Medicaid Managed Care: CMS's Oversight of States' Rate Setting Needs Improvement
Published: 2010-08-04T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid managed care rates are required to be actuarially sound. A state is required to submit its rate-setting methodology, including a description of the data used, to the Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services (CMS) for approval. The Children's Health Insurance Program Reauthorization Act of 2009 required GAO to examine the extent to which states' rates are actuarially sound. GAO assessed CMS oversight of states' compliance with the actuarial soundness requirements and efforts to ensure the quality of data used to set rates. GAO reviewed documents, including rate-setting review files, from 6 of CMS's 10 regional offices. The selected offices oversaw 26 of the 34 states with comprehensive managed care programs; the states' programs varied in size and accounted for over 85 percent of managed care enrollment. GAO interviewed CMS officials and Medicaid officials from 11 states that were chosen based in part on variation in program size and geography.
section_title: What GAO Found
paragraphs: CMS has been inconsistent in reviewing states' rate setting for compliance with the Medicaid managed care actuarial soundness requirements, which specify that rates must be developed in accordance with actuarial principles, appropriate for the population and services, and certified by actuaries. Variation in CMS regional office practices contributed to this inconsistency in oversight. For example, GAO found significant gaps in CMS's oversight of two states. 1) First, the agency had not reviewed Tennessee's rate setting for multiple years and only determined that the state was not in compliance with the requirements through the course of GAO's work. According to CMS officials, Tennessee received approximately $5 billion a year in federal funds for rates that GAO determined had not been certified by an actuary, which is a regulatory requirement. 2) Second, CMS had not completed a full review of Nebraska's rate setting since the actuarial soundness requirements became effective, and therefore may have provided federal funds for rates that were not in compliance with all of the requirements. Variation in a number of CMS regional office practices contributed to these gaps and other inconsistencies in the agency's oversight of states' rate setting. For example, regional offices varied in the extent to which they tracked state compliance with the actuarial soundness requirements, their interpretations of how extensive a review of a state's rate setting was needed, and their determinations regarding sufficient evidence for meeting the actuarial soundness requirements. As a result of our review, CMS took a number of steps that may address some of the variation that contributed to inconsistent oversight, such as requiring regional office officials to use a detailed checklist when reviewing states' rate setting. However, additional steps are necessary to prevent further gaps in oversight and additional federal funds from being paid for rates that are not in compliance with the actuarial soundness requirements. CMS's efforts to ensure the quality of the data used to set rates were generally limited to requiring assurances from states and health plans--efforts that did not provide the agency with enough information to ensure the quality of the data used. CMS's regulations do not include standards for the type, amount, or age of the data used to set rates, and states are not required to report to CMS on the quality of the data. When reviewing states' descriptions of the data used to set rates, CMS officials focused primarily on the appropriateness of the data rather than their reliability. With limited information on data quality, CMS cannot ensure that states' managed care rates are appropriate, which places billions of federal and state dollars at risk for misspending. States and other sources have information on the quality of data used for rate setting--information that CMS could obtain. In addition, CMS could conduct or require periodic audits of data used to set rates; CMS is required to conduct such audits for the Medicare managed care program.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS implement a mechanism to track state compliance with the requirements, clarify guidance on rate-setting reviews, and make use of information on data quality in overseeing states' rate setting. HHS agreed with our recommendations and described initiatives underway that are aimed at improving CMS's oversight.

section_title: Letter
paragraphs: The importance of managed care in the Medicaid program is significant,  with nearly half of all Medicaid enrollees—approximately 20.7 million  individuals—enrolled in capitated managed care in 2008 and a total of over  $62 billion in federal and state spending for managed care in 2007.  Moreover, Medicaid—a joint federal-state program that finances health  care for certain categories of low-income individuals—is expanding. With  the passage of the Patient Protection and Affordable Care Act (PPACA) in  March 2010, states will expand coverage under the Medicaid program to  an estimated 18 million additional people. Expansions of Medicaid are  likely to increase the number of people enrolled in and amount of  spending for managed care, making effective federal oversight of this large  and complex component of the Medicaid program particularly critical.
The potential benefits and risks of Medicaid managed care are substantial.  Managed care is designed to ensure the provision of appropriate health  care services in a cost-efficient manner. However, capitation payments,  which are made prospectively to health plans to provide or arrange for  services for Medicaid enrollees, can create an incentive to underserve or  deny access to needed care. Thus, appropriate safeguards are needed to  ensure access to care and appropriate payment in Medicaid managed care.  One such safeguard included in federal law is the requirement that states’  capitation rates be actuarially sound. In 2002, the Centers for Medicare &  Medicaid Services (CMS), the agency within the Department of Health and  Human Services (HHS) that oversees states’ Medicaid programs, issued  regulations defining actuarially sound rates as those that are (1) developed  in accordance with generally accepted actuarial principles and practices;  (2) appropriate for the populations to be covered and the services to be  furnished; and (3) certified as meeting applicable regulatory requirements  by qualified actuaries. The regulations also specify the documentation  states are required to submit to CMS regional offices to demonstrate  compliance with the requirements, including a description of their rate- setting methodology and the data used to set rates. In 2003, CMS finalized  a detailed checklist that its regional office staff could use in their reviews  of states’ rate setting and for states and states’ actuaries to consider in  setting rates.
The Children’s Health Insurance Program Reauthorization Act of 2009  directed us to examine the extent to which state Medicaid managed care  payment rates are actuarially sound. Specifically, we assessed (1) CMS’s  oversight of states’ compliance with the Medicaid managed care actuarial  soundness requirements, and (2) CMS’s efforts to ensure the quality of the  data used to set rates.
To assess CMS’s oversight of states’ compliance with the actuarial  soundness requirements, we reviewed documentation of CMS’s oversight  efforts from 6 of the 10 CMS regional offices. These offices were  responsible for reviewing rate setting and approving rates for 26 of the   34 states with comprehensive managed care programs, were  geographically diverse, and oversaw states with programs that ranged in  size and accounted for about 85 percent of national managed care  enrollment. Our review of CMS’s oversight efforts included completing a  structured review of 28 CMS files documenting rate-setting reviews  completed as of October 31, 2009. (See app. I for a summary of the  criteria we used to select the 6 CMS regional offices and the methodology  for our review of CMS files.) To supplement our review, we interviewed  officials in CMS’s central office and the 6 selected CMS regional offices to  obtain information regarding steps taken by CMS to ensure the actuarial  soundness of rates; and we reviewed regional office standard operating  procedures. We also interviewed Medicaid officials from 11 of the states  overseen by the 6 selected CMS regional offices to obtain their views of,  and experiences with, CMS’s oversight of state compliance with the  actuarial soundness requirements. These states were geographically  diverse and had managed care programs that varied in size. (See app. II for  our criteria for selecting states for interviews.)
To assess CMS’s efforts to ensure the quality of data used to set rates, we  reviewed CMS policies and guidance related to rate setting. In addition, in  interviews with officials from CMS’s central office and the selected  regional offices, we asked about steps CMS takes to ensure data quality,  including what information CMS requires states to include in their rate- setting submissions to demonstrate the appropriateness and reliability of  the data used to set rates and whether any audits or studies of rate setting  had been performed. We also assessed, as part of our review of CMS files,  the information provided in states’ rate-setting submissions about steps  taken to ensure data quality, including statements made by states’  actuaries. In interviews with state Medicaid officials, we asked about their  processes to ensure data quality and their experiences with CMS oversight  of data quality. We also reviewed relevant audit findings from the  Washington State Auditor’s Office. Finally, we contacted officials from  five health plans to discuss their efforts to ensure the quality of the data  submitted to states for rate setting.
We conducted our performance audit from October 2009 through July  2010 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Under Medicaid managed care, states contract with health plans and  prospectively pay the plans a fixed monthly rate per enrollee to provide or  arrange for most health services. These contracts are known as “risk”  contracts because plans assume the risk for the cost of providing covered  services. States’ processes for developing rates may vary in a number of  ways, including the type and time frames of data they use as the basis for  setting rates, referred to as the base-year data, and what approach they  use to negotiate rates with health plans. After rates are developed, an  actuary certifies the rates as actuarially sound for a defined period of time,  typically 1 year. In order to receive federal funds for its managed care  program, a state is required to submit its rate-setting methodology and  rates to CMS for review and approval. This review, completed by CMS  regional office staff, is designed to ensure a state complies with federal  regulatory requirements for setting actuarially sound rates.
subsections: section_title: CMS’s Oversight of Rate Setting
paragraphs: CMS published a final rule on June 14, 2002, outlining the agency’s  regulatory requirements for actuarially sound rates. These requirements  largely focus on the process states must use in setting rates. For  example, the regulations require states to document their rate-setting  methodology and include an actuarial certification of rates. In addition,  the regulations include a requirement that when states use data from  health plans as the basis for rates they must have plan executives certify the accuracy and completeness of their data. The regulations do not   include standards for the type, amount, or age of the data that states mayuse in setting rates. The regulations also do not include standards for the reasonableness or adequacy of rates. In the preamble to the final rule, CMS noted that health plans were better able to determine the reasonableness  and adequacy of rates when deciding whether to contr act with a state.
In July 2003, CMS finalized a detailed checklist that regional office staff  could use when reviewing states’ rate-setting submissions for compliance  with the actuarial soundness requirements and that states and states’  actuaries could use when developing rates. The checklist includes  citations to, and a description of, each regulatory requirement; guidance  on what constitutes state compliance with the requirement; and spaces for  the CMS official to check whether each requirement was met and cite  evidence from the state’s submission for compliance with the requirement.  The checklist also provides guidance on the level of review that should  occur for different types of rate changes. When the state is developing a  new rate, or using new actuarial techniques or data to change previously  approved rates, the checklist indicates a full review should be done, which  entails reviewing the state’s submission for compliance with all of the  requirements covered in the checklist. For adjustments to rates that were  previously approved as meeting the regulations, the checklist indicates a  partial review should be done; a partial review focuses on a few key  requirements in the checklist, such as ensuring that the state has included  a certification of rates from a qualified actuary. As of June 2010, CMS was  in the process of revising the checklist. One of the planned changes was to  emphasize the need for more complete encounter data because CMS  officials indicated that the agency has determined that encounter data that  do not include pricing information are not sufficient for setting rates. CMS  expects to complete the checklist revisions by November 2010. (See   table 1 for a summary of the sections in CMS’s checklist.)
According to CMS officials, the regional officials responsible for  conducting rate-setting reviews may have a financial background, but are  not actuaries. Officials also noted that CMS’s OACT, which provides  actuarial advice to other offices within CMS, is generally not involved with  Medicaid rate-setting reviews. However, they indicated that when the CMS  officials responsible for rate-setting reviews have concerns with a state’s  rate-setting methodology and cannot resolve those concerns with the  state, they can contact OACT to request an independent review.
section_title: Actuarial Principles and Practices for Medicaid Managed Care Rate Setting
paragraphs: CMS’s regulations require that actuarially sound rates be developed in  accordance with generally accepted actuarial principles and practices.  There is no Actuarial Standard of Practice (ASOP) that applies to actuarial  work performed to comply with CMS’s regulations. However, in 2005, the  American Academy of Actuaries published a practice note that provides  nonbinding guidance on certifying Medicaid managed care rates.
The practice note includes a proposed definition for “actuarial soundness,”  as there was no other working definition of the term that would be  relevant to the actuary’s role in certifying Medicaid managed care rates.  Under the definition, rates are actuarially sound if, for the period of time  covered by the certification, projected premiums provide for all  “reasonable, appropriate, and attainable costs;” also under the definition,  rates do not have to encompass all possible costs that any health plan  might incur. The note emphasizes that the definition only applies to the  certification of Medicaid managed care rates, and that it differs from the  definition used when certifying a health plan’s rates.
The practice note also provides information on the actuary’s role in  assessing the quality of data used to set rates and refers the actuary to the  ASOP on data quality for further guidance. The practice note explains  that if the actuary is involved in developing the rate, then the actuary  would consider all available data, including FFS data, Medicaid managed  care encounter data, and Medicaid managed care financial reports and  financial statements. The actuary would typically compare data sources  for reasonableness and check for material differences when determining  the preferred source or sources for the base-year data. The ASOP on data  quality clarifies that while actuaries should generally review the data for  reasonableness and consistency they are not required to audit the data.
The ASOP also explains that the accuracy and completeness of the data  are the responsibility of those that provided them, namely the state or  health plans.
section_title: CMS’s Oversight of States’ Compliance with Actuarial Soundness Requirements Has Been Inconsistent, in Part Due to Variation in Regional Office Practices
paragraphs: CMS has been inconsistent in its review of states’ rate setting. In the six  CMS regional offices we reviewed, CMS had not reviewed one state’s rate  setting for compliance with the actuarial soundness requirements and had  not conducted a full review for another. We also identified a number of  other inconsistencies in CMS’s review of states’ compliance with the  actuarial soundness requirements. Variation in CMS regional offices’  practices contributed to these inconsistencies in oversight.
subsections: section_title: CMS Has Been Inconsistent in Reviewing States’ Rate Setting for Compliance with the Actuarial Soundness Requirements
paragraphs: In the six CMS regional offices we reviewed, we found inconsistencies in  CMS’s review of state’s rate setting, including significant gaps in the  agency’s oversight of two states’ compliance with the actuarial soundness  requirements. First, CMS had not reviewed one state’s (Tennessee) rate  setting for compliance with the actuarial soundness requirements or  approved the state’s rates. In 2007, Tennessee began transitioning its  managed care program, which included all of the state’s approximately   1 million Medicaid enrollees, to risk contracts that were subject to the  actuarial soundness requirements. Since moving to risk contracts, the  state submitted at least two actuarial reports to CMS’s Atlanta regional  office indicating the program change, but these documents did not trigger  a CMS review. These reports did not include actuarial certifications, and  Tennessee officials confirmed that the state’s rates had not been certified  by an actuary, which is a regulatory requirement. As a result, according  to CMS officials, Tennessee received, and is continuing to receive,  approximately $5 billion a year in federal funds for rates that we  determined had not been certified by an actuary or assessed by CMS for  compliance with the requirements. Based on issues we raised during our  review, CMS determined that Tennessee was not in compliance with the  actuarial soundness requirements and, as of June 2010, was working to  bring the state into compliance.
Second, while CMS officials said that all states should have had a full  review of rate setting after the actuarial soundness requirements became  effective in August 2002, it appeared that CMS officials had not completed  a full rate-setting review for Nebraska. CMS had no documentation of its  last full review of Nebraska’s rate setting, but officials believed that the  last full review was completed in 2002. According to Nebraska officials,  the state last made significant changes to its rate setting for the state fiscal  year beginning in 2001, which according to criteria in CMS’s checklist  would have triggered a full CMS review. Based on what CMS and Nebraska  officials told us, CMS’s last full review was likely done before the actuarial  requirements became effective. As a result, Nebraska received federal  funds for more than 7 years for rates that may not have been in  compliance with all of the actuarial soundness requirements.
In addition to these gaps in oversight, we found inconsistencies in the  reviews CMS completed. In instances when CMS did a full rate-setting  review, it was unclear whether CMS consistently ensured that states met  all of the actuarial soundness requirements. We found evidence that the  rates in all 28 of the CMS files we reviewed were certified by a member of  the American Academy of Actuaries, as is required by the regulations.  However, the extent to which CMS ensured state compliance with other  aspects of the actuarial soundness requirements—such as the requirement  that rates be based only on services covered under the state’s Medicaid  plan or costs related to providing these services—was unclear. For  example, in nearly a third of the files we reviewed, or 8 of 28 files, CMS  officials did not use the rate-setting checklist to document their review;  therefore we could not determine whether CMS ensured that states were  in compliance with all of the requirements. In 17 of the 20 remaining files  where the CMS official used the checklist, the official cited evidence of the  state’s compliance for some requirements, but not others.
When officials did cite evidence, the evidence did not always appear to  meet the requirements. For example, one of the requirements in the  regulations is that states provide an assurance that rates are based only on  services covered under the state’s Medicaid plan or costs related to  providing these services. Of the 19 files where CMS officials cited evidence  of such an assurance, we were unable to locate the assurance in 2 of the  files. Another requirement is that states include a comparison of  expenditures under the previous year’s rates to those projected under the  proposed rates. In the 15 files where CMS cited evidence of the  comparison of expenditures, we did not find a comparison that appeared  to meet the requirement in 2 of the files. See table 2 for more information  on the extent to which evidence was cited in the CMS files we reviewed.
Finally, CMS did not consistently review states’ rate setting for compliance  with the actuarial soundness requirements prior to the new rates being  implemented. In 20 of 28 files we reviewed, we found that CMS completed  its review of rate setting after the state had begun implementing the  proposed rates; that is, after the effective date of the proposed rates. CMS  officials told us that a variety of factors could delay the approval of rates,  including states submitting a request for approval after implementing the  rates. CMS officials further explained that they did not consider a state to  be out of compliance with the actuarial soundness requirements until the  end of the federal fiscal year quarter in which the state implemented the  unapproved rates. Of the 20 files where CMS approved rates after the  state implemented them, 13 had rates that were approved more than   3 months after the state implemented the rates, which means that the rates  were approved after the end of the quarter in which they were  implemented. CMS officials confirmed that the agency generally  continued to provide federal funds for the states’ managed care contracts  even in cases where the rates were not approved by the end of the quarter.  According to CMS officials, if the state failed to gain CMS approval or had  to lower the rates to achieve approval, then CMS would reduce future  federal reimbursement to account for federal funds paid to states for rates  that had not been approved. However, CMS reviewing states’ rate setting  after states have begun implementing rates may result in changes to states’  rate-setting methodology; this could lead to retroactive changes, including  reductions, in health plans’ rates. The possibility of rates being decreased  retroactively may make it difficult for health plans to assess the  reasonableness and adequacy of rates when contracting with states, an  assessment that CMS relies on as a check of states’ rate setting.
section_title: Variation in Practices among CMS Regional Offices Contributed to Inconsistent Oversight
paragraphs: Variation in a number of regional office practices contributed to the  inconsistency in CMS’s oversight of states’ rate setting. Regional offices  varied in the extent to which they tracked state compliance with the  requirements, the extent to which they withheld federal funds, their  criteria for doing full and partial reviews of rate setting, and what they  considered to be sufficient evidence for meeting the requirements.
Tracking compliance. Officials from all of the regional offices we spoke  with told us that they tracked basic information regarding the status of the  CMS review process, such as when a state’s submission was received and  when CMS’s approval letter was issued. However, based on our interviews  with CMS regional officials, we found that four of the six regional offices  did not track information that would allow them to identify states that  were not in compliance with actuarial soundness requirements, such as  the beginning and end dates of the rates specified by the actuary in the  certification. Officials from the remaining two regional offices, Kansas City  and San Francisco, told us they tracked the effective dates of approved  rates.
Withholding funds. There was also variation among regional offices in  the conditions that had to be met in order for states to receive federal  funds. For example, officials from the San Francisco regional office told us  that they did not release federal funds to states until the states’ managed  care contract and rates had been approved. Officials said that the office  had withheld funds in several cases until the state demonstrated  compliance with the requirements. For example, from October 2008  through April 2010, the San Francisco regional office reported withholding  a total of $302.7 million in federal funding for Hawaii because the state’s  contracts and rates did not meet the actuarial soundness requirements. In  contrast, officials we interviewed from the Atlanta regional office said that  the office would release federal funds to a state even if the state’s rates  had not yet been approved by CMS.
Criteria for full and partial reviews. CMS regional officials had  different interpretations of when full versus partial reviews of rate setting  were necessary. For example, officials from the New York regional office  told us that they completed a full review for each rate-setting submission  received, regardless of the changes made to rates or rate setting. In  contrast, a Kansas City regional office official told us that she completed a  partial review in cases where the state adjusted the rates but had not  changed the data used as the basis for rates.
Sufficient evidence for compliance. Regional office officials varied in  how they determined sufficient evidence for state compliance with certain  requirements. For example, for the requirement that rates are for  Medicaid-eligible individuals covered under the contract, officials from the  San Francisco regional office told us that, while they had verified  information provided by states on the populations covered under the rates,  they mainly looked for an assurance from the state that rates were for  eligible populations. In contrast, a Kansas City regional office official  explained that an assurance from the state alone would not be sufficient.  Rather, the official would require evidence of the eligible populations  included in, and excluded from, the rate-setting methodology.
Other variations. Variations in other regional office practices may also  have contributed to the inconsistency in CMS oversight. For example,  management oversight of rate-setting reviews in regional offices varied. A  Kansas City regional official who reviews states’ rate setting told us that,  prior to approving states’ rates, she submitted memoranda outlining the  impact of states’ proposed rate changes and the rationale for  recommending approval of the package to her regional office managers. In  contrast, officials from the New York regional office told us that most  officials responsible for reviewing and approving states’ rate setting  worked independently and managers did not review a completed  checklist. Other variations in practices that may have had an effect on  CMS oversight included differences in training and standard procedures  for conducting and documenting reviews.
As a result of our review, CMS took a number of steps that may address  some of the variation in regional office practices. For example:    officials from two regional offices told us that their offices were  implementing new standard procedures to address inconsistencies in  reviews identified through the course of GAO’s work; and in December 2009, CMS began requiring that regional offices use the  checklist in reviewing all states’ rate-setting submissions and assure  central office of its use before approving a state’s rates.
However, as we reported above, variations existed even when the  checklist was used, such as in the extent to which CMS officials using the  checklist cited evidence of compliance for each of the actuarial soundness  requirements.
section_title: CMS’s Limited Efforts Do Not Ensure the Quality of the Data Used to Set Rates
paragraphs: CMS’s efforts to ensure the quality of the data used to set rates were  generally limited to requiring assurances from states and health plans,  which did not provide the agency with sufficient information to ensure  data quality. CMS regulations require states to describe the data used as  the basis for rates and provide assurances from their actuaries that the  data were appropriate for rate setting. The regulations also specify that  states using data submitted by the health plans as the basis for rates must  require executives from the health plans to attest that the data are  accurate, complete, and truthful. The regulations do not include  requirements for the type, amount, or age of data or standards for the  reasonableness or adequacy of rates. Additionally, CMS does not require  states to submit documentation about the quality of the data used to set  rates. In our interviews with regional office officials, we found that, when  reviewing states’ descriptions of the data used for rate setting, CMS  officials focused primarily on ensuring the appropriateness of the data  used by states to set rates rather than their reliability. This included  reviewing the specific services and populations included in the base-year  data or checking for assurances of appropriateness from the states’  actuaries. CMS officials noted that if they had concerns with the quality  of a state’s data they would ask the state questions. None of the officials,  however, reported taking any action beyond asking questions.
With limited information on the quality of data used to set rates, CMS  cannot ensure that states’ managed care rates are appropriate and risks  misspending billions of federal and state dollars. Actuarial certification  does not ensure that the data used to set rates are reliable. In particular,   9 of the 28 files we reviewed included a disclaimer in the actuary’s  certification that if the data used were incomplete or inaccurate then the  rates would need to be revised. Additionally, in more than half of the   28 files we reviewed, the actuaries noted that they did not audit or  independently verify the data and relied on the state or health plans to  ensure that the data were accurate and complete. Officials from three of  the five health plans we spoke with raised concerns about the  completeness of the encounter data used by states to set rates.  Additionally, state auditors in Washington have raised concerns about the  lack of monitoring of the accuracy of data used for rate setting. The  auditors found that the state did not verify the accuracy of the data used as  the basis for Medicaid managed care rates in fiscal years 2003 through  2007. The state auditor’s report from fiscal year 2007 concluded that the  risk of paying health plans inflated rates increased when the accuracy of  data used to establish rates could not be reasonably assumed to be  correct.
States have information on the quality of data used for rate setting— information that CMS could obtain. State officials we spoke with reported  having information on, and efforts intended to ensure, the quality of the  data used to set rates. For example, New Jersey officials told us that the  state tested the reliability and accuracy of the health plan financial data  used to set rates against encounter data and required health plans to have  an independent auditor review selected portions of the financial data.  Additionally, Arizona officials indicated that the state periodically  completes validation studies of the state’s encounter data in which they  traced a sample of the encounters back to individuals’ medical records.  State officials indicated that CMS used to require the state to submit  results of these studies as a condition of operating its managed care  program. However, given the state’s extensive experience with managed  care, CMS no longer requires the state to submit these studies for all  participating health plans. (See app. III for a summary of selected states’  efforts intended to ensure data quality.) Without requiring and reviewing  information on states’ data quality efforts, CMS cannot ensure that these  data are of sufficient quality to be used for setting rates.
In addition to information from states, CMS conducts audits that could  have provided CMS officials relevant information about the quality of the  data used to set rates. For example, when describing the state’s efforts to  ensure the quality of data used to set rates, officials from South Carolina  noted that CMS periodically reviews the state’s FFS data through the  Payment Error Rate Measurement (PERM) program. Error rates  calculated using FFS and encounter data through the PERM program  could provide CMS with insights regarding the quality of the data that  some states use to set rates. In CMS’s rate-setting review file for South  Carolina, however, there was no discussion of PERM results by either the  state or CMS. CMS central office officials confirmed that regional office  staff do not consider the results of data studies, such as state validation or  PERM program reports, when reviewing states’ rate-setting submissions.
CMS also could have conducted or required periodic audits of the data  used to set rates. In Medicare Advantage, which is Medicare’s managed  care program, CMS is required to conduct annual audits of the financial  records of at least one-third of the organizations participating in the  program. For Medicaid, however, CMS had not conducted any recent  audits or studies of states’ rate setting, including the quality of data used.  Specifically, officials in all six of the regional offices we spoke with told us  that they had not performed any audits or special studies of states’ rate  setting. Officials from CMS’s central office were also not aware of any  recent audits or studies done by the four other regional offices. In  addition, officials from CMS’s central office told us that they could only  recall one instance, in the nearly 8 years since the regulations were issued,  where OACT arranged for an independent assessment of a state’s rate  setting; that assessment was done more than 2 years ago.
section_title: Conclusions
paragraphs: The statutory and regulatory requirements for actuarially sound rates are  key safeguards in efforts to ensure that federal spending for Medicaid  managed care programs is appropriate, which could help avoid significant  overpayments and reduce incentives to underserve or deny enrollees’  access to needed care. CMS, however, has been inconsistent in ensuring  that states are complying with the actuarial soundness requirements and  does not have sufficient efforts in place to ensure that states are using  reliable data to set rates. During the course of our work, CMS took steps to  address some of the variation in regional office practices that contributed  to inconsistencies in overseeing state compliance, such as requiring  regional office officials to use the checklist in reviewing all states’ rate- setting submissions. While these are positive steps, they do not address all  of the variations in regional office practices that contributed to  inconsistencies in CMS’s oversight of rate setting. For example, these  steps do not address variations in tracking state compliance, which may  have led to CMS’s failure to review Tennessee’s rates for compliance with  the actuarial soundness requirements. Additionally, the steps taken do not  address the variation in what evidence CMS officials considered sufficient  for compliance, how officials used the checklist to document their  reviews, and what conditions were necessary for federal funds to be  released. CMS also does not have sufficient efforts in place to ensure the  quality of the data states used to set rates, relying on assurances from  states without considering any other available information on the quality  of the data used. By relying on assurances alone, the agency risks  reimbursing states for rates that may be inflated or inadequate.
As a result of the weaknesses in CMS’s oversight, billions of dollars in  federal funds were paid to one state for rates that were not certified by an  actuary, and billions more may be at risk of being paid to other states for  rates that are not in compliance with the actuarial soundness requirements  or are based on inappropriate and unreliable data. Given the complexity of  overseeing states’ unique and varied Medicaid programs, it is appropriate  that CMS would allow for flexibility in states’ rate setting and would  expect states to have the primary responsibility for ensuring the quality of  the data used to set rates. However, CMS needs to ensure that all states’  rate setting complies with all of the actuarial soundness requirements and  needs to have safeguards in place to ensure that states’ data quality efforts  are sufficient. Improvements to CMS’s oversight of states’ rate setting will  become increasingly important as coverage under Medicaid expands to  new populations for which states may not have experience serving, and  may have no data on which to base rates.
section_title: Recommendations for Executive Action
paragraphs: To improve oversight of states’ Medicaid managed care rate setting, we  recommend that the Administrator of CMS take three actions.
To improve consistency in the oversight of states’ compliance with the  Medicaid managed care actuarial soundness requirements, we recommend  that the Administrator of CMS:  implement a mechanism for tracking state compliance, including tracking  the effective dates of approved rates; and   clarify guidance for CMS officials on conducting rate-setting reviews.
Areas for clarification could include identifying what evidence is sufficient  to demonstrate state compliance with the requirements, the conditions  necessary for federal funds to be released, and how officials should  document their reviews.
To better ensure the quality of the data states use in setting Medicaid  managed care rates, we recommend that the Administrator of CMS make  use of information on data quality in overseeing states’ rate setting. CMS  could, among other things, require states to provide CMS with a  description of the actions taken to ensure the quality of the data used in  setting rates and the results of those actions; consider relevant audits and  studies of data quality done by others when reviewing rate setting; and  conduct or require periodic audits or studies of the data states use to set  rates.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for its review and comment.  HHS concurred with all three of our recommendations, and commented  that it appreciated our efforts to highlight improvements that CMS can  make in its oversight of states’ compliance with Medicaid managed care  actuarial soundness requirements, as well as its focus on the quality of  data used to set managed care rates. Moreover, HHS noted that CMS has  identified many of the same issues. (See app. IV for a copy of HHS’s  comments.)
HHS agreed with our two recommendations related to improving the  consistency of CMS’s oversight, namely that CMS implement a mechanism  for tracking state compliance with the actuarial soundness requirements  and clarify guidance for CMS officials on conducting rate-setting reviews.  HHS noted that CMS has established a managed care oversight team to  develop and implement a number of improvements in its managed care  oversight, some of which will address our recommendations. These  improvements included CMS’s plans to develop standard operating  protocols for the review and approval of Medicaid managed care rates and  provide comprehensive training to CMS staff on all aspects of the new  process and requirements. As CMS implements efforts aimed at improving  its oversight, we reiterate the need to implement a mechanism for tracking  state compliance with actuarial soundness requirements, including the  effective dates of rates.
HHS also agreed with our recommendation that CMS make use of  information on data quality in overseeing states’ rate setting. In  commenting on our finding related to CMS’s limited efforts to ensure data  quality, HHS noted that a number of requirements within PPACA will give  CMS additional authority and responsibility for acquiring and utilizing  Medicaid program data. In response to our recommendation, HHS noted  that, as part of a broader effort to redesign how it collects Medicaid data,  CMS will be setting standards for the type and frequency of managed care  data submissions by states. HHS commented that with more complete data  at its disposal, CMS will be able to better assess the underlying quality of  data submissions and, thus, better execute its oversight and monitoring  responsibilities. CMS should use these assessments and other available  information when overseeing states’ rate setting. Finally, HHS provided  technical comments, which we incorporated as appropriate.
We are sending copies of this report to the Administrator of CMS and  other interested parties. In addition, the report is available at no charge on  the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix V.
section_title: Appendix I: Methodology for Selecting CMS Regional Offices and Analyzing CMS’s Medicaid Managed Care Rate-Setting Files
paragraphs: To assess the Centers for Medicare & Medicaid Services’s (CMS) oversight  of states’ compliance with the Medicaid managed care actuarial soundness  requirements, we conducted a structured review of CMS files from 6 of the  10 CMS regional offices. We selected CMS regional offices that:  represented at least 5 of the 10 CMS regional offices,   collectively had oversight responsibility for at least 65 percent of the   34 states with comprehensive Medicaid managed care programs, and    were geographically diverse and oversaw states with Medicaid managed  care programs ranging in size.
The six regional offices that we selected for our review had oversight  responsibility for 26 of the 34 states (or 76 percent) with comprehensive  Medicaid managed care programs. According to information from CMS,  these 26 states accounted for about 85 percent of Medicaid managed care  enrollment nationally in 2008 and state program size ranged from   8 percent of Medicaid enrollees in Illinois to 100 percent in Tennessee.  (See table 3.)
We conducted a structured review of a selection of files from the six CMS  regional offices. Specifically, we reviewed the files for CMS’s rate-setting  reviews of the most recently approved contract for each state’s  comprehensive managed care program, or, for states with multiyear  contracts, the file for the most recent full review of rate setting completed  as of October 31, 2009. Several states in the selected regions had multiple  comprehensive managed care programs that had separate contracts and  rate-setting processes each subject to CMS review and approval. For states  that had two programs, we selected the file for the program CMS officials  indicated was the largest, as defined by the number of enrollees and  estimated expenditures. For the states that had more than two programs,  we selected the files for the two largest programs. For 2 of the 26 states  overseen by the six regional offices (Nebraska and Tennessee), CMS had  not done a review that met our criteria, so we did not review a file for  those states. In total, we reviewed 28 files, which covered 24 states, 4 of  which had two or more programs for which CMS did separate reviews.  (See table 4.)
As part of our file review, we assessed the degree to which CMS  documented its review. Specifically, we determined whether the CMS  official completed CMS’s checklist—a tool CMS developed for regional  office staff to use when reviewing states’ rate-setting submissions for  compliance with the actuarial soundness requirements. For those files  where the CMS official did not complete the checklist and provided no  other documentation of the review, we did no further assessment of CMS’s  review. For the files where the CMS official completed the checklist, we  assessed the extent to which CMS ensured that the state complied with the  actuarial soundness requirements. To do this, we identified several  requirements of the regulations, including that rates were certified by a  qualified actuary, that rates were based on covered services for eligible  individuals, and that the state documented any adjustments to the base  year data. For these requirements, we assessed whether (1) CMS  documented that the state met the requirement, (2) CMS cited evidence for  the assessment that the state was in compliance, and (3) the cited  evidence was consistent with the guidance in CMS’s checklist.  Additionally, as part of our review, we summarized descriptive elements of  states’ rate setting and rates. For example, we documented the types of  data used as the basis for rates and how the state’s rates changed from the  prior year. To ensure the accuracy of the information collected as part of  our structured review of the files, we conducted independent verifications  of each review.
section_title: Appendix II: Methodology for Selecting States to Contact
paragraphs: To describe state views of the Centers for Medicare & Medicaid Services’s  (CMS) oversight of state compliance with the Medicaid managed care  actuarial soundness requirements and state efforts to ensure the quality of  the data used to set rates, we selected 11 of the 34 states with  comprehensive Medicaid managed care programs and interviewed officials  from those states’ programs. We selected states that:    varied in the size of their Medicaid managed care programs, as defined by  the numbers of managed care enrollees, the proportion of states’ Medicaid  population that were in managed care, and the number of MCOs  participating in the program; and   overlapped with the oversight responsibilities of the six selected CMS  regional offices.
Table 5 provides information about the selected states.
section_title: Appendix III: Selected States’ Reported Efforts Intended to Ensure the Quality of the Data Used to Set Rates
paragraphs: The 11 states we interviewed used a combination of approaches intended  to ensure the quality of the data used in Medicaid managed care rate  setting. These included front-end efforts intended to prevent errors in data  reported by providers and health plans, reconciliation methods to help  ensure the reliability and appropriateness of reported data, and in-depth  reviews that identified and addressed issues of ongoing concern. See table  6 for a summary of the selected states’ efforts intended to ensure data  quality.
section_title: Appendix IV: Comments from the Department of Health and Human Services
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Michelle Rosenberg, Assistant  Director; Joseph Applebaum, Chief Actuary; Susan Barnidge; William A.  Crafton; Drew Long; Kevin Milne; and Dawn D. Nelson made key  contributions to this report.