Medicaid: Program Oversight Hampered by Data Challenges, Underscoring Need for Continued Improvements
Published: 2017-01-06T00:00:00

Fast Facts:
Medicaid made an estimated $36 billion in payment errors in 2016—underscoring the need for improved oversight.
Federal Medicaid administrators rely on state-reported data to inform oversight activities, but we found continuing concerns regarding such data's completeness, accuracy, and timeliness.
Although Medicaid administrators cite a key initiative to gather new, better data and improve program oversight, they haven’t developed plans to ensure the quality of these new data, or how to use them for better oversight.
We recommended expedited efforts to assess and ensure the quality of the new Medicaid data.

Highlights:
section_title: Why GAO Did This Study
paragraphs: To inform its oversight of Medicaid, CMS relies on state-reported data that contain information on multiple aspects of the program, including expenditures and service utilization. Recent increases in Medicaid improper payments, which were an estimated $36 billion in fiscal year 2016, have exacerbated concerns about the quality of data available to CMS for program oversight.
GAO was asked to examine the usefulness of Medicaid data for oversight purposes and any efforts to improve known limitations. This report (1) describes how available Medicaid expenditure and utilization data affect CMS's ability to oversee the Medicaid program; and (2) examines CMS's efforts to improve these data. To address these objectives, GAO reviewed agency guidance, laws, regulations, and federal internal control standards; reviewed reports from GAO and others published from March 2010 through September 2016; and interviewed CMS officials about continuing data challenges and initiatives to improve data.
section_title: What GAO Found
paragraphs: GAO found that available Medicaid expenditure and utilization data do not provide CMS with sufficient information to consistently ensure that payments are proper or that beneficiaries have access to covered services. The Centers for Medicare & Medicaid Services (CMS), the agency within the Department of Health and Human Services (HHS) that administers the Medicaid program, relies on two key data sources for program oversight: the CMS-64, which serves as the basis for calculating the amount of federal matching funds for states, and the Medicaid Statistical Information System (MSIS), which is designed to report individual beneficiary claims data. The CMS-64 and MSIS have the potential to offer a robust view of payments, overall spending, and services in the Medicaid program; however, GAO found that the usefulness of these data is limited because of issues with completeness, accuracy, and timeliness.
Available expenditure data do not provide complete or accurate information on how states finance their portion of program costs, such as complete data on the sources or amounts of local government funds used to finance states' share of Medicaid costs, thus complicating CMS's ability to assess the appropriateness of states' financing.
Available utilization data, particularly for Medicaid managed care, are incomplete and are reported up to 3 years late, complicating CMS's ability to identify billing patterns that indicate inappropriate provider behavior or ensure that beneficiaries have access to covered services.
CMS has acknowledged the need for improved Medicaid data and cites the Transformed Medicaid Statistical Information System (T-MSIS) as its key initiative to improve Medicaid data and program oversight. T-MSIS includes aspects aimed at improving the completeness, accuracy, and timeliness of state data available to CMS, yet uncertainty remains as to when these data will be available from all states as implementation has been delayed for several years. As of October 2016, 18 states were submitting T-MSIS data. Although CMS officials were uncertain when the remaining states would begin submitting data, they estimated that states representing over 70 percent of the Medicaid population would be submitting T-MSIS data by the end of calendar year 2016. CMS officials identified several factors contributing to states' delayed T-MSIS implementation, such as coinciding with the ongoing efforts of over 30 states to redesign or replace their Medicaid information technology systems. Moreover, CMS has not fully developed its plans to ensure the quality of T-MSIS data, and its plans for using these data for oversight purposes remain preliminary. Through rulemaking and other guidance, CMS has taken other actions to improve data; however, given that these actions have recently or not yet been implemented, it is unclear how they will affect CMS's oversight. CMS's continued reliance on inaccurate, incomplete, and untimely data, and the ongoing uncertainty about the scope and timing of its remedial actions, hamper effective oversight and are inconsistent with federal internal control standards, which require entities to rely on quality and timely information to oversee their programs and take timely actions to improve deficiencies.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS take immediate steps to improve Medicaid data available for program oversight, such as expediting efforts to assess and ensure the quality of T-MSIS data. HHS concurred with GAO's recommendation.

section_title: Letter
paragraphs: In 2015, the Medicaid program financed coverage for an estimated 68.9  million low-income and medically needy individuals—nearly one-quarter  of the U.S. population—and is the largest source of funding of health care  for America’s most vulnerable populations. In recent years, the federal- state program has undergone steady growth, particularly since the  enactment in 2010 of the Patient Protection and Affordable Care Act  (PPACA), under which states have the option to expand program  eligibility to certain nonelderly individuals. A significant pressure on  federal and state budgets, Medicaid’s estimated outlays for fiscal year  2015 were $554.3 billion, of which $347.5 billion was financed by the  federal government and $206.8 billion by the states.
Within broad federal parameters, Medicaid allows states significant  flexibility to design and implement their programs, resulting in more than  50 distinct state-based programs. This flexibility has allowed states to  fashion their programs based on their unique needs; however, it has also  complicated oversight. The states are responsible for day-to-day  operations of their Medicaid programs, while the Centers for Medicare &  Medicaid Services (CMS), the agency within the Department of Health  and Human Services (HHS) that administers Medicaid, has a critical role  in overseeing states’ compliance with federal requirements, including  ensuring that federal Medicaid payments are made appropriately.
CMS oversight relies in great part on state-reported data on multiple  aspects of the Medicaid program, including expenditures and service  utilization. However, we and others have identified the lack of accurate,  complete, and timely data at the federal level needed to oversee the  diverse and complex state Medicaid programs. These concerns are not  new—and we have designated Medicaid as a high-risk program since  2003 due to its size, growth, diversity of programs, and concerns about  the adequacy of fiscal oversight. Recent trends in improper payments,  however, have exacerbated concerns about Medicaid oversight. In  particular, improper payments in fiscal year 2016 were estimated to be  $36.3 billion of Medicaid’s expenditures, a significant increase from the  estimated $14.4 billion in improper payments in fiscal year 2013.  Recognizing the need for improved Medicaid data, CMS has undertaken  a number of steps aimed at streamlining and improving the quality of data  currently reported by states and available to CMS for oversight purposes.
You asked us to examine the usefulness of available Medicaid data for  program oversight purposes, and CMS’s efforts to address known data  limitations. In this report, we  1.  describe how available Medicaid expenditure and utilization data  affect CMS’s ability to oversee the Medicaid program; and  2.  examine the extent to which CMS has undertaken efforts to improve  the data available to oversee states’ Medicaid programs.
To describe how the available Medicaid expenditure and utilization data  affect CMS’s ability to oversee the Medicaid program, we reviewed  relevant federal laws, regulations, and federal internal control standards.  We also reviewed our own reports that specifically examined Medicaid  expenditure and utilization data that were issued between March 2010,  when PPACA was signed into law, and September 2016, the most  recently available when we conducted this review. A list of the related  GAO reports and testimonies we reviewed is included at the end of this  report. For the same time period, we also reviewed reports on Medicaid  expenditure and utilization data published by other entities, including the  Medicaid and CHIP Payment and Access Commission (MACPAC), the  Congressional Research Service (CRS), and HHS’s Office of Inspector  General (HHS-OIG). We interviewed CMS officials to verify that these  reports’ findings on Medicaid expenditure and utilization data were  current.
To examine the extent to which CMS has taken steps to improve the data  available to oversee states’ Medicaid programs, we reviewed federal  laws, regulations, and guidance, and CMS’s formal responses to GAO  recommendations regarding identified data limitations. We also  interviewed CMS officials about current or future initiatives to address  data quality and the status of those initiatives, and reviewed relevant  agency documentation.
We conducted this performance audit from February 2016 to January  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Medicaid, by design, allows significant flexibility for states to design and  implement their programs. Within broad federal guidelines and under  federally approved plans, states have some discretion in setting Medicaid  eligibility standards and provider payment rates; determining the amount,  scope, and duration of covered benefits, and how these benefits are  delivered; and developing their own administrative structures. For  example, states may pay health care providers for each service they  provide on a fee-for-service (FFS) basis; contract with managed care  organizations (MCO) to provide a specific set of Medicaid-covered  services to beneficiaries and pay them a set amount per beneficiary per  month; or rely on a combination of both delivery systems. This flexibility  has influenced the development of the program and has resulted in over  50 distinct state-based programs that vary in how health care is delivered,  financed, reimbursed, and overseen.
Medicaid expenditures are financed by both the federal government and  the states. The rate at which the federal government matches most state  expenditures—the Federal Medical Assistance Percentage (FMAP)—also  varies by state and by beneficiary eligibility type, which also contributes to  program variation. Specifically, the federal government pays a higher  portion of Medicaid expenditures in states with low per capita incomes  relative to the national average, and pays different portions for  expenditures for beneficiaries qualifying for Medicaid under traditional  eligibility rules and those qualifying under a PPACA expansion. The  resulting variation complicates program oversight efforts, which are  shared by the federal government and the states, and are aimed, in part,  at ensuring that funds are used appropriately and that enrollees have  access to covered benefits. (See table 1.)
To help inform its oversight, CMS relies on data that states submit from  their respective Medicaid Management Information Systems (MMIS).  MMIS are claims processing and information retrieval systems that  support the administration of the program, which states are required to  implement in order to receive federal matching funds. Two data sets  derived from state MMIS provide CMS with state data on program  expenditures and utilization.
The CMS-64 contains service expenditures and administrative  expenses that are not linked to individual enrollees. State Medicaid  agencies must submit this information each quarter 30 days after a  quarter has ended. CMS-64 data are reported at a state aggregate  level, such as a state’s total expenditures for such categories as  inpatient hospital services and prescription drugs, and are the basis  for determining federal reimbursements to states for Medicaid  expenditures. The CMS-64 also includes expenditures for  supplemental payments, including disproportionate share hospital  (DSH) payments.
The Medicaid Statistical Information System (MSIS) is an eligibility  and claims data set, and is the federal source of state Medicaid  expenditure and utilization data that can be linked to a specific  enrollee. For each Medicaid beneficiary, MSIS provides data on  eligibility status, service utilization, and expenditures, and CMS uses  these data for policy analysis and forecasting expenditures. State  Medicaid agencies are required to provide CMS, through MSIS,  quarterly electronic files approximately 45 days after a quarter has  ended. These files contain (1) information on persons covered by  Medicaid, known as “eligible files”; and (2) adjudicated claims, known  as the “paid claims file,” for medical services reimbursed by the  Medicaid program.
To support external researchers’ analyses of the Medicaid program, CMS  also makes excerpts of MSIS data available through the Medicaid  Analytic eXtract (MAX), which includes data on Medicaid enrollment,  service use, and expenditures, and the MSIS Annual Person Summary  file, which includes aggregated expenditure and utilization data for each  beneficiary. (See fig. 1.)
section_title: CMS’s Oversight Is Hindered by Insufficient Expenditure and Utilization Data
paragraphs: Based on our review of reports issued by GAO and other entities, we  determined that available Medicaid expenditure and utilization data do not  provide CMS with sufficient information to consistently ensure that  payments are proper or that beneficiaries have access to covered  services, which is inconsistent with federal internal control standards that  state that management should use quality information to achieve the  entity’s objectives. CMS should rely on quality information to oversee  the Medicaid program.
subsections: section_title: Expenditure Data
paragraphs: The CMS-64, which serves as the basis of calculating the amount of  federal matching funds for states, and MSIS, which is designed to report  individual beneficiary claims data, have the potential to offer a robust view  of payments and overall spending in the Medicaid program. However, as  the following examples from our work on supplemental payments, states’  sources of financing, and beneficiary eligibility under PPACA  demonstrate, the usefulness of the CMS-64 and MSIS data is limited,  because of issues with completeness, accuracy, and timeliness. For  example, neither the CMS-64 nor the MSIS is designed to capture  detailed information on payments made to individual providers or the non- state sources of the state share of Medicaid payments. Without more  transparent information on program payments and state funding sources,  CMS is unable to determine the appropriateness of program expenditures  and ensure the fiscal integrity of the program.
States report aggregate data regarding supplemental payments on the  CMS-64, but neither the CMS-64 nor MSIS identifies supplemental  payments made to individual providers. As a result, we had to rely on  alternative sources to determine Upper Payment Limit (UPL)  supplemental payment amounts in conducting two reviews. In particular,  we examined states’ mandatory DSH reports, which include some  information on UPL supplemental payments made to DSH hospitals, and  interviewed providers from selected states to identify their uses of these  payments. Based on these efforts, we made the following observations,  among others.
Thirty-nine states made UPL supplemental payments to 505 hospitals  that, along with their regular Medicaid payments, exceeded those  hospitals’ total costs of providing Medicaid-funded care by $2.7  billion.
Certain hospitals use these payments for a wide range of purposes,  from covering the costs of uninsured patients to funding general  hospital operations, maintenance, and capital purchases, such as a  helicopter.
These findings suggest that further examination of UPL supplemental  payments is warranted; however, data on these payments are incomplete  as states are not required to report such payments to non-DSH hospitals  or to other providers at the provider level. By not collecting complete or  consistent data about these payments to all providers—either through the  CMS-64 or another vehicle—CMS is missing an opportunity to ensure  that such payments were made for Medicaid purposes and were  consistent with Medicaid payment principles.
States’ sources of financing  States have increasingly relied on health care providers and other non- state sources to fund the state share of Medicaid payments. However,  CMS does not collect accurate and complete data on state sources of  funds to finance the Medicaid program, thus complicating CMS’s ability to  fully assess whether state financing of the nonfederal share complies with  federal law, or the extent to which the increased reliance on providers and  local governments serves to provide fiscal relief to states and shifts costs  to the federal government.
We and MACPAC found that CMS does not have complete data on  the sources or amounts of local government funds states use to  finance their nonfederal share.
We and CRS also determined that the CMS-64 contained incomplete  data on provider taxes, and we noted that CMS has not assessed the  accuracy and completeness of those data. For a 2014 report, we  asked states to identify and quantify the sources of their nonfederal  share, and 47 states indicated that they had at least one provider tax  or donation in effect in 2012. In comparing these responses to the  provider tax and donation data they reported on the CMS-64 for the  same year, we found that 6 states did not report one or more provider  taxes.
As of October 2016, over 30 states have opted to expand their Medicaid  program under PPACA. Because the FMAP rate can vary by beneficiary  eligibility type, it is critical that CMS apply the correct matching rate for  each respective eligibility group in these states to ensure proper payment  amounts. However, CMS does not collect accurate state data on  Medicaid enrollment by eligibility type in the CMS-64, thus complicating  its ability to identify erroneous expenditures due to incorrect eligibility  determinations. For example
We reviewed state eligibility reviews and noted that, in 8 of the 9  states reviewed, the state identified errors that resulted in incorrect  eligibility determinations, including enrollment of individuals with  incomes exceeding Medicaid standards—totaling up to $48,000 in  improper payments identified in one state alone.
At the time of our review, CMS had not reviewed federal Medicaid  eligibility determinations in the 10 states that had delegated authority  to the federal government to make these determinations, thus creating  a substantial gap in its oversight of Medicaid eligibility determinations.
section_title: Utilization Data
paragraphs: MSIS is the primary data source available to CMS on beneficiaries’  utilization of services as it includes claims data submitted by FFS  providers and encounter data submitted by MCOs. However, we and  HHS-OIG have identified incomplete and untimely state MSIS data,  particularly managed care encounter data. Without better MSIS data,  CMS may not be able to identify billing patterns that indicate inappropriate  provider billing or ensure that beneficiaries have access to covered  services.
In July 2015, HHS-OIG reviewed states’ compliance with federal  requirements regarding the submission of Medicaid encounter data  and determined that 11 states did not report encounter data for all  managed care plans operating in their states as required. In that  same year, we could not assess utilization patterns for Medicaid  managed care beneficiaries in 32 states, because MSIS data were  either not available or were unreliable. The lack of complete and  reliable encounter data presents a significant oversight challenge for  CMS given that over three-quarters of Medicaid beneficiaries were  enrolled in managed care in 2014.
We and HHS-OIG found evidence of states not reporting MSIS data  on time. For example, in an October 2012 report examining  consistencies between CMS-64 and MSIS data, we found that 37  states were late reporting their quarterly MSIS data by six quarters in  July 2012. Although CMS requires states to submit MSIS data within  45 days of the end of a fiscal quarter, we found that states’ reporting  of MSIS data and the subsequent validation process are up to 3 years  late. Similarly, the July 2015 HHS-OIG report noted above, also  identified 8 of the 38 states it reviewed as not reporting any MSIS  encounter data by the required deadline.
In a 2015 review of Medicaid prescription-drug fraud controls, we also  identified how inaccurate and incomplete encounter data can affect  state program integrity efforts. Data from 4 of the 11 states we  reviewed had missing or unreliable provider information or encounter  data, thus affecting those states’ ability to identify incidents of fraud,  waste, or abuse.
section_title: CMS Has a Key Initiative to Improve Medicaid Data, but Uncertainty Exists Regarding its Implementation and Effect on Program Oversight
paragraphs: CMS officials identified the Transformed Medicaid Statistical Information  System (T-MSIS) initiative as the agency’s primary effort to improve  Medicaid expenditure and utilization data, and highlighted aspects of the  initiative intended to improve their accuracy, completeness, and  timeliness. However, less than half of the states are submitting T-MSIS  data files to CMS, and it is uncertain when the remaining states will  submit these data or how CMS will ensure their quality or use them for  oversight purposes.
subsections: section_title: CMS Officials Cite T-MSIS as the Key Effort among Several to Improve Medicaid Data and Program Oversight
paragraphs: CMS has acknowledged the need for improved Medicaid data, and has  undertaken a number of steps aimed at streamlining and improving the  quality of data currently reported by states and available to CMS for  oversight purposes. For example, since 2011, CMS has been working to  implement the T-MSIS initiative to increase and improve the data  collected through MSIS. T-MSIS is to include data about enrollees,  services, and costs, including FFS claims, managed care encounters,  beneficiary eligibility and demographics, and provider enrollment.  According to CMS officials, T-MSIS includes aspects designed to improve  the completeness, accuracy, and timeliness of available state data, as  well as their utility for states.
Completeness: T-MSIS is designed to capture significantly more data  from states than is the case with MSIS. CMS requires states to report  data on approximately 550 variables across eight data files in T-MSIS,  a significant contrast to the approximately 200 variables required in  MSIS.
T-MSIS requires states to report three additional data files,  including specific files on providers, third-party liability, and  MCOs, thus collecting data not previously reported that could  provide CMS information to enhance its oversight efforts.
The provider file includes a unique identifier for each  provider, as well as data fields to show provider specialty  and practice locations. Each of these has the capacity to  assist CMS oversight in terms of providing insight on  provider referrals, Medicaid payments to specific providers,  and identifying ineligible providers.
The third party liability file includes data on whether a  beneficiary has any health insurance in addition to  Medicaid, which would provide CMS with data on  potentially liable third parties.
The managed care file includes more detailed information  on MCOs, such as type and name of managed care plans,  covered eligibility groups, service areas, and  reimbursement arrangements. In addition to identifying  failure to report encounter data, this file could help CMS’s  oversight by allowing the agency to identify excess plan  profit and volatility of expenditures for some enrollee  groups across states.
In addition to the data variables associated with the three new  files, CMS expanded the scope of data to be collected through  the existing MSIS files. For example, according to CMS  officials, T-MSIS is to collect more detailed information on  enrollees, including their citizenship, immigration, and disability  status, as well as expanded diagnosis and procedure codes  associated with their treatments.
Accuracy: Within T-MSIS, there exist aspects aimed at improving the  accuracy of data initially submitted by states. For example, T-MSIS  includes approximately 3,500 automated quality checks, which  provide states with feedback on data format and consistency, in  contrast to MSIS, which has relatively few automated checks. T-MSIS  quality checks include ensuring that a beneficiary’s date of birth is a  valid date and that a beneficiary’s age is under a reasonable limit.  Other quality checks are to ensure logical relationships across T- MSIS files, such as ensuring that the beginning date of service on  claims are on or after a beneficiary’s date of birth. According to  agency officials, CMS accepts state data for subsequent processing,  provided the data are correctly formatted. According to CMS officials,  states have access to error reports that are generated as a result of  processing their T-MSIS data.
Timeliness: CMS requires states to report T-MSIS data to CMS  monthly, versus quarterly, as is the case with MSIS data.
Utility for states: T-MSIS includes aspects aimed at improving state  oversight and reducing state burden. For example, while states have  not relied on MSIS data to oversee their Medicaid programs, T-MSIS  is intended to eventually provide states with the capability to analyze  and compare their program data to other states, potentially enhancing  their ability to manage expenditures and identify concerns regarding  access to care. According to CMS officials, the agency also intends to  access certain state data directly through T-MSIS, rather than  separately requesting such data from the states, thereby reducing the  number of data requests that CMS makes to states.
In addition to its ongoing implementation of T-MSIS, CMS has taken other  actions—for example, issuing regulations and guidance—to improve data  reporting and enhance available data; however, given the recent nature  or future implementation dates of these actions, their effect on CMS’s  ability to oversee the Medicaid program is not fully known.
The May 2016 managed care rule includes provisions intended to  strengthen data the agency collects on managed care utilization and  relevant for program integrity, which could help improve MCO  oversight, the need for which was identified in several GAO reports.  For example, the rule requires states to include provisions regarding  the maintenance of encounter data in contracts with MCOs and  limited benefit plans, to have procedures in place to ensure that  enrollee encounter data these entities submit are complete and  accurate, and includes financial consequences for lack of  compliance. Although MCOs have been expressly required to report  encounter data under statute since 2010, CMS’s May 2016 rule  provides more clarity regarding the format and collection of these  data. However, because these rules will not take effect until 2017 and  2018, their success in improving data is dependent on state and CMS  implementation. In addition, the managed care rule increases and  clarifies state responsibilities related to overseeing payments to and  by MCOs, which addresses a GAO recommendation that CMS hold  states accountable for managed care program integrity by requiring  them to conduct audits of MCOs. In particular, the managed care  rule requires that states, at least once every 3 years, audit encounter  and financial data submitted by MCOs.
A December 2015 final rule includes more targeted financial  consequences for states that do not comply with data submission  requirements, including T-MSIS. While CMS previously had the  authority to reduce federal financial participation for system operations  from 75 percent to 50 percent if any system failed to meet any or all  requirements, the final rule provides CMS with the option to tailor the  federal matching rate reduction to the specific operational  expenditures related to the system component that does not meet  applicable requirements. Having the ability to impose more targeted  funding reductions may enable CMS to more effectively leverage  improved state compliance with reporting requirements.
In December 2015, in response to a GAO recommendation to  routinely monitor and share information regarding key third-party  liability efforts and challenges across states, CMS provided states  with an updated guide on Medicaid third-party liability practices with  information to help make states more aware of such efforts and  challenges. This updated guide is an important tool that could help  states ensure that Medicaid pays only after other liable third parties.
In its Comprehensive Medicaid Integrity Plan for fiscal years 2014- 2018, CMS noted that it is leveraging available Medicare data to  assist states in identifying providers who are enrolled in both Medicare  and Medicaid, and may be involved in fraudulent or abusive billing  practices. CMS officials also reported they adjusted the CMS-64 to  improve states’ reporting of eligibility categories and UPL  supplemental payments and trained states on how to report UPL  supplemental payments.
section_title: Uncertainty Surrounds States’ T-MSIS Implementation and CMS’s Plans for These Data in Enhancing Program Oversight
paragraphs: Although T-MSIS may ultimately provide CMS with improved data to  enhance its oversight of the Medicaid program, it is unclear when T-MSIS  data will be available from all states. Federal internal control standards  require agency management to complete actions to improve deficiencies  on a timely basis; however, T-MSIS implementation, which began in  March 2011 as a pilot program in 12 states, has been delayed for several  years. The original date for nationwide submission was July 2014; as of  October 2016, 18 states were submitting T-MSIS data, and CMS officials  were uncertain as to when the remaining 33 states would begin  submitting these data. Agency officials stated that for a state to be  considered submitting T-MSIS data, it must submit all eight data files, but  not necessarily all data variables within each file. CMS officials currently  estimate that states representing over 70 percent of the Medicaid  population will be submitting T-MSIS data by the end of calendar year  2016.
To expedite states’ implementation of T-MSIS, CMS officials noted that  they are focusing their efforts on the states they have determined are  closest to implementing T-MSIS. According to these officials, CMS has  had calls with these states to inquire about their plans, including what  help the state may need from the agency. CMS has categorized the  remaining states according to their readiness to begin submitting T-MSIS  data.
CMS and state officials identified several factors contributing to states’  delayed T-MSIS implementation. For example, in addition to requiring  states to submit significantly more information than they have in the past,  T-MSIS implementation also coincides with the ongoing efforts of over 30  states to redesign or replace their Medicaid information technology  systems—an effort that states are undertaking, in part, to facilitate their  efforts to comply with a multitude of federal requirements, only one of  which is T-MSIS. A group representing state Medicaid directors also  noted that state efforts to implement T-MSIS have been hindered by  unclear and changing federal requirements. According to this group,  CMS’s ongoing revisions to T-MSIS requirements have created  challenges and costs for states.
In addition to uncertainty regarding states’ implementation of T-MSIS,  CMS has not fully developed its plans for assessing and ensuring the  quality of state data and, according to agency officials, is still trying to  determine the best way to summarize and communicate what it has  learned about the data’s quality to internal users and to states. According  to CMS officials, the agency is producing data quality reports for internal  users and anticipates sharing such reports with the public in 2017. While  CMS officials identified seven broad priority areas for assessing the  quality of the data—eligibility, expenditures, all utilization, FFS utilization,  managed care utilization, providers, and third party liability—they have  not yet delineated priorities within these areas for further review or  identified specific data variables for priority validation—associated with  improper payments or otherwise. Nonetheless, CMS officials noted that  they have taken some steps to address the quality of state data. For  example, in addition to the automated front-end data quality checks, the  agency’s contractor has developed 2,000 quality measures to determine  whether data are within expected ranges. For instance, if a state’s data  suggested a Medicaid population that is 70 percent male, CMS would  examine the data further as its data indicate the Medicaid population is  predominantly female. CMS officials emphasized that they continue to  develop processes to ensure data quality and expect to identify trends in  the data that would allow them to develop new quality checks or  determine which checks are no longer relevant. Without fully developing,  implementing, and expediting efforts to assess the quality of T-MSIS data,  CMS cannot ensure the accuracy and completeness of T-MSIS data that  states submit.
CMS’s plans for using T-MSIS to oversee states’ Medicaid programs also  remain preliminary, and the agency has not established specific time  frames for their use. Officials report that the agency is currently examining  available state T-MSIS data to identify any problematic trends and  developing analytic tools designed to assist with monitoring and  oversight. For example, CMS’s Center for Program Integrity has begun to  crosswalk T-MSIS provider data to Medicare data to develop an algorithm  to assist with program integrity efforts. Additionally, CMS established the  Division of Business and Data Analysis in 2015 to lead analysis and  dissemination of Medicaid and CHIP data. Such efforts include working  with states on improving the quality of their T-MSIS data and to support  other CMS offices’ use of data for program management and monitoring.  According to CMS officials, the improved data will be used by CMS,  states, and researchers for program monitoring, policy implementation,  improving beneficiary health care, and lowering costs. Officials reported  they anticipate that as more states submit T-MSIS data, and both states  and CMS gain more experience with the process, the agency will develop  additional and more complex uses of T-MSIS for program oversight  purposes.
section_title: Conclusion
paragraphs: The continuing increase in federal Medicaid improper payments— estimated at over $36 billion in fiscal year 2016—underscores the need  for improved program oversight. We and others have expressed long- standing concerns about the completeness, accuracy, and timeliness of  available Medicaid data, and the effect of these insufficiencies on CMS’s  ability to ensure the fiscal integrity of the program. CMS’s continued  reliance on inaccurate, incomplete, and untimely data, and the ongoing  uncertainty about the scope and timing of its remedial actions, is  inconsistent with federal internal control standards. As a steward of the  program, CMS must take immediate steps to ensure the appropriate use  of scarce federal and state dollars.
CMS acknowledges the need for improved Medicaid data and is taking  actions aimed at improving available data. Thus far, CMS actions have  focused on guidance and regulations, continued oversight of program  integrity, and improved reporting of specific expenditures, such as  supplemental payments. It is unknown whether these actions, while  important, will significantly improve CMS’s ability to oversee this complex  and growing program. In the longer term, CMS cites T-MSIS as its  primary effort to streamline and improve data. T-MSIS includes aspects  aimed at improving the quality of state data available to CMS, yet  uncertainty remains as to when these data will be available from all  states; how CMS will ensure their quality; or how CMS will use these data  for oversight purposes. Without an improved focus on ensuring the  accuracy of data—and setting priorities for the data that are most likely to  improve program oversight—the effectiveness of T-MSIS cannot be  assured.
section_title: Recommendation for Executive Action
paragraphs: We recommend that the Administrator of CMS take immediate steps to  assess and improve the data available for Medicaid program oversight,  including, but not limited to, T-MSIS. Such steps could include  refining the overall data priority areas in T-MSIS to better identify  those variables that are most critical for reducing improper payments,  and expediting efforts to assess and ensure the quality of these T-MSIS  data.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for comment. In its written  comments, HHS concurred with our recommendation and acknowledged  the importance of having robust, timely, and accurate data to ensure the  highest financial and program performance in the Medicaid program. HHS  highlighted aspects of T-MSIS aimed at improving state data, which  would strengthen program monitoring and oversight, policy  implementation, and provide a framework for identifying potential areas of  concern so that additional efforts may be taken that could reduce future  instances of potential fraud, waste, and abuse. Further, HHS noted its  ongoing efforts to work with states to ensure compliance with T-MSIS  reporting requirements, reduce reporting errors, and improve the quality  of their data submissions. HHS also provided a technical comment, which  we incorporated. HHS’s comments are reproduced in appendix I.
As arranged with your offices, unless you publicly announce the contents  of this report earlier, we plan no further distribution until 30 days after its  issuance date. At that time, we will send copies of this report to the  Secretary of Health and Human Services and other interested parties. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions, please contact me at  (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors to this report are listed in appendix II.
section_title: Appendix I: Comments from the Department of Health and Human Services
section_title: Appendix II: GAO Contact and Staff Acknowledgements
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Susan Anthony (Assistant  Director), Manuel Buentello (Analyst-in-Charge), Ricky Harrison Jr., and  Kate Nast Jones made key contributions to this report. Also contributing  were Sandra George and Drew Long.
section_title: Related GAO Products
paragraphs: The following are selected GAO products pertinent to the issues  discussed in this report. Other products may be found at GAO’s web site  at www.gao.gov.
Medicaid: Federal Guidance Needed to Address Concerns About  Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.:  February 5, 2016.
Medicaid: Improving Transparency and Accountability of Supplemental  Payments and State Financing Methods. GAO-16-195T. Washington,  D.C.: November 3, 2015.
Medicaid: Additional Efforts Needed to Ensure that State Spending is  Appropriately Matched with Federal Funds. GAO-16-53. Washington,  D.C.: October 16, 2015.
Medicaid: Key Issues Facing the Program. GAO-15-677. Washington,  D.C.: July 30, 2015.
Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug  Fraud Controls. GAO-15-390. Washington, D.C.: July 8, 2015.
Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care.  GAO-15-481. Washington, D.C.: May 29, 2015.
Medicaid: CMS Oversight of Provider Payments is Hampered by Limited  Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.
High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February  11, 2015.
Medicaid: Additional Federal Action Needed to Further Improve Third- Party Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015.
Medicaid Program Integrity: Increased Oversight Needed to Ensure  Integrity of Growing Managed Care Expenditures. GAO-14-341.  Washington, D.C.: May 19, 2014.
Medicaid Financing: States’ Increased Reliance on Funds from Health  Care Providers and Local Governments Warrants Improved CMS Data  Collection. GAO-14-627. Washington, D.C.: July 29, 2014.
Medicaid: Completed and Preliminary Work Indicate that Transparency  around State Financing Methods and Payments to Providers Is Still  Needed for Oversight. GAO-14-817T. Washington, D.C.: July 29, 2014.
Medicaid: More Transparency and Accountability for Supplemental  Payments are Needed. GAO-13-48. Washington, D.C.: November 26,  2012.
Medicaid: Data Sets Provide Inconsistent Picture of Expenditures.  GAO-13-47. Washington, D.C.: October 29, 2012.
Medicaid: States Reported Billions More in Supplemental Payments in  Recent Years. GAO-12-694. Washington, D.C.: July 20, 2012.
National Medicaid Audit Program: CMS Should Improve Reporting and  Focus on Audit Collaboration with States. GAO-12-627. Washington,  D.C.: June 14, 2012.
Medicaid and CHIP: Reports for Monitoring Children’s Health Care  Services Need Improvement. GAO-11-293R. Washington, D.C.: April 5,  2011.