 
not electing to operate their own exchanges, the federal government was 
required to operate an exchange.
    \6\ Specifically, in 34 states, the federal government operated 
individual exchanges. Two states operated their own exchanges, but 
applicants applied through HealthCare.gov. As of March 2015, the number 
of states had grown to 37, according to HHS's Office of the Assistant 
Secretary for Planning and Evaluation, with the Marketplace accounting 
for 76 percent (8.8 million) of consumers' plan selections.

    To be eligible to enroll in a qualified health plan offered through 
a marketplace, an individual must be a U.S. citizen or national, or 
otherwise lawfully present in the United States; reside in the 
marketplace service area; and not be incarcerated (unless incarcerated 
while awaiting disposition of charges). Marketplaces, in turn, are 
required by law to verify application information to determine 
eligibility for enrollment and, if applicable, determine eligibility 
for the income-based subsidies.\7\ These verification steps include 
validating an applicant's Social Security number, if one is provided; 
\8\ verifying citizenship, status as a national, or lawful presence 
with the Social Security Administration (SSA) or the Department of 
Homeland Security (DHS); and verifying household income and family size 
against tax-return data from the Internal Revenue Service (IRS), as 
well as data on Social Security benefits from the SSA.
---------------------------------------------------------------------------
    \7\ 42 U.S.C. Sec. 18081(c); 45 C.F.R. Sec. Sec. 155.310, 155.315, 
155.320.
    \8\ An exchange must require an applicant who has a Social Security 
number to provide the number. 42 U.S.C. Sec. 18081(b)(2) and 45 CFR 
Sec. 155.310(a)(3)(i).

    My statement today presents results and analysis from work 
originally requested by a number of congressional requesters.\9\ 
Specifically, today's statement (1) describes the final results of our 
undercover testing of the federal Marketplace's application, 
enrollment, and eligibility verification controls, including 
opportunities for potential enrollment fraud, for the act's first open-
enrollment period ending March 31, 2014; and (2) describes additional 
undercover testing in which we sought in-
person consumer assistance for federal Marketplace applications. Our 
control testing began in January 2014 and concluded in April 2015.
---------------------------------------------------------------------------
    \9\ Our original requesters were: in the U.S. Senate, the then-
ranking member of the Committee on Homeland Security and Government 
Affairs and the then-ranking member of the Committee on Finance; and in 
the U.S. House of Representatives, the then-chairman of the Committee 
on Ways and Means and the then-chairman of the Committee on Ways and 
Means, Subcommittee on Oversight.

    Our July 2014 testimony, which described the results of our work up 
to that time, focused on application for, and approval of, coverage for 
fictitious applicants.\10\ My statement today extends that work to the 
post-application process, including our maintenance of the fictitious 
applicant identities throughout 2014 and into 2015, payment of 
subsidized premiums on policies we obtained, and the Marketplace's 
verification process for applicant documentation. Thus, taken together, 
our two statements now cover the entire process of first obtaining, and 
then continuing, coverage for our fictitious applicants, from early 
2014 into 2015.
---------------------------------------------------------------------------
    \10\ GAO-14-705T.

    To perform our undercover testing of the Marketplace application, 
enrollment, and eligibility-verification process, we created 18 
fictitious identities for the purpose of making applications for 
individual health-care coverage by telephone, online, and in-
person.\11\ Because the federal government, at the time of our review, 
operated a marketplace on behalf of the state in about two-thirds of 
the states, we focused our work on those states. We selected three of 
these states for our undercover applications, and further selected 
target areas within each state.\12\ To maintain independence in our 
testing, we created our applicant scenarios without knowledge of 
specific control procedures, if any, that CMS or other federal agencies 
may use in accepting or processing applications. We thus did not create 
the scenarios with intent to focus on a particular control or 
procedure.\13\ The results obtained using our limited number of 
fictional applicants are illustrative and represent our experience with 
applications in the three states we selected. They cannot, however, be 
generalized to the overall population of all applicants or enrollees. 
In particular, our tests were intended to identify potential control 
issues and inform possible further work. We shared details of our work 
with CMS during the course of our testing, to seek agency responses to 
the issues we raised. We also provided details prior to this hearing, 
and made technical changes as appropriate.
---------------------------------------------------------------------------
    \11\ For all our applicant scenarios, we sought to act as an 
ordinary consumer would in attempting to make a successful application. 
For example, if, during online applications, we were directed to make 
phone calls to complete the process, we acted as instructed.
    \12\ We based the state selections on factors including range of 
population size, mixture of population living in rural versus urban 
areas, and number of people qualifying for income-based subsidies under 
the act. We selected target areas within each state based on factors 
including community size. To preserve confidentiality of our 
applications, we do not disclose here the number or locations of our 
target areas. We generally selected our states and target areas to 
reflect a range of characteristics.
    \13\ We were aware of general eligibility requirements, however, 
from public sources such as websites.

    For 12 of the 18 applicant scenarios, we chose to test controls for 
verifications related to the identity or citizenship/immigration status 
of the applicant.\14\ This approach allowed us to test similar 
scenarios across different states. We made half of these applications 
online and half by phone. In these tests, we also stated income at a 
level eligible to obtain both types of income-based subsidies available 
under PPACA--a premium tax credit and cost-sharing reduction.\15\ Our 
tests included fictitious applicants who provided invalid Social 
Security identities, noncitizens claiming to be lawfully present in the 
United States, and applicants who did not provide Social Security 
numbers. As appropriate, in our applications for coverage and 
subsidies, we used publicly available information to construct our 
scenarios. We also used publicly available hardware, software, and 
materials to produce counterfeit or fictitious documents, which we 
submitted, as appropriate for our testing, when instructed to do so. We 
then observed the outcomes of the document submissions, such as any 
approvals received or requests to provide additional supporting 
documentation. We began this control testing in January 2014 and 
concluded it in April 2015. We also obtained data from CMS on applicant 
submission of required verification documentation. These data listed 
document submission status as of April 2015 for the act's first open-
enrollment period, including for our undercover applications.
---------------------------------------------------------------------------
    \14\ As noted earlier, to be eligible to enroll in a qualified 
health plan offered through a marketplace, an individual must be a U.S. 
citizen or national, or otherwise lawfully present in the United 
States; reside in the marketplace service area; and not be incarcerated 
(unless incarcerated while awaiting disposition of charges). 
Marketplaces, in turn, are required by law to verify application 
information to determine eligibility for enrollment and, if applicable, 
determine eligibility for the income-based subsidies.
    \15\ To qualify for these income-based subsidies, an individual 
must be eligible to enroll in marketplace coverage; meet income 
requirements; and not be eligible for coverage under a qualifying plan 
or program, such as affordable employer-sponsored coverage, Medicaid, 
or the Children's Health Insurance Program. Cost-sharing reduction 
(CSR) is a discount that lowers the amount consumers pay for out-of-
pocket charges for deductibles, coinsurance, and copayments. Because 
the benefit realized through the CSR subsidy can vary according to 
medical services used, the value to consumers of such subsidies can 
likewise vary.

    For the remaining 6 of our 18 applicant scenarios to examine 
enrollment through the Marketplace, we sought to test only income-
verification controls. We randomly selected three ``Navigator'' and 
three non-Navigator in-person assisters in our target areas.\16\ For 
half of these 6 applications, our applicant planned to state income 
slightly above the maximum amount allowable for income-based subsidies, 
while for the others, our applicant planned to state income slightly 
below the range eligible for these subsidies. We sought to determine 
the extent to which, if any, in-person assisters might encourage our 
undercover applicants to misstate income in order to qualify for either 
of the income-based PPACA subsidies. We chose to limit our review of 
those providing in-person assistance to the extent we encountered these 
assisters as part of our enrollment control testing. A full examination 
of in-person assistance, including issues other than eligibility and 
enrollment, was beyond the scope of our work. Overall, our review 
covered the act's first open-enrollment period, from October 1, 2013 to 
March 31, 2014, as well as follow-on work through 2014 and into 2015 
after close of the open-enrollment period.
---------------------------------------------------------------------------
    \16\ For the 2014 coverage year, CMS awarded $67 million in grants 
for ``Navigators,'' which are individuals or organizations that are to 
provide, without charge, impartial health-insurance information to 
consumers, and to help them complete eligibility and enrollment forms. 
In addition, such aid is also to be available from other in-person 
assisters (``non-Navigators'') who generally perform the same functions 
as Navigators, but are funded through separate grants or contracts. 
Navigators and non-Navigator assisters must complete comprehensive 
training, according to CMS. Through the HealthCare.gov website, CMS 
published a state-by-state list of where in-person assistance can be 
obtained.

    We plan to issue a final report, with recommendations, on our 
undercover eligibility- and enrollment-controls testing. We are 
conducting our audit work in accordance with generally accepted 
government auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence we obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We conducted our related investigative work in accordance 
with investigative standards prescribed by the Council of the 
Inspectors General on Integrity and Efficiency.
   the federal marketplace approved subsidized coverage for 11 of 12 
   fictitious applicants in 2014, with coverage continuing into 2015
We Obtained Coverage for 11 of 12 Fictitious Applicants by Using the 
        Telephone 
        Application Process and Bypassing Online Identity Verification
    As we described in our July 2014 testimony, the federal Marketplace 
approved subsidized coverage for 11 of 12 fictitious applicants who 
initially applied online or by telephone. For the 11 approved 
applications, we paid the required premiums to put health-insurance 
policies into force. We obtained the advance premium tax credit (APTC) 
in all cases, totaling about $2,500 monthly or about $30,000 annually 
for all 11 applicants. After receiving these premium subsidies, our 11 
fictitious applicants paid premiums at a total annual rate of about 
$12,000. We also obtained eligibility for cost-sharing reduction (CSR) 
subsidies.\17\ The APTC and CSR subsidies are not paid directly to 
enrolled consumers; instead, the federal government pays them to 
issuers of health-care policies on consumers' behalf. However, they 
represent a benefit to consumers--and a cost to the government--by 
reducing out-of-pocket costs for medical coverage.\18\ To receive 
advance payment of the premium tax credit, applicants agree they will 
file a tax return for the coverage year, and must indicate they 
understand that the premium tax credits paid in advance are subject to 
reconciliation on their federal tax return.
---------------------------------------------------------------------------
    \17\ Because the benefit realized through the CSR subsidy can vary 
according to medical services used, the value to consumers of such 
subsidies can likewise vary.
    \18\ Even if not obtaining subsidies, applicants can also benefit 
if they obtain coverage for which they would otherwise not qualify, 
such as by not being a U.S. citizen or national, or lawfully present in 
the United States.

    As we also reported in July 2014, for each of our 6 online 
applications (among the group of 12 applications made online and by 
phone), we failed to clear a required identity-checking step, and thus 
could not complete the process online. For online applications, the 
Marketplace employs a process known as ``identity proofing'' to verify 
an applicant's identity.\19\ It does so by using personal and financial 
history on file with a credit reporting agency contracted by the 
Marketplace. The Marketplace generates questions, based on information 
on file with the contractor, that only the applicant is believed likely 
to know.\20\ If an applicant's identity cannot be verified online, 
applicants are directed to call the credit reporting agency for 
assistance.\21\ If the credit reporting agency then cannot verify 
identity, applicants are typically told to contact the federal 
Marketplace or their state-based exchange, credit-reporting agency 
officials told us.
---------------------------------------------------------------------------
    \19\ According to CMS, the purpose of identity proofing is to 
prevent someone from creating an account and applying for health 
coverage based on someone else's identity and without their knowledge. 
Although intended to counter such identity theft involving others, 
identity proofing thus also serves as an enrollment control for those 
applying online.
    \20\ According to executives of the contractor that performs the 
identity proofing, about 78 percent of applicants overall that have 
attempted identity proofing online for the 2014 and 2015 application 
cycles were successful, across the federal Marketplace and state 
exchanges combined. The contractor officials said that the 78 percent 
success rate is marginally lower than the general success rate for 
identity-proofing services the contractor provides. This lower rate, 
the contractor told us, is likely due to the health-care exchange 
population being less likely to have an ``electronic footprint'' upon 
which identity proofing is based. The contractor executives said that 
the remaining 22 percent did not necessarily fail the identity 
proofing. In many cases, the contractor was not able to locate the 
applicant in its records, or the applicant did not respond to the 
questions for identity verification.
    \21\ According to the contractor, about 560,000 telephone inquiries 
were made to the contractor from October 2013 to April 1, 2015, after 
applicants did not pass the online identity proofing. In about 35 
percent of those cases, identity could be verified.

    We subsequently were able to obtain coverage for all six of these 
applications that we began online by completing them by phone. By 
following instructions to make telephone contact with the Marketplace, 
we circumvented the initial identity-
proofing control that had stopped our online applications. When we 
later asked CMS officials about this difference between online and 
telephone applications, they told us that unlike with online 
applications, the Marketplace allows phone applications to be made on 
the basis of verbal attestations by applicants, given under penalty of 
---------------------------------------------------------------------------
perjury, who are directed to provide supporting documentation.

    For our 6 phone applications, we successfully completed the 
application process, with the exception of one applicant who declined 
to provide a Social Security number and was not allowed to proceed.\22\ 
After being approved for coverage, we received enrollment material from 
insurers for each of our 11 successful fictitious applicants. Appendix 
I summarizes outcomes for all 12 of our phone and online 
applications.\23\
---------------------------------------------------------------------------
    \22\ As shown in app. I, three of our applicants did not provide 
Social Security numbers. While one of them was not allowed to proceed, 
the other two were allowed to complete applications. Our purported 
rationale for not providing the numbers was concern about personal 
privacy.
    \23\ We shared with CMS details on our successfully obtaining 
coverage, during the course of our review, in March 2015.

    The Marketplace is required to seek post-approval documentation in 
the case of certain application ``inconsistencies.'' Inconsistencies 
occur in instances in which information an applicant has provided does 
not match information contained in data sources that the Marketplace 
uses for eligibility verification at time of application, or such 
information is not available. For example, an applicant might state 
income at a particular amount, but his or her federal tax return lists 
a different amount, or the applicant has no tax return on file. 
Likewise, the applicant may provide a Social Security number, but it 
does not match information on file with the SSA. If there is such an 
application inconsistency, the Marketplace is to determine eligibility 
using attestations of the applicant, and ensure that subsidies are 
provided on behalf of the applicant, if he or she is eligible to 
receive them, while the inconsistency is being resolved using ``back-
end'' controls. Thus, the Marketplace was required to approve 
eligibility to enroll in health-care coverage and to receive subsidies 
for each of our 11 fictitious applicants while the inconsistencies were 
being addressed.\24\ At the time of our July 2014 testimony, we had 
begun to receive notifications from the Marketplace on the outcomes of 
our fictitious document submissions. As discussed later in this 
statement, we continued to receive additional notices about our 
applicants through 2014 and into 2015.
---------------------------------------------------------------------------
    \24\ According to CMS officials, the federal Marketplace makes 
eligibility determinations. Private insurers, also called ``issuers,'' 
provide coverage.
---------------------------------------------------------------------------
Federal Marketplace Communications With Our 11 Successful Fictitious 
        Enrollees About Their Applications Were Unclear or Incomplete
    In all 11 cases in which we obtained coverage, the Marketplace 
directed us, either orally or in writing, to send supporting 
documentation. However, the Marketplace did not always provide clear 
and complete communications. As a result, during our testing, we did 
not always know the current status of our applications or specific 
documents required in support of them. Examples include the following:

    Unclear correspondence. Rather than stating a message directly, 
        correspondence instead was conditional or nonspecific, stating 
        the applicant may be affected by something, and then leaving it 
        to the applicant to parse through details to see if they were 
        indeed affected.

    Inaccurate guidance. The Marketplace directed 8 of our 11 
        successful applicants to submit additional documentation to 
        prove citizenship and identity--but an accompanying list of 
        suitable documents that could be sent in response consisted of 
        items for proving income.

    Lack of Marketplace notice on document submissions. In five cases, 
        we did not receive any indication on whether information sent 
        in response to Marketplace directives was acceptable. As a 
        result, we had to call the Marketplace to obtain status 
        information. According to CMS, after documents are processed, 
        consumers will receive a written notice.

    Lack of written notice. In one case, the Marketplace did not 
        provide us with any written correspondence directing we submit 
        additional documentation. The Marketplace only requested 
        documentation for the initial enrollment during our phone 
        application for coverage. According to the Marketplace, 
        applicants are to receive written notice of documentation 
        required.\25\
---------------------------------------------------------------------------
    \25\ We shared with CMS details on communication issues we 
encountered, during the course of our review, in March 2015.

    CMS officials told us they are working to improve communication 
with consumers, and will make improvements in consumer notices. 
According to the officials, they are soliciting feedback from consumer 
advocates, call-center representatives, and application assisters to 
improve such communications. According to the officials, CMS has 
already made significant improvements that include adding a complete 
list of acceptable documents to resolve citizenship and immigration 
status inconsistencies, and consolidating warning notices to include 
all inconsistency issues. CMS is currently working on further 
improvements in notices, including those for eligibility and instances 
of insufficient documentation, according to the officials.
Our 11 Fictitious Enrollees Maintained Subsidized Coverage Throughout 
        2014, Even Though We Sent Fictitious Documents, or No 
        Documents, to Resolve Application Inconsistencies
    As part of our testing, and in response to Marketplace directives, 
we provided follow-up documentation, albeit fictitious.\26\ Overall, as 
shown in appendix II, we varied what we submitted by application--
providing all, none, or only some of the material we were told to 
send--in order to test controls and note any differences in outcomes. 
Among the 11 applications for which we were directed to send 
documentation, we submitted
---------------------------------------------------------------------------
    \26\ Any documentation we supplied was, like our initial 
applications, fictitious, having been fabricated by us using 
commercially available hardware, software, and materials.

    all requested documentation for four applications,
    partial documentation for four applications, and
    no documentation for the remaining three applications.

    Although our documentation was fictitious, and in some cases we 
submitted none, or only some, of the documentation we were directed to 
send, we retained our coverage for all 11 applicants through the end of 
the 2014 coverage year. As described earlier, APTC subsidies our 
applicants received totaled about $30,000 annually, and further 
financial benefit would have been available through CSR subsidies if we 
had obtained qualifying medical services. Following our document 
submissions, the Marketplace told us, either in writing or in response 
to phone calls, that the required documentation for all our approved 
applicants had been received and was satisfactory. In one case, when we 
called the Marketplace to inquire about the status of our documentation 
submission--but where we had not actually submitted any documents--a 
representative told our applicant that documents had been reviewed and 
processed, and, ``There is nothing else to do at this time.'' Figure 1 
shows a portion of a call in which a Marketplace representative said 
our documentation was complete, even though we did not submit any 
documents.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    For one applicant, the Marketplace did subsequently state in a 
November 2014 letter that we would lose our subsidies, beginning in 
December 2014. However, there was no follow-up communication regarding 
the loss of our subsidies, and the subsidies were not terminated in 
December 2014.

    On the basis of applicant data we obtained from CMS, the 
Marketplace cleared inconsistencies for some of our 11 fictitious 
applications in instances where we submitted bogus documents.\27\ 
Appendix III contains a summary of our document requests and 
submissions. We also noted instances where the Marketplace either did 
not accurately capture all inconsistencies, or resolved inconsistencies 
based on suspect documentation, including the following:
---------------------------------------------------------------------------
    \27\ The inconsistency data we obtained listed status as of April 
2015 for all inconsistencies generated during the first open-enrollment 
period, including those for our undercover applications. For this 
statement, we examined only inconsistency information for our 
applications, but we plan to make a broader analysis as part of ongoing 
work.

    Did not capture all inconsistencies. For 3 of the 11 applicants, 
        while the Marketplace at the outset directed our applicants to 
        provide documentation of citizenship/immigration status, the 
        CMS applicant data we later received for these applicants do 
---------------------------------------------------------------------------
        not reflect inconsistencies for the items initially identified.

    Disqualifying income. For 2 of the 11 applicants, we reported 
        income substantially higher than the amount we initially stated 
        on our applications, and at levels that should have 
        disqualified our applications from receiving subsidies. 
        However, according to the CMS data, the Marketplace resolved 
        our income inconsistencies and, as noted, our APTC and CSR 
        subsidies for both applicants continued.

    In addition to having fictitious documentation approved, two of our 
applicants also received notices in early 2015 acknowledging receipt of 
documents recently submitted, when we had not sent any such documents. 
We do not know why we received these notices.
The CMS Document-Verification Process Is Not Designed to Identify 
        Fraudulent Applications
    We found that the CMS document-processing contractor is not 
required to seek to detect fraud.\28\ It is only required to inspect 
for documents that have obviously been altered. According to contractor 
executives we spoke with, the contractor personnel involved in the 
document-verification process are not trained as fraud experts and do 
not perform antifraud duties. In particular, the executives told us, 
the contractor does not certify the authenticity of submitted 
documents, does not engage in fraud detection, and does not undertake 
investigative activities. In the contractor's standard operating 
procedures for its work for CMS, document-review workers are directed 
to ``determine if the document image is legible and appears unaltered 
by visually inspecting it.'' Further, according to the contractor, it 
is not equipped to attempt to identify fraud, and does not have the 
means to judge whether documents submitted might be fraudulent.
---------------------------------------------------------------------------
    \28\ Fraud involves obtaining something of value through willful 
misrepresentation. Whether conduct is in fact fraudulent is a 
determination to be made through the judicial or other adjudicative 
system. For information generally on fraud controls, see GAO, 
Individual Disaster Assistance Programs: Framework for Fraud 
Prevention, Detection, and Prosecution, GAO-06-954T (Washington, D.C.: 
July 12, 2006).

    CMS officials told us there have been no cases of fraudulent 
applications or documentation referred to the U.S. Department of 
Justice or the HHS Office of Inspector General, because its document-
processing contractor has not identified any fraud cases to CMS. 
However, as noted earlier, the contractor is not required to detect 
fraud, nor is it equipped to do so. According to the CMS officials, 
---------------------------------------------------------------------------
there has been ``no indication of a meaningful level of fraud.''

    According to CMS officials, it would not be practical to have 
applicants show original documents at time of application. With the 
HealthCare.gov website, the agency decided to move away from in-person 
authentication, in order to avoid burden on consumers, the officials 
told us. They also said in-person presentation of documentation is not 
possible in the current structure, as there are insufficient resources 
to establish a system to do so.

    Overall, according to CMS officials, the agency has limited ability 
to respond to attempts at fraud. They told us CMS must balance 
consumers' ability to ``effectively and efficiently'' select 
Marketplace coverage with ``program-integrity concerns.'' CMS places a 
strong emphasis on program integrity and builds program integrity 
features into all aspects of implementation of the law, according to 
CMS officials. In any case, the CMS officials said the design of the 
program does not allow for direct consumer profit from fraud, because 
APTC and CSR subsidies are paid to policy issuers, not consumers. We 
note, however, that even so, the subsidies nevertheless can produce 
direct financial benefits to consumers. For example, if consumers elect 
to receive the premium tax credit in advance, that lowers the cost of 
monthly coverage. A consumer could also receive the advance premium tax 
credit and not file a federal tax return, as required to ensure proper 
treatment of the credit. Likewise, CSR subsidies mean smaller out-of-
pocket expenses when obtaining medical services. Accordingly, although 
subsidies may be paid directly to issuers, they still result in a cost 
to the government and a benefit to enrollees.

    CMS officials told us the agency plans to conduct an assessment of 
the Marketplace's eligibility determination process, including the 
application process and the inconsistency resolution process. They did 
not provide a firm date for completion, saying the review would depend 
on obtaining IRS information for use as a reference.
Four of Our 11 Applicants Continued to Receive Subsidized Coverage for 
        2014, 
        Likely Because CMS Waived Documentation Requirements
    According to the applicant data we obtained from CMS, most of our 
applications had unresolved inconsistencies--indicating either that the 
Marketplace did not receive requested documentation or the 
documentation was not satisfactory. Specifically, as shown in appendix 
III, the CMS data indicate that, as of April 2015, 7 of our 11 
applications had at least one inconsistency that remained unresolved.

    Because we did not disclose the specific identities of our 
fictitious applicants, CMS officials said they could not explain our 
findings on handling of inconsistencies for our applications.\29\ 
However, in general, they said our subsidized policies may have 
remained in effect during 2014 because CMS waived certain document 
filing requirements. Specifically, CMS directed its document contractor 
not to terminate policies or subsidies if an applicant submitted any 
documentation to the Marketplace. That is, if an applicant submitted at 
least one document, whether it resolved an inconsistency or not, that 
would be deemed sufficient so that the Marketplace would not terminate 
either the policy or subsidies of the applicant, even if other 
documentation had initially been required.\30\ For example, for one of 
our applicants, the Marketplace requested citizenship, income, and 
identity documents, but our applicant submitted only identity 
information. Under the CMS directive, the applicant's policy and 
subsidies continued through 2014 because our applicant submitted at 
least one document to the Marketplace, but not all documents required. 
Thus, in the case of our four applicants that submitted partial 
documentation to the Marketplace, we likely were relieved of the 
obligation for submitting all documents for the 2014 plan year.
---------------------------------------------------------------------------
    \29\ GAO's standard practice is to not disclose identifiers 
associated with undercover identities and operatives, in order to 
protect use of this sensitive investigative technique, which can yield 
results not obtainable through other means.
    \30\ For example, in the case of an income inconsistency, 
contractor procedures stated there will not be action taken ``if the 
consumer or anyone in the household has sent any supporting document . 
. . regardless of the relevance of the document to the Annual Income 
inconsistency.'' For instance, there will be no action on the income 
issue ``if the consumer or household member has sent a document 
relating to immigration, even though that document cannot be used to 
resolve the Annual Income inconsistency.'' relieved of the obligation 
for submitting all documents for the 2014 plan year.

    For the 2014 plan year, PPACA authorized CMS to extend the period 
for applicants to resolve inconsistencies unrelated to citizenship or 
lawful presence.\31\ Additionally, regulations state that CMS may 
extend the period for an applicant to resolve any type of inconsistency 
when the applicant demonstrates a ``good faith effort'' to submit 
documentation.\32\ CMS officials told us they relied upon these 
authorities to make a policy decision to broadly extend the period for 
resolving all types of inconsistencies in 2014. Under the policy, the 
officials told us, the submission of a single document served as 
evidence of a good faith effort by the applicant to resolve all 
inconsistencies, and therefore extended the resolution period through 
the end of 2014.\33\ As such, CMS did not terminate any applicant who 
``demonstrated a good faith effort'' in 2014. The officials told us 
that CMS is enforcing the full submission requirement for 2015, and 
that any good-faith extensions granted in 2015 would be decided on a 
case-by-case basis and be limited in length. All consumers, regardless 
of whether they benefitted from the good-faith effort extension in 
2014, will still be subject to deadlines for filing sufficient 
documentation, they said. In particular, according to the officials, 
those who made a good-faith effort by submitting documentation, but 
failed to clear their inconsistencies in 2014, were among the first 
terminations in 2015, which they said took place in February and early 
March. We are continuing to seek further information from CMS officials 
on their good-faith effort policy, as well as any 2015 terminations, as 
part of ongoing work.
---------------------------------------------------------------------------
    \31\ 42 U.S.C. Sec. 18081(e)(4)(A).
    \32\ 45 CFR Sec. 155.315(f)(3).
    \33\ We did not find any public announcement of CMS's decision to 
apply the good-faith provision.

    Although the good-faith effort policy could explain the handling of 
some of our applications, CMS officials could not provide a general 
explanation for the three applications for which we submitted no 
documentation but our subsidized coverage remained. However, based on 
our examination of applicant files at the CMS document contractor, this 
could be due to an error in the CMS enrollment system. Specifically, we 
found instances in which records we reviewed showed that applicants had 
not enrolled in a plan, when they actually had done so. Contractor 
officials told us that in such cases, they did not terminate the plans 
or subsidies because the applicants were shown as not enrolled. We plan 
to address this issue of tracking of inconsistencies in our ongoing 
---------------------------------------------------------------------------
work.

    Also included among the unresolved inconsistencies for our 
applicants were four for Social Security numbers. According to CMS 
officials, inconsistencies for Social Security numbers occur when an 
applicant's name, date of birth, and Social Security number cannot be 
validated in an automated check with SSA. The officials told us that 
systems capability has not allowed CMS's document contractor to make 
terminations for such inconsistencies. They also said the agency has 
done no analysis of the fiscal effect of not making such terminations. 
We plan to address this issue in ongoing work.\34\ In addition, CMS 
officials told us that although it checks applicants or enrollees 
against SSA's Death Master File, it currently does not have the systems 
capability to change coverage if a death is indicated. Instead, the 
officials told us, the Marketplace has established a self-reporting 
procedure for individuals to report a consumer's death in order to 
remove the consumer from coverage. The number of reported deaths from 
SSA is ``very minimal,'' according to CMS officials.
---------------------------------------------------------------------------
    \34\ CMS officials also told us the agency did not pursue 
terminations for inconsistencies involving American Indian status and 
presence of employer-sponsored or minimum essential coverage. For 
incarceration status (incarcerated individuals are generally not 
eligible for coverage), CMS officials said the agency accepted 
applicant attestations after determining that the SSA prisoner database 
was unreliable.
---------------------------------------------------------------------------
The Marketplace Automatically Reenrolled Coverage for All 11 Fictitious 
        Applicants for 2015
    The coverage we obtained for our 11 fictitious applicants contained 
an automatic reenrollment feature--both insurers and the Marketplace 
notified us that if we took no action, we would automatically be 
enrolled in the new coverage year (2015).\35\ In all 11 of our cases, 
we took no action and our coverage was automatically reenrolled in 
January 2015. We continued to make premium payments, in order to 
demonstrate continuation of subsidized coverage, which meant continuing 
costs for the federal government. Appendix IV summarizes our automatic 
reenrollments.
---------------------------------------------------------------------------
    \35\ Under a CMS policy adopted in September 2014 for the 2015 
coverage year, generally, if consumers do nothing, they will be 
automatically enrolled in the same plan with the same premium tax 
credit and other financial assistance. Consumers whose 2013 tax return 
indicates they had very high income, or who did not give the 
Marketplace permission to check updated tax information for annual 
eligibility redetermination purposes, were to be automatically enrolled 
but without financial assistance if they do not return to 
HealthCare.gov. CMS said this process provides continuity of coverage 
and safeguards public funds. See
    http://cms.gov/Newsroom/MediaReleaseDatabase/Fact-sheets/2014-Fact-
sheets-items/2014-09-02.html?DLPage=1&DLSort=0&DLSortDir=descending, 
accessed July 8, 2015.

    Although we obtained automatic reenrollments, we found 
communications from the Marketplace leading up to the end of 2014 to be 
---------------------------------------------------------------------------
contradictory or erroneous. Examples include the following:

    As noted earlier, our applicants were notified they would 
        automatically be reenrolled for the new coverage year. But most 
        of the applicants also received, to varying degrees, notices to 
        reapply or to take some type of action. For example, we 
        received notices stating: ``Official Notice: Your 2015 
        application is ready,'' ``Action Needed: Your 2015 health 
        coverage,'' and ``Follow these steps to re-
        enroll by December 15.'' The message and frequency of these 
        notices could create uncertainty among applicants who believed 
        they need not take any action to remain enrolled.

    In correspondence to our applicants, the Marketplace referred to 
        things that could not have happened. In four cases in the 
        latter part of 2014, Marketplace correspondence referred to the 
        filing of federal tax returns of our applicants, even though 
        our applicants never filed a tax return.

    In four cases, our enrollees received notices directing them to 
        send additional information in order to continue coverage, 
        saying they could lose coverage if they did not--but the 
        deadline for submission was a date that had passed months 
        earlier. For example, one enrollee received such a notice in 
        December 2014, advising that coverage might be lost six months 
        earlier, in June 2014.

    As mentioned previously, CMS officials told us they are working to 
improve communication with consumers, and will make improvements in 
consumer notices.
CMS Provided Inaccurate Tax Information for 3 of 11 Fictitious 
        Applicants
    Under PPACA, an applicant's filing of a federal income-tax return 
is a key element of back-end controls. When applicants apply for 
coverage, they report family size and the amount of projected income. 
Based, in part, on that information, the Marketplace will calculate the 
maximum allowable amount of advance premium tax credit. An applicant 
can then decide if he or she wants all, some, or none of the estimated 
credit paid in advance, in the form of payment to the applicant's 
insurer that reduces the applicant's monthly premium payment.

    If an applicant chooses to have all or some of his or her credit 
paid in advance, the applicant is required to ``reconcile'' on his or 
her federal tax return the amount of advance payments the government 
sent to the applicant's insurer on the applicant's behalf with the tax 
credit for which the applicant qualifies based on actual reported 
income and family size.\36\
---------------------------------------------------------------------------
    \36\ To receive advance payment of the tax credit at time of 
application, applicants must pledge to file a tax return. The actual 
premium tax credit for the year will differ from the advance tax credit 
amount calculated by the Marketplace if family size and income as 
estimated at the time of application are different from family size and 
household income reported on the tax return. If the actual allowable 
credit is less than the advance payments, the difference, subject to 
certain caps, will be subtracted from the applicant's refund or added 
to the applicant's balance due. On the other hand, if the allowable 
credit is more than the advance payments, the difference is added to 
the refund or subtracted from the balance due.

    To facilitate this reconciliation process, the Marketplace sends 
enrollees Form 1095-A, which reports, among other things, the amount of 
advance premium tax credit paid on behalf of the enrollee. This 
information is necessary for enrollees to complete their tax returns. 
The accuracy of information reported on this form, then, is important 
for determining an applicant's tax liability, and ultimately, 
---------------------------------------------------------------------------
government revenues.

    We found errors with the information reported on 1095-A forms for 3 
of our 11 fictitious applicants.\37\ In two cases, we received multiple 
forms containing different information for the same applicant. In all 
three cases, the forms did not accurately reflect the number of months 
of coverage, thus misstating the advance premium tax credits received. 
In one of the cases, for instance, the form did not include a couple of 
months of advance premium tax credit that was received and, as a 
result, understated the advance premium tax credit received by more 
than $600. Appendix V shows complete results for tax forms we received. 
Because we did not provide CMS with detailed information about the 
specific cases, CMS officials said they could not conduct research and 
explain why these errors occurred. In general, CMS officials told us 
the agency made quality checks on tax information before mailings to 
consumers.\38\
---------------------------------------------------------------------------
    \37\ The errors we encountered were of a different type than those 
announced by CMS in February 2015, when the agency said about 800,000 
tax filers had received Forms 1095-A that listed incorrect benchmark 
plan premium amounts. For details, see
    http://blog.cms.gov/2015/02/20/what-consumers-need-to-know-about-
corrected-form-1095-as/ accessed on June 30, 2015.
    \38\ We shared with CMS details on errors in our applicants' 1095-A 
forms, during the course of our review, in March 2015.

    During our testing work, we also identified that unlike advance 
premium tax credits, CSR subsidies are not subject to a recapture 
process such as reconciliation on the taxpayer's federal income-tax 
return. In discussions with CMS and IRS officials, we found that the 
federal government has not established a process to identify and 
recover the value of CSR subsidies that have been provided to our 
fictitious enrollees improperly. These subsidies increase government 
costs; and, according to IRS, excess CSR payments, if not recovered by 
CMS, would be taxable income to the individual for whom the payment was 
made. We are continuing to seek information from CMS on any efforts to 
recover costs associated with subsidy reductions or eliminations due to 
unresolved inconsistencies.
The Marketplace Later Terminated Subsidized Coverage for 6 of Our 11 
        Applicants in Early 2015, but We Restored Coverage for 5 of 
        These Applicants--With Larger Subsidies
    In December 2014, the Marketplace sent notifications to 5 of our 11 
applicants, indicating that we had filed new applications for 
subsidized coverage. In four of these notices, the Marketplace stated 
our subsidies or coverage, or both, would be terminated if we failed to 
provide supporting documentation. However, we had not filed any such 
applications, nor, as described earlier, had we sought any 
redetermination of subsidies. Because each of our fictitious applicants 
earlier received either written or verbal assurances from the 
Marketplace that documentation had been received and no further action 
was necessary, we did not respond to these requests to submit 
supporting documentation.

    A few months later, the Marketplace terminated coverage or 
subsidies for six applicants, including four applicants who had 
received notice of new applications in December 2014, and two 
applicants who had not received notice of a new application. The 
termination notices cited failure to respond to requests to submit 
documentation in support of what were claimed to be the new 
applications we submitted. Our remaining five applicants continued 
receiving subsidized coverage without interruption.\39\ Following the 
termination notices, we elected to pursue continued coverage for the 
six cases as part of our testing, even though we had not filed the 
claimed new applications. Each of our six fictitious applicants that 
lost coverage or subsidies made phone inquiries to the Marketplace for 
an explanation of the terminations. In three of these inquiries, the 
Marketplace representatives told our applicants that they were required 
to file a new application or supporting documentation each year. 
However, as described earlier, notifications we received earlier from 
the Marketplace and insurers told us that no actions were needed to 
automatically reenroll in our plans other than to continue to pay 
premiums. In addition, as noted, other applicants did not receive 
notices of new applications being filed.\40\ We are continuing to seek 
from CMS information on this treatment of our applicants.\41\
---------------------------------------------------------------------------
    \39\ We shared with CMS details of our purported new applications, 
during the course of our review, in May 2015.
    \40\ Although our other applicants did not receive notices of new 
applications being filed, CMS officials told us that each year, a new 
application for the upcoming coverage year is created for those who 
have coverage through the Marketplace. To lessen consumer burden, the 
Marketplace pre-populates a new application using existing information, 
they said. According to the officials, CMS encourages applicants who 
wish to continue Marketplace coverage to update their application 
information during open-enrollment and decide what coverage they will 
need for the next year. If applicants do not contact the Marketplace to 
choose coverage by December 15th, the Marketplace will automatically 
re-enroll them in their current plan or a similar one, the CMS 
officials told us.
    \41\ For the general situation for reenrollment, see Centers for 
Medicare and Medicaid Services, Bulletin #14: Guidance for Issuers on 
2015 Reenrollment in the Federally-facilitated Marketplace (FFM), 
available at https://www.cms.gov/CCIIO/Resources/Regulations-and-
Guidance/Downloads/Bulletin14_Reenrollment_120114.pdf, accessed July 2, 
2015.

    Next, for each of these six fictitious applicants, we requested in 
Marketplace phone conversations reinstatement of coverage or subsidies. 
For five of the six applicants, the Marketplace approved reinstatement 
of subsidized coverage, while in the process also increasing total 
premium tax credit subsidies for all these applicants combined by a 
total of more than $1,000 annually.\42\ For the sixth applicant, a 
Marketplace representative said a caseworker must evaluate our 
situation. We were told we could not speak with the caseworker, and it 
could take the caseworker up to 30 days to resolve the issue. This 
applicant's case was still pending at the time we concluded our 
undercover activity in April 2015. Appendix VI summarizes outcomes for 
the unknown applications and terminations that followed for six of our 
applicants.
---------------------------------------------------------------------------
    \42\ In seeking restoration of coverage, we did not request any 
change in subsidies. The Marketplace provided us with new subsidy 
amounts in approving our restored coverage. According to CMS officials, 
factors that could affect subsidy amounts include use of updated 
federal poverty level income information; a change in plans available 
in the market, which affects calculation of subsidies; and a consumer 
aging. We did not make premium payments for these five applicants 
following reinstatement because the reinstatements occurred at the end 
of our undercover testing period.

    For three of the five applicants for whom we obtained reinstatement 
of subsidized coverage, we had open inconsistencies related to 
citizenship/immigration status remaining from our initial applications 
for 2014, according to CMS data. For each of these three applications, 
we had never submitted any citizenship or immigration documentation to 
the Marketplace for resolution. Nonetheless, we had subsidized coverage 
restored. We are continuing to seek from CMS any information on whether 
procedures allow repeated applications as a way to avoid document-
filing requirements.
We Were Unable To Obtain In-Person Assistance in Five of Six Undercover 
        Attempts To Test Income-Verification Controls, and Application 
        Assisters Subsequently Acknowledged Errors
    As described earlier, CMS has awarded grants for ``Navigators,'' 
which are to provide free, impartial health-insurance information to 
consumers. In addition, such aid is also to be available from other in-
person assisters (``non-Navigators'') who generally perform the same 
functions as Navigators, but are funded through separate grants or 
contracts.

    As described in our July 2014 statement, in addition to the 12 
online and telephone applications, we also attempted an additional 6 
in-person applications, seeking to test income-verification controls 
only.\43\ During our testing, we visited one in-person assister and 
obtained information on whether our stated income would qualify for 
subsidy. In that case, as shown in Figure 2, a Navigator correctly told 
us that our income would not qualify for subsidy. However, for the 
remaining five in-person applications, we were unable to obtain such 
assistance. We encountered a variety of situations that prevented us 
from testing our planned scenarios.\44\ We later returned to the 
locations, seeking explanations on why we could not obtain the 
advertised assistance, which are also shown in figure 2.\45\ 
Representatives of these organizations generally acknowledged the 
issues we raised in handling of our application inquiries.
---------------------------------------------------------------------------
    \43\ In these in-person applications, our planned approach was to 
discuss concerns about policy costs and to inquire whether there were 
ways to reduce the expenses, such as through income-based PPACA 
subsidies.
    \44\ For these six in-person applications, we randomly chose three 
Navigators and three non-Navigators in the target areas of our selected 
states. For the in-person applications, because our sole interest was 
any potential advice on reducing policy costs, we did not seek or 
obtain policies, as we did with our phone and online applications.
    \45\ These subsequent visits were not undercover, and we identified 
ourselves as being with GAO.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    We shared these results with CMS officials, who said they could not 
comment on the specifics of our cases without knowing details of our 
undercover applications. CMS officials said Navigators are required to 
accept all applicants, even if an organization's mission is to work 
with specific populations. If Navigators cannot provide timely help 
themselves, they must refer applicants to someone who can give 
assistance. CMS officials also said that they can terminate grant 
agreements, among other enforcement actions, if Navigators do not 
comply with terms of their awards. They cited as an example a 
corrective action taken in March 2015 against a Navigator grantee 
operating in several states for not providing the full range of 
activities it promised. CMS officials stressed to us Navigator training 
and experience from the first open-enrollment period helped improve 
training for the second enrollment period ending in February 2015. As 
noted earlier, our review of in-person assistance was limited to the 
extent we encountered Navigators and non-Navigators as part of our 
enrollment control testing. A full examination of in-person assistance 
---------------------------------------------------------------------------
was beyond the scope of our work.

    CMS officials told us there is no formal policy or specific 
guidance for situations such as the one we encountered in a case 
described in figure 2, in which an applicant is asked if he or she 
wishes to perform a service, such as volunteering for union activities, 
at the time the applicant seeks assistance. Still, CMS officials said 
Navigators would be discouraged from such activities while applicants 
seek help.

    CMS officials told us it is reasonable for consumers to think that 
if an assister is listed on the federal website as providing help--as 
were the assisters we selected--that assistance should be available as 
indicated. CMS officials told us the agency recognizes challenges with 
its online tool to find local assistance, and has been working to make 
changes. We are continuing to seek written documentation on these 
planned improvements.

    Chairman Hatch, Ranking Member Wyden, and Members of the Committee, 
this concludes my statement. I would be pleased to respond to any 
questions that you may have.
                 gao contact and staff acknowledgments
GAO Contacts
    For questions about this statement, please contact Seto J. Bagdoyan 
at (202) 512-6722 or BagdoyanS@gao.gov. Contact points for our Offices 
of Congressional Relations and Public Affairs may be found on the last 
page of this statement.
Staff Acknowledgements
    Individuals making key contributions to this statement, or our 2014 
statement reporting preliminary results, include: Matthew Valenta and 
Gary Bianchi, Assistant Directors; Maurice Belding; Mariana Calderon; 
Marcus Corbin; Carrie Davidson; Paul Desaulniers; Colin Fallon; Suellen 
Foth; Sandra George; Robert Graves; Barbara Lewis; Maria McMullen; 
James Murphy; George Ogilvie; Shelley Rao; Ramon Rodriguez; Christopher 
H. Schmitt; Julie Spetz; Helina Wong; and Elizabeth Wood.
               appendix i: undercover application results
    Figure 3 summarizes outcomes for all 12 of the undercover phone and 
online applications we made for coverage to the Health Insurance 
Marketplace (Marketplace) under the Patient Protection and Affordable 
Care Act, as part of our testing of eligibility and enrollment 
controls.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

       appendix ii: fictitious applicant documentation submitted
    Figure 4 shows, by application, the documentation we submitted in 
support of the 11 undercover applications that were successful. As part 
of our eligibility- and 
enrollment-controls testing, we varied what we submitted by 
application--providing all, none, or only some of the material we were 
told to send.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

   appendix iii: marketplace consideration of documentation submitted
    Figure 5 shows, by application, a summary of our document requests 
and submissions, with Marketplace communications on adequacy of the 
submissions, for the 11 undercover applications that were successful.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    a CMS officials said that any ID documents requested and 
submitted are reported under the citizenship status inconsistency. They 
said this is because ID information is not a distinct inconsistency, 
and that any such information is used as part of evaluating citizenship 
inconsistencies. As a result, CMS-reported status of inconsistencies, 
as shown in the table, does not include a separate item for ID status. 
We note, however, that Marketplace representatives specifically cited 
ID documents to our applicants, and that CMS online information, as 
well as letters sent to applicants, likewise refer to ID or documents 
that can be submitted to resolve an ID issue.
    b Although GAO applicants were not specifically 
requested at time of application to provide confirmation of Social 
Security number, data obtained from CMS listed separately a Social 
Security number inconsistency.
    c CMS data did not show an inconsistency for this 
category.
    d Indicates case where GAO submitted income at a level 
substantially higher than the amount initially stated on fictitious 
applications, and at levels making the applicant ineligible for income-
based subsidies.
    e Notwithstanding the status as reported by CMS, the 
applicant continued to receive coverage and subsidies.
                  appendix iv: automatic reenrollments
    Figure 6 summarizes automatic reenrollment activity at the end of 
the 2014 coverage year for the 11 undercover applications that were 
successful.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

               appendix v: accuracy of tax forms received
    Figure 7 summarizes receipt of Forms 1095-A, for reconciliation of 
advance premium tax credits received, for the 11 undercover 
applications that were successful.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

            appendix vi: restoration of subsidized coverage
    Figure 8 summarizes outcomes for the six applicants for whom the 
Marketplace terminated subsidies or coverage in early 2015. Prior to 
termination, four of these applicants had received notices of new 
applications filed, although we did not file any such applications. 
Following notice of the terminations, we restored subsidized coverage 
in five of six cases, with one case pending at the time we concluded 
our undercover activity.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                 ______
                                 
              Prepared Statement of Hon. Chuck Grassley, 
                        a U.S. Senator From Iowa
    GAO conducted an undercover operation to sign up fictitious 
individuals in Obamacare's marketplaces to try to determine if 
fictitious individuals could actually acquire Federal subsidies. A July 
2014 GAO report concluded that the answer is ``yes.''

    GAO created 12 fake applicants, and, for 11 of 12 applications 
which were made by phone and online using fictitious identities, GAO 
obtained subsidized coverage. For three of the 12 applications, GAO did 
not submit any documents requested of them by CMS and yet still 
received subsidized coverage.

    CMS has been aware of this issue since July 2014. Even so, the 11 
fake applicants were automatically re-enrolled. In 2015, coverage 
continued for all applicants until six were terminated for unclear 
reasons. However, GAO was able to reinstate five of the six with 
greater subsidy amounts.

    In addition, the administration has spent $120 million on 
``navigators'' to help people to sign up. Five out of six applicants 
did not receive any help from the navigators.

    The undercover GAO operation illustrates, yet again, that the 
Federal Government--and Obamacare in particular--is not working in the 
people's best interest.

    It is apparent that the Federal Government is not meeting the 
requirements of Federal law. For example, GAO provided false 
documentation, partial documentation, and sometimes no documentation to 
enroll in marketplaces. In response, CMS told GAO that the documents 
were satisfactory, and 10 out of 11 fictitious applicants continue to 
receive taxpayer subsidies.

    The GAO report noted that document processing contractors are not 
required to authenticate documentation. Marketplaces are required by 
law to verify applications to determine eligibility, not only for 
enrollment but also for subsidies. And CMS is allowing promises to take 
the place of paperwork.

    This GAO report documented systemic failures that leave the 
taxpayer on the hook for an even bigger bill.

                                 ______
                                 
              Prepared Statement of Hon. Orrin G. Hatch, 
                        a U.S. Senator From Utah
WASHINGTON--Senate Finance Committee Chairman Orrin Hatch (R-Utah) 
today delivered the following opening statement at a Committee hearing 
examining problems with HealthCare.gov enrollment controls:

    Good morning.

    Today's hearing will address controls at the HealthCare.gov 
website.

    Specifically, the committee will hear from the Director of Audit 
Services at the Government Accountability Office, Seto Bagdoyan. 
Director Bagdoyan's team has led an undercover ``secret shopper'' 
investigation to test the internal controls of HealthCare.gov and to 
review the Centers for Medicare & Medicaid Services' handling of this 
program.

    This investigation was designed to determine the degree to which 
the administration's federal health insurance exchange can protect 
against fraudulent applications, what happens when applicants provide 
false information and documentation, and whether the controls are 
successful in dealing with irregularities once they are found.

    Perhaps I should say ``spoiler alert'' before this next part. 
Today, Director Bagdoyan will explain how the federal exchange failed 
spectacularly on virtually all relevant accounts tested by GAO.

    For this investigation, GAO created fictitious identities to apply 
for premium tax subsidies through the federal health insurance 
exchange. We learned last year that 11 out of 12 fake applications were 
approved. CMS accepted fabricated documentation with these applications 
without attempting to verify its authenticity and enrolled fake 
applicants while handing out thousands of dollars in premium tax 
subsidies.

    Now, a year later, GAO has reported that nothing has changed and 
that, if anything, there are more problems.

    Worst of all, the administration has known about these problems for 
over a year now and has apparently not taken the necessary steps to 
rectify them. While CMS says that it is balancing consumer access to 
the system with program integrity concerns, I think it's pretty clear 
just what's going on here.

    Since the federal exchange was first implemented, success has been 
measured by the number of applicants who have signed up for insurance. 
Indeed, last year, when the administration reached its initial 
enrollment goal, critics of the law were told that we had been wrong 
all along and that the law was, despite all the evidence to the 
contrary, working just fine.

    However, with these findings from GAO, it seems obvious, at least 
to me, that the administration has been preoccupied with signing up as 
many applicants as possible, ignoring potential fraud and integrity 
issues along the way.

    Now, supporters of Obamacare often insist that it is ``the law of 
the land,'' and that Congress should work to improve, rather than 
repeal it.

    On the first point, these proponents are, unfortunately, correct. 
For the foreseeable future, the so-called Affordable Care Act is the 
law of the land.

    On the second point, Republicans in Congress continue to work 
toward repeal of the misguided law and its expensive mandates, 
regulations, penalties, and taxes, and replacement of it with patient-
centered reforms that put patients, rather than Washington bureaucrats, 
in charge of their health care decisions.

    However, needless to say, that day will not come until there is a 
President who shares our goal.

    So until then, Obamacare will remain in place. In the meantime, 
Congress has an obligation to exercise rigorous oversight of the 
implementation of the law and to work to protect both beneficiaries and 
taxpayers from its negative consequences.

    That's what today's hearing is about.

    We're here today to get an account of how things are working on the 
federal health insurance exchange. And, once again, what we've heard 
thus far is not reassuring and does not speak well for CMS's management 
of HealthCare.gov, the protection of taxpayer dollars, or the 
experience of enrollees.

    The GAO's investigation exposes not only huge gaps in federal 
exchange program integrity, but also flaws in how the exchange and CMS 
contractors treat Americans who are trying to file or correct 
legitimate applications.

    Time after time, the GAO team sent information to the exchange for 
verification only to have it ignored, or have the exchange respond as 
if something entirely different had been sent in. The fact that GAO 
encountered mind-boggling levels of incompetence and inefficiency at 
nearly every turn does not bode well for the experience of your 
average, honest enrollee.

    I look forward to today's hearing and what I hope will be a good 
discussion on program integrity of HealthCare.gov.

    Before I conclude, I want to note that, even though this GAO 
investigation was requested by this committee, CMS was less than 
cooperative. Indeed, throughout the entire endeavor, officials at CMS 
appeared to be dragging their feet, blowing past deadlines and good-
faith attempts to carry out this important work.

    Put simply, when Congress asks GAO to conduct an inquiry, no 
federal agency should stand in the way of that work. By delaying the 
GAO and hampering their efforts, CMS has also delayed this committee's 
work and hampered our efforts.

    This is unacceptable. And, unfortunately, despite promises of 
increased transparency and cooperation from agencies throughout this 
administration, this type of stonewalling of legitimate oversight 
efforts is far, far too common.

    Acting CMS Administrator Andy Slavitt, who is now the President's 
nominee to run the agency, was personally involved in this process. As 
the committee considers his nomination, I look forward to asking Mr. 
Slavitt about this investigation and why CMS has been interfering with 
our oversight efforts.

    Of course, that will all have to wait for another day and another 
time. Today, we have our hands full as we hear testimony about this 
important GAO investigation.

                                 ______
                                 
                 Prepared Statement of Hon. Ron Wyden, 
                       a U.S. Senator From Oregon
    Let me begin my remarks by saying that on this side of the aisle, 
we don't take a back seat to anybody in fighting fraud and protecting 
taxpayer dollars. One dollar ripped off is one dollar too many. But 
let's be perfectly clear about one thing: the report up for discussion 
today is not about any real-world fraud.

    This study looks at a dozen fictitious cases--and not one of them 
was a real person who filed taxes or got medical services. No fast-buck 
fraudster got a government check sent to their bank account. Moreover, 
the government auditors acknowledge today that their work, quote, 
``cannot be generalized to the full population of applicants or 
enrollees.''

    None of the fictitious characters in this study stepped foot in a 
hospital or a doctor's office. And the fact is, when you actually show 
up for medical services, it's a lot harder to fake your way into 
receiving taxpayer-subsidized care. Often before any services are 
delivered, providers ask for a photo I.D. with an insurance card. And 
if you've stolen an identity, there's probably a medical history 
belonging to somebody else that should set off alarm bells.

    If you're a real person signing up in the insurance marketplace, 
you have to attest under penalty of perjury that the information you 
provide is correct. And if you falsify the application, you face the 
prospect of a fine of up to $250,000.

    Another big anti-fraud check went untested in this study. That is, 
squaring up tax returns with the information from your insurance 
application. The GAO's testimony today calls it a, quote, ``key element 
of back-end controls.'' If your tax return and personal info don't 
match, the gambit's up. But the study before us today ignores that 
anti-fraud check. It looks at only part of the picture when it comes to 
stopping fraud.

    As I said at the beginning, there are always methods of 
strengthening any program and rooting out fraudsters and rip-off 
artists. Part of any smart, ferocious strategy against fraud, on one 
hand, is drawing a distinction between aggressively going after 
scammers and, on the other, not harming a law-abiding American who has 
made an honest, often technical mistake.

    A retiree nearing Medicare age shouldn't get kicked to the curb 
because she accidentally submitted an incorrect document. A transgender 
American shouldn't lose health coverage after a name change because 
some forms don't match. I can't imagine the Congress wants a system 
that nixes the health insurance coverage of Americans because of simple 
issues like those.

    A recent Gallup report stated that the rate of Americans without 
health insurance is the lowest they've ever measured. This is the first 
Finance Committee hearing on health care since the Supreme Court's 
landmark decision upholding the law that made that possible. The fact 
is, the Affordable Care Act has extended health care coverage to more 
than 16 million real people who use their insurance to see real 
doctors. At some point down the road, GAO is expected to complete their 
report. At that time, let's work responsibly to draw conclusions on a 
bipartisan basis about how the committee can work to improve American 
health care.

                                   [all]
```