Medicaid: Federal Oversight of Payments and Program Integrity Needs Improvement
Published: 2012-04-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid, a joint federal-state health care program, financed care for about 67 million people at a cost of $401 billion in fiscal year 2010. At the federal level, CMS, an agency within the Department of Health and Human Services, is responsible for overseeing the design and operations of states Medicaid programs, while the states administer their respective programs day-to-day operations. The shared financing arrangement between the federal government and the states presents challenges for program oversight and Medicaid has been on GAOs list of high-risk programs since 2003, in part, because of concerns about the fiscal management of the program. Our prior work has shown that CMS continues to face challenges overseeing the Medicaid program.
section_title: What GAO Found
paragraphs: Oversight of managed care rate-setting has been inconsistent. In August 2010, GAO reported that the Centers for Medicare & Medicaid Services (CMS) had not ensured that all states were complying with the managed care actuarial soundness requirements that rates be developed in accordance with actuarial principles, appropriate for the population and services, and certified by actuaries. For example, GAO found significant gaps in CMSs oversight of 2 of the 26 states reviewedCMS had not reviewed one states rates in multiple years and had not completed a full review of another states rates since the actuarial soundness requirements became effective. Variation in practices across CMS regional offices contributed to these gaps and other inconsistencies in the agencys oversight of states rate setting. GAOs previous work also found that CMSs efforts to ensure the quality of the data used to set rates were generally limited to requiring assurances from states and health plansefforts that did not provide the agency with enough information to ensure the quality of the data used. With limited information on data quality, CMS cannot ensure that states managed care rates are appropriate, which places billions of federal and state dollars at risk for misspending. GAO made recommendations to improve CMSs oversight.
Oversight of supplemental payments needs improvement. GAO has reported on varied financing arrangements involving supplemental paymentsdisproportionate share hospital (DSH) payments states are required to make to certain hospitals, and other non-DSH supplemental paymentsthat increase federal funding without a commensurate increase in state funding. GAOs work has found that while a variety of federal legislative and CMS actions have helped curb inappropriate financing arrangements, gaps in oversight remain. For example, while there are federal requirements designed to improve transparency and accountability for state DSH payments, similar requirements are not in place for non-DSH supplemental payments, which may be increasing. From 2006 to 2010, state-reported non-DSH supplemental payments increased from $6.3 billion to $14 billion; however, according to CMS officials, reporting was likely incomplete. GAO made numerous recommendations aimed at improving oversight of supplemental payments.
Challenges exist related to CMSs role ensuring program integrity. In December 2011, GAO testified that the key challenge CMS faced in implementing the statutorily established federal Medicaid Integrity Program was ensuring effective coordination to avoid duplicating state program integrity efforts, particularly in the area of auditing provider claims. GAO found that overpayments identified by its audit contractors since fiscal year 2009 were not commensurate with its contractors costs, and CMS reported in 2011 that it was redesigning its audit program to achieve better results. Data limitations may have hampered the contractors ability to identify improper claims beyond what states had already identified. With regard to CMSs other core oversight activitiesannual assessments and triennial comprehensive state program integrity reviewsGAO found that much of the information collected from the annual assessments duplicated information collected during triennial reviews. Finally, CMSs Medicaid Integrity Institute, a national training program, appears to promote effective state coordination and collaboration.

section_title: Letter
paragraphs: I am pleased to be here today as you explore oversight of Medicaid—a  joint federal-state program that in 2010 financed health care for about   67 million people. Given the size and complexity of this $401 billion  program, the federal government and its state partners continue to face  challenges finding the proper balance between states’ flexibility to  administer their Medicaid programs and the shared federal-state  responsibility to manage program finances efficiently and economically.  Ensuring the program’s long-term sustainability is critical as Medicaid  plays a crucial and growing role in providing health care coverage for a  variety of vulnerable populations, including certain low-income children,  families, and individuals who are aged or disabled.
Medicaid is jointly funded by the federal and state governments. At the  federal level, the Centers for Medicare & Medicaid Services (CMS), an  agency within the Department of Health and Human Services (HHS), is  responsible for overseeing the design and operations of states’ Medicaid  programs, while the states administer their respective programs’ day-to- day operations. Within broad federal requirements, states have some  flexibility in deciding the range of medical services to provide, which  individuals to cover, and the amount to pay providers. The federal  government matches state expenditures for most Medicaid services using  the Federal Medical Assistance Percentage, a statutory formula that is  based, in part, on each state’s per capita income.
The shared financing arrangement between the federal government and  the states, however, presents challenges for program oversight and  requires sustained vigilance on the part of CMS and the Congress. Our  prior work has shown that CMS continues to face challenges overseeing  the fiscal management of the Medicaid program. Because of concerns  about the program’s fiscal management, size, growth, and diversity,  Medicaid has been on GAO’s list of high-risk programs since 2003.
You asked GAO to testify today on our previous work related to CMS’s  oversight of the Medicaid program. My remarks will focus on our findings  related to CMS’s oversight of the following three areas of the Medicaid  program:  1.  states’ rate-setting methodologies for capitated managed care  arrangements, particularly the statutory and regulatory requirements  that rates be actuarially sound;  2.  supplemental payments, which are payments made to certain  providers that are separate from and in addition to standard Medicaid  payments for services; and 3.  program integrity, which focuses on ensuring that payments made are  in the correct amount, to the correct provider, for an eligible  beneficiary.
My testimony is based on our previous work assessing federal oversight  of Medicaid managed care rate-setting, and supplemental payment  arrangements, as well as our work assessing CMS’s program integrity  activities. We conducted this body of work from June 1993 through  December 2011 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The federal government and the states share responsibilities for financing  and administering Medicaid. As a result of flexibility in the program’s  design, Medicaid consists of 56 distinct state-based programs. The  challenges inherent in overseeing a program of Medicaid’s size and  diversity make the program vulnerable to inappropriate program  spending. CMS is responsible for overseeing state Medicaid programs.  For example, CMS is responsible for ensuring that states’ capitated  managed care payments meet actuarial soundness requirements, that  supplemental payments are appropriate, and for supporting and  overseeing state program integrity activities—activities intended to  address Medicaid fraud, waste, and abuse.
subsections: section_title: Managed Care Rate Setting and Actuarial Soundness
paragraphs: Managed care is a significant component of the Medicaid program, with  nearly half of all Medicaid enrollees—approximately 20.7 million  individuals—enrolled in capitated managed care in 2008. In 2007, there  was a total of over $62 billion in federal and state spending for managed  care. Under managed care, states use capitation payments to  prospectively pay health plans to provide or arrange for services for  Medicaid enrollees. Such capitation payments are required by federal law  to be actuarially sound. CMS regulations, first issued in 2002, define  actuarially sound rates as those that are (1) developed in accordance with  generally accepted actuarial principles and practices, (2) appropriate for  the populations to be covered and the services to be furnished, and   (3) certified as meeting applicable regulatory requirements by qualified  actuaries. In order to receive federal funds for their managed care  programs, states must submit documentation to CMS regional offices for  review, including a description of their rate-setting methodology and data  used to set rates. This review, completed by CMS regional office staff, is  designed to ensure that a state complies with the regulatory requirements  for setting actuarially sound rates.
section_title: Supplemental Payments
paragraphs: Most state Medicaid programs make supplemental payments to certain  providers in addition to the standard payments states make to these  providers for Medicaid services. For purposes of this testimony, we   have grouped supplemental payments into two broad categories:   (1) Disproportionate Share Hospital (DSH) payments, which states are  required to make to hospitals that treat large numbers of low-income  uninsured people and Medicaid patients; and (2) non-DSH supplemental  payments, which are not required by statute or regulation. In fiscal year  2010, states made more than $31 billion in supplemental payments; the  federal share was more than $19 billion. CMS is responsible for  overseeing these payment arrangements to ensure the propriety of  expenditures for which states seek federal reimbursement, including  whether states were appropriately financing their share.
section_title: Program Integrity
paragraphs: Program integrity activities are designed to prevent, or detect and  recover, improper payments throughout the Medicaid program. The  Deficit Reduction Act of 2005 expanded CMS’s role regarding Medicaid  program integrity, establishing the Medicaid Integrity Program to provide  effective federal support and assistance to states to combat fraud, waste,  and abuse. CMS’s core program integrity activities include:
National Provider Audit Program—a program through which separate  CMS contractors analyze claims data to identify aberrant claims and  potential billing vulnerabilities, and conduct postpayment audits based  on data analysis leads in order to identify overpayments to Medicaid  providers.
Comprehensive program integrity reviews—comprehensive  management reviews that are conducted every 3 years to assess the  effectiveness of each state’s program integrity efforts and determine  whether the state’s policies and procedures comply with federal law  and regulations.
State program integrity assessments—annual assessments in which  CMS collects data on state Medicaid integrity activities—including  program integrity staffing and expenditures, audits, fraud referrals,  and recoveries—for the purposes of program evaluation and technical  assistance support.
CMS also provides training and technical assistance to states. For  example, CMS’s Medicaid Integrity Institute is the first national Medicaid  integrity training program and offers state officials training and  opportunities to develop relationships with program integrity staff from  other states.
section_title: CMS’s Oversight of Managed Care Rate Setting Was Inconsistent and Did Not Ensure the Quality of the Data Used to Set Rates
paragraphs: We found that CMS had not ensured that all states were complying with  the actuarial soundness requirements and did not have sufficient efforts in  place to ensure that states were using reliable data to set managed care  rates. Specifically, in August 2010, we reported that there were  significant gaps in CMS’s oversight of 2 of the 26 states included in our  review.
First, CMS had not reviewed one state’s rate setting for multiple years  and only determined that the state was not in compliance with the  requirements through the course of our work.
Second, at the time of our work, CMS had not completed a full review  of a second state’s rate setting since the actuarial soundness  requirements became effective in August 2002, and therefore may  have provided federal funds for managed care rates that were not in  compliance with all of the requirements.
In addition to these gaps in oversight, we found inconsistencies in the  reviews CMS completed. For example, the extent to which CMS ensured  state compliance with some of the actuarial soundness requirements was  unclear because CMS officials did not always document their review or  cite evidence of the state’s compliance. When officials did cite evidence,  the evidence did not always appear to meet the actuarial soundness  requirements. Variation in practices across CMS regional offices  contributed to these gaps and other inconsistencies in the agency’s  oversight of states’ rate setting. For example, regional offices varied in the  extent to which they tracked state compliance with the actuarial  soundness requirements, their interpretations of how extensive a review  of a state’s rate setting was needed, and their determinations regarding  sufficient evidence for meeting the actuarial soundness requirements.
We also reported in 2010 that CMS’s efforts to ensure the quality of the  data used to set rates were generally limited to requiring assurances from  states and health plans—efforts that did not provide the agency with  enough information to ensure the quality of the data used. CMS  regulations require states to describe the data used as the basis for rates  and provide assurances from their actuaries that the data were  appropriate for rate setting. The regulations do not include requirements  for the type, amount, or age of the data used to set rates, and states are  not required to report to CMS on the quality of the data. When reviewing  states’ descriptions of the data used to set rates, CMS officials focused  primarily on the appropriateness of the data rather than their reliability.  Additionally, we found that actuarial certification does not ensure that the  data used to set rates are reliable. In particular, our review of rate-setting  documentation found that some actuaries’ certifications included a  disclaimer that if the data used were incomplete or inaccurate then the  rates would need to be revised. Furthermore, some actuaries noted that  they did not audit or independently verify the data and relied on the state  or health plans to ensure that the data were accurate and complete. With  limited information on data quality, CMS cannot ensure that states’  managed care rates are appropriate, which places billions of federal and  state dollars at risk for misspending. States and other sources have  information on the quality of data used for rate setting—information that  CMS could obtain. In addition, CMS could conduct or require periodic  audits of data used to set rates; CMS is required to conduct such audits  for the Medicare managed care program.
CMS took a number of steps that may address some of the variation that  contributed to inconsistent oversight, such as requiring regional office  officials to use a detailed checklist when reviewing states’ rate setting;  use of the checklist had previously been optional. However, we found  variations in CMS oversight even when the checklist was used. Thus, to  improve oversight of states’ Medicaid managed care rate setting, we  recommended that CMS (1) implement a mechanism for tracking state  compliance, including tracking the effective dates of approved rates;   (2) clarify guidance for CMS officials on conducting rate-setting reviews,  such as identifying what evidence is sufficient to demonstrate state  compliance with the actuarial soundness requirements, and how officials  should document their reviews; and (3) make use of information on data  quality in overseeing states’ rate setting. HHS agreed with these  recommendations, and as of June 2011, CMS officials indicated they  were investigating ways to create an easily accessible database to help  them more closely monitor the status of rate-setting approvals, reviewing  and updating its guidance, and looking into incorporating information  about data quality into its review and approval of Medicaid managed care  rates.
section_title: CMS Oversight of Medicaid Supplemental Payments Needs Improvement
paragraphs: In our prior work, we have reported on varied financing arrangements  involving supplemental payments that shifted costs from the states to the  federal government. In some cases, the providers did not retain the full  amount of the payments as some states required providers to return  most, or all, of the supplemental payment to the state. Our work found  that while a variety of federal legislative and CMS actions have helped  curb inappropriate financing arrangements, gaps in oversight remain.  Because such financing arrangements effectively increased the federal  Medicaid share, they could compromise the fiscal integrity of Medicaid’s  federal and state partnership.
Our most recent reports on supplemental payments underscore these  gaps in federal oversight. In May 2008, we reported that CMS had not  reviewed all supplemental payment arrangements to ensure that these  payments were appropriate and used for Medicaid purposes. In  November 2009, we found that ongoing federal oversight of supplemental  payments was warranted, in part, because two of the four states reviewed  did not comply with federal requirements to account for all Medicaid  payments when calculating DSH payment limits for uncompensated  hospital care.
Recently implemented requirements have the potential to improve  oversight of some supplemental payments, but concerns about other  payments remain. and accountability requirements in place for DSH payments. However,  these requirements are not in place for non-DSH supplemental payments,  which may be increasing. Specifically, in 2006, states reported making  $6.3 billion in non-DSH supplemental Medicaid payments, of which the  federal share was $3.7 billion, but not all states were reporting their  payments. By 2010, this amount had grown to $14 billion, with a federal  share of $9.6 billion. However, according to CMS officials, states’  reporting of non-DSH supplemental payments was likely incomplete.
For example, there are now improved transparency  As a result of our prior work, we have made numerous recommendations  aimed at improving federal oversight of supplemental payments. Some  key recommendations we made have not been implemented by CMS. We  have recommended that CMS adopt transparency requirements for non- DSH supplemental payments and develop a strategy to ensure all state  supplemental payment arrangements have been reviewed by CMS. CMS  has taken some action to address some of these recommendations but  we continue to believe additional action is warranted. CMS has raised  concern that congressional action may be necessary to fully address our  concerns. Additionally, given continued concerns associated with  Medicaid supplemental payments, we have work under way related to  states’ reporting and CMS’s oversight of DSH and non-DSH supplemental  payments.
See the Medicare Prescription Drug, Improvement, and Modernization Act of 2003,   Pub. L. No. 108-173, § 1001(d), 117 Stat. 2066, 2430-2431 (2003) (codified, as amended,  at 42 U.S.C. § 1395r-4(j)) and Medicaid Program, Disproportionate Share Hospital  Payments, Final Rule, 73 Fed. Reg. 77,904 (Dec. 19, 2008).
section_title: CMS’s Expanded Role in Ensuring Medicaid Program Integrity Presents Challenges to and Opportunities for Assisting States
paragraphs: In December 2011, we testified that the key challenge CMS faced in  implementing the statutorily established federal Medicaid Integrity  Program was ensuring effective coordination to avoid duplicating state  program integrity efforts, particularly in the area of auditing provider  claims. At the outset of the Medicaid Integrity Program, CMS stressed  the need for effective coordination and acknowledged the potential for  duplication with states’ ongoing efforts to identify Medicaid overpayments.
However, the National Provider Audit Program results—the largest  component of the Medicaid Integrity Program—call into question the  effectiveness of CMS’s communication, and its ability to avoid duplication  with state audit programs. After examining CMS’s program expenditures,  we found that overpayments identified by its audit contractors since fiscal  year 2009 were not commensurate with its contractors’ costs. From fiscal  years 2009 through 2011, CMS authorized 1,663 provider audits in   44 states. However, CMS’s reported return on investment from these  audits was negative. While its contractors identified $15.2 million in  overpayments in fiscal year 2010, the combined cost of the National  Provider Audit Program was about $36 million. In addition, CMS reported  in 2011 that it was redesigning the National Provider Audit Program to  achieve better results. Data limitations—in particular, the use of summary  data that states submit to CMS on a quarterly basis—may have  hampered the contractors’ ability to identify improper claims beyond what  states already identified. It remains to be seen, however, whether CMS’s  redesign of the National Provider Audit Program will result in an increase  in identified overpayments.
CMS’s other core oversight activities—triennial comprehensive state  program integrity reviews and annual assessments—are broad in scope  and were conceived to provide a basis for the development of appropriate  technical assistance. However, we found that much of the information  collected from the annual assessments duplicated information collected  during triennial reviews. Further, our review of a sample of assessments  revealed missing data and a few implausible measures, such as one state  reporting over 38 million managed care enrollees. Improved data  collection activities and dialogue with states will help CMS ensure that it  has complete and reliable state information on which to direct its training  and technical assistance resources appropriately.
Finally, we found that the Medicaid Integrity Institute appears to promote  effective state coordination and collaboration. We reported that states  have uniformly praised the institute and a special June 2011 session  brought together Medicaid program integrity officials and representatives  of Medicaid Fraud Control Units—independent state units responsible for  investigating and prosecuting Medicaid fraud—in 39 states to improve  working relations between these important partners.
As we testified in December 2011, CMS’s expanded role in ensuring  Medicaid program integrity has presented both challenges to and  opportunities for assisting states with their activities to ensure proper  payments. We have ongoing work reviewing CMS’s Medicaid program  integrity activities that will provide additional information about CMS’s  oversight efforts in this area.
Chairmen Gowdy and Jordan, this concludes by prepared statement. I  would be happy to answer any questions that you or other Members may  have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this statement, please contact Carolyn L.  Yocom at (202) 512-7114 or yocomc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. Michelle B. Rosenberg, Assistant Director;  Eagan Kemp; Drew Long; Peter Mangano; Christina Ritchie; and Hemi  Tewarson were key contributors to this statement.
section_title: Appendix I: Abbreviations
section_title: Related GAO Products
paragraphs: Medicaid Program Integrity: Expanded Federal Role Presents   Challenges to and Opportunities for Assisting States. GAO-12-288T.  Washington, D.C.: December 7, 2011.
Fraud Detection Systems: Additional Actions Needed to Support   Program Integrity Efforts at Centers for Medicare and Medicaid Services.  GAO-11-822T. Washington, D.C.: July 12, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Opportunities to Reduce Potential Duplication in Government   Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP.  Washington, D.C.: March 1, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.:   February 2011.
Medicaid Managed Care: CMS’s Oversight of States’ Rate Setting Needs  Improvement. GAO-10-810. Washington D.C.: August 4, 2010.
Medicaid: Ongoing Federal Oversight of Payments to Offset  Uncompensated Hospital Care Costs Is Warranted. GAO-10-69.  Washington D.C.: November 20, 2009.
Medicaid: Fraud and Abuse Related to Controlled Substances Identified  in Selected States. GAO-09-1004T. Washington, D.C.: September 30,  2009.
Medicaid: Fraud and Abuse Related to Controlled Substances Identified  in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009.
Improper Payments: Progress Made but Challenges Remain in  Estimating and Reducing Improper Payments. GAO-09-628T.  Washington, D.C.: April 22, 2009.
Medicaid: CMS Needs More Information on the Billions of Dollars   Spent on Supplemental Payments. GAO-08-614. Washington D.C.:   May 30, 2008.
Medicaid Financing: Long-standing Concerns about Inappropriate   State Arrangements Support Need for Improved Federal Oversight.   GAO-08-650T. Washington D.C.: April 3, 2008.
Medicaid Demonstration Waivers: Recent HHS Approvals Continue to  Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.:  January 31, 2008.
Medicaid Financing: Long-standing Concerns about Inappropriate   State Arrangements Support Need for Improved Federal Oversight.   GAO-08-255T. Washington D.C.: November 1, 2007.
Medicaid Financing: Federal Oversight Initiative Is Consistent with  Medicaid Payment Principles but Needs Greater Transparency.   GAO-07-214. Washington D.C.: March 30, 2007.
Medicaid Financial Management: Steps Taken to Improve Federal  Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705.  Washington D.C.: June 22, 2006.
Medicaid Integrity: Implementation of New Program Provides  Opportunities for Federal Leadership to Combat Fraud, Waste, and  Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006.
Medicaid Financing: States’ Use of Contingency-Fee Consultants to  Maximize Federal Reimbursements Highlights Need for Improved Federal  Oversight. GAO-05-748. Washington, D.C.: June 28, 2005.
Medicaid Fraud and Abuse: CMS’s Commitment to Helping States  Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.:  June 28, 2005.
Medicaid Program Integrity: State and Federal Efforts to Prevent   and Detect Improper Payments. GAO-04-707. Washington, D.C.:   July 16, 2004.
Medicaid: State Efforts to Control Improper Payments. GAO-01-662.  Washington, D.C.: June 7, 2001.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.