Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk
Published: 2016-03-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony summarizes the information contained in GAO's February 2016 report, entitled Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk , GAO-16-29 .
section_title: What GAO Found
paragraphs: The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs.
During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.

section_title: Letter
paragraphs: I am pleased to be here today to discuss enrollment and verification  controls for health-care coverage that individuals obtain through the  federal health-insurance exchange under the Patient Protection and  Affordable Care Act (PPACA). The act expands the availability of  subsidized health-care coverage, and it provides for the establishment of  health-insurance exchanges, or marketplaces, to help consumers in  comparing and selecting among insurance plans offered by participating  private issuers of health-care coverage. Under PPACA, states may elect  to operate their own health-care marketplaces, or may rely on the  federally facilitated marketplace, or Health Insurance Marketplace  (Marketplace). The Centers for Medicare & Medicaid Services (CMS), a  unit of the Department of Health and Human Services (HHS), maintains  the federal Marketplace.
To be eligible to enroll in a qualified health plan offered through a  marketplace, an individual must be a U.S. citizen or national, or otherwise  lawfully present in the United States; reside in the marketplace service  area; and not be incarcerated (unless incarcerated while awaiting  disposition of charges). Marketplaces, in turn, are required by law to verify  application information to determine eligibility for enrollment and, if  applicable, determine eligibility for income-based subsidies the act  provides.
PPACA provides subsidies to those eligible to purchase private health- insurance plans who meet certain income and other requirements.  According to the Congressional Budget Office, the estimated cost of  subsidies and related spending under the act is $880 billion for fiscal  years 2016–2025. While subsidies under the act are not paid directly to  enrollees, participants nevertheless benefit through reduced monthly  premiums or lower costs due at time of service, such as copayments.  Because subsidy costs hinge on eligibility for coverage, enrollment  controls that help ensure only qualified applicants are approved for  coverage with subsidies are a key factor in determining federal  expenditures under the act.
A central feature of the enrollment controls is the federal “data services  hub” (data hub), which, among other things, provides a vehicle to check  applicant-provided information against a variety of data sources.  Verification steps include validating an applicant’s Social Security  number, if one is provided; verifying citizenship, status as a national, or  lawful presence by comparison with Social Security Administration (SSA)  or Department of Homeland Security (DHS) records; and verifying  household income and family size by comparison against tax-return data  from the Internal Revenue Service (IRS), as well as data on Social  Security benefits from SSA.
If the eligibility information applicants provide to the federal Marketplace  cannot be verified through the external sources, such as SSA, IRS, and  DHS, an “inconsistency” will result. In particular, an inconsistency can  arise when the data hub query process yields no information; or when  information is available through the data hub, but it does not match  information the applicant has provided.
My testimony today is based on a report we issued on February 23, 2016,  that examined eligibility and enrollment controls, and fraud risk, of the  federal Marketplace. It addresses  1.  the extent to which applicant information is verified through the data  hub—the primary means for verifying eligibility—and  2.  the extent to which the federal Marketplace resolved inconsistencies  that resulted from the data hub verification process.
In our report, to examine outcomes of the data hub applicant verification  process, we obtained summary data from key federal agencies involved  in the process—SSA, IRS, and DHS—on the nature and extent of their  responses to electronic inquiries made through the data hub, for the 2014  and 2015 coverage years. We also interviewed agency officials and  reviewed statutes, regulations, and other policy and related information.  In addition, we obtained applicant data on inconsistencies, subsidies  awarded, and submission of required verification documentation, from  CMS data systems for coverage year 2014. To determine the reliability of  data we used, we interviewed CMS officials and others responsible for  their respective data, reviewed relevant documentation, and performed  electronic testing to determine the validity of specific data elements we  used to perform our work. Based on this reliability examination, we  concluded that the data we used were sufficiently reliable for our  purposes.
Additional details on our scope and methodology can be found in our  report. We conducted our performance audit from January 2014 to  February 2016 in accordance with generally accepted government  auditing standards.
subsections: section_title: CMS’s Approach to Applicant Verification Information Needs Improvement
paragraphs: HHS officials described the data hub process to us as being part of an  innovative, multilayered approach to verifying applicant information  efficiently and without undue burden on individuals and families. Through  secure electronic connections, the data hub provides real-time responses  to eligibility queries, HHS told us.
In our February 2016 report, however, we found that although the data  hub plays a key role in the eligibility and enrollment process, CMS  officials said the agency does not track the extent to which the federal  agencies deliver responsive information to a request, or, alternatively,  whether they report that information was not available. Additionally, CMS  officials said they do not analyze data provided in response to data hub  inquiries. This is because, they said, by design, the data hub does not  store individual transactional data that could be collectively analyzed over  time. For policy reasons, the officials said, the agency did not want the  data hub to become a data repository itself, and in particular, a repository  of sensitive personal data. The CMS officials also said the agency is  barred legally from maintaining IRS taxpayer information in the data hub.
Asked about analysis of data hub responses, CMS officials told us when  we conducted work for our February 2016 report that the key  performance measures for the data hub are the extent to which the  system is available for queries, and the extent to which transmissions of  queries and responses are successfully accomplished; that is, that an  inquiry is made and a corresponding reply received, without regard to  content.
Further, the federal agencies responding to data hub queries generally  told us they do not analyze outcomes of data hub inquiries. Instead, SSA,  IRS, and DHS officials said they focus on responding to inquiries  received. Our review also found that SSA, IRS, and DHS had limited  information on the nature and extent of the inquiries made by the data  hub. According to the three agencies, available statistics reflect data hub  inquiries in general, and cannot be broken out by program, such as a  qualified health plan or Medicaid. In addition, according to agency  officials, an unknown number of data hub applicant inquiries were  duplicates, which we could not eliminate from our examination. Instead,  agency officials told us, they generally process inquiries sequentially as  they are received from the data hub. Thus, we found that while the  agencies can provide some information on data hub queries, they cannot  provide comprehensive information specifically on number of inquiries  and individuals represented by those queries.
We further found, based on our examination of available statistics from  SSA, IRS, and DHS, that while the agencies could successfully provide  applicant verification information in a large percentage of cases, they did  not have data in their records to verify information for millions of data hub  inquiries over the course of PPACA’s first two enrollment cycles, for 2014  and 2015 coverage.
We concluded that by not assessing the extent to which data hub– provided data matches applicant-provided information, CMS foregoes  analysis of the extent to which responding agencies successfully deliver  applicant verification information in response to data hub requests. In  doing so, CMS foregoes information that could suggest potential program  issues or potential vulnerabilities to fraud, as well as information that  might be useful for enhancing program management. We recommended  that HHS direct CMS to conduct a comprehensive feasibility study on  actions CMS can take to monitor and analyze, both quantitatively and  qualitatively, the extent to which data hub queries provide requested or  relevant applicant verification information, for the purpose of improving  the data-matching process and reducing the number of applicant  inconsistencies; and for those actions identified as feasible, create a  written plan and schedule for implementing them. HHS said it concurred  with our recommendation and is reviewing options for such a study.
section_title: The Federal Marketplace Did Not Resolve About One- Third of Applicant Inconsistencies for Coverage Year 2014, Involving $1.7 Billion in Associated Subsidies
paragraphs: For qualifying applicants, the act provides two forms of subsidies for  consumers enrolling in individual health plans, both of which are paid  directly to insurers on consumers’ behalf. One is a federal income tax  credit, which enrollees may elect to receive in advance of filing tax  returns, and which reduces a consumer’s monthly premium payment.  This is known as the advance premium tax credit (APTC). The other,  known as cost-sharing reduction (CSR), is a discount that lowers the  amount consumers pay for out-of-pocket charges such as deductibles,  coinsurance, and copayments.
In our report, for applicants who obtained subsidies but had application  inconsistencies, we identified about 1.1 million applications with a total of  about 2 million inconsistencies. These applications had combined APTC  and CSR subsidies of about $4.4 billion associated with them for  coverage year 2014. We found, based on our analysis of CMS data, that  the agency resolved about 58 percent of the total inconsistencies,  meaning the inconsistencies were settled by consumer action, such as  document submission, or removed due to events such as life change,  application deletion, or consumer cancellation. Meanwhile, our analysis  found that about 34 percent of inconsistencies, with about $1.7 billion in  associated subsidies, remained open, as of April 2015—that is,  inconsistencies still open several months following the close of the 2014  coverage year.
We also found, based on our analysis of the 2014 data, that CMS did not  terminate or adjust subsides for any applications with incarceration or  Social Security number inconsistencies, plus other inconsistencies.  Further, CMS officials told us that they currently do not plan to take any  actions on individuals with unresolved Social Security number or  incarceration inconsistencies.
Social Security number inconsistencies. Under CMS regulations, the  Marketplace must validate all Social Security numbers provided by  submitting them to SSA along with other identifying information. If the  Marketplace is unable to validate the Social Security number, it must  follow the standard process for resolving all types of inconsistencies. In  our analysis, we identified about 35,000 applications that had an  unresolved Social Security number inconsistency, which were associated  with about $154 million in combined subsidies.
We reported that CMS officials told us they did not take action to  terminate coverage or adjust subsidies during 2014 based on Social  Security number inconsistencies. They said this was because such  inconsistencies are generally related to other inconsistencies, such as  citizenship or immigration status, and that document submissions for  citizenship or immigration status may also resolve Social Security number  inconsistencies. Overall, CMS officials told us they do not consider  missing or invalid Social Security number information to be a stand-alone  inconsistency that must be resolved, and do not take adverse action in  such cases.
However, CMS regulations state that “to the extent that the   is unable to validate an individual’s Social Security number through the  Social Security Administration,” the Marketplace must follow its standard  inconsistency procedures. Further, when promulgating this regulation,  CMS explained that transmitting Social Security numbers to SSA for  validation “is separate from the  provision regarding citizenship  verification, and only serves to ensure that SSNs [Social Security  numbers] provided to the  can be used for subsequent  transactions, including for verification of family size and household  income with IRS.”
In addition to unresolved Social Security number inconsistencies  generally, our analysis also found in particular more than 2,000  applications with Social Security number inconsistencies that had no  corresponding citizenship or immigration inconsistencies. We also  identified nearly 5,500 applications with Social Security number  inconsistencies that had no corresponding income inconsistency. These  applications had total subsidies of about $10 million and $31 million  associated with them, respectively. They indicate that Social Security  number inconsistencies can stand alone, unrelated to other  inconsistencies.
Social Security number inconsistencies also affect tax compliance.  Missing or invalid Social Security numbers can affect IRS verification that  taxpayers have properly filed APTC information on their tax returns, as  well as impair IRS outreach to taxpayers who have received the APTC  subsidy.
We recommended that HHS direct CMS to identify and implement  procedures to resolve Social Security number inconsistencies where the  Marketplace is unable to verify Social Security numbers or applicants do  not provide them. HHS concurred with our recommendation, but did not  provide details on how it would seek to implement it.
Incarceration inconsistencies. In our inconsistency analysis that we  reported on in February 2016, we identified about 22,000 applications  having an unresolved incarceration inconsistency, which were associated  with about $68 million in combined subsidies. CMS officials, however, told  us they did not terminate eligibility for incarceration inconsistencies,  because the agency determined in fall 2014 that SSA’s Prisoner Update  Processing System (PUPS) was unreliable for use by the Marketplace.  As a result, CMS officials told us the agency elected to rely on applicant  attestations on incarceration status.
PPACA provides that incarcerated individuals are not eligible to enroll in a  qualified health plan through a marketplace, with the exception of those  incarcerated pending disposition of charges. CMS currently uses PUPS to  generate incarceration inconsistencies when there are indications an  applicant may be incarcerated. As part of the inconsistency resolution  process, the Marketplace notifies applicants to send documentation to  resolve the inconsistency. To do so, consumers can submit  documentation such as release papers, CMS officials told us.
Under CMS’s approach to incarceration inconsistencies, agency officials  told us, the Marketplace continues to make an initial verification attempt  using the PUPS data. If a consumer maintains he or she is not  incarcerated, CMS will rely on that representation and not take adverse  action, regardless of what PUPS indicates, officials told us. According to  HHS officials, based on the data reliability issue, the Marketplace no  longer requires applicants to submit documentation on incarceration  status.
In its 2013 computer-matching agreement with CMS, SSA acknowledged  that PUPS is not as accurate as other SSA data and contains information  that SSA may not have independently verified. Thus, the agreement  states that CMS will independently verify information it receives from  PUPS and will provide individuals an opportunity to contest an  incarceration inconsistency before any adverse action in an eligibility  determination. Overall, according to SSA officials, PUPS information can  be used to identify individuals who require additional follow-up to  determine eligibility.
We reported that our review of documentation CMS provided for its  decision to take no adverse action on incarceration inconsistencies  showed it did not contain key information supporting the agency’s  decision to not use PUPS data. Specifically, the documentation did not  provide specific details on why, or to what extent, people were  misidentified as incarcerated; why CMS also judged inmate release  information to be unreliable; any criteria or assessment employed to  conclude that the PUPS data were not sufficiently current or accurate; or  the potential cost associated with not verifying incarceration status.
We concluded that without clearly identifying such elements as analysis,  scope, and costs of significant decisions, CMS is at greater risk of  providing benefits to ineligible applicants, and also may undermine  confidence in the applicant verification process and compromise overall  program integrity. We further concluded that by not using PUPS data as a  lead for further investigation, and by relying on applicant attestation in the  alternative, CMS may be granting eligibility to, and making subsidy  payments on behalf of, individuals who are ineligible to enroll in qualified  health plans.
We recommended that HHS direct CMS to reevaluate use of PUPS  incarceration data and make a determination to either (1) use the PUPS  data, among other things, as an indicator of further research required in  individual cases, and to develop an effective process to clear  incarceration inconsistencies or terminate coverage; or (2) if no suitable  process can be identified to verify incarceration status, accept applicant  attestation on status in all cases, unless the attestation is not reasonably  compatible with other information that may indicate incarceration, and  forego the inconsistency process. HHS concurred with our  recommendation, but did not provide details on how it would seek to  implement it.
We also recommended that HHS direct CMS to fully document prior to  implementation, and have readily available for inspection thereafter, any  significant decision on qualified health plan enrollment and eligibility  matters, with such documentation to include details such as policy  objectives, supporting analysis, scope, and expected costs and effects.  HHS concurred with our recommendation, and said it was committed to  documenting significant decisions.
Chairman Hatch, Ranking Member Wyden, and Members of the  Committee, this completes my prepared statement. I would be pleased to  respond to any questions that you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact Seto J. Bagdoyan, Director, Forensic Audits and Investigative  Service, (202) 512-6722 or BagdoyanS@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this testimony.
GAO staff who made key contributions to this testimony, or previous  related work, are Matthew Valenta and Philip Reiff, Assistant Directors;  Mariana Calderón; Marcus Corbin; Carrie Davidson; Colin Fallon; Suellen  Foth; Sandra George; Barbara Lewis; Maria McMullen; James Murphy;  Shelley Rao; Christopher H. Schmitt; Elizabeth Wood; and the Forensic  Audits and Investigative Service investigative unit.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.