Health Care: Results of Recent Undercover Testing for Patient Protection and Affordable Care Act Coverage, and Review of Market Concentration in the Private Insurance Markets
Published: 2016-09-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: PPACA provides for the establishment of health-insurance marketplaces through which private issuers can sell qualifying health-care coverage, and makes subsidies available to enrollees who meet certain income and other requirements. According to the Congressional Budget Office, the estimated cost of subsidies and related spending under the act is $56 billion for fiscal year 2017, and totaling $866 billion for fiscal years 2017–2026.
GAO issued three reports in September 2016 that examined (1) enrollment controls for health-care coverage obtained through the health-insurance marketplaces, and (2) private health-insurance market concentration. This testimony summarizes those reports' findings .
For its undercover testing of the 2015 coverage year, GAO submitted fictitious applications for subsidized coverage through the federal Marketplace in New Jersey and North Dakota, and through state-based marketplaces in Kentucky and California. For the 2016 coverage year, GAO submitted fictitious applications through the federal Marketplace in Virginia and West Virginia, and through the state-based marketplace in California. The results of these undercover tests, while illustrative, cannot be generalized to the full population of enrollees. To review market concentration, GAO examined data reported by issuers to CMS for fiscal years 2011 through 2014, the latest data available.
In response to GAO's findings, the Department of Health and Human Services stated that it continues to strengthen marketplace controls.
section_title: What GAO Found
paragraphs: The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information, such as citizenship or immigration status and household income, to determine eligibility for enrollment and, if applicable, eligibility for income-based subsidies. While inconsistencies between the information provided by the applicant and by government sources are being resolved, marketplaces must determine eligibility using an applicant's attestations and ensure subsidies are provided, if the applicant is qualified to receive them. GAO's undercover testing for the 2015 and 2016 coverage years found that the federal and selected state health-care marketplace's eligibility determination and enrollment process were vulnerable to fraud.
For the 2015 coverage year, for example, the federal and selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health-plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued. Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.
For the 2016 coverage year, the federal and selected state marketplaces initially approved subsidies for 15 fictitious applications. However, three fictitious applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications. For 4 of the 12 applications, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. The 2016 coverage year was the first year in which verification was required to ensure that applicants who previously received a specific type of federal subsidy under the act had filed a federal tax return. This was a condition for these applicants to retain this benefit in 2016. None of the four fictitious applicants had filed a 2014 tax return, but all for were approved for the 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is the time lag between when tax returns are filed and when they are reflected in IRS's systems. Centers for Medicare & Medicaid Services (CMS) officials said they are rechecking 2014 tax-filing status and will remove subsidies for applicants that have not filed a 2014 tax return.
GAO's review of concentration in the private health-insurance market found that enrollment was concentrated among a small number of health insurance companies (issuers) in most states in 2014, including in the newly established exchanges. On average, in each state and the District of Columbia, 11 or more issuers participated in each of three types of markets—individual, small-group, and large-group—from 2011 through 2014. However, in most states, the 3 largest issuers in each market had at least an 80 percent share of the market during the period. Enrollment through the exchanges was generally more concentrated among a few issuers than was true for the overall markets.

section_title: Letter
paragraphs: I am pleased to be here today to discuss enrollment for health-care  coverage obtained through the health-insurance marketplaces, or  exchanges, established under the Patient Protection and Affordable Care  Act (PPACA). PPACA subsidies are available to those eligible to  purchase private health-insurance plans from a marketplace who meet  certain income and other requirements. With those subsidies and other  costs, the act represents a significant, long-term fiscal commitment for the  federal government. According to the Congressional Budget Office, the  estimated cost of subsidies and related spending under the act is $56  billion for fiscal year 2017, rising to $106 billion for fiscal year 2026, and  totaling $866 billion for fiscal years 2017–2026.
While subsidies under PPACA are generally not paid directly to enrollees,  participants nevertheless benefit financially through reduced monthly  premiums or lower costs due at time of service, such as copayments.  Because subsidy costs are contingent on who obtains coverage,  enrollment controls that help ensure only qualified applicants are  approved for subsidized coverage are a key factor in determining federal  expenditures under the act. In addition, PPACA provided for the  expansion of the Medicaid program. Under the expansion, states may  choose to provide Medicaid coverage to nonelderly adults who meet  income limits and other criteria. The federal government is to fully  reimburse states through calendar year 2016 for the Medicaid  expenditures of “newly eligible” individuals who gained Medicaid eligibility  through the expansion. According to the Office of the Actuary of the  Centers for Medicare & Medicaid Services (CMS), federal expenditures  for the Medicaid expansion are estimated at $430 billion from 2014  through 2023.
The private health-insurance market has historically been highly  concentrated—that is, a small number of issuers in a market enrolled a  significant portion of the people in that market. A highly concentrated  market may indicate a less competitive market and could affect  consumers’ choice of health-plans and their premiums. PPACA contained  a number of provisions that took effect in 2014 and could affect market  concentration among health issuers.
My statement will summarize the findings of three recently issued reports   and will (1) describe the results of our undercover testing of eligibility and  enrollment controls for the federal Health Insurance Marketplace  (Marketplace) and selected state-based marketplaces for the 2015 and  2016 coverage years, and (2) discuss findings from our review of private  health-insurance market concentration in three markets: individual, small- group, and large-group.
For our report in which we conducted undercover testing for the 2015  coverage year, we submitted, or attempted to submit, 18 fictitious  applications by telephone and online. Ten of these applications tested  controls related to obtaining subsidized coverage available through the  federal Marketplace in New Jersey and North Dakota, and through state- based marketplaces in California and Kentucky. We chose these states  based partly on range of population and whether the state had expanded  Medicaid eligibility under PPACA. The other 8 applications tested controls  for determining Medicaid eligibility.
For our report in which we conducted undercover testing for the 2016  coverage year, we submitted 15 fictitious applications for subsidized  coverage through the federal Marketplace in Virginia and West Virginia  and through the state-based marketplace in California. Our applications  tested verifications related to (1) applicants making required income-tax  filings, and (2) applicants’ identity or citizenship/immigration status.  For  both coverage years, the results of our undercover testing, while  illustrative, cannot be generalized to the overall population of applicants  or enrollees.
For our report on private-health insurance market concentration and  changes in issuer participation, we determined market share using  enrollment data from the 2011 through 2014 Medical Loss Ratio datasets  that issuers are required to report annually to CMS. To obtain 2014  enrollment data for the issuers in the exchanges, we analyzed Unified  Rate Review data that certain issuers are required to report to CMS. For  both datasets, enrollment for each issuer is available only at the state  level, and 2014 data are the most recent available.
We conducted the work upon which this statement is based in  accordance with generally accepted government auditing standards. We  conducted our related investigative work in accordance with investigative  standards prescribed by the Council of the Inspectors General on Integrity  and Efficiency.
subsections: section_title: Background
paragraphs: PPACA provides for the establishment of health-insurance marketplaces  to assist consumers in comparing and selecting among insurance plans  offered by participating private issuers of health-insurance coverage.  Under PPACA, states may elect to operate their own health-insurance  marketplaces, known as state-based marketplaces, or they may rely on  the federal Marketplace, known to the public as HealthCare.gov. These  marketplaces were intended to provide a single point of access for  individuals to enroll in private health-plans, apply for income-based  subsidies to offset the cost of these plans—which, as noted, are paid  directly to health-insurance issuers—and, as applicable, obtain an  eligibility determination or assessment of eligibility for other health- coverage programs, such as Medicaid or the Children’s Health Insurance  Program. CMS, a unit of the Department of Health and Human Services  (HHS), is responsible for overseeing the establishment of these online  marketplaces, and the agency maintains the federal Marketplace.
To be eligible to enroll in a “qualified health plan” offered through a  marketplace—that is, one providing essential health benefits and meeting  other requirements under PPACA—an individual must be a U.S. citizen or  national, or otherwise lawfully present in the United States; reside in the  marketplace service area; and not be incarcerated (unless incarcerated  while awaiting disposition of charges). To be eligible for Medicaid,  individuals must meet federal requirements regarding residency, U.S.  citizenship or immigration status, and income limits, as well as any  additional state-specific criteria that may apply.
Marketplaces are required by PPACA to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. These verification steps  include validating an applicant’s Social Security number, if one is  provided; verifying citizenship, status as a U.S. national, or lawful  presence by comparison with Social Security Administration or  Department of Homeland Security records; and verifying household  income with tax-return data from the Internal Revenue Service (IRS), as  well as data on Social Security benefits from the Social Security  Administration.
Under PPACA’s eligibility verification process, “inconsistencies” are  generated when individual applicant information does not match federal  data sources—either because information an applicant provided does not  match information contained in data sources that a marketplace uses for  eligibility verification at the time of application, or because such  information is not available. If there is an application inconsistency, the  marketplace is to determine eligibility using the applicant’s attestations  and ensure that subsidies are provided on behalf of the applicant, if  qualified to receive them, while the inconsistency is being resolved. Under  the marketplace process, applicants may be asked to provide additional  information or documentation for the marketplaces to review to resolve  the inconsistencies.
In addition to the two related reports discussed in this statement, we have  issued a body of work in which we examined enrollment and verification  controls of the federal and state marketplaces. For example, in February  2016, we issued a report addressing CMS enrollment controls and the  agency’s management of enrollment fraud risk. That report included eight  recommendations to CMS to strengthen its oversight of the federal  Marketplace. CMS concurred with our recommendations, and  implementation is pending.
In terms of concentration in the private health-insurance market, in  December 2014 we reported that, from 2010 through 2013, enrollment in  most states was concentrated among the largest issuers in each of the  three types of health-insurance markets: the large-group market (under  which individuals obtain coverage through a group plan maintained by  large employers), the small-group market (under which individuals obtain  coverage through a group plan maintained by small employers), and the  individual market (coverage sold directly to individual consumers other  than in connection with a group health-plan).
As mentioned above, PPACA contained provisions that could affect  market concentration among health issuers. For example, the law  required the establishment of individual health-insurance exchanges, as  well as Small Business Health Options Programs (“SHOPs”), within each  state by 2014. These exchanges are a new type of market where  eligible individuals and small employers, respectively, can compare and  select among qualified insurance plans offered by participating issuers.
PPACA does not require issuers to offer plans through these exchanges  but instead generally relies on market incentives to encourage their  participation. Issuers seeking to offer a health plan in an individual  exchange or SHOP must first have that plan approved by the exchange in  the state. About a third of the states chose to operate their exchanges in  2014 and approved issuers for participation. In the remaining states  electing not to establish and operate their own exchange, PPACA  required HHS to carry out these responsibilities. As reported in August  2014, most of the largest issuers holding the majority of the market in the  2012 individual and small-group markets participated in the 2014  exchanges, although most of the numerous smaller issuers in those  markets did not.
section_title: The Marketplaces Approved Subsidized Coverage for the 2015 Coverage Year for 17 of 18 of our Fictitious Applicants
paragraphs: Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for  qualified health-plans—that is, coverage obtained from private insurers— was vulnerable to fraud. The federal Marketplace or selected state-based  marketplaces approved each of 10 fictitious applications we made for  subsidized health-plans. Although 8 of these 10 fictitious applications  failed the initial online identity-checking process, all 10 were subsequently  approved. Four applications used Social Security numbers that, according  to the Social Security Administration, have never been issued, such as  numbers starting with “000.” Other applicants obtained duplicate  enrollment or obtained coverage by claiming that their employer did not  provide insurance that met minimum essential coverage.
For eight additional fictitious applications, initially made for Medicaid  coverage, we were approved for subsidized health-care coverage in  seven of the eight cases, through the federal Marketplace and the two  selected state-based marketplaces.
Three of our applications were approved for Medicaid, which was the  health-care program for which we originally sought approval. In each  case, we provided identity information that would not have matched  Social Security Administration records. For two applications, the  marketplace or state Medicaid agency directed the fictitious applicants  to submit supporting documents, which we did (such as a fake  immigration card), and the applications were approved. For the third,  the marketplace did not seek supporting documentation, and the  application was approved by phone.
For four applications, we were unable to obtain approval for Medicaid  but were subsequently able to gain approval of subsidized health-plan  coverage. In one case, we falsely claimed that we were denied  Medicaid and were able to obtain the subsidized health-plan when in  fact no Medicaid determination had been made at that time.
For one application, we were unable to enroll into Medicaid, in  California, because we declined to provide a Social Security number.  According to California officials, the state marketplace requires a  Social Security number or taxpayer-identification number to process  applications.
We submitted fictitious documentation as part of the application and  enrollment process. According to officials from CMS, California, Kentucky,  and North Dakota, the marketplaces or Medicaid office only inspect  supporting documentation that has obviously been altered. Thus, if the  documentation submitted did not show signs of alteration, it would not be  questioned for authenticity.
section_title: The Marketplaces Approved Subsidized Coverage for the 2016 Coverage Year for all 15 of Our Fictitious Applicants, Even Those Who Had Not Filed Required Tax Returns
paragraphs: Our undercover testing for the 2016 coverage year found that the health- care marketplaces’ eligibility determination and enrollment processes  continued to be vulnerable to fraud. The marketplaces initially approved  coverage and subsidies for our 15 fictitious applications, including 1  application for Medicaid, made through the federal Marketplace in Virginia  and West Virginia and through the state marketplace in California.  However, three applicants were unable to put their policies in force  because their initial payments were not successfully processed.  Therefore, we focused our testing on the remaining 12 applications —11  applications for qualified health-plans, and 1 for Medicaid.
For four applications, to obtain 2016 subsidized coverage, we used  identities from our 2014 testing that had previously obtained  subsidized coverage. The 2016 coverage year was the first year in  which verification was required to ensure that applicants who  previously received a specific type of federal subsidy under the act  had filed a federal tax return. This was a condition for these applicants  to retain this benefit in 2016. None of the four fictitious applicants had  filed a 2014 tax return but all were approved for the 2016 subsidies.  Marketplace officials told us that they allowed applicants to attest to  filing taxes if information from the IRS indicated that the applicant did  not file tax returns. Marketplace officials said one reason they allow  attestations is the time lag between when tax returns are filed and  when they are reflected in IRS’s systems. CMS officials said they  are rechecking the 2014 tax-filing status and will remove subsidies for  applicants that have not filed a 2014 tax return.
For eight applications, we used new fictitious identities to test  verifications related to identity or citizenship/immigration status and, in  each case, successfully obtained subsidized coverage.
When the marketplaces directed 11 of the 12 applicants to provide  supporting documents, we submitted fictitious documents as follows:
For five applications, we provided all documentation requested, and  the applicants were able to retain coverage.
For three applications, we provided only partial documentation, and  the applicants were able to retain coverage. Two of these applicants  were able to clear inconsistencies through conversations with  marketplace phone representatives even though the information  provided over the phone did not match the fictitious documentation  that we previously provided.
For three applications, we did not provide any of the requested  documents, and the marketplaces terminated coverage for one  applicant but did not terminate coverage for the other two applicants.
Marketplace officials told us that without specific identities of our fictitious  applicants—which we declined to provide, to protect the identities—they  could not comment on individual outcomes. In general, however, they told  us our results indicate their marketplace processes worked as designed.  For example, according to officials from CMS, some of our application  outcomes could be explained by decisions to extend document filing  deadlines. CMS regulations authorize the Marketplace to extend the  standard 90-day inconsistency resolution period if the applicant  demonstrates a good-faith effort to obtain the required documentation  during the period. Under good-faith-effort extensions for 2016,  documentation requirements are not waived, but applicants were  provided additional time to submit documents.
For Covered California applications, when our applicants could not clear  online identity proofing and contacted representatives by phone, the  representatives were correct in first seeking to direct the applicants to visit  enrollment counselors, so they could verify identities in person. While in- person presentation of identity documentation is never required, the  officials said, an in-person visit provides an opportunity to examine  identity documents.
In discussing these outcomes for our fictitious applicants, federal and  state marketplace officials reaffirmed, as we have reported previously,  that the marketplaces do not seek to identify fraudulent document  submissions. Federal Marketplace officials said document-review  standards—in which CMS’s documents-processing contractor is not  required to examine documents for fraud—remain unchanged. Unless  documents show signs of being visibly altered, they are accepted as  authentic. In response to our findings, the Department of Health and  Human Services stated that it continues to strengthen marketplace  controls.
section_title: Health-Insurance Markets Remained Concentrated in Most States in 2014, While Issuer Participation Generally Decreased
paragraphs: We found that enrollment in private health-insurance plans remained  concentrated among a small number of issuers in most states in 2014,  including in the newly established exchanges. On average, in each state,  11 or more issuers participated in each of three types of markets— individual, small-group, and large-group—from 2011 through 2014.  However, in most states, the 3 largest issuers in each market had at least  an 80 percent share of the market during the period. Beginning in 2014,  issuers in the individual and small-group markets could sell coverage  through the individual and SHOP exchanges established by PPACA. Not  all issuers in these overall markets participated in the exchanges, and  several exchanges had fewer than 3 issuers participating. Enrollment  through these exchanges was generally more concentrated among a few  issuers than was true for the overall markets. We did not assess the  effect of the law on concentration and participation as 2014 was the first  year of implementation for certain PPACA insurance reforms.
In nearly all states, we found that the number of issuers participating in  individual markets decreased from 2013 to 2014, while fewer states’  small-group and large-group markets had decreased participation.  However, across the three types of markets, those issuers exiting each  state market before 2014 generally had less than 1 percent of the market  in the prior year. There were also issuers that newly entered state  markets in 2014. Their market shares in 2014 varied across the three  types of markets, with some entering issuers in the individual market  capturing a market share of over 10 percent. Newly entering issuers  generally captured a larger share of the enrollment sold through the  exchanges than through the overall markets, and some captured a  majority of their exchange market.
Chairmen Murphy and Pitts, Ranking Members DeGette and Green, and  Members of the Subcommittees, this concludes my statement. I would be  happy to respond to any questions that you might have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For questions about this statement, please contact Seto Bagdoyan at  (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement.
Individuals making key contributions to this statement include John  Dicken, Director; Philip Reiff and William Hadley, Assistant Directors;  Ariel Vega, Christopher H. Schmitt, Ranya Elias, Colin Fallon, James  Murphy, Olivia Lopez, Madeline Messick, and Dee Abasute.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.