Patient Protection and Affordable Care Act: Results of Undercover Enrollment Testing for the Federal Marketplace and a Selected State Marketplace for the 2016 Coverage Year
Published: 2016-09-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans. States may operate their own health-care marketplace or rely on the federal Health Insurance Marketplace (Marketplace). The Congressional Budget Office estimates subsidies and related spending under PPACA at $56 billion for fiscal year 2017.
GAO was asked to review marketplace enrollment and verification controls for the act's third open-enrollment period ending in January 2016.This report provides results of GAO undercover testing of potential vulnerabilities to fraud in the application, enrollment, and eligibility-verification of the federal Marketplace and one selected state marketplace.
GAO submitted 15 fictitious applications for subsidized coverage through the federal Marketplace in Virginia and West Virginia and through the state marketplace in California. GAO's applications tested verifications related to (1) applicants' making required income-tax filings, and (2) applicants' identity or citizenship/immigration status. The results, while illustrative, cannot be generalized to the full population of enrollees. GAO discussed results with CMS, IRS, and state officials. Written comments from HHS and California are included in the report.
GAO currently has eight recommendations to CMS to strengthen its oversight of the federal Marketplace (see GAO-16-29 ). CMS concurred with the recommendations and implementation is pending.
section_title: What GAO Found
paragraphs: The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies. Verification steps include validating the applicant's Social Security number, if one is provided; citizenship or immigration status; and household income. PPACA requires the marketplaces to grant eligibility while identified inconsistencies between the information provided by the applicant and by government sources are being resolved. The 2016 coverage year was the first year in which a key eligibility requirement—verification of whether applicants who previously received one type of federal subsidy under the act filed federal tax returns, as a requirement to retain that benefit—went into effect.
As previously reported for the 2014 and 2015 coverage years, GAO's undercover testing for the 2016 coverage year found that the health-care marketplaces' eligibility determination and enrollment processes remain vulnerable to fraud. The marketplaces initially approved coverage and subsidies for GAO's 15 fictitious applications. However, three applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications.
For four applications, to obtain 2016 subsidized coverage, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. Although none of the fictitious applicants filed a 2014 tax return, all were approved for 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is a time lag between when tax returns are filed and when they are reflected in IRS's systems. CMS officials said they are rechecking 2014 tax-filing status.
For eight applications, GAO used new fictitious identities to test verifications related to identity or citizenship/immigration status and, in each case, successfully obtained subsidized coverage.
When marketplaces directed 11 of the 12 applicants to provide supporting documents, GAO submitted fictitious documents as follows:
For five applications, GAO provided all documentation requested and the applicants were able to retain coverage.
For three applications, GAO provided only partial documentation and the applicants were able to retain coverage. Two of these applicants were able to clear inconsistencies through conversations with marketplace phone representatives even though the information provided over the phone did not match the fictitious documentation that GAO previously provided.
For three applications, GAO did not provide any of the requested documents, and the marketplaces terminated coverage for one applicant but did not terminate coverage for the other two applicants.
According to officials from the Department of Health and Human Services' (HHS) Centers for Medicaid & Medicare Services (CMS), some of GAO's application outcomes could be explained by decisions to extend document filing deadlines.

section_title: Letter
paragraphs: The Patient Protection and Affordable Care Act (PPACA), signed into law  in March 2010, offers subsidized health-care coverage for qualifying  applicants, expands the availability of Medicaid, and provides for the  establishment of health-insurance exchanges, or marketplaces, to help  consumers compare and select among plans offered by participating  private issuers of health-care coverage. In January 2016, the third open- enrollment season conducted under the act was completed. This period  was the first year in which a key eligibility requirement—verification of  whether applicants who previously received one type of federal subsidy  under the act filed federal tax returns, as a requirement to retain that  benefit—went into effect.
Under PPACA, states may elect to operate their own health-care  marketplaces, or may rely on the federally facilitated marketplace, or  Health Insurance Marketplace (Marketplace), often known to the public as  HealthCare.gov. The Centers for Medicare & Medicaid Services (CMS),  a unit of the Department of Health and Human Services (HHS), is  responsible for overseeing the establishment of these marketplaces, and  the agency maintains the federally facilitated marketplace.
PPACA provides subsidies to those eligible to purchase private health- insurance plans who meet certain income and other requirements. With  those subsidies and other costs, the act represents a significant, long- term fiscal commitment for the federal government. According to the  Congressional Budget Office, the estimated cost of subsidies and related  spending under the act is $56 billion for fiscal year 2017, rising to $106  billion for fiscal year 2026, and totaling $866 billion for fiscal years 2017  through 2026. While subsidies under the act are generally not paid  directly to enrollees, participants nevertheless benefit financially through  reduced monthly premiums or lower costs due at time of service, such as  copayments. Because subsidy costs are contingent on eligibility for  coverage, enrollment controls that help ensure only qualified applicants  are approved for coverage with subsidies are a key factor in determining  federal expenditures under the act. In addition, PPACA provided for the  expansion of the Medicaid program.
In light of the government’s substantial financial commitment under the  act, you asked us to examine marketplace enrollment and verification  controls. In July 2014 and July 2015, we testified on results of undercover  applications for the 2014 coverage year—the first under the act—for the  federal Marketplace, including the maintenance of fictitious applicant  identities and provision of coverage through 2014 and into 2015. In  October 2015, we testified on preliminary results of fictitious undercover  applications for the 2015 coverage year for the federal Marketplace and  selected state-based marketplaces. In February 2016, we issued a  report addressing CMS enrollment controls and the agency’s  management of enrollment fraud risk. On the basis of our 2014  undercover testing and related work, that report included eight  recommendations to CMS to strengthen its oversight of the federal  Marketplace.
This report describes potential vulnerabilities to fraud in the application,  enrollment, and eligibility-verification controls of the federal Marketplace  and a selected state marketplace for the act’s third open-enrollment  period and for 2016 coverage, based on undercover testing involving  fictitious applicants.
To perform our undercover testing of the application, enrollment, and  eligibility-verification controls for the 2016 open-enrollment season— which ran from November 1, 2015, to January 31, 2016—we used 15  fictitious identities for the purpose of making applications for individual  health-care coverage and Medicaid by telephone and online. Because  the federal government, at the time of our review, operated a marketplace  on behalf of the state in about three-quarters of the states, we focused  our work on those states. Specifically, we selected two states—Virginia  and West Virginia—that elected to use the federal Marketplace rather  than operate a marketplace of their own. We selected one additional  state—California—that operates its own marketplace, known as Covered  California. The results obtained using our limited number of fictional  applicants are illustrative and represent our experience with applications  in the three states we selected. The results cannot, however, be  generalized to the overall population of applicants or enrollees.
Our testing covered both individual health-care plans and Medicaid— specifically, 14 applications for individual plans, and 1 application for  Medicaid. A portion of the applications focused on a requirement that  applicants who previously received advance payment of tax credits to  subsidize their monthly premium payments must file federal income-tax  returns and account for those subsidies in order to continue receiving that  benefit. In our 15 applicant scenarios, we chose to test controls related to  (1) whether certain applicants had made required income-tax filings, and  (2) the identity or citizenship/immigration status of the applicant. In  general, our approach allowed us to test similar scenarios across different  states. We made 10 of our applications online initially and 5 by phone. In  some cases, we filed paper applications, as is permissible, after speaking  with marketplace representatives. We set our applicants’ income levels at  amounts eligible for subsidies provided under the act, or to meet Medicaid  eligibility requirements, as appropriate.
After conducting our undercover testing, we briefed officials from CMS,  the California marketplace, and the West Virginia state Medicaid agency  on our results. To protect our fictitious identities, we did not disclose  specific applicant identity information. CMS and state officials generally  told us that without such information they could not fully research  handling of our applicants. We also reviewed statutes, regulations, and  other policy and related information. Appendix I provides a more detailed  description of our scope and methodology.
We conducted this performance audit from November 2015 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objective. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objective. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
paragraphs: Under PPACA, health-insurance marketplaces were intended to provide a  single point of access for individuals to enroll in participating private  health plans, apply for income-based subsidies to offset the cost of these  plans, and, as applicable, obtain an eligibility determination or  assessment of eligibility for other health-coverage programs, such as  Medicaid or the Children’s Health Insurance Program.
To be eligible to enroll in a “qualified health plan” offered through a  marketplace—that is, one providing essential health benefits and meeting  other requirements under PPACA—an individual must be a U.S. citizen or  national, or otherwise lawfully present in the United States; reside in the  marketplace service area; and not be incarcerated (unless incarcerated  while awaiting disposition of charges). To be eligible for Medicaid,  individuals must meet federal requirements regarding residency, U.S.  citizenship or immigration status, and income limits, as well as any  additional state-specific criteria that may apply.
Under the Medicaid expansion, states may choose to provide Medicaid  coverage to nonelderly adults who meet income limits and other criteria.  Under PPACA, the federal government is to fully reimburse states  through fiscal year 2016 for the Medicaid expenditures of “newly eligible”  individuals who gained Medicaid eligibility through the expansion.  According to the CMS Office of the Actuary, federal expenditures for the  Medicaid expansion are estimated at $430 billion from 2014 through  2023.
PPACA requires marketplaces to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. These verification steps  include validating an applicant’s Social Security number, if one is  provided; verifying citizenship, status as a U.S. national, or lawful  presence by comparison with Social Security Administration (SSA) or  Department of Homeland Security records; and verifying household  income by comparison with tax-return data from the Internal Revenue  Service (IRS), data on Social Security benefits from SSA, and other  available current income sources.
In particular, PPACA requires that consumer-submitted information be  verified, and that determinations of eligibility be made, through either an  electronic verification system or another method approved by HHS. To  implement this verification process, CMS developed the data services  hub (data hub), which acts as a portal for exchanging information  between the federal Marketplace, state-based marketplaces, and  Medicaid agencies, among other entities, and CMS’s external partners,  including other federal agencies. The Marketplace uses the data hub in  an attempt to verify that applicant information necessary to support an  eligibility determination is consistent with external data sources.
For qualifying applicants, the act provides two possible forms of subsidies  for consumers enrolling in individual health plans, both of which are  generally paid directly to insurers on consumers’ behalf. One is a federal  income-tax credit, which enrollees may elect to receive in advance, and  which reduces a consumer’s monthly premium payment. When taken in  advance, this benefit is known as the advance premium tax credit  (APTC). The other, known as cost-sharing reduction (CSR), is a discount  that lowers the amount consumers pay for out-of-pocket charges for  deductibles, coinsurance, and copayments.
Under PPACA, an applicant’s filing of a federal income-tax return,  including a required additional form, is a significant eligibility requirement  for continued receipt of federal subsidies. When applicants apply for  coverage, they report family size and the amount of projected income. On  the basis, in part, of that information, the Marketplace will calculate the  maximum allowable amount of APTC. An applicant can then decide  whether he or she wants all, some, or none of the estimated credit paid in  advance, in the form of payment to the applicant’s insurer that reduces  the applicant’s monthly premium payment.
If an applicant chooses to have all or some of his or her credit paid in  advance, the applicant is required to “reconcile” on his or her federal  income-tax return the amount of advance payments the government sent  to the applicant’s insurer on the applicant’s behalf with the tax credit for  which the applicant qualifies based on actual reported income and family  size. Reconciliation is accomplished using IRS Form 8692, Premium  Tax Credit (PTC). To receive advance payment of the tax credit at time of  application, applicants must attest they will file a tax return for the year for  which they receive APTC. CMS announced that, beginning with the open- enrollment period for 2016 coverage, APTC and CSR subsidies will be  discontinued for 2016 coverage for enrollees who received APTC in 2014,  but did not comply with the requirement to file a federal income-tax return  and reconcile receipt of their APTC subsidy.
Under PPACA’s application process, “inconsistencies” are generated  when individual applicant information does not match information from  federal data sources—either because information an applicant provided  does not match information contained in data sources that a marketplace  uses for eligibility verification at the time of application, or because such  information is not available. If there is an application inconsistency, the  marketplace is to determine eligibility using the applicant’s attestations  and ensure that subsidies are provided on behalf of the applicant, if  qualified to receive them, while the inconsistency is being resolved. Under  the marketplace process, applicants will be asked to provide additional  information or documentation for the marketplaces to review to resolve  the inconsistency.
section_title: The Marketplaces Approved Subsidized Coverage for All 15 of Our Fictitious Applicants, Including Those Who Had Not Filed Required Tax Returns
paragraphs: Our undercover testing for the 2016 coverage year found that the  eligibility determination and enrollment processes of the federal and state  marketplaces we reviewed remain vulnerable to fraud, as we previously  reported for the 2014 and 2015 coverage years. For each of our 15  fictitious applications, the marketplaces approved coverage, including for  6 fictitious applicants who had previously obtained subsidized coverage  but did not file the required federal income-tax returns. Although IRS  provides information to marketplaces on whether health-care applicants  have filed required returns, the federal Marketplace and our selected  state marketplace allowed applicants to instead attest that they had filed  returns, saying the IRS information was not sufficiently current. The  marketplaces we reviewed also relaxed documentation standards or  extended deadlines for filing required documentation. After initial  approval, all but one of our fictitious enrollees maintained subsidized  coverage, even though we sent fictitious documents, or no documents, to  resolve application inconsistencies. Marketplace officials told us that  without specific identities of our fictitious applicants—which we declined  to provide, to protect the identities—they could not comment on individual  outcomes. In general, however, they told us our results indicate their  marketplace processes worked as designed.
subsections: section_title: Results of Applications
paragraphs: For each of our 15 fictitious applications, the federal or state-based  marketplaces approved coverage at time of application—specifically, 14  applications for qualified health plans, and 1 application for Medicaid.  Each of the 14 applications for qualified health plans was also approved  for APTC subsidies. These subsidies totaled about $5,000 on a monthly  basis, or about $60,000 annually. These 14 qualified-health-plan  applications also each obtained CSR subsidies, putting the applicants in a  position to further benefit if they used medical services. However, our  successful applicants did not seek medical services. These subsidies are  not paid directly to enrolled consumers; instead, the federal government  pays them to health-plan issuers on consumers’ behalf.
For the first time in our three rounds of undercover application testing  since the 2014 coverage year, we successfully cleared an online identity- checking step for one fictitious applicant. Known as “identity proofing,” the  process uses personal and financial history on file with a credit-reporting  agency. The marketplace generates questions that only the applicant is  believed likely to know. According to CMS, the purpose of identity  proofing is to prevent someone from creating an account and applying for  health coverage based on someone else’s identity and without the other  person’s knowledge. Although intended to counter such identity theft  involving others, identity proofing also serves as an enrollment control for  those applying online.
For our 2014 and 2015 undercover testing, we failed to clear identity  proofing in each online application we made. In this latest round of  testing, we cleared identity proofing in one online application by  successfully answering the identity questions presented: (1) name the  county for the applicant address provided, (2) identify the high school  from which the applicant graduated, and (3) identify the last four digits of  a cellular phone number. Although our applicant’s identity was fictitious,  the eligibility system may still have been able to generate questions  based on a “likely” match, CMS officials told us.
For our state marketplace applications, in four of five cases, marketplace  representatives were unable to verify our applicants’ identities and, as a  result, suggested that we visit enrollment counselors to present  identification in person. As a representative said to one of our applicants,  “I can’t look at your picture ID” and, “I have to be able to confirm that you  are who you say you are … in case you were an impostor calling us.” We  avoided such in-person visits, however, by filing paper applications (which  under PPACA must be an option available to applicants). In such cases,  an applicant signature is provided under penalty of perjury and threat of  civil or criminal penalty. In our paper applications, we provided signatures  for our fictitious identities and filed the forms. In another of the state  marketplace cases, we were able to complete the application over the  phone, without being asked identity-proofing questions. Our federal  Marketplace applicants received no similar instructions on visiting  enrollment counselors or submitting paper applications.
For the 14 qualified-health-plan applications, we attempted to pay the  required premiums to put policies into force, as we did in both of our  previous rounds of testing. For 11 applicants, we successfully made  premium payments. However, for three applicants, our initial premium  payments—made to insurers we selected—were unsuccessful, and we  were unable to resolve the issue. While we believed we had received  confirmation of premium payments, insurers said payments were not  received on a timely basis. As a result, our coverage was not put into  effect in these three cases. At that point, because these cases had  experienced different treatment than our other applications and no longer  matched our original testing profile, we elected to discontinue them from  further testing. Thus, the remainder of our discussion centers on the 12  cases for which we did not encounter payment issues—11 applications  for qualified health plans, and 1 for Medicaid. As discussed in following  sections, we divided the remaining 12 cases into those involving  reconciliation of APTC subsidies and those involving other issues. Figure  1 shows a breakdown of our applications, from the original group of 15  down to the division into the tax-filing and other-issue groups.
section_title: Marketplaces Approved Subsidies for Fictitious Applicants Who Had Previously Obtained Subsidized Coverage but Did Not File Required Tax Returns
paragraphs: CMS announced that beginning with the open-enrollment period for 2016  coverage, APTC and CSR subsidies would be discontinued for 2016  coverage for enrollees who received APTC in 2014 but did not comply  with the requirement to file a 2014 federal income-tax return and reconcile  APTC received. Figure 2 illustrates how the reconciliation process is  designed to work, and how failing to reconcile is to affect the ability to  retain subsidized coverage. As discussed later, IRS tax-return processing  time, and taxpayer-requested extension of the filing deadline, can affect  the timeliness of tax-filing data that IRS reports to marketplaces.
Because reconciliation is a key requirement for receipt of subsidies, and  CMS announced that loss of subsidy would be enforced for the first time  in 2016, we focused a number of our undercover applicant scenarios on  this process. At the outset of our testing, we made 6 of our 15  applications using identities from our 2014 testing, when we obtained  subsidized coverage for them. After the payment-processing issue  noted earlier, four of these six identities remained in active testing.
In addition to obtaining coverage, each of the four remaining fictitious  applicants was also approved for APTC subsidies. For these four  applicants, these subsidies totaled about $1,100 on a monthly basis, or  about $13,000 annually. They also obtained CSR subsidies. Figure 3  summarizes results by scenario.
In two of the four cases, Marketplace representatives asked our  applicants if they had filed the requisite income-tax return, to which they  replied falsely that they had done so. For one of these applicants, a  federal Marketplace representative initially told us that we were not  approved for subsidies, for tax-related reasons. However, when we  provided the representative with verbal assurances that we had filed the  necessary tax return, the representative dropped the matter, and we were  approved for subsidized coverage. In May 2016, we received a  Marketplace notice stating that if we do not file a 2014 tax return and  reconcile APTC, our subsidies would end. As of August 2016, our  subsidized coverage remained in force.
In the two other of the four cases, our fictitious state marketplace  applicants were not asked whether they received APTC subsidies in 2014  or whether they filed income-tax returns. As noted earlier, for our state  marketplace applicants, we filed some applications by paper form. The  state marketplace’s paper application form, however, did not ask whether  we had filed a 2014 tax return, or otherwise require us to demonstrate  that we had filed the return.
subsections: section_title: About $4 Billion in 2014 APTC Has Not Been Reconciled, According to IRS
paragraphs: To support the tax-reconciliation requirement, IRS began reporting to  federal and state-based marketplaces, in response to 2016 queries made  to the data hub, cases in which an applicant or a member of the  applicant’s tax household received APTC subsidies for 2014 but had not  filed a 2014 income-tax return. IRS reports subsidy-recipient tax-return  filing status based on information received from marketplaces on who  received APTC subsidies. It matches the marketplace-provided  information against records of who has filed tax returns, to identify those  reported as receiving subsidies but who did not file a return. As shown  in table 1, about one-quarter of 2014 APTC—totaling about $4 billion— had not been reconciled as of December 2015, according to summary  information provided by IRS.
As table 1 indicates, the largest category for unreconciled APTC, both in  number of filers and value of APTC, is those who filed tax returns, but did  not, as part of their filing, complete the necessary form for reconciliation.  Although IRS reports to marketplaces whether an applicant has filed a tax  return, it does not make eligibility determinations for APTC on  applications for coverage. Instead, it passes the filing information to  marketplaces, which then make the determinations. As IRS officials noted  to us, reporting that an applicant has not filed a required tax return ends  IRS’s role.
section_title: The Federal Marketplace Generally Chose Not to Rely on IRS Failure-to-File Data
paragraphs: In the case of the federal Marketplace, CMS generally elected not to rely  on the IRS data identifying 2014 subsidy recipients who failed to file  income-tax returns when making federal Marketplace eligibility  determinations for 2016. Instead, if IRS reported that applicants had not  filed a tax return, CMS chose to offer applicants the opportunity to attest  they had made the proper tax filing, to be followed by CMS postapproval  checks of IRS data.
CMS officials told us they chose to allow applicant attestations of tax  filing, rather than rely solely on IRS failure-to-file data, for two reasons:
Time lag between when tax returns are filed and when filings are  reflected in information IRS provides to marketplaces. This is due to:  normal IRS processing time; additional time required to update tax- return-filing status in information provided to marketplaces; and  because taxpayers can request a tax-filing deadline extension, to  October 15, beyond the normal filing date of April 15. IRS officials told  us that assuming a return is complete, normal processing time is  typically 3 to 12 weeks. They also confirmed that the IRS status  updates, which occur monthly, can add additional time.
Enrollees receiving the APTC subsidy had not previously been  required to reconcile the credit as part of their taxes and were  unfamiliar with the reconciliation process.
CMS officials told us that in May 2016, seeking to check individuals who  received APTC after attesting to filing a 2014 tax return, the agency  began a postapplication approval process for tax-filing verification. Under  this process, the officials said, the federal Marketplace would first check  IRS tax-filing-requirement data for applicants who attested on their  applications that they had filed a tax return; next, would notify remaining  APTC recipients who have not filed of the obligation to do so; and then  would conduct a final IRS check of tax-filing status for those who had  received warning notices. After that, nonfilers will lose APTC and income- based CSR subsidies. According to the officials, this process will be  complete, with subsidies terminated, by October 2016. If such a  determination is made to end subsidies, on the schedule CMS identified,  those losing financial assistance for failure to file may have received  subsidized coverage for January to September, or 9 months of the 2016  coverage year, according to CMS officials. IRS officials said subsidy  recipients would still be responsible for reconciling APTC provided. As  noted, that could increase or decrease tax liability depending on the  individual situation.
According to CMS officials, the tax-filing recheck process—done following  applicant attestations on tax-filing earlier—began in May 2016, 4 months  after the close of 2016 open enrollment. The CMS officials told us this  timing was chiefly because the federal Marketplace did not have the  system capability earlier to both first determine on a large-scale basis  whether applicants had made required tax filings, and then also to  subsequently end subsidies for those who had not done so. The process  of both comprehensively checking tax-return-filing status and also taking  action against those not making the required filings is a difficult, complex  task, CMS officials told us, due to coordination required with IRS and  restrictions on disclosure of protected federal taxpayer information.  Although building a system to do so has been a priority, they said,  competing priorities, coupled with complexity of building a new system,  meant system capability to remove APTC on a large-scale basis following  a recheck process would not be available until August or September 2016  at the earliest. CMS officials said that among enrollees in Marketplace  coverage with APTC subsidies who had attested to filing a 2014 tax  return, there were about 19,000 applications for which IRS indicated no  2014 return had been processed at the start of the recheck process in  May 2016. CMS officials said they do not have information on the value of  APTC and CSR subsidies associated with this coverage. Although the  recheck process began 4 months after the end of 2016 open enrollment,  the Marketplace hopes to begin the tax-filing check-and-termination  process earlier for the upcoming 2017 coverage year, because the  system will already be in place, the officials said. But a timetable has not  been set, they said.
For our 2016 fictitious applicants, because they did not file a tax return  and reconcile APTC subsidies they received, IRS could have reported the  failure to file in response to marketplace queries if the applicant had a  valid Social Security number, CMS officials told us. Since the federal  Marketplace process allowed applicant attestation instead, that is likely  what accounted for our fictitious applicants successfully gaining coverage  despite not having filed tax returns, according to the officials.
IRS officials told us they expressed concerns to CMS about CMS’s  attestation approach. Allowing applicants to attest to tax filing, without  making some validation attempt at the time of application, raises the  possibility that improper APTC payments would be made, in the case that  it is determined later that an applicant in fact did not make the required  filing. The issue arises because the APTC is paid before reconciliation  status is ultimately known, the officials told us. From IRS’s perspective, if  someone has not reconciled, the person has not met the obligation  necessary to continue to receive APTC, they said. IRS officials said they  have had ongoing discussions with CMS about this issue, but noted that  CMS has the decision-making authority in the matter.
section_title: Tax Reconciliation for the State Marketplace
paragraphs: In the case of the state marketplace we tested, Covered California  similarly opted for applicant attestation rather than relying on IRS tax-filing  data, marketplace officials told us. State officials told us that for 2016  enrollment, the marketplace added an attestation form to its online  application system for those who had received subsidized coverage for  2014 and were renewing their coverage. In November 2015, the  marketplace conducted an outreach campaign, sending notices to  consumers who were reported by IRS as not having filed, warning that  they were at risk of losing subsidies if they did not file tax returns.  Covered California followed up with a reminder notice in January 2016,  the officials said. Then, in May 2016, the marketplace rechecked IRS tax- filing data, officials told us, for those reported by IRS as not having filed,  plus those who had not attested earlier that they had filed tax returns. On  the basis of that check, the marketplace then ended subsidized coverage  for those still showing as not having filed, officials told us.
Covered California also allowed an opportunity to regain subsidized  coverage, however. The state marketplace sent a notice of loss of  subsidy, explaining that the change was based on failure to file. But the  marketplace also told those losing subsidized coverage that if they  believed the determination was wrong, they could attest to having filed. If  consumers made that attestation, subsidized coverage would be restored,  officials told us. Thus, a consumer could have attested (at renewal, when  submitting a new application, or while reporting a change) that he or she  had filed, or would file; next, have had subsidized coverage end when  IRS data did not support the attestation; but then have the subsidized  coverage reestablished through another attestation. The reason for this  ultimate reliance on attestation is that officials were “very mindful” that  IRS data being reported to marketplaces may not be current. While  relying on attestation, the marketplace does not have information on the  extent to which people who attested to filing have actually done so, the  officials said. The officials also could not provide information on the  number of applications where the IRS non-filing code was received, but  the marketplace relied on attestation. As of May 2016, among 14,000  consumers that had not attested, 5,000 lost APTC during the  redetermination process, Covered California officials told us.
After subsidized coverage is restored following a postcutoff attestation,  there are no further checks of IRS data for the coverage year, officials  told us. This practice is because they deemed a new round of checks for  the 2017 coverage year, beginning in about October 2016, as an  opportune time to make the next check. However, the officials said the  October check would not distinguish between failure to file for the first  year subject to the reconciliation requirement—2014—or instead for the  second year for which the requirement was in effect, 2015.  Nevertheless, if a consumer has the IRS nonfiling code at that time, her  or she will not be renewed with a subsidy, the officials said. In general,  Covered California only takes action on the most recent tax-filing status  code returned from the data hub, the officials said, which currently does  not distinguish between years.
In our California work we also identified that the state marketplace used a  paper application that did not include a tax-filing query, which means that  applicants filing by paper would not have to attest to tax-filing status. As a  result, two of our fictitious applicants that submitted paper applications  were not asked whether they filed taxes (as noted in fig. 3). Covered  California officials confirmed the form has been in use since the first  PPACA open-enrollment period began in 2013. The state marketplace is  seeking to revise its paper application, with CMS to review the changes,  Covered California officials told us.
The state marketplace has limited ability to know whether applicants  received subsidies in prior years, the Covered California officials told us,  and thus are subject to the reconciliation requirement. Those who  obtained previous coverage through Covered California can readily be  identified, they said. But the state marketplace generally does not receive  information on whether its applicants have ever had previous coverage  elsewhere. An exception is for applicants flagged by IRS for failure to file.  For non–Covered California enrollees, that flag indicates previous  coverage elsewhere, the officials said. Otherwise, the state marketplace  has no way to determine such previous coverage.
section_title: Remaining Fictitious Applicants, Using Testing Scenarios Similar to Those Employed Previously, Likewise Were Approved for Coverage and Awarded Subsidies
paragraphs: At the outset of our testing, we made 9 of our 15 applications using new  fictitious identities to test scenarios similar to those tested in our previous  undercover testing—citizenship / lawful presence, Social Security identity,  and duplicate enrollment in more than one state. After the payment- processing issue noted earlier, eight of these nine applications remained  in active testing—seven for qualified-health-plan coverage and one for  Medicaid.
For all seven of the qualified-health-plan coverage cases that remained  active, our fictitious applicants were approved for coverage with APTC  and CSR subsidies. However, as discussed later, one fictitious applicant  did not maintain subsidized coverage. For these seven successful  applicants, we obtained APTC subsidies totaling about $2,700 on a  monthly basis, or about $33,000 annually. In the eighth case, our  applicant was approved for Medicaid coverage. Figure 4 summarizes  our testing results by scenario.
As previously noted, citizenship/lawful presence is an explicit eligibility  criterion under PPACA. In the case of Social Security identity, the  information our applicants submitted did not match information on file with  SSA. In the case of duplicate enrollment, we used a single identity to  apply for coverage in each of the three states—a situation consistent with  identity theft.
subsections: section_title: According to Officials, Federal Marketplace Outcomes Appear to Be as Expected
paragraphs: CMS officials told us that for the federal Marketplace there generally  appeared to be reasons to explain the outcomes our fictitious applicants  experienced. For example, in the case of the applicant who passed online  identity proofing (described earlier), the eligibility system may still have  been able to generate identity-proofing security questions even if our  applicant’s identity was fictitious, the officials told us. This could be  possible through use of probable or likely matching criteria, rather than  exact matching of the phony applicant information, officials explained.  That is, the system that seeks to identify a person and then generate  corresponding security questions may have made a match based on  some applicant information, rather than on a one-for-one match with  information the applicant provided. The federal Marketplace uses a risk- based system for applicant identification, CMS officials told us, based on  the preponderance of data available, as opposed to a single identity  element. Because there is no universal source for applicant information,  the risk-based approach is best, they said. Meanwhile, the identity- proofing process used in online applications is not used in the telephone  application process, the officials said. This is due in part to resource  limits, CMS officials told us, but is chiefly attributable to a policy decision  that call center representatives not have access to applicants’ credit  histories, in order to protect personally identifiable information.
Likewise, according to CMS officials, some of our applicants’ treatment  could likely be explained by an extension of document-submission  deadlines granted by the Marketplace. CMS regulations authorize the  Marketplace to extend the standard 90-day inconsistency resolution  period if the applicant demonstrates a good-faith effort to obtain the  required documentation during the period. In 2014, the Marketplace had  statutory authority to extend for any reason the period to resolve  inconsistencies unrelated to citizenship or lawful presence, as well as the  good-faith-effort regulatory authority to extend the submission period for  resolving any type of inconsistency. Using its authority, the Marketplace  effectively waived document-submission requirements for many  applicants.
For 2015 and 2016, however, the statutory authority had expired, and the  Marketplace took a different approach in implementing its good-faith-effort  regulatory authority. CMS told us as part of our 2014 testing work that use  of the good-faith-effort authority would be limited to a case-by-case basis  after 2014. Under good-faith-effort extensions for 2016, documentation  requirements are not waived, but applicants are provided additional time  to submit documents, CMS officials said.
According to CMS officials, a good-faith-effort extension can be triggered  for these reasons:  1.  An applicant has not received standard reminder notices warning of  an unresolved inconsistency and the deadline for submitting  documentation. In such cases, a 90-day extension is provided.  2.  The Marketplace has not called the applicant to warn that he or she  needs to submit documents by the deadline. A 30-day extension is  provided.  3.  The consumer requests an extension. A 60-day extension is  provided.
Each extension based on these factors is onetime only, the CMS officials  told us. Other than granting these extensions, the Marketplace did not  apply good-faith-effort authority in any other way for 2016 enrollment,  officials told us. CMS also did not otherwise waive, amend, or extend  verification or eligibility controls in 2016, officials told us. We asked CMS  officials for details on the number of applications that benefited from  good-faith-effort extensions for 2016, including the reason for granting the  extensions and types of inconsistencies at issue, and as of August 2016  officials had yet to respond.
In the case of duplicate enrollments, our fictitious applicant was first  approved for subsidized coverage in the California marketplace and  then—using the same identity—applied and was approved for a qualified  health plan in Virginia and for Medicaid in West Virginia. When our  applicant made the Medicaid application, a federal Marketplace  representative flagged the applicant as potentially fraudulent.  Nonetheless, the applicant was told that he was eligible for coverage.  CMS officials told us they consider it highly unlikely, and thus low risk,  that individuals would apply for multiple plans for themselves, given the  cost of paying premiums on more than one plan. But they also  acknowledged they are interested in the possibility that multiple  enrollments could represent identity theft, and said they are working on  approaches to identify such situations.
As CMS has reported to us previously, officials during this review also  said the agency is unaware of any fraud in individual consumer  applications for federal Marketplace coverage. Apart from individual- consumer-level fraud, instances have occurred in which agents or brokers  have submitted applications for people without their knowledge, for  financial gain, such as if the agent/broker is working for an organization  and is paid on commission based on the number of people enrolled, CMS  officials told us. The officials said some consumers have reported to the  agency that they have been enrolled without their knowledge. CMS  officials declined to provide other details, saying work in this area is law- enforcement sensitive. In responding to consumer complaints, CMS has  recently developed a capability for service-center representatives to direct  complaint information to a program-integrity office for investigation into  waste, fraud, or abuse, CMS officials told us. They likewise said further  details were unavailable.
Overall, according to CMS officials, the federal Marketplace has made a  number of improvements to the eligibility and enrollment process, as well  as the process for resolving application inconsistencies. In particular,  CMS officials said the agency has focused on providing applicants with  specific details of what documentation is required, and that notices sent to  consumers have been improved. As a result, more consumers are  sending proper documentation with appropriate information in response to  Marketplace requests, and applicant inconsistencies are down. As an  illustration of improvements in document filing, CMS officials cited a 40  percent increase in the number of documents consumers have submitted  to resolve inconsistencies.
According to CMS officials, the Marketplace has also relaxed the income- inconsistency resolution-threshold standard beginning with applications  for 2016 coverage. Under this change, the acceptable variance for  applicants submitting documentation to resolve income inconsistences  has increased, and the inconsistency can be resolved if the new income  information meets one of two standards. First, there can now be up to a  25 percent difference, up from 20 percent, between what an applicant  initially reported in income and the amount submitted later when providing  income documentation to resolve an income inconsistency, for that  inconsistency to be officially resolved. Or second, he or she can resolve  the inconsistency if the income difference is within $6,000. CMS officials  said the federal Marketplace made the change in recognition that many  applicants experience variations in earnings, making it hard to project  income. They said that for lower-income households a small difference in  income, measured in dollars, can result in a large percentage change.
In the case of our Medicaid application, as noted, we applied through the  federal Marketplace and were told our applicant may be eligible for  Medicaid and that the West Virginia state Medicaid agency would contact  us with a final determination. When we later called the West Virginia state  Medicaid agency, we were told our applicant was approved for Medicaid.  When we shared the results of our testing with West Virginia Medicaid  officials, they told us that without a specific identity for our fictitious  applicant, they could not comment authoritatively on the outcome.  However, the officials said that because our applicant was not directed to  produce any documentation, it is likely that the federal Marketplace did  not pass along any application inconsistencies, assuming the application  was processed properly. As noted, for this fictitious applicant a federal  Marketplace representative said the case would be flagged as a “fraud  issue,” because applicant identifying information was already present in  the Marketplace system. However, West Virginia officials said the  Marketplace does not pass along to the state any information suggesting  fraud.
The West Virginia officials told us that this experience illustrates why the  federal Marketplace should make a greater effort to verify identity before  sending Medicaid applicant information to the state. West Virginia is a  “determination state,” meaning it delegates eligibility determinations to the  federal Marketplace. That underscores the importance of the federal  Marketplace making accurate determinations, the officials said. The  officials told us West Virginia’s experience with Medicaid applicant data  from the federal Marketplace has been that for 2014, the first coverage  year for the program, data quality was not good overall. For example, the  state would receive applicant information showing income exceeding  Medicaid limits; or, the state would not receive Medicaid application  information that should have passed from the federal Marketplace to the  state. But since the first year, data quality has improved significantly, the  officials said, although quality issues such as blank data fields or incorrect  Social Security numbers remain. Data quality is important because if  applicant information cannot be verified electronically, a Medicaid case  worker must review it manually, the officials said. Had our West Virginia  Medicaid applicant been directed to send documentation, a case worker  would have examined it with the level of scrutiny applied varying  according to the particular situation, the officials told us.
section_title: According to Officials, State Marketplace Outcomes Also Appear to Be as Expected
paragraphs: Although Covered California officials also told us that without specific  identities they could not comment on individual outcomes, in general they  said the results of our undercover testing indicate their marketplace  processes worked as designed. For example, they said, when our  applicants could not clear online identity proofing and contacted Covered  California representatives by phone, the representatives were correct in  first seeking to direct the applicants to visit enrollment counselors, so they  could verify identities in person. While in-person presentation of identity  documentation is never required, the officials said, an in-person visit  provides an opportunity to examine identity documents. When our  applicants indicated they would have difficulty in doing so, the  representatives were also correct in offering the opportunity to file a paper  application, the officials said. Likewise, applicants were treated correctly  in being granted eligibility with the directive to provide supporting  documentation.
The state officials noted that under PPACA the marketplace is required to  accept paper applications. While our applicants could not establish their  identity through the standard online process, the officials said, they could  file a paper application in which the signature on the paper application is  done under penalty of perjury. The same paper process is available for  those originally applying by telephone, they said. Obtaining an eligibility  determination then becomes possible—an option precluded by failure to  confirm an identity in the online process, the officials said. The state  marketplace does not have any information on the extent to which the  threat of a penalty for perjury actually compels applicants to provide  truthful answers.
Like the federal Marketplace, Covered California made use of a good- faith-effort extension policy for applicant documentation. According to  state officials, consumers must affirmatively request such an extension by  contacting the state marketplace. They can be granted a maximum of 60  additional days to file required documentation, beyond the 90-day period  initially provided. According to the officials, there has been a low volume  of such requests—about 10 percent to 15 percent of consumers required  to submit documentation to retain coverage.
Covered California officials also told us they have eased documentation  requirements in several other ways:  Income: Covered California is not taking steps to resolve income  inconsistencies.  Even though it requested applicants to submit  income documentation, it is not taking action in cases in which they do  not. The reason is a policy decision that the issue of whether amount  of subsidies received was proper will be addressed through the tax  reconciliation process. The marketplace provides consumers with  multiple notices, alerting them to possible tax consequences of  income inconsistencies, officials said. In addition, Covered California  decided to give higher priority to other inconsistencies that can lead to  termination of coverage, such as citizenship / lawful presence, rather  than adjustment of subsidies, they said. We note that under PPACA,  even if reconciliation is made, the amount of excess APTC that can be  recovered can be limited, based on household income and tax-filing  status. CSR subsidies, however, are not subject to reconciliation.
Minimum essential coverage: The marketplace is not taking action to  verify applicants’ claims that they do not have access to “minimum  essential coverage” and hence can apply for subsidized coverage  through the marketplace. While important, such cases account for a  very low percentage of all applications, the officials said.
Incarceration: Rather than rely on documentation, the marketplace  accepts applicant attestation on incarceration status. Under PPACA,  those who are incarcerated are not eligible for coverage, unless they  are incarcerated awaiting disposition of charges. The officials said  they did not have information on the number of such attestations  provided.
Otherwise, Covered California officials told us the state marketplace has  made a number of improvements. In May 2016, it implemented a system  check to guard against use of impossible Social Security numbers; we  used such numbers in our 2015 undercover testing, which included  California. The marketplace is more consistently reminding people when  documents are due and warning of loss of coverage if the material is not  provided, they said. Consumer notices overall are more readable,  following work with focus groups, according to the officials, and efforts are  under way to address cases in which applicant-supplied Social Security  numbers cannot be verified through the data hub. Such applicants, too,  are being warned about loss of subsidy or coverage.
On the issue of identity theft and duplicate enrollment, Covered California  officials said that while it can check the state marketplace’s own records it  would be helpful if CMS could supply data on those obtaining plans  through the federal Marketplace. That way the state marketplace could  check those obtaining coverage against coverage obtained elsewhere.
section_title: All But One of Our Fictitious Enrollees Maintained Subsidized Coverage, Even Though We Sent Fictitious Documents, or No Documents, to Resolve Application Inconsistencies
paragraphs: We retained subsidized coverage for 10 of the 11 qualified-health-plan  applicants through August 2016, even though supporting documentation  we submitted was fictitious, and in some cases we submitted none or only  some of the documentation we were directed to send.
As noted, we focused our testing on 12 fictitious applicants. For all 11 of  our applicants approved for qualified-health-plan coverage with subsidies,  we were directed to provide supporting documentation. Our applicant  approved for Medicaid received no direction to provide supporting  documentation.
In response to the marketplace directives to the 11 subsidized qualified- health-plan applicants, we provided follow-up documentation, albeit  fictitious. Overall, we varied what we submitted by application— providing all, none, or only some of the material we were told to send—to  test controls and note any differences in outcomes. Among the 11  applications for which we were directed to send documentation, we  submitted all requested documentation for five applications, partial documentation for three applications, and no documentation for the remaining three applications.
Figure 5 summarizes document submissions and outcomes for the 11  qualified-health-plan applicants, plus the Medicaid application for which,  as noted, we were not directed to send documentation.
In two of the cases, in which we provided only partial documentation, our  applicants were nevertheless able to clear inconsistencies through  conversations with marketplace phone representatives. For example, in  one case we called the federal Marketplace to discuss notices received  about application inconsistencies. A representative told our applicant that  the applicant needed to submit documentation on citizenship status and  Social Security number. However, our applicant told the representative  that the applicant had a name change, and provided the former name.  The representative appeared to enter this information into the  Marketplace system before saying the documentation issues had been  cleared, and no other information was required. The information our  applicant provided over the phone, however, did not match  documentation our applicant had filed previously. Without a specific  identity, CMS officials could not say conclusively what happened with our  application. Generally, however, they told us that under certain  circumstances, such as an applicant providing new information, a  previously recorded inconsistency may become inactive.
In one of the 11 qualified-health-plan cases, as shown in figure 5, our  fictitious applicant’s coverage was terminated after the document- submission period, after we failed—by design—to provide any  documentation to clear an inconsistency, in this case regarding  immigration status.
We also noted other issues with marketplace-requested documentation:  In one case involving Social Security identity, one of our applicants  was directed to supply proof of a valid Social Security number at the  time of initial eligibility determination. A subsequent Marketplace  notice in early 2016, however, omitted that directive. We believe this  could be confusing to an applicant. Further, to the extent it might  cause an applicant to not submit necessary documentation, the  discrepancy could lead to loss of coverage. CMS officials told us that  the Marketplace initially requests a Social Security number, because  having a Social Security number can help to clear other  inconsistencies. The Marketplace does not, however, make it a  practice to resolve Social Security inconsistencies alone. In another  of our applications involving Social Security identity, a Marketplace  representative noted a discrepancy with our applicant’s Social  Security number, and inquired about the possibility of identity theft.  Based on our applicant’s assurances, however, the representative  cleared the discrepancy and made no request for the applicant’s  Social Security card.
In some cases, our applicants presented identical information, but  marketplace handling of their applications was different. For example,  in each of two federal Marketplace applicant scenarios, we claimed to  be lawfully present and with income at a level qualifying for a subsidy.  In each case, we were directed to provide proof of immigration status  and income, and in both cases, we did not provide any  documentation. In one case we lost coverage, while in the other we  retained it.
As noted, we elected not to continue testing with three scenarios after  encountering premium-payment issues. Even though our coverage  was canceled in these cases, we continued to receive marketplace  notices directing us to provide supporting documentation or risk losing  coverage. Such a situation could cause consumer confusion. CMS  officials told us this practice is by design, because if consumers  reapply later, they would still need to resolve inconsistencies  previously identified.
As noted in the case of our one successful Medicaid application, we were  not directed to submit any supporting documentation.
In discussing these outcomes for our fictitious applicants, federal and  state marketplace officials reaffirmed, as we have reported previously,  that the marketplaces do not seek to identify fraudulent document  submissions. Federal Marketplace officials said document-review  standards—in which CMS’s documents-processing contractor is not  required to examine documents for fraud—remain unchanged. Unless  documents show signs of being visibly altered, they are accepted as  authentic. Covered California officials likewise told us marketplace  service-center representatives do not authenticate documents. As with  the federal Marketplace, the standard for review is visible alteration and  whether a document presented appears as it should be; that is, for  example, that a permanent-resident card submitted conforms to  established design of such a card. If documents do look suspicious, they  can be referred to a consumer-protection office for investigation, the  officials said. Thus far, the office has not received any such referrals, they  said.
In addition, as noted earlier, federal officials cited good-faith-effort  extensions as possibly contributing to our outcomes. California officials  said the state marketplace does not take action in cases when applicants  fail to submit requested income documentation, thereby leaving income  inconsistencies unresolved, which could account for our results.
For overall handling of inconsistency resolution, we asked CMS about the  number of unresolved inconsistencies and the value of associated APTC  and CSR subsidies. As of August 2016, the agency had yet to respond.  Covered California officials provided some information on the state  marketplace’s experience with inconsistency resolution. Since January 1,  2016, the marketplace eliminated APTC for failure to resolve citizenship /  lawful-presence inconsistencies in 10,043 cases; and likewise for 875  cases with unresolved incarceration inconsistencies. Covered California  did not have information on value of subsidies for these groups. As of  June 2016, Covered California’s largest categories of unresolved  inconsistencies were income (190,693 cases), Social Security number  (9,247 cases), and citizenship / lawful presence (7,717 cases). Values of  associated subsidies were likewise unavailable, officials told us.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS, IRS, Covered California, and  the West Virginia state Medicaid agency for their review and comment.  HHS, IRS, and Covered California provided technical comments, which  we incorporated as appropriate. HHS provided us with written comments,  which are reprinted in appendix II. Covered California’s comments, along  with our responses, are reprinted in appendix III. The West Virginia  Medicaid agency did not provide comments.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Secretary of Health and Human Services, the Acting Administrator of  CMS, the Commissioner of Internal Revenue, and other interested  parties. In addition, the report will be available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: The objective of this report is to describe, by means of undercover testing  and related work, potential vulnerabilities to fraud in the application,  enrollment, and eligibility-verification controls of the federal Health  Insurance Marketplace (Marketplace) and a selected state marketplace,  for the third open-enrollment period under the Patient Protection and  Affordable Care Act, for 2016 coverage. Our testing covered both  individual health-care plans and Medicaid, with a portion focusing on a  requirement that applicants who previously received advance payment of  tax credits to subsidize their monthly premium payments must file federal  income-tax returns and account for those credits, in order to continue  receiving subsidies in future years.
To perform our undercover testing of the application, enrollment, and  eligibility-verification process for the 2016 open enrollment season— which ran from November 1, 2015, to January 31, 2016—we used  fictitious identities for the purpose of making 15 applications. Specifically,  we made 14 applications for individual plans, and 1 application for  Medicaid. In these 15 applicant scenarios, we chose to test controls for  verifications related to the following:  1.  Whether applicants had made required income-tax filings. We made  six such fictitious applications. For qualifying applicants, the act  provides two possible forms of subsidies for consumers enrolling in  individual health plans, both of which are generally paid directly to  insurers on consumers’ behalf. One is a federal income-tax credit,  which enrollees may elect to receive in advance, which reduces a  consumer’s monthly premium payment. This is known as the  advance premium tax credit. If an applicant chooses to have all or  some of his or her credit paid in advance, the applicant is required to  “reconcile” on his or her federal income-tax return the amount of  advance payments the government sent to the applicant’s insurer on  the applicant’s behalf with the tax credit for which the applicant  qualifies based on actual reported income and family size. Our group  of six fictitious applicants tested this reconciliation requirement.  2.  The identity or citizenship/immigration status of the applicant, or  whether the applicant had sought enrollment in multiple plans. We  made nine such fictitious applications.
In general, our testing approach allowed us to test similar scenarios  across different states. We made 10 of our applications online initially,  and 5 by phone. In some cases, we filed paper applications, as is  permissible, after speaking with marketplace representatives. We set our  applicants’ income levels at amounts eligible for subsidies provided under  the act, or to meet Medicaid eligibility requirements, as appropriate.
Because the federal government, at the time of our review, operated a  marketplace on behalf of the state in about three-quarters of the states,  we focused our work on those states. Specifically, we selected two  states—Virginia and West Virginia—that elected to use the federal  Marketplace rather than operate a marketplace of their own. We selected  one additional state—California—that operates its own marketplace. The  results obtained using our limited number of fictional applicants are  illustrative and represent our experience with applications in the three  states we selected. The results cannot, however, be generalized to the  overall population of applicants or enrollees.
For all 15 fictitious applications, we used publicly available information to  construct our scenarios. We also used publicly available hardware,  software, and materials to produce counterfeit or fictitious documents,  which we submitted as appropriate for our testing. In responding to  marketplace directives to submit documentation, we adopted an approach  of submitting all requested documentation in some cases, partial  documentation in other cases, or no documentation in the remaining  cases, in order to note any differences in outcomes. We observed any  approvals received, and responded as appropriate for our testing to any  directions to provide additional supporting documentation.
Fourteen of our 15 applicant scenarios involved qualified individual health  plans. For these 14 plans, we attempted to pay the required premiums to  put policies into force. For 11 of these 14 applicants, we successfully  made premium payments. However, for three applicants, our initial  premium payments—made to insurers we selected—were unsuccessful,  and we were unable to resolve the issue. While we believed we had  received confirmation of premium payments, insurers said payments were  not received on a timely basis. As a result, our coverage was not put into  effect in these three cases. At that point, because these cases had  experienced different treatment than our other applications and no longer  matched our original testing profile, we elected to discontinue them from  further testing.
To protect our undercover identities, we did not provide the marketplaces  with specific applicant identity information. Centers for Medicare and  Medicaid Services (CMS) and state officials generally told us that without  such information they could not fully research handling of our applicants.
We also reviewed statutes, regulations, and other policy and related  information. Overall, our review covered the act’s third open-enrollment  period, for 2016 coverage, as well as follow-on work after close of the  open-enrollment period. After conducting our undercover testing, we  briefed officials from CMS, the Internal Revenue Service, the California  marketplace, and the West Virginia state Medicaid agency on our results  and sought their views on the outcomes.
We conducted this performance audit from November 2015 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objective. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: Comments from Covered California
subsections: section_title: GAO Comment
paragraphs: 1.  For the two California applications that were submitted to test income- tax filing and reconciliation requirements, we did provide a valid Social  Security number. This means that our applicants could have been  flagged by the Internal Revenue Service for failure to file tax returns.   As Covered California noted, if the Social Security number is invalid or  is not provided, the Internal Revenue Service does not return a  failure-to-file code to the marketplace.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Philip Reiff, Gary Bianchi, and  Helina Wong, Assistant Directors; Evelyn Calderón; Paul Desaulniers;  Ranya Elias; Robert Graves; Olivia Lopez; Maria McMullen; James  Murphy; George Ogilvie; Ramon Rodriguez; Christopher H. Schmitt; Julie  Spetz; and Elizabeth Wood made key contributions to this report.