Medicaid Integrity Program: CMS Should Take Steps to Eliminate Duplication and Improve Efficiency
Published: 2012-11-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid has the second-highest estimated improper payments of any federal program that reports such data. The Deficit Reduction Act of 2005 created the Medicaid Integrity Program to oversee and support state program integrity activities. CMS, the federal agency within HHS that oversees Medicaid, established the MIG to implement this new program. This report assesses (1) the MIG's use of two types of contractors to review and audit state Medicaid claims, (2) the MIG's implementation of other oversight and support activities, and (3) CMS and state reporting on the results of their program integrity activities. GAO analyzed MIG data on its contractors' audits, training program for state officials, comprehensive state reviews, and state assessments; analyzed reports that summarized the monetary returns from MIG and state program integrity activities; and interviewed MIG officials, contractors, and state program integrity officials.
section_title: What GAO Found
paragraphs: The Medicaid Integrity Group's (MIG) hiring of separate review and audit contractors for its National Medicaid Audit Program (NMAP) was inefficient and led to duplication because key functions were performed by both entities. Review contractors analyze state claims data to identify aberrant claims or billing anomalies while audit contractors conduct postpayment audits to determine if payments to providers were improper. Because both types of contractors had to assess whether payments were improper under state Medicaid policies, having separate contractors doubled states' burden in ensuring that state policies were being correctly applied. Also, poor coordination and communication between the two types of contractors resulted in duplicative data analysis. In turn, these inefficiencies added to the length of audits, which on average took almost 23 months to complete. By contrast, the average duration of six audits using a more collaborative and coordinated approach was 16 months, and the amount of identified overpayments increased significantly.
Other MIG oversight and support activities--the free training provided to state officials through the Medicaid Integrity Institute, the evaluation of state program integrity procedures through triennial comprehensive reviews, and the collection of data from states through annual assessments--show mixed results in enhancing program integrity efforts. According to state officials, the modest expenditures on the institute result in valuable training and networking opportunities. The MIG, however, has not taken advantage of the potential for comprehensive reviews to inform the selection of states for federal audits. Although the MIG's comprehensive reviews yield considerable information about state program integrity vulnerabilities, states with serious program integrity vulnerabilities often had few NMAP audits. Furthermore, the data collected through state program integrity assessments (SPIA) duplicate data collected through comprehensive reviews and other reports, are not validated, and, even if the data were accurate, are less current than similar data from other sources.
Reporting by the Centers for Medicaid & Medicaid Services (CMS) on the return on investment (ROI) from the activities of the MIG is inadequate. CMS's annual reports to Congress provide a limited picture of ROI for NMAP audits, which account for over half of the MIG's annual expenditures, and it is difficult to calculate an ROI with the expenditure and activity information provided. The Department of Health and Human Services (HHS) recently announced that it will discontinue reporting a separate ROI for NMAP. In addition, CMS's ROI methodology includes a percentage of state-identified overpayments reported on the SPIA, which is questionable. To date, CMS has not published an ROI methodology. Regarding state reporting of recoveries, we found that most states were not fully reporting recoveries according to specific program integrity activities and that a sizable number appeared to underreport aggregate recoveries compared to other sources. For example, one state reported aggregate recoveries of about $195,000 over 3 years to CMS but about $36 million in its annual report to the governor for 2 of these years. The apparent gaps in state reporting of such recoveries make it difficult to determine whether states are returning the federal share of recovered overpayments. A full accounting of state and NMAP related recoveries is vital for measuring the effectiveness of efforts to reduce improper payments.
section_title: What GAO Recommends
paragraphs: GAO recommends that the CMS Administrator (1) eliminate duplication by merging contractor functions, (2) use comprehensive reviews to better target audits, (3) follow up with states to ensure reliable reporting of their program integrity recoveries, (4) discontinue the SPIA, and (5) reevaluate and publish its ROI methodology. In response, HHS concurred with three of GAO's recommendations and partially concurred with the need to eliminate SPIA-related duplication and to reevaluate CMS's ROI methodology. As discussed in this report, GAO continues to believe that its recommendations are valid.

section_title: Letter
paragraphs: The size and diversity of the Medicaid program make it particularly  vulnerable to improper payments—including payments made for  treatments or services that were not covered by program rules, that were  not medically necessary, or that were billed for but never provided.
Medicaid, the joint federal-state health care financing program for certain  low-income individuals, is one of the largest social programs in federal  and state budgets, providing care to about 70 million individuals at a cost   The Centers for Medicare & Medicaid  of $436 billion in fiscal year 2011.Services (CMS), the federal agency within the Department of Health and  Human Services (HHS) that oversees Medicaid, estimated that   $21.9 billion (8.1 percent) of federal Medicaid expenditures for that fiscal  year were improper—the second-highest of any federal program that  reports such data.
We have had long-standing concerns about Medicaid’s program integrity.  In January 2003 we added Medicaid to our list of high-risk programs  because of concerns about the sufficiency of federal and state oversight. Two years later, we testified that CMS needed to increase its  commitment—both the alignment of resources and strategic planning—to  helping states fight Medicaid fraud, waste, and abuse. More recently, we  highlighted the program’s vulnerability to improper payments.
See GAO, Major Management Challenges and Program Risks: Department of Health and  Human Services, GAO-03-101 (Washington, D.C.: Jan. 2003).
See Pub. L. No. 109-171, § 6034, 120 Stat. 4, 74-78 (2006) (codified at 42 U.S.C.   § 1396u-6). the Medicaid Integrity Institute—a national Medicaid integrity training  program for state officials;  state comprehensive reviews—triennial assessments of states’  program integrity procedures and processes;  state program integrity assessments (SPIA)—the annual collection of  data on state Medicaid integrity activities; state technical assistance; and education and training of providers on payment integrity and quality of  care issues.
You asked us to examine CMS’s support for and oversight of states’  efforts to prevent and reduce improper payments. To address your  request, we first reported on the results of the MIG’s efforts to redesign  the NMAP, which accounts for about half of the MIG’s expenditures. This  report further examines the NMAP as well as the MIG’s other activities. It  assesses (1) how the MIG used contractors to conduct NMAP audits,   (2) the MIG’s implementation of several other oversight and support  activities, and (3) the reporting of the results of program integrity activities  by CMS and states.
To assess how the MIG used contractors to conduct NMAP audits, we  analyzed MIG data on audit assignments and its contractors’ lessons  learned reports. We discussed the NMAP program with MIG officials,  representatives of the MIG’s review and audit contractors, and program  integrity officials in 11 states.the Inspector General (HHS-OIG) reports, and interviewed HHS-OIG  officials involved in early assessments of the work of the MIG’s review  and audit contractors. To ensure the reliability of the data provided by the  MIG, we reviewed the accompanying data descriptions and interviewed   Finally, we reviewed relevant HHS Office of  knowledgeable MIG officials. We determined that the data were reliable  for our purposes.
To assess the MIG’s implementation of other oversight and support  activities, we collected and analyzed available information on its three  core activities. Specifically, we (1) examined materials related to the  operation of the MIG’s Medicaid Integrity Institute, such as the institute’s  2011 training calendar and one course’s after action evaluation report;   (2) analyzed final reports for the MIG’s most recent triennial  comprehensive reviews of the 50 states and the District of Columbia for  state program integrity vulnerabilities and compliance issues; and   (3) reviewed the summary statistics collected annually as a part of the   We discussed these three activities with MIG officials and with  SPIA.program integrity staff in the same 11 states mentioned above, and  reviewed other pertinent reports and documents related to these  activities. We also performed reliability checks on the comprehensive  reviews and SPIA data, such as reviewing relevant documentation and  discussing these data sources and their internal controls with  knowledgeable CMS officials. These officials told us that the SPIA data  are self-reported and not validated. As a result, we discuss the SPIA’s  data limitations in this report but did not use these data to analyze states’  reported recoveries.
CHIP is the acronym for the State Children’s Health Insurance Program, a federal-state  program that provides health care coverage to children 18 years of age and younger living  in low-income families whose incomes exceed the eligibility requirement for Medicaid. were incomplete in their reporting of states’ recoveries, we did not use  this data source but do discuss the data limitations we identified in this  report.
We conducted this performance audit from July 2011 through November  2012 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The MIG implemented its set of core activities gradually from fiscal years  2006 to 2009 when it reached its annual funding level of $75 million.example, the MIG initiated comprehensive reviews in fiscal year 2007,  completing eight, week-long site visits and implemented NMAP audits in  fiscal year 2009. To track the value of its program integrity activities, the  MIG developed a formula to measure return on investment (ROI),  including both direct and indirect benefits. The MIG, in conjunction with  Center for Medicaid and CHIP Services, also developed a mechanism for  states to report recoveries from fraud, waste, and abuse at a more  detailed level than previously as a part of CMS’s fiscal oversight of state  Medicaid expenditures.
subsections: section_title: NMAP Audits
paragraphs: The NMAP program accounts for about half of the $75 million  appropriated annually for the Medicaid integrity program. In each of five   geographic areas, two separate contractors are responsible for the review  and audit functions (see fig. 1):
Review function. One contractor reviews states’ paid claims data to  identify aberrant claims or billing anomalies.
Audit function. A different audit contractor conducts targeted provider  audits to determine whether or not the provider received an  overpayment.
As of July 2012, the MIG had two review contractors and three separate  audit contractors.
Since its inception, the MIG has used three different approaches to  conducting NMAP audits—test audits, Medicaid Statistical Information  System (MSIS) audits, and, more recently, collaborative audits. As we  noted in our June 2012 report on NMAP, the test and collaborative audits  differed from the MSIS audits in two important ways: the test and  collaborative audits (1) leveraged state expertise to identify potential audit  targets, rather than having the MIG select potential targets on the basis of  the work of its review contractors; and (2) primarily used state Medicaid  Management Information System (MMIS) data rather than MSIS data.  The MMIS is a mechanized claims-processing and information-retrieval  system maintained by individual states that generally reflects real-time  payments and adjustments of detailed claims for each health care service  provided. The MSIS audits relied on MSIS data, which contains extracts  from states’ MMIS databases. Because MSIS is a subset of states’ MMIS  data files, MSIS data are missing elements that can assist in audits, such  as the explanations of benefit codes and the names of providers and  beneficiaries. In addition, MSIS data are not current because of late state  submissions and the time it takes CMS’s contractors to review and  validate the data.
We recently reported that the identified overpayments from MSIS audits  were significantly lower than those identified by test and collaborative  audits.  As of February 2012, 59 of the 1,550 MSIS audits identified   $7.4 million in potential overpayments. In contrast, 26 test audits and   6 collaborative audits together identified $12.5 million in potential  overpayments (see fig. 2).yet identified more in overpayments than MSIS audits, only 6 of the   112 collaborative audits had final audit reports through February 2012,  and thus the total overpayment amounts identified through collaborative   While the newer collaborative audits have not  audits will likely continue to grow. In addition, we reported that (1) half of  the MSIS audits were for potential overpayments of $16,000 or less,  compared to a median of about $140,000 for test audits and $600,000 for  collaborative audits, and (2) over two-thirds (69 percent) of the 1,550  MSIS audits assigned to contractors were either discontinued (625), had  low or no findings (415), or were put on hold (37). Finally, we also  reported that the main reason the NMAP audits were ineffective was the  use of MSIS data, which are inadequate for reviewing claims and  selecting audit targets. Further, the MSIS audits were not well  coordinated with states, duplicated state program integrity activities, and  diverted resources from states’ activities. When we spoke about the MSIS  audits with 11 states, some indicated that participation in MSIS audits  diverted staff from their regular duties.
In addition to the NMAP, the MIG has implemented three activities that  are the core of its support and oversight of state program integrity—the  Medicaid Integrity Institute, comprehensive reviews, and SPIA. Less than  half of the MIG’s $75 million annual budget supports these three  activities. The MIG has also developed a methodology for computing the  ROI for its activities.
Medicaid Integrity Institute. In 2007, the MIG established the Medicaid  Integrity Institute, the first national Medicaid training program for state  program integrity officials. CMS executed an interagency agreement with  the Department of Justice to house the institute at the National Advocacy  Center, located at the University of South Carolina. At no cost to states,  the institute offers substantive training and support in a structured  learning environment. In time, the institute intends to create a  credentialing process to elevate the professional qualifications of state  Medicaid program integrity staff.
Comprehensive reviews. In 2007, the MIG initiated triennial  comprehensive state program integrity reviews, which assess each  state’s Medicaid program integrity procedures and processes. Topics  covered include program integrity organization and staffing, postpayment  review and fraud identification, investigation, and referral. The objective of  the reviews is to assess the effectiveness of states’ program integrity  activities and compliance with federal program integrity laws. As of fiscal  year 2011, the MIG had reviewed all states once (as well as the District of  Columbia, and Puerto Rico) and 26 states twice. Eighteen states have  been scheduled for review in fiscal year 2012.
State comprehensive reviews are guided by a detailed protocol and  represent a significant investment of staff time and resources for both  states and the MIG. In advance of a 1-week on-site review, state staff  respond to the review protocol and provide documentation on a state’s  program integrity activities (see fig. 3.) After the week-long visit, MIG staff  draft a report, obtain state comments, and follow up with the state on the  implementation of any corrective actions required to address findings.  The culmination of a review is a final report that details the MIG’s  assessment of each state’s program integrity vulnerabilities, compliance  with federal laws, and effective practices. These reports are posted on  CMS’s website and the MIG prepares an annual report that summarizes  the results for all states reviewed each year.
State Program Integrity Assessments. Annually, the MIG collects  information through a web-based portal from each state about its program  integrity activities, which results in a publication of a one-page summary  that provides statistics on states’ program integrity staffing, expenditures,  audits for improper payments, and recoveries.officials, the SPIA represent the first national baseline collection of data   According to MIG  on state Medicaid integrity activities for the purpose of program evaluation  and technical assistance. Although the profiles are published every year,  there is a 2-year lag in the SPIA data collection. For example, the 2010  SPIA covered state fiscal year 2008 activities.
Return on Investment. Federal law requires HHS to annually report to  Congress on the effectiveness of the use of the funds appropriated for the  Medicaid Integrity Program. However, the benefit derived from some of  the activities, such as the Medicaid Integrity Institute or technical  assistance, are difficult to quantify because they contribute to cost  avoidance rather than recoveries of overpayments. The MIG has  developed a strategy for reporting the ROI for the NMAP and its other  activities, which has changed over the program’s existence. Typically, an  ROI is calculated as a percentage—the benefits identified through a  program or set of activities relative to the total costs of that program or  activities.
section_title: Medicaid Overpayment Recovery Reporting
paragraphs: CMS has had a long-standing requirement that states report the  aggregated amount of recoveries from provider overpayments as a part of  their quarterly reporting on Medicaid program expenditures. During fiscal  year 2009, the MIG helped the CMS unit responsible for validating state  reporting of Medicaid expenditures develop more detailed reporting of  states’ recoveries of provider overpayments. Beginning in fiscal year  2010, CMS required states to report recoveries for specific activities  separately, such as NMAP, state program integrity activities, or the  activities of the HHS-OIG. The more detailed reporting of fraud, waste,  and abuse recoveries was initiated to allow CMS to track recouped  amounts according to specific program activities. CMS regional office  staff validates and audits the reported expenditure data and  accompanying detailed information; state officials must also attest to the  data’s accuracy.states’ Medicaid expenditures, which forms the basis for computing the  federal share of program costs.
section_title: Use of Separate Review and Audit Contractors Was Inefficient, Led to Duplication, and Contributed to a Longer Audit Process
paragraphs: The MIG’s decision to establish separate review and audit contractors for  each state was inefficient and led to duplication because key functions  such as data analysis were performed by both types of contractors. In  turn, these inefficiencies contributed to lengthy MSIS audits, which, on  average, took almost 2 years to complete.
subsections: section_title: Use of Separate Review and Audit Contractors Was Inefficient and Led to Duplication
paragraphs: The MIG’s decision to establish separate review and audit contractors for  each state was inefficient and led to duplication in two key areas—state  Medicaid policies and data analysis. The DRA required CMS to hire  contractors to review and audit provider claims. According to MIG  officials, they initially believed that the DRA required the use of separate  contractors but, in hindsight, concluded that these activities could have  been performed by one contractor.
State Medicaid policies. The MIG’s decision to use separate review and  audit contractors meant that both entities had to master the details of  numerous state Medicaid policies related to eligibility, benefits, and claims  processing in order to appropriately assess whether payments were  improper. Although MIG officials told us that they were sensitive to the  burden placed on states by the establishment of NMAP, the use of  separate review and audit contractors nonetheless increased states’  administrative burden because both types of contractors performed the  same function and states had to review the contractors’ work to ensure  that state policies were applied correctly. States provided feedback about  the samples prepared by the review contractors, which in some cases  reflected a misunderstanding of state policy. In addition, state officials  told us that they found themselves educating audit contractors about state  Medicaid policies. The MIG’s two review contractors were responsible  for learning and correctly applying the policies of 22 and 28 states,  respectively, while the three audit contractors were required to master the  policies of from 8 to as many as 24 states. Officials from one state noted  that becoming fully knowledgeable about all the policies affecting state  program integrity audits could take 2 to 3 years. According to several  state officials, the lack of an in-depth knowledge of state policy  contributed to unproductive provider audits. For example, according to  one state official, the MIG and its contractors had mistakenly identified  overpayments for federally qualified health centers because they  assumed that centers should receive reduced payments for an  established patient on subsequent visits. The contractors were not aware  that these types of centers are paid on an encounter basis, which makes  the same payment for the first and follow-up visits.
Data analysis. The use of separate review and audit contractors  increased inefficiencies in data analysis, which also led to duplication of  effort. The review contractors’ primary function was using algorithms to  analyze MSIS data with the goal of identifying potential improper  payments. Audit contractors also analyzed MSIS data to learn more about  targeted providers and the services for which they billed. However, the  audit contractors duplicated certain data analyses that had already been  performed by the review contractors, such as performing their own  verification of the completeness and accuracy of MSIS data. For example,  one audit contractor reported that the presence of large numbers of  duplicate claims in the MSIS data resulted in a significant commitment of  the contractor’s analytical and data management resources for 66 audit  targets that were subsequently discontinued.
The inefficiencies of having both review and audit contractors were  exacerbated by the MIG’s communication policies. All communication,  whether between review and audit contractors or between contractors  and states, went through a multistep process controlled by the MIG and,  as a result, the audit contractors could not easily communicate with the  review contractors to verify specific details of the review contractors’ data  analyses. Two audit contractors’ lessons-learned reports recommended  closer collaboration between audit and review contractors during the  algorithm vetting process and target selection to prevent duplicative data  analysis. In addition, the inability to communicate freely inhibited  contractors from taking full advantage of states’ knowledge of their own  Medicaid policies. The HHS-OIG reported a similar finding that the MIG’s  communication policy also contributed to a duplication of contractor  functions. To improve coordination and communication between the  contractors, MIG officials told us they began monthly conference calls in  mid-2011 that included both the review and audit contractors working in  the same geographic area. One audit contractor stated that the improved  communication with the review contractor has increased the efficacy of  their audits specifically related to early readmissions and hospice.
Several of the MIG’s recent changes to NMAP may reduce, but not  eliminate, duplication. Although review contractors were not initially  involved in collaborative audits, MIG officials told us that collaborative  audits were evolving and in some cases the review contractors are  conducting data analysis on state supplied MMIS data or are continuing  to analyze MSIS data in order to identify potential audit targets. However, they told us that review contractors are collaborating more  closely with states to validate any MSIS data findings using MMIS data.  Moreover, in July 2012, the MIG told us that while it planned to retain two  review contractors, it would reduce their workload overall and realign their  geographic areas of responsibility to ensure that all states are still  supported. Despite these changes, both review and audit contractors  must still correctly apply states’ Medicaid policies because both continue  to be involved in collaborative audits.
section_title: MSIS Audits Were Lengthy
paragraphs: According to MIG officials, in cases where MMIS data are not available at the outset, the  review contractors run algorithms on MSIS data. The review contractors conducted data  analysis on 34 percent of the 112 collaborative audits assigned to the MIG’s audit  contractors from January 2010 through December 2011. length of time from assignment of audit until submission of the final audit  report for these 58 successful MSIS audits was 23 months, ranging from  11 months to 38 months, with half of these audits taking 23 months or  more to complete (see fig. 4). In addition, for the 118 audits that were  assigned from 2009 to 2011 and still in progress, the average duration as  of February 2012 was 21 months. As the MIG shifts to collaborative  audits, preliminary results suggest these audits are completed more  quickly than MSIS audits. Although only six collaborative audits had final  audit reports as of February 2012, the average duration of those  successful audits was 16 months compared to 23 months for successful  MSIS audits.
Successful MSIS audits, those that identified overpayments, took nearly   2 years to complete, longer than some states and HHS-OIG typically  allow for Medicaid provider audits. Several state officials we interviewed  told us that MSIS audits took too long to complete. One state official  indicated that the state expected its new recovery audit contractor would  produce results within 9 months of the start of the contract, and an official  from a different state said that his staff attempt to produce draft audit  reports within 60 days of initiating an audit. Additionally, the HHS-OIG  allows about a year for audits to be conducted and completed before  reviewing or reporting on them. MIG officials told us that they were  aware of the time-consuming nature of MSIS audits and do track audit  progress, such as “days remaining to completion.” On the basis of a 2010  suggestion by one of its audit contractors, the MIG is taking steps to build  the capability to generate audit aging reports that would be available to its  contractors in its new workflow management system, but officials told us  that these changes are still in the implementation and testing phase.
section_title: Other MIG Activities Show Mixed Results in Overseeing and Supporting States’ Program Integrity Activities
paragraphs: The MIG’s modest spending on the Medicaid Integrity Institute enhances  states’ capabilities. Comprehensive reviews, a MIG oversight activity,  have the potential to inform state selection for federal audits. But, the data  collected through the SPIA, another MIG oversight activity, has been of  limited value as it is inconsistently reported, not validated, and overlaps  with information collected through comprehensive reviews and other state  reporting mechanisms.
subsections: section_title: Modest MIG Spending on Training through the Institute Enhances States’ Program Integrity Capabilities
paragraphs: Spending on the Medicaid Integrity Institute is a small fraction of the  MIG’s overall budget, and the 11 state program integrity officials we  interviewed affirmed the value of the institute for the substantive training it  provided. In addition, officials from 10 states described the benefits  derived from the opportunity to network with other states (see text box for  examples of state officials’ comments). The cost of the institute is modest  compared with overall MIG funding; the MIG reported that $1.7 million of  the approximately $75 million appropriated for the Medicaid Integrity  Program in fiscal year 2011 was spent on the institute.2008 to 2012, the institute trained over 3,000 state employees. While  officials from the 11 states we spoke with commended the institute, some  also offered suggestions for expanding the reach of the institute’s  activities:   From fiscal years
Officials from three states suggested that the MIG expand  opportunities for additional staff to attend, such as staff from the  Medicaid Fraud Control Units (MFCU) or the clinical staff that work  with program integrity staff, or allow attendance by more staff from  larger states.
Furthermore, officials from three states recommended that the  institute offer Medicaid audit certification to state program integrity  staff.
The National Association of Medicaid Directors and the Medicaid and  CHIP Payment and Access Commission also recommended that CMS  expand the institute to make it more accessible to state officials.
section_title: The MIG’s Comprehensive Reviews Could Help Inform the Selection of States for NMAP Audits
paragraphs: Comprehensive reviews yield important information about all aspects of  states’ program integrity capabilities and vulnerabilities, and such  information could be used to target NMAP audits towards states with  serious vulnerabilities. In its comprehensive reviews of 51 states, the MIG  identified 7 states as having serious program integrity infrastructure  vulnerabilities, such as not maintaining a centralized program integrity  function, yet 5 of these states had less than the typical number of audits   Two of the 7 states had no NMAP audits assigned, 3 states  assigned.had less than 1 percent of assigned audits in their states, and 2 other  states had 16 and 23 audits, respectively; these last 2 states ranked 29th  and 22nd in the assignment of 1,662 NMAP audits as of February 2012.  (See table 1.) In the same set of 51 state comprehensive reviews, the  MIG identified 6 states that had a limited or ineffective Surveillance  Utilization Review Subsystem (SURS), another serious vulnerability  involving the required claims-data surveillance system. Only 1 of these  states was among the top 10 states for assigned NMAP audits. The  number of assigned audits in these 6 states ranged from 0 to 110, with   3 states having 10 or fewer audits, 2 states having about 30 audits, and  one state having 110 audits. The state with the highest number of NMAP  audits was Louisiana, which accounted for 10 percent of all NMAP audits  (195); yet, according to the MIG’s comprehensive review, the state did not  have a vulnerable program integrity infrastructure or any identified SURS  weaknesses. (See app. I for the number of NMAP audits assigned to  each state.)
As a part of its comprehensive reviews, the MIG identifies findings or  vulnerabilities that continue to persist from the state’s prior  comprehensive review. Of the 51 comprehensive reviews we analyzed,  the MIG found that one quarter of states had uncorrected repeat or partial  repeat findings or vulnerabilities that had not been addressed since the  prior reviews. Nonetheless, of the 10 states that received 62 percent of  the 1,662 NMAP audits, 8 states had no uncorrected repeat findings or  vulnerabilities.
section_title: SPIA Data Are Not Validated, Are Inconsistently Reported, and Overlap with Other Efforts
paragraphs: On an annual basis, states self-report the data submitted to the SPIA, and  MIG staff told us that they do not review all 220 state-reported data  elements or validate the data for reliability. Yet, MIG staff told us that they  do check the states’ data submissions for reasonableness and follow up  with states to confirm extreme responses. We have reported that the  SPIA contained significant errors and were inconsistent with data  reported in state comprehensive reviews covering the same year.  Overall, the data are not reported in a consistent enough manner to allow  for comparisons across states. For example, the instructions specify  which collections a state may include in the category of recovered  overpayments, but one state official told us the state’s recoveries included  collections that were supposed to be excluded. State reporting is further  complicated because the collection instrument does not allow state  officials to comment on or explain their responses. Thus, states unable to  report data as requested also cannot explain why or how their data  deviates from what was requested, resulting in inconsistent reporting and  blank items.
According to CMS, not all of the information that the SPIA collects on expenditures is  available through quarterly reports. For example, unlike the quarterly reporting form, the  SPIA asks for expenditure information by activity. Many states, however, do not report  such information and the information provided is not validated. If CMS believed that such  detailed program integrity expenditure data were valuable, it could revise states’ quarterly  reporting requirements. organizational structure, number of staff, use of contractors, SURS, and  recoveries—are also collected during the comprehensive reviews every   3 years and included in the published reports available on the MIG’s  website. MIG officials acknowledged that the SPIA duplicated other  requests for information and told us they were examining ways to reduce  the duplication.
MIG officials told us that states use the SPIA as a reference tool to  familiarize themselves with other states’ program integrity activities, plan  program integrity activities and training, and identify how the MIG can  provide support to them. However, representatives from 10 out of   11 states we spoke with told us that they had not looked at other states’  assessment data posted on the MIG’s website. One state official  explained that smaller states or those with newer program integrity  activities may refer to the SPIA, but the larger states we contacted had  not. In addition, representatives from 4 states commented that SPIA  reporting is not consistent or comparable across states.
Correcting inconsistencies in the SPIA data, however, would be of limited  value. The 2-year time lag in the SPIA data undermines its usefulness in  determining which states would benefit from technical assistance and  developing measures to assess states’ performance. Other sources, such  as comprehensive reviews, provide more timely and useful information.
section_title: Reporting on Program Integrity Results Is Inadequate
paragraphs: CMS’s limited reporting on the ROI from the Medicaid Integrity Program is  inadequate. State reporting of recoveries is similarly insufficient because  we found that most states were not fully reporting recoveries according to  specific program integrity activities and that almost half appeared to  underreport aggregate annual recoveries.
subsections: section_title: CMS’s Limited ROI Reporting Is Inadequate
paragraphs: CMS’s annual reports to Congress do not provide a clear picture of the  ROI for NMAP audits because they combined the results of MSIS and  test audits, which performed very differently. In its annual report covering  fiscal year 2010, CMS reported that 947 MSIS and test audits were  underway in 45 states and that its contractors had identified cumulative  potential overpayments of about $10.7 million.data, which summarized these results by audit approach, found that over  three-fourths of the overpayments—$8.4 million—were identified by the  small number of test audits, in which states identified the audit targets  and supplied their own data. Reporting combined overpayments for MSIS  and test audits gave the impression that NMAP was more successful than  was the case. Moreover, the annual report did not provide information on  the number of audits that were discontinued because of no or low  overpayments. Finally, the $42 million in expenditures for Medicaid  integrity contractors reported in the fiscal year 2010 annual report  combined the cost of both NMAP and education contractors, making it  difficult to compute an ROI for NMAP.
Our analysis of CMS’s  ROI reporting for the Medicaid Integrity Program as a whole has changed  over time.
For fiscal year 2008, HHS’s budget justification for CMS reported an  ROI of 300 percent for the test audits covering a 3-month period—the  amount of identified overpayments from the test audits as a  percentage of the contractor expenses for that time period.
For fiscal year 2009, the ROI formula was broadened to capture MIG  overpayment identification activities beyond the NMAP. As such, it  included the identification and recovery of overpayment amounts  through the MIG’s identification of systematic errors in state payment  systems and comprehensive state program integrity reviews as a  percentage of its fiscal year 2009 funding for the Medicaid Integrity  Program. HHS reported a 2009 ROI of 175 percent using this new  formula.
Although an ROI has not been released for fiscal years 2010 or 2011,  HHS has announced that it will calculate the ROI to better reflect the  resources invested through the Medicaid Integrity Program and will  discontinue reporting an ROI for the NMAP.
In several reports to the Congress, CMS has indicated that it was  developing a methodology for calculating an ROI based on its activities.  The MIG has not published its ROI methodology, but did provide it to us   The methodology incorporates identified overpayments  for our review.from activities for which the MIG was directly responsible as well as  benefits from activities where the MIG provided support and assistance  (see table 2).
The MIG’s ROI strategy includes a variety of elements, some of which  may be difficult to quantify, and others that may be less valid or  duplicative of other ROI calculations. For example, although difficult to  measure, the MIG is attempting to quantify cost savings realized from  states’ participation at the institute so that they can be incorporated into  an overall calculation of the ROI for the MIG’s activities. However, it also  incorporates a percentage of the identified overpayments reported on the  SPIA, which are self-reported and not validated. Given that the MIG’s  methodology already includes the benefit from comprehensive reviews  and technical assistance to states, its rationale for claiming an additional  percentage of states’ own identified overpayments is questionable.
section_title: Most States Are Not Fully Reporting Recoveries
paragraphs: Even though the reporting of aggregated program integrity recoveries has  been a longstanding requirement, many states appear to be  underreporting aggregate annual recoveries when compared with other  data sources, such as their CMS comprehensive program integrity  reviews or reports states prepare on the results of their program integrity  activities. For example:
One state reported aggregate recoveries of $3 million for federal fiscal  years 2009 and 2010—$0 and $3 million—but about $37 million for  state fiscal years 2009 and 2010 in its comprehensive review.
Another state reported aggregate recoveries of about $195,000 over   3 years to CMS—$0, $130,000, and $65,000—but about $36 million  in its annual report to the governor for 2 of these years.
A third state reported about $6,000 in aggregate recoveries for federal  fiscal year 2009 but about $3 million for state fiscal year 2009 in its  comprehensive review.
Overall from federal fiscal years 2009 through 2011, 15 states reported  no fraud, waste, and abuse recoveries in at least 1 fiscal year (see   app. II). These results appear questionable given that 5 of the 15 states  were among the 20 states with the highest Medicaid expenditures in fiscal  year 2010. Additionally, total reported recoveries for all states in fiscal  year 2010 represented only about 0.28 percent of state Medicaid  expenditures, significantly less than CMS’s estimate that improper  payments accounted for about 8 percent of state Medicaid expenditures  in fiscal year 2011.
In addition, although CMS implemented more detailed state reporting of  recovered overpayments beginning in fiscal year 2010, we found that  most states were not fully reporting recoveries by the specific type of  activity that resulted in the recovery. In fiscal year 2011, the second year  of detailed reporting of program integrity recoveries, 36 or more states  reported no recoveries for specific state-based activities that generally  produce program integrity recoveries, such as state data analysis,  provider audits, or MFCU investigations (see fig. 5).
The underreporting of program integrity recoveries occurs despite CMS’s  validation efforts. CMS’s financial review protocols specify that quarterly  desk reviews must be completed for every state in every quarter, and  yearly on-site reviews must be completed for the 20 states with the  greatest Medicaid expenditures in the preceding fiscal year. On-site  review protocols explicitly instruct the reviewer to verify the reported  aggregated amount of fraud, waste, and abuse recoveries, and CMS  regional office staff may conduct on-site reviews in additional states as  appropriate. CMS staff told us that its financial review protocols  encompass hundreds of pages and that reporting of fraud, waste, and  abuse recoveries is a small portion of the items they are responsible for  validating. They commented that their limited reviews did not allow them  to know whether or not fraud, waste, and abuse recoveries were listed  elsewhere as a part of the state’s quarterly expenditure reporting because  states may report recoveries as an offset to other expenditures or may  report them comingled with other credits that are not fraud, waste, or  abuse-related.
Further, CMS staff offered several explanations for the reporting gaps we  identified, including the observation that it is not unusual for states to take  several years to come into compliance with new reporting requirements.  This delay may reflect the fact that states’ accounting processes may  differ from the new instructions and states may need to change their  processes or data systems to accommodate the new reporting  requirements. CMS officials also said that states may have reported their    recoveries as an adjustment that decreased claims from prior quarters. While it is plausible that state accounting systems may differ from the  recently implemented federal reporting requirements, states have had a  long-standing requirement to report their recoveries of overpayments in  the aggregate. Additionally, states report recovered overpayments as a  part of their state comprehensive reviews, and some states include the  results of their program integrity activities in their Medicaid annual  reports.
section_title: Conclusions
paragraphs: The MIG’s activities to support and oversee state Medicaid program  integrity efforts are relatively new and have had mixed success. The  Medicaid Integrity Institute is widely acclaimed by state officials. However,  the MIG has had to make significant changes to NMAP, the use of  comprehensive reviews have shortcomings, and the SPIAs are unreliable.  In addition, CMS and states’ reporting on the results of their program  integrity activities are not transparent and are incomplete. Specifically:
The MIG’s decision to hire separate review and audit contractors was  inefficient and contributed to overlap and duplication. For example,  both types of contractors were engaged in data analysis and both had  to be cognizant of state Medicaid policies, which increased the burden  on states.
Although the MIG’s comprehensive reviews yield considerable  information about state structural and data-analysis vulnerabilities,  there is no apparent connection between the reviews’ findings and the  selection of states for NMAP audits. Thus, states with serious  program integrity vulnerabilities often had few NMAP audits.
Information that the MIG collects through the SPIAs is unreliable.  Even if SPIAs were accurate, their value is unclear because similar  and more timely information is collected through other sources, such  as the comprehensive reviews.
Computing an ROI for the entire Medicaid Integrity Program that  reflects the outcomes from all MIG expenditures is complex because it  involves measuring both direct and indirect benefits. To date, CMS  has provided a misleading picture of the ROI for NMAP audits and its  unpublished methodology incorporates a percentage of identified  overpayments reported on the SPIA, which is questionable.
A full accounting of state and NMAP-related recoveries is an  important yardstick for measuring the effectiveness of efforts to  reduce improper payments. The apparent gaps in state reporting of  such recoveries, however, hamper federal efforts to quantify the  results of state and federal activities and make it difficult to determine  whether states are returning the federal share of recovered  overpayments.
Given the magnitude of the estimated Medicaid improper payments,  federal support and oversight of Medicaid program integrity is important,  and it is essential that federal efforts are carried out efficiently without  placing an undue burden on states.
section_title: Recommendations for Executive Action
paragraphs: To strengthen the Medicaid Integrity Program, we are making five  recommendations to the CMS Acting Administrator:
To eliminate duplication and more efficiently use audit resources, the  CMS Acting Administrator should merge the functions of the federal  review and audit contractors within a state or geographic region.
To ensure that the MIG’s comprehensive reviews inform its  management of NMAP, the CMS Acting Administrator should use the  knowledge gained from the comprehensive reviews as a criterion for  focusing NMAP resources towards states that have structural or data- analysis vulnerabilities.
To avoid unnecessary duplication overlap with other efforts, as well as  the reporting of unverified and inaccurate data, the CMS Acting  Administrator should discontinue the annual state program integrity  assessments.
To ensure the most effective use of federal Medicaid program integrity  funding, the CMS Acting Administrator should reevaluate the agency’s  methodology for calculating an ROI for the Medicaid Integrity  Program, including reporting separately on the NMAP, and share its  methodology with Congress and the states.
To ensure the appropriate tracking of the results of states’ program  integrity activities, the CMS Acting Administrator should increase the  agency’s efforts to hold states accountable for reliably reporting  program integrity recoveries as a part of their quarterly expenditure  reporting.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for comment. In its written  comments, HHS stated that CMS was currently revising its  Comprehensive Medicaid Integrity Plan covering fiscal years 2013  through 2017 in order to address the duplication and inefficiencies that we  had identified in the Medicaid Integrity Program. According to HHS, the  plan will unveil significant changes to improve the efficiency of the  agency’s Medicaid integrity activities. In response to our five  recommendations, HHS concurred with three recommendations and  partially concurred with two others.
Review and audit contractor functions. HHS said that it concurred with our  recommendation to merge the functions of its review and audit  contractors in order to eliminate duplication and use contractor resources  more efficiently. The department stated that it was evaluating options for  consolidating its contractors’ work within current statutory and  procurement requirements.
Comprehensive reviews and recovery reporting. HHS also concurred with  our recommendations to (1) use the comprehensive program integrity  reviews to better inform NMAP, and (2) increase efforts to hold states  accountable for reliably reporting program integrity recoveries as part of  their quarterly expenditure reporting. With regard to the comprehensive  reviews, HHS stated that CMS would work to improve the integration of  the knowledge gained from the comprehensive reviews to help identify  the states and program areas representing the greatest risks to the  Medicaid program, which, in turn, would influence the agency’s national  audit strategy. In terms of holding states accountable, the department  indicated that it would work through its regional offices to include state  recovery reporting in the risk assessment used to select areas for  financial management reviews, which validate state reported data. In  addition, it will continue to provide the necessary training to states to help  facilitate reliable recovery reporting.
ROI methodology and reporting. HHS partially concurred with our  recommendation to reevaluate the methodology used to calculate an ROI  for the Medicaid Integrity Program, including reporting separately on  NMAP, and to share its methodology with Congress and the states. HHS  indicated that CMS annually reevaluates the methodology and has  provided descriptions of the methodology in documents that are, or will  soon be, available to the public, such as the fiscal year 2013 annual  budget justification for CMS. We found that those descriptions were  limited and that the budget justification was less detailed than the ROI  methodology that CMS shared with us, which is summarized in table 2 of  this report. HHS also noted that CMS’s methodology will become public  when our report is published. HHS said that CMS will be reviewing the  scope of what should be included in the calculation of ROI for the  Medicaid Integrity Program but it did not address our concern that taking  an additional percentage of states’ own identified overpayments was  questionable. HHS did not concur that an ROI should be reported  separately for NMAP because it believes that CMS’s Medicaid program  integrity investments interact with one another and NMAP ROI would be a  misleading index of the work and impact of the Medicaid Integrity  Program. We continue to believe that separately reporting an NMAP ROI  is essential to hold CMS accountable for the effective operation of those  audits, which constituted about half of CMS’s annual expenditures on the  Medicaid Integrity Program.
SPIA. HHS partially concurred with our recommendation and said that it  would suspend the annual state program integrity assessments while  taking steps to address the limitations that we had identified. HHS stated  that the triennial comprehensive state program integrity reviews alone  may not provide adequate data to inform CMS oversight. Although the  department acknowledged the reporting overlap between the SPIA and  comprehensive reviews, it stated that CMS was now working to  streamline the comprehensive review questionnaires to eliminate  duplication. HHS also indicated that CMS’s forthcoming Comprehensive  Medicaid Integrity Plan would outline plans to enhance the SPIA by  refining the data collection tool, reducing the reporting time lag, and  providing for data validation and correction by CMS staff during the  triennial comprehensive reviews. We believe that CMS’s efforts to  address overlap by eliminating duplicative information collected though  the comprehensive reviews does not take into account the considerable  resources that states devote to filling out the comprehensive review  questionnaires, which CMS officials have the opportunity to discuss and  verify during week-long site visits. In contrast, SPIA data are collected  through a web-based survey, which is inconsistently completed and  viewed as a burden by states. Although CMS believes the annual SPIA  data are important to its program integrity mission and plans to reduce the  current reporting time lag, it has not clearly articulated how it will or could  use this information to inform its oversight. In addition, state recoveries  and program integrity expenditures are reported to CMS on a quarterly  basis, which would provide a more reliable financial accounting of states’  program integrity activities. As a result, we continue to believe that the  SPIA should be permanently, not just temporarily, discontinued.
HHS’s comments are reproduced in appendix III. HHS also provided  technical comments, which we incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff has any questions about this report, please contact me  at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.
section_title: Appendix I: Number of National Medicaid Audit Program Audits
section_title: Appendix II: Recoveries from State Medicaid Program Integrity Activities
section_title: Appendix III: Comments from the Department of Health and Human Services
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributors to this report  were: Water Ochinko, Assistant Director; Leslie V. Gordon; Drew Long;  and Jasleen Modi.
section_title: Related GAO Products
paragraphs: National Medicaid Audit Program: CMS Should Improve Reporting and  Focus on Audit Collaboration with States. GAO-12-814T. (Washington,  D.C.: June 14, 2012).
National Medicaid Audit Program: CMS Should Improve Reporting and  Focus on Audit Collaboration with States. GAO-12-627. (Washington,  D.C.: June 14, 2012).
Program Integrity: Further Action Needed to Address Vulnerabilities in  Medicaid and Medicare Programs. GAO-12-803T. (Washington, D.C.:  June 7, 2012).
Medicaid: Federal Oversight of Payments and Program Integrity Needs  Improvement. GAO-12-674T. Washington, D.C.: April 25, 2012.
Medicaid Program Integrity: Expanded Federal Role Presents Challenges  to and Opportunities for Assisting States. GAO-12-288T. Washington,  D.C.: December 7, 2011.
Fraud Detection Systems: Additional Actions Needed to Support Program  Integrity Efforts at Centers for Medicare and Medicaid Services.   GAO-11-822T. Washington, D.C.: July 12, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.
Status of Fiscal Year 2010 Federal Improper Payments Reporting.   GAO-11-443R. Washington, D.C.: March 25, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. GAO-11-430T. Washington, D.C.: March 2,  2011.
Opportunities to Reduce Potential Duplication in Government Programs,  Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington,  D.C.: March 1, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.
Medicare Recovery Audit Contracting: Weaknesses Remain in  Addressing Vulnerabilities to Improper Payments, Although  Improvements Made to Contractor Oversight. GAO-10-143. Washington,  D.C.: March 31, 2010.
Medicaid: Fraud and Abuse Related to Controlled Substances Identified  in Selected States. GAO-09-1004T. Washington, D.C.: September 30,  2009.
Medicaid: Fraud and Abuse Related to Controlled Substances Identified  in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009.
Improper Payments: Progress Made but Challenges Remain in  Estimating and Reducing Improper Payments. GAO-09-628T.  Washington, D.C.: April 22, 2009.
Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax  System. GAO-08-239T. Washington, D.C.: November 14, 2007.
Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax  System. GAO-08-17. Washington, D.C.: November 14, 2007.
Medicaid Financial Management: Steps Taken to Improve Federal  Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705.  Washington, D.C.: June 22, 2006.
Medicaid Integrity: Implementation of New Program Provides  Opportunities for Federal Leadership to Combat Fraud, Waste, and  Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006.
Medicaid Fraud and Abuse: CMS’s Commitment to Helping States  Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.:  June 28, 2005.
Major Management Challenges and Program Risks: Department of  Health and Human Services. GAO-03-101. Washington, D.C.: January  2003.