Medicaid: CMS Has Taken Steps, but Further Efforts Are Needed to Control Improper Payments
Published: 2017-01-31T00:00:00

Fast Facts:
Medicaid is a joint federal-state health care program for low income and medically needy people, with an estimated $36 billion in improper payments in fiscal year 2016.
We've identified some ways to reduce these errors, such as by confirming that Medicaid's participants and health care providers meet eligibility requirements, effectively overseeing managed care organizations, and ensuring that participants don't have duplicate coverage through private health insurance.
The Centers for Medicare & Medicaid Services has taken steps to address some of these issues, but more work is needed—at both the state and federal levels.

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid, a joint federal-state health care program, is a significant component of federal and state budgets, with estimated outlays of $576 billion in fiscal year 2016. The program's size and diversity make it particularly vulnerable to improper payments. In fiscal year 2016, improper payments were an estimated 10.5 percent ($36 billion) of federal Medicaid expenditures, an increase from an estimated 9.8 percent ($29 billion) in fiscal year 2015.
States, which are responsible for the day-to-day administration of the Medicaid program, are the first line of defense against improper payments. Specifically, states must implement federal requirements to ensure the qualifications of the providers who bill the program, detect improper payments, recover overpayments, and refer suspected cases of fraud and abuse to law enforcement authorities. At the federal level, CMS is responsible for supporting and overseeing states' Medicaid program integrity activities.
This testimony highlights key program integrity issues in Medicaid, the progress CMS has made improving its oversight of program integrity, and the related challenges the agency and states continue to face. This testimony is based on 10 products and 11 recommendations. Of these 11 recommendations, 3 have been implemented based on agency action.
section_title: What GAO Found
paragraphs: GAO's prior work has identified four Medicaid program integrity issues—where the program is vulnerable to improper payments such as those made for services that were not covered, were not medically necessary, or were not provided—as well as actions taken by the Centers for Medicare & Medicaid Services (CMS) to address the issues and additional actions that should be taken.
Enrollment Verification: In response to the Patient Protection and Affordable Care Act (PPACA), CMS established a more rigorous approach for verifying financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. Despite CMS's efforts, however, there continue to be gaps in efforts to ensure that only eligible individuals are enrolled into Medicaid, and that Medicaid expenditures for enrollees—particularly those eligible as a result of the PPACA expansion—are matched appropriately by the federal government.
Oversight of Medicaid Managed Care: CMS has provided states with additional guidance on their oversight of Medicaid managed care. Oversight of managed care is increasing in importance and improvements in measuring the improper payment rate are needed. For example, the estimated improper payment rate for managed care is based on a review of payments made to managed care organizations, and does not review any underlying medical documentation. GAO and the Department of Health and Human Services (HHS) Office of Inspector General have identified incomplete and untimely managed care encounter data—data that managed care organizations are expected to report to state Medicaid programs, allowing states to track the services received by beneficiaries enrolled in managed care.
Provider Eligibility: PPACA included multiple provisions aimed at strengthening the screening of providers who enroll to participate in Medicaid. While the act requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures, such as fingerprint-based criminal-background checks for high-risk providers. Also, CMS regulations now require that all Medicaid managed care providers enroll with the state Medicaid agency, which has the potential to improve oversight of providers in managed care. However, GAO's work based on 2 states and 16 health plans identified challenges screening providers for eligibility, partially due to fragmented information.
Coordination between Medicaid and the Exchange: CMS implemented a number of policies and procedures to ensure that individuals do not have duplicate coverage (enrolled in both Medicaid and in subsidized coverage through an exchange, which is a marketplace where eligible individuals may compare and purchase private health insurance). CMS has conducted checks to identify individuals with duplicate coverage, and plans to complete these checks at least two times per coverage year, which has the potential to save federal—as well as beneficiary—dollars. However, CMS has not developed a plan for assessing whether the checks and other procedures—such as thresholds for the level of duplicate coverage deemed acceptable—are sufficient to prevent and detect duplicate coverage.

section_title: Letter
paragraphs: I am pleased to be here today to discuss program integrity efforts  intended to prevent improper payments in the Medicaid program.  Medicaid is a federal-state health financing program projected to cover  about 72 million people in fiscal year 2016 and a significant component of  federal and state budgets. In fiscal year 2016, Medicaid expenditures  were estimated to total about $576 billion, with the federal government  spending about $363 billion and combined state spending of about $213  billion. As a result of flexibility in the program’s design, Medicaid consists  of 56 distinct state-based programs.
The program’s size and diversity make it particularly vulnerable to  improper payments, including payments made for treatments or services  that were not covered by the program, that were not medically necessary,  or that were never provided. In fiscal year 2016, improper payments  totaled an estimated 10.5 percent ($36 billion) of federal Medicaid  expenditures, an increase from an estimated 9.8 percent ($29 billion) in  fiscal year 2015. While the percentage of improper payments is  increasing, the concerns are not new; we added Medicaid to our list of  high-risk programs in January 2003, because of the program’s risk of  improper payments, as well as insufficient federal and state oversight.
States are the first line of defense against Medicaid improper payments.  Specifically, they must comply with federal requirements to ensure the  qualifications of the providers who bill the program, detect improper  payments, recover overpayments, and refer suspected cases of fraud and  abuse to law enforcement authorities. At the federal level, the Centers for  Medicare & Medicaid Services (CMS), an agency within the Department  of Health and Human Services (HHS), is responsible for supporting and  overseeing state Medicaid program integrity activities. The Deficit  Reduction Act of 2005 (DRA) expanded CMS’s oversight role by, for  example, establishing the Medicaid Integrity Program and including other  provisions designed to increase CMS’s support for state activities to  address Medicaid fraud, waste, and abuse. The DRA provided  appropriations to implement the Medicaid Integrity Program, and the  Patient Protection and Affordable Care Act (PPACA), enacted in March  2010, gave CMS and states additional provider and program integrity  oversight tools. In particular, PPACA and its implementing regulations  require state Medicaid agencies to terminate the participation of any  provider that has been terminated on or after January 1, 2011, under  Medicare, any other state Medicaid program, or Children’s Health  Insurance Program.
Beginning in 2014, PPACA also provided millions of low-income  Americans new options for obtaining health insurance coverage—through  the Medicaid program or through an exchange, which is a marketplace  where eligible individuals may compare and purchase private health  insurance. Because many low-income individuals experience income  volatility, they are likely to transition between Medicaid and subsidized  exchange coverage. PPACA required the creation of a coordinated  eligibility and enrollment process for Medicaid and the exchanges to  streamline the eligibility determination process, and to ensure that  individuals are enrolled in the coverage for which they are eligible, and  transferred to the appropriate form of coverage if their eligibility changes.
Streamlining eligibility determinations necessitated the adoption of new  policies and information technology systems by the states, and can  require significant coordination between states and the federal  government. CMS oversight is crucial to ensure that determinations of  Medicaid eligibility are appropriate, and that the risk of coverage gaps and  duplicate coverage—generally not permitted under federal law—is  minimized.
You asked GAO to testify today on program integrity issues in Medicaid,  including issues associated with the Medicaid expansion. My remarks  focus on four key Medicaid program integrity issues we have identified, as  well as the progress CMS has made addressing them, and the related  challenges the agency and states continue to face.
My remarks today are based on our large body of work on the Medicaid  program, including our 2015 report on key issues facing the Medicaid  program, as well as agency responses to recommendations that we have  made. See appendix I for a list of related GAO products and appendix II  for selected recommendations. Those reports provide further details on  our scope and methodology. We conducted all of the work on which this  statement is based in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Under the Medicaid program’s federal-state partnership, CMS is  responsible for overseeing the program, while state Medicaid agencies  are responsible for the day-to-day administration of the program.  Although subject to federal requirements, each state develops its own  Medicaid administrative structure for carrying out the program, including  its approach to program integrity. To monitor program integrity in  Medicaid, CMS estimates the national improper payment rate on an  annual basis through the Payment Error Rate Measurement (PERM)  program. The PERM involves reviews of sampled fee for service claims,  payments to managed care entities, and beneficiary eligibility  determinations in the states; the national improper payment rate is a  weighted average of states’ rates in each of these components.
State Medicaid programs do not work in isolation on program integrity;  instead, there are a large number of federal agencies, other state entities,  and contractors with which states must coordinate. (See fig. 1.)  Recognizing the importance of federal state collaboration on program  integrity issues, in November 2016, along with the Office of Management  and Budget, we convened a meeting with state auditors, CMS, and other  federal officials to discuss ways to strengthen collaboration between the  federal government and the states.
In recent years, Medicaid expenditures and enrollment grew under  PPACA. Growth in enrollment is primarily due to more than half of the  states choosing to expand their Medicaid programs by covering certain  low-income adults not historically eligible for Medicaid coverage, as  authorized under PPACA. In addition to expanding Medicaid eligibility,  PPACA required the establishment of health insurance exchanges in all  states, and provided for federal subsidies to assist qualifying low-income  individuals in paying for exchange coverage. States may elect to  establish and operate an exchange, known as a state-based exchange,  or allow CMS—which is responsible for overseeing the exchanges—to do  so within the state, known as a federally facilitated exchange (FFE). As  of March 2015, CMS operated an FFE in 34 states, and 17 states were  approved to operate state-based exchanges.
section_title: Despite Steps Taken, Additional Efforts Are Needed to Control Medicaid Improper Payments
paragraphs: CMS has taken steps to improve Medicaid program integrity and reduce  improper payments; however, additional actions should be taken to help  further prevent improper payments. Specifically, our work has identified  four key program integrity issues for the Medicaid program—enrollment  verification, managed care, provider screening, and coordination between  Medicaid and the exchanges—along with CMS’s progress in addressing  them, and additional necessary actions.
subsections: section_title: Ensuring that Only Eligible Beneficiaries Are Enrolled in Medicaid
paragraphs: Since 2011, CMS has taken steps to make the Medicaid enrollment- verification process more data-driven to improve the accuracy of eligibility  determinations. For example, in response to PPACA, CMS established a  more rigorous approach to verifying financial and nonfinancial information  needed to determine Medicaid beneficiary eligibility. CMS created a tool  called the Data Services Hub that was implemented in fiscal year 2014 to  help verify beneficiary applicant information used to determine eligibility  for enrollment in qualified health plans and insurance-affordability  programs, including Medicaid. The hub routes to and verifies application  information in various external data sources, such as the Social Security  Administration and the Department of Homeland Security. According to  CMS, the hub can verify key application information, including household  income and size, citizenship, state residency, incarceration status, and  immigration status.
Despite CMS’s efforts, there continue to be gaps in the agency’s efforts to  ensure that only eligible individuals are enrolled into Medicaid. In  particular, our work found that federal and selected state-based  marketplaces approved health insurance coverage and subsidies for 9 of  12 fictitious applications made during the 2016 special enrollment period.  In another study, we found that CMS also had gaps in ensuring that  Medicaid expenditures for enrollees—including enrollees eligible as a  result of the PPACA expansion—are matched appropriately by the federal  government. Specifically, we found that CMS had excluded from review  federal Medicaid eligibility determinations in the states that have  delegated authority to the federal government to make Medicaid eligibility  determinations through the federally facilitated exchange. To address this  gap in oversight of eligibility determinations, we recommended that CMS  conduct reviews of federal Medicaid eligibility determinations to ascertain  the accuracy of these determinations and institute corrective action plans  where necessary. In October 2016, HHS provided additional information  indicating that the department is relying upon operational controls within  federal marketplaces to ensure accurate eligibility determinations as well  as new processes that would identify duplicate coverage. However, we  continue to believe that without a systematic review of federal eligibility  determinations, the agency lacks a mechanism to identify and correct  errors and associated payments.
Lastly, CMS requires all states to participate annually in the Eligibility  Review Pilots to test different approaches to measuring the accuracy of  eligibility determinations under the new beneficiary enrollment  processes. Oversight of beneficiary eligibility is important to program  integrity. Our prior work has identified thousands of Medicaid  beneficiaries involved in potential improper or fraudulent payments. Some  of the concerns that we identified included beneficiaries having payments  made on their behalf concurrently by two or more states, and payments  made for claims that were dated after a beneficiary’s death.
section_title: Improving Oversight of Managed Care
paragraphs: CMS has taken steps to provide states with additional guidance on their  oversight of Medicaid managed care organizations. In October 2014,  CMS made available on its website the managed care plan compliance  toolkit to provide further guidance to states and managed care plans on  identifying improper payments to providers. In May 2016, CMS issued a  final rule on Medicaid managed care, which requires states to conduct  periodic audits of financial data submitted by, or on behalf of each  Medicaid managed care plan. The final rule takes additional steps to  improve oversight of Medicaid managed care, with some provisions  applying after 2018. CMS has also taken action in response to  recommendations that we made with regard to increasing guidance for  states, requiring states to audit managed care organizations, and  providing states with additional audit support.
Oversight of Medicaid managed care is increasing in importance as  states’ use of managed care plans to deliver services has been growing.  More than half of all Medicaid beneficiaries are now enrolled in managed  care plans, and nearly 40 percent of Medicaid expenditures are for health  care services delivered through managed care. The estimated improper  payment rate for managed care is currently less than one percent;  however, this estimate is based on a review of the payments made to  managed care organizations and does not review any underlying medical  documentation. Additional actions on the part of CMS and the states are  critical to improving program integrity in Medicaid. In particular, we and  the HHS Office of Inspector General have identified incomplete and  untimely managed care encounter data. Encounter data are data that  managed care organizations are expected to report to state Medicaid  programs, allowing states to track the services received by beneficiaries  enrolled in managed care. Our work found that encounter data for 11  states were not available in a timely manner, and that 6 states had  encounter data that we deemed were unreliable.
section_title: Ensuring that Only Eligible Providers Are Enrolled in Medicaid.
paragraphs: PPACA included multiple provisions aimed at strengthening the screening  of providers who enroll to participate in Medicaid. While the act requires  that all providers and suppliers be subject to licensure checks, it gave  CMS discretion to establish a risk-based application of other screening  procedures. According to CMS’s risk-based screening, moderate- and  high-risk providers and suppliers additionally must undergo pre- enrollment and post-enrollment site visits, while high-risk providers and  suppliers also will be subject to fingerprint-based criminal-background  checks. This requirement may address some of the potentially fraudulent  or improper payments. Additionally, CMS regulations now require that the  state Medicaid agency enroll all Medicaid managed care providers, which  has the potential to improve oversight of providers in managed care.
Prior to PPACA, if one state terminated a provider from its Medicaid  program, a provider could potentially enroll in or continue participation in  another state’s Medicaid program, leaving the latter state’s program  vulnerable to potential fraud, waste, and abuse. Our prior work has  identified hundreds of Medicaid providers who were potentially improperly  receiving Medicaid payments. Potential improper behavior included  providers with suspended or revoked licenses, improper mailing  addresses, or deceased providers.
Actions to ensure appropriate oversight of Medicaid providers, however,  continue to require additional action on the part of CMS and the states.  Our work, which was based on 2 states and 16 health plans, found that  these states and health plans used information that was fragmented  across 22 databases managed by 15 different federal agencies to screen  providers—and that these databases did not always have unique  identifiers. Our work resulted in in a recommendation that CMS identify  databases best suited for oversight of provider eligibility and coordinate  with other agencies to explore the use of a unique identifier. CMS  regulations now require that the state Medicaid agency enroll all Medicaid  managed care providers, which has the potential to improve oversight of  providers in managed care. However, CMS has not yet evaluated  whether the additional database merit further action or considered ways  to ensure that a unique identifier is available so that providers can be  accurately identified. We also found that the 10 selected states that we  reviewed used inconsistent practices to make data on ineligible providers  publicly available, which could result in provider screening efforts that do  not identify ineligible providers. CMS has taken action that is responsive  to another recommendation on providing guidance to state Medicaid  programs, establishing expectations and best practices on sharing  provider screening data among states and Managed care plans. In  addition, the recently enacted 21st Century Cures Act takes important  steps to address this recommendation including requiring CMS to  establish a provider termination notification database by July 2018 and  requiring the agency to establish uniform terminology for reasons for  provider terminations.
section_title: Minimizing Duplicate Coverage between Medicaid and the Exchanges
paragraphs: Regarding coordination between Medicaid and the exchanges, CMS  implemented policies and procedures to ensure that individuals do not  have duplicate coverage (enrolled in Medicaid and in subsidized  exchange coverage). Due to changes in income and other factors, it is  likely that under PPACA many low-income individuals will transition  between Medicaid and subsidized exchange coverage. Our prior work  found that despite CMS policies and procedures designed to prevent  duplicate coverage, it was occurring. In response, CMS has conducted  three checks to identify individuals with duplicate coverage. CMS has also  reported that the agency intends to complete these checks at least two  times per coverage year, which has the potential to save federal—as well  as beneficiary—dollars.
While CMS has made progress by implementing checks for duplicate  coverage, weaknesses remain. CMS has not developed a plan for  assessing whether the checks and other procedures are sufficient to  prevent and detect duplicate coverage. In March 2016, CMS reported that  it was reviewing data on the number of people identified as having  duplicate coverage through the first CMS check who subsequently  disenrolled from subsidized exchange coverage. CMS reported reviewing  these data as a means of assessing the effectiveness of the checks for  duplicate coverage. We are continuing to monitor CMS’s efforts in this  area, particularly whether CMS develops a plan, including thresholds for  the level of duplicate coverage it deems acceptable, to routinely monitor  the effectiveness of the checks and other planned procedures to prevent  and detect duplicate coverage.
In closing, Medicaid represents significant expenditures for the federal  government and states, and is the source of health care for tens of  millions of Americans. Its long-term sustainability is critical, and will  require, among other things, effective federal and state oversight.
Chairman Murphy, Ranking Member DeGette, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions that you might have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact Carolyn L. Yocom, Director, Health Care at (202) 512-7114 or  YocomC@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. GAO staff who made key contributions to this testimony are  Ann Tynan (Assistant Director), Susan Barnidge, Leslie Gordon, Drew  Long, Andrea E. Richardson, and Jennifer Whitworth.
section_title: Appendix I: Related GAO Reports
paragraphs: Patient Protection and Affordable Care Act: Results of Enrollment Testing  for the 2016 Special Enrollment Period. GAO-17-78. Washington, D.C.:  November 17, 2016.
Medicaid Fee-For-Service: State Resources Vary for Helping  Beneficiaries Find Providers. GAO-16-809. Washington, D.C.: August 29,  2016.
Patient Protection and Affordable Care Act: CMS Should Act to  Strengthen Enrollment Controls and Manage Fraud Risk. GAO-16-506T.  Washington, D.C.: March 17, 2016.
Medicaid Managed Care: Trends in Federal Spending and State  Oversight of Costs and Enrollment. GAO-16-77. Washington, D.C.:  December 17, 2015.
Medicaid: Additional Efforts Needed to Ensure that State Spending is  Appropriately Matched with Federal Funds. GAO-16-53. Washington,  D.C.: October 16, 2015.
Medicaid: CMS Could Take Additional Actions to Help Improve Provider  and Beneficiary Fraud Controls. GAO-15-665T. Washington, D.C.: June  2, 2015.
Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care.  GAO-15-481. Washington, D.C.: May 29, 2015.
Medicaid: Additional Actions Needed to Help Improve Provider and  Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14,  2015.
Medicaid Program Integrity: Increased Oversight Needed to Ensure  Integrity of Growing Managed Care Expenditures. GAO-14-341.  Washington, D.C.: May 19, 2014.
section_title: Appendix II: Selected Recommendations Related to Medicaid Program Integrity
paragraphs: The following table lists selected recommendations GAO has made to the  Department of Health and Human Services regarding Medicaid program  integrity. The agency has implemented 3 of these recommendations. The  agency has either not taken or has not completed steps to implement the  remaining 8 recommendations, as of January 2017.