Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls
Published: 2015-05-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid is a significant expenditure for the federal government and the states, with total federal outlays of $310 billion in fiscal year 2014. CMS reported an estimated $17.5 billion in potentially improper payments for the Medicaid program in 2014.
GAO was asked to review beneficiary and provider enrollment-integrity efforts at selected states. This report (1) identifies and analyzes indicators of improper or potentially fraudulent payments in fiscal year 2011, and (2) examines the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect fraud and abuse in determining eligibility.
GAO analyzed Medicaid claims paid in fiscal year 2011, the most-recent reliable data available, for four states: Arizona, Florida, Michigan, and New Jersey. These states were chosen because they were among those with the highest Medicaid enrollment; the results are not generalizable to all states. GAO performed data matching with various databases to identify indicators of potential fraud, reviewed CMS and state Medicaid program-integrity policies, and interviewed CMS and state officials performing oversight functions.
section_title: What GAO Found
paragraphs: GAO found thousands of Medicaid beneficiaries and hundreds of providers involved in potential improper or fraudulent payments during fiscal year 2011—the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states had about 9.2 million beneficiaries and accounted for 13 percent of all fiscal year 2011 Medicaid payments. Specifically:
About 8,600 beneficiaries had payments made on their behalf concurrently by two or more of GAO's selected states totaling at least $18.3 million.
The identities of about 200 deceased beneficiaries received about $9.6 million in Medicaid benefits subsequent to the beneficiary's death.
About 50 providers were excluded from federal health-care programs, including Medicaid, for a variety of reasons that include patient abuse or neglect, fraud, theft, bribery, or tax evasion.
Since 2011, the Centers for Medicare & Medicaid Services (CMS) has taken regulatory steps to make the Medicaid enrollment process more rigorous and data-driven; however, gaps in beneficiary-eligibility verification guidance and data sharing continue to exist. These gaps include the following:
In October 2013, CMS required states to use electronic data maintained by the federal government in its Data Services Hub (hub) to verify beneficiary eligibility. According to CMS, the hub can verify key application information, including state residency, incarceration status, and immigration status. However, additional guidance from CMS to states might further enhance program-integrity efforts beyond using the hub. Specifically, CMS regulations do not require states to periodically review Medicaid beneficiary files for deceased individuals more frequently than annually, nor specify whether states should consider using the more-comprehensive Social Security Administration Death Master File in conjunction with state-reported death data when doing so. As a result, states may not be able to detect individuals that have moved to and died in other states, or prevent the payment of potentially fraudulent benefits to individuals using these identities.
In 2011, CMS issued regulations to strengthen Medicaid provider-enrollment screening. For example, CMS now requires states to screen providers and suppliers to ensure they have active licenses in the state where they provide Medicaid services. CMS's regulations also allow states to use Medicare's enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS)—to screen Medicaid providers so that duplication of effort is reduced. In April 2012, CMS gave each state manual access to certain information in PECOS. However, none of the four states GAO interviewed used PECOS to screen all Medicaid providers because of the manual process. In October 2013, CMS began providing interested states access to a monthly file containing basic enrollment information that could be used for automated screening, but CMS has not provided full access to all PECOS information, such as ownership information, that states report are needed to effectively and efficiently process Medicaid provider applications.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS issue guidance for screening deceased beneficiaries and supply more-complete data for screening Medicaid providers. The agency concurred with both of the recommendations and stated it would provide state-specific guidance to address them.

section_title: Letter
paragraphs: Medicaid, a federal–state health-financing program for low-income and  medically needy individuals, is a significant expenditure for the federal  government and the states, with total federal outlays of $310 billion in  fiscal year 2014. The Centers for Medicare & Medicaid Services (CMS),  within the Department of Health and Human Services (HHS), is  responsible for broad program oversight, including disbursement of  federal matching funds, while states are responsible for the daily  administration of their Medicaid programs. CMS also provides guidelines,  technical assistance, and periodic assessments of state Medicaid  programs. Federal laws require both federal and state entities to protect  the Medicaid program from fraud, waste, and abuse. In February 2015,  we reported that Medicaid remains at high risk because of concerns  about the adequacy of fiscal oversight of the program, including improper   In fiscal year 2014, CMS reported an  payments to Medicaid providers.estimated improper-payment rate of 6.7 percent, or $17.5 billion, for the  Medicaid program, which is an increase over its 2013 estimate of 5.8  percent, or $14.4 billion.
Because of the substantial Medicaid program expenditures and the  program’s significant estimated improper-payment rate, you asked us to  review the program-integrity efforts associated with beneficiary-eligibility  determination and provider enrollment in selected states. Specifically, for  this review we  (1) identified and analyzed indicators, if any, of improper or potentially  fraudulent payments to Medicaid beneficiaries and providers; and  (2) examined the extent to which federal and state oversight policies,  controls, and processes are in place to prevent and detect fraud and  abuse in determining eligibility for Medicaid beneficiaries and enrolling  providers.
To identify indicators of potentially improper or fraudulent payments to  Medicaid beneficiaries and providers, we obtained and analyzed Medicaid  claims paid in fiscal year 2011, the most-recent consistently comparable  data, for four states: Arizona, Florida, Michigan, and New Jersey.  Medicaid payments to these states constituted about 13 percent of all  Medicaid payments made during fiscal year 2011. These states were  selected primarily because they had reliable data and were among states  with the highest Medicaid enrollment. The results of our analysis of these  states cannot be generalized to other states. We obtained CMS Medicaid  Statistical Information System (MSIS) beneficiary, provider, and other  services claims data, as well as state Medicaid Management Information  System (MMIS) claims identification data to perform our work.
We performed data matching to identify indicators of potentially improper  payments, which includes fraud. These matches sought to identify  individuals who may be ineligible to receive Medicaid benefits or  providers who should not have received Medicaid payments due to  residency, death, or other exclusionary factors. We used the beneficiary  files to identify individuals who had payments made on their behalf  concurrently by two or more of our selected states. To identify potentially  improper payments, we compared the beneficiary and provider identity  information shown in the Medicaid claims data to the Social Security  Administration’s (SSA) full Death Master File (DMF) to determine whether  any beneficiaries were deceased. We also compared beneficiaries’  identity information from the four selected states to the identity  information from SSA official records using the Enumeration Verification  System. This comparison helped identify individuals who submitted  potentially invalid or inappropriate identity information on their Medicaid  beneficiary applications. However, many applications may have  inaccuracies due to simple errors such as inaccurate data entry or  incomplete sections, making it impossible to determine whether these  cases involve potential fraud.
To identify claims that might have been improperly processed and paid by  the Medicaid program because the federal government had excluded the  corresponding providers from providing services to Medicaid  beneficiaries, we compared the Medicaid claims to the exclusion and  debarment files from HHS’s Office of Inspector General (OIG) and the  General Services Administration (GSA). To identify claims that might  have been improperly paid to providers with invalid licenses, we  compared Medicaid claims data to Federation of State Medical Boards  (FSMB) license data for providers that had licenses that were revoked or  suspended.
To identify claims that might have been improperly processed and paid by  the Medicaid program because either the providers or beneficiaries were  incarcerated, we compared the Medicaid claims to data files listing  incarcerated individuals from the four selected states. To identify claims  that are associated with inaccurate, missing, or invalid addresses, we  used the United States Postal Service (USPS) Address Matching System  Application Programming Interface. As discussed later in this report,  managed-care organizations (MCO) receive a monthly capitated  payment. As a result, the Medicaid paid amounts associated with  managed care reflect these capitated payments and not the costs of  specific services provided to a beneficiary. Consequently, our estimate  may understate the actual cost of the Medicaid services provided. All of  the states included in our review—Arizona, Florida, Michigan, and New  Jersey—had some MCO arrangements in place.
To identify federal and state oversight policies, controls, and processes to  prevent and detect fraud and abuse in the enrollment of Medicaid  beneficiaries and providers, we reviewed federal statutes, CMS  regulations, and state Medicaid policies pertinent to program-integrity  structures, met with agency officials, and visited state Medicaid offices  that perform oversight functions. We used federal standards for internal  control, GAO’s Fraud Prevention Framework,  federal statutes and  Medicaid eligibility regulations to evaluate these functions.
To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  federal and selected states’ databases that we used to perform our work.  We also interviewed officials responsible for their respective databases  and reviewed documentation related to the databases and literature  related to the quality of the data. On the basis of our discussions with  agency officials and our own testing, we concluded that the data elements  used for this report were sufficiently reliable for our purposes.
We conducted this performance audit from March 2014 to May 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  audit findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. More details on our  objectives, scope, and methodology can be found in appendix I.
subsections: section_title: Background
paragraphs: Medicaid was established in 1965 by Title XIX of the Social Security Act  as a joint federal–state program to finance health care for certain low- income, aged, or disabled individuals. Medicaid is an entitlement  program, under which the federal government pays its share of  expenditures for any necessary, covered service for eligible individuals  under each state’s federally approved Medicaid plan, as described below.  States pay qualified health-care providers for covered services provided  to eligible beneficiaries and then seek reimbursement for the federal  share of those payments.
Title XIX of the Social Security Act allows flexibility in the states’ Medicaid  plans. Although the federal government establishes broad federal  requirements for the Medicaid program, states can elect to cover a range  of optional populations and benefits. Guidelines established by federal  statutes, regulations, and policies allow each state some flexibility to (1)  broaden eligibility standards; (2) determine the type, amount, duration,  and scope of services; (3) set the rate of payment for services; and (4)  administer its own program, including processing and monitoring of  medical claims and payment of claims. Differences in program design can  lead to differences in state programs’ vulnerabilities to improper payments  and state approaches to protecting the program. States are required to  submit plans to CMS to outline their plans to verify Medicaid eligibility  factors, including income, residency, age, Social Security numbers (SSN),  citizenship, and household composition. With more than 50 distinct state- based programs that are partially federally financed, overseeing Medicaid  is a complex challenge for CMS and states.
In order to participate in Medicaid, federal law requires states to cover  certain population groups (mandatory-eligibility groups) and gives the  states the flexibility to cover other population groups (optional-eligibility  groups). States set individual eligibility criteria within federal minimum  standards. There are other nonfinancial eligibility criteria that are used in  determining Medicaid eligibility. In order to be eligible for Medicaid,  individuals need to satisfy federal and state requirements regarding  residency, immigration status, and documentation of U.S. citizenship.  Beginning in October 2013, states were required to use available  electronic data sources to confirm information included on the application,  while minimizing the amount of paper documentation that consumers  need to provide.
As of March 25, 2011, federal regulations require that certain ordering  and referring physicians or other professionals providing services under  the state plan or under a waiver of the plan must be enrolled as  participating providers, which includes screening the providers upon initial  enrollment and when follow-up verification occurs (at least every 5 years).  The follow-up verification is referred to as revalidation or reenrollment.  As part of the enrollment process, and depending on the provider’s risk  level, states may be required to collect certain information about the  providers’ ownership interests and criminal background, search exclusion  and debarment lists, and take action to exclude those providers who  appear on those lists. When state officials discover potentially fraudulent  activity in the enrollment process, states must refer that activity or  providers to law-enforcement entities for investigation and possible  prosecution.
In May 2014 we reported that states have historically provided Medicaid  benefits using a fee-for-service system, in which health-care providers are  paid for each service. However, according to CMS, in the past 15 years,  states have more frequently implemented a managed-care delivery  system for Medicaid benefits. In a managed-care delivery system,  beneficiaries obtain some portion of their Medicaid services from an  organization under contract with the state, and payments to MCOs are  typically made on a predetermined, per person, per month basis.  Currently, two-thirds of Medicaid beneficiaries receive some of their  services from MCOs, and many states are expanding their use of  managed care to additional geographic areas and Medicaid populations.According to HHS, approximately 27 percent, or $74.7 billion, of  nationwide federal Medicaid expenditures in fiscal year 2011 (the fiscal  year our review focused on) were attributable to Medicaid managed care.  States oversee MCOs that provide care to Medicaid beneficiaries through  contracts and reporting requirements, which may include identifying  improper payments to providers within their plans.
Pub. L. No. 109-171, § 6034, 120 Stat. 4, 74 (2006) (codified at 42 U.S.C. § 1396u-6). In  September 2014, the Center for Program Integrity was reorganized to integrate the  Medicare and Medicaid program-integrity functions across the Center for Program  Integrity, so that all Center for Program Integrity units are focused on both programs. To  achieve Medicare–Medicaid integration, the Medicaid Integrity Group was also  reorganized and integrated with Medicare staff so that the Medicaid Integrity Group no  longer exists as a separate identifiable unit. states through the Medicaid Integrity Institute in April 2014. HHS OIG  oversees Medicaid program integrity through its audits, investigations,  and program evaluations. It is also responsible for enforcing certain civil  and administrative health-care fraud laws. States have primary  responsibility for reducing, identifying, and recovering improper payments.
section_title: Indicators of Potentially Improper Medicaid Payments to Beneficiaries and Providers Highlight Potential Weaknesses in Selected State Controls
paragraphs: Of the approximately 9.2 million beneficiaries in the four states that we  examined, thousands of cases from the fiscal year 2011 data analyzed  showed indications of potentially improper payments, including fraud, to  Medicaid beneficiaries and providers. The numbers on beneficiaries and  providers may not reflect the total incidence of potentially improper  payments, including fraud, because it was not possible to fully investigate  claims that did not have a valid SSN. For example, we were unable to  match beneficiaries and providers without valid SSNs to the full DMF,  making it difficult to fully investigate such cases for other indicators of  improper payments or fraud.
subsections: section_title: Medicaid Providers
paragraphs: In addition to beneficiaries, we found hundreds of Medicaid providers who  were potentially improperly receiving Medicaid payments. As described  below, these cases show indications of certain types of fraud or improper  benefits.
Providers with suspended or revoked medical licenses. All  physicians applying to participate in state Medicaid programs must  hold a current, active license in each state in which they practice.  During enrollment, states are required to screen out-of-state licenses  to confirm the license has not expired and that there are no current  limitations on the license. Additionally, states are required to provide  CMS with information and access to certain information respecting  sanctions taken against health-care practitioners and providers by  their own licensing authorities. Using data from the Federation of  State Medical Boards (FSMB), we found that approximately 90  medical providers in the four selected states had their medical  licenses revoked or suspended in the state in which they received  payment from Medicaid during fiscal year 2011. Medicaid approved  the associated claims of these cases at a cost of at least $2.8  million.
Invalid addresses for providers. A drop-box or mailbox scheme is a  common fraud scheme in which a fraud perpetrator will set up a  medical-oriented business and will use a CMRA as his or her official  address. The four states we examined for our review required  providers to provide the physical service location of their business  when they apply to provide Medicaid services. Our analysis matching  Medicaid data to USPS address-management tool data found that at  least 220 providers may have inappropriately used a virtual address  as their physical service location. Specifically, these providers used a  CMRA address as their physical service location. For these providers,  Medicaid approved claims of at least $318,000. Additionally, our  analysis found nearly 26,600 providers with addresses that did not  match any USPS records. These unknown addresses may have  errors due to inaccurate data entry or differences in the ages of MMIS  and USPS address-management tool data, making it difficult to  determine whether these cases involve fraud through data matching  alone.
Our analysis also identified 47 providers with foreign addresses as  their location of business. These providers had addresses in Canada,  China, India, and Saudi Arabia. Our analysis found that 8 of the 47  providers with foreign addresses had been paid over $90,000 in  Medicaid claims during fiscal year 2011. In December 2010, CMS  released guidance on implementing the Patient Protection and  Affordable Care Act (PPACA) provisions prohibiting payments to  institutions or entities located outside of the United States. CMS’s  guidance went into effect on June 1, 2011. Approximately 28 percent  of the claims we identified occurred after CMS’s guidance went into  effect.
Deceased providers. We identified over 50 deceased providers in  the four states we examined whose identities received Medicaid  payments. Our analysis matching Medicaid eligibility and claims data  to SSA’s full DMF found these individuals were deceased before the  Medicaid service was provided. The Medicaid benefits involved with  these deceased providers totaled at least $240,000 for fiscal year  2011. These benefits are an indication of improper or potentially  fraudulent payments.
Excluded providers. We found that about 50 providers in the four  states we examined had been excluded from federal health-care  programs, including Medicaid; these providers were excluded from  these programs when they billed for Medicaid services during fiscal  year 2011. The selected states paid the claims at a cost of about  $60,000. The federal government can exclude health-care providers  from participating in the Medicaid program for several reasons.  Excluded providers can be placed on one or both of the following  exclusion lists, which state Medicaid officials must check no less  frequently than monthly: the List of Excluded Individuals and Entities  (LEIE), managed by HHS, and the System for Award Management  (SAM), managed by GSA. The LEIE provides information on health- care providers that are excluded from participation in Medicare,  Medicaid, and other federal health-care programs because of criminal  convictions related to Medicare or state health programs or other  major problems related to health care (e.g., patient abuse or neglect).  SAM provides information on individuals or entities that are excluded  from participating in any other federal procurement or  nonprocurement activity. Federal agencies can place individuals or  entities on SAM for a variety of reasons, including fraud, theft, bribery,  and tax evasion.
On the basis of our matching of state prison data to Medicaid claims data,  we found that 16 providers in the selected states were incarcerated in  state prisons at some point in fiscal year 2011. The offenses that led to  incarceration included drug possession, drug trafficking, money  laundering, racketeering, and murder. We did not identify any Medicaid  claims associated with these providers while they were incarcerated.
section_title: CMS Has Taken Steps to Strengthen Certain Medicaid Enrollment-Screening Controls, but Gaps Remain
paragraphs: Through regulation, CMS has taken steps since 2011 to make the  Medicaid enrollment-verification process more data-driven. The steps  may address many of the improper-payment indicators that were found in  our 2011 analysis of Medicaid claims; specifically, CMS took regulatory  action to enhance beneficiary-screening procedures in 2013 and provider- screening procedures in 2011. However, gaps in guidance and data  sharing continue to exist, and additional opportunities for improvements  are available for screening beneficiaries and providers.
subsections: section_title: CMS Issued Regulations Requiring States to Access Additional Data Sources to Verify Medicaid Applicant Information
paragraphs: In response to PPACA, which was enacted in 2010, CMS issued federal  regulations in 2013 to establish a more-rigorous approach to verify  financial and nonfinancial information needed to determine Medicaid  beneficiary eligibility. Specifically, under these regulations, states are  required to use electronic data maintained by the federal government to  the extent that such information may be useful in verifying eligibility. CMS  created a tool called the Data Services Hub (hub) that was implemented  in fiscal year 2014 to help verify beneficiary applicant information used to  determine eligibility for enrollment in qualified health plans and insurance- affordability programs, including Medicaid. The hub routes to and verifies  application information in various external data sources, such as SSA and  the Department of Homeland Security. According to CMS, the hub can  verify key application information, including household income and size,  citizenship, state residency, incarceration status, and immigration  status. If properly implemented by CMS, the hub can help mitigate some  of the potential improper-payment issues that we identified earlier in our  analysis of fiscal year 2011 Medicaid claims including state residencies,  deceased beneficiaries, and incarcerated beneficiaries.
Figure 1 shows beneficiary enrollment procedures that states are required  to follow beginning in October 2013. Under CMS’s regulations, when  states receive an application they are to use the hub to verify an  individual’s eligibility. available in the hub, or if there is missing information on the application,  the state must use other data sources to determine an individual’s  eligibility.all available electronic data resources before contacting an applicant  directly.
Under 42 C.F.R. § 435.945(k), subject to approval by the Secretary, states may request  and use information from alternate sources, provided that such alternative source or  mechanism will reduce the administrative costs and burdens on individuals and states  while maximizing accuracy, minimizing delay, meeting applicable requirements relating to  the confidentiality, disclosure, maintenance, or use of information, and promoting  coordination with other insurance-affordability programs. The data used for our study are  from fiscal year 2011, approximately 3 years prior to implementation of the CMS hub  requirement.
section_title: Gaps Remain for Screening Deceased Beneficiaries in Selected States
paragraphs: Medicaid services to individuals are to cease once a beneficiary dies.  Under CMS regulations, states are to screen beneficiaries through the  hub, which includes a check using the full DMF to determine whether they  are deceased, at the time of initial enrollment as well as on at least an  annual basis thereafter. Hence, the extent to which the hub identifies  deceased individuals in Medicaid is generally limited to about once every  year.
To supplement the death verification check from the hub, states may use  other electronic resources they have available, such as state vital  records, to identify deceased beneficiaries. While officials at the four  states we examined said that they periodically check the state vital  records to determine whether a potential Medicaid beneficiary has died,  the four states did not use the more-comprehensive full DMF to perform  this check outside of the initial enrollment or annual revalidation period.  As discussed earlier, and highlighted in table 1, we used the full DMF to  identify approximately 200 incidents of potential fraud in these four states  in fiscal year 2011. Without using information from the full DMF, states  can generally only detect deaths within the state’s borders and not  prevent or detect benefit payments made for individuals who had their  deaths recorded in other states’ vital records. Additionally, we previously  reported the full DMF contained approximately 40 percent more records  than the public DMF for deaths reported in 2012 alone. Moreover, in  March 2015, we reported that while verifying eligibility using SSA’s death  data can be an effective tool to help prevent improper payments to  deceased individuals or those that use their identities, agencies may not  be obtaining accurate data because of weaknesses in how these data are  received and managed by SSA.
According to CMS officials, many state Medicaid agencies have long- standing policies of using data matches against both SSA and state vital  statistics to identify deceased individuals. SSA has made the full DMF  available through the hub for the states’ annual redetermination and also  has agreements in place to provide death indicators based on the full  DMF to states. In commenting on the draft of this report, SSA officials  stated that the agency also provides the full DMF to CMS. Thus, states  should be able to access this death information directly from CMS,  according to SSA. While the federal regulation requires states to check  the hub for such items as citizenship and incarceration, CMS officials  noted that the federal regulation does not specify how deceased  individuals should be identified nor has CMS explored the feasibility of  states using the full DMF in the periodic screening for deceased  individuals, outside of the initial enrollment or the annual revalidation  period. As a result, states may not be able to detect individuals who have  moved to and died in other states and prevent payment of potentially  fraudulent benefits.
section_title: CMS Issued Guidance for Screening Provider Enrollment
paragraphs: PPACA authorized CMS to implement several actions to strengthen  provider-enrollment screening. CMS and HHS OIG issued a final rule in  February 2011, effective March 2011, to implement many of the new  screening procedures. This final rule, if properly implemented, will  address some of the issues that we found in our analysis of fiscal year  2011 data, such as screening of excluded providers.
As shown in figure 2, to enroll in Medicaid directly with the state,  providers must apply to the state Medicaid office. While PPACA requires  that all providers and suppliers be subject to licensure checks, it gave  CMS discretion to establish a risk-based application of other screening  procedures. As part of the February 2011 regulation, CMS determined  that states must continue to verify providers and suppliers using various  data sources, such as the full DMF, National Plan and Provider  Enumeration System, LEIE, and SAM. According to CMS’s risk-based  screening, moderate- and high-risk providers and suppliers additionally  must undergo unscheduled or unannounced site visits, while high-risk  providers and suppliers also will be subject to fingerprint-based criminal- background checks. This requirement may address some of the  potentially fraudulent or improper payments highlighted in table 2,  including approximately 200 providers with a CMRA or foreign address.  Additionally, the regulations require the state Medicaid agency to  revalidate providers at least every 5 years. Because the regulation was  effective in March 2011, the states are required to complete revalidation  for Medicaid providers in their states by March 2016.
We found that the states in our review had different methods for  identifying deceased providers. Specifically, according to officials in one  state we examined, Arizona, the state uses the public DMF to periodically  screen providers.  Michigan uses a private-company dataset in  monitoring providers for, among other things, deaths; however, the  dataset used is not the full DMF but the public DMF, which excludes  state-reported death data. New Jersey officials stated that they use a  different source of death data—an Internet genealogy website—to check  for deceased providers during the application process. According to the  genealogy website, it includes deaths from SSA through 2011 and  contains updated obituaries from newspapers.
In addition, according to HHS, providers must hold a valid professional  license before enrolling in Medicaid. CMS regulations require states to  verify licenses in states in which the provider is enrolling and in each of  the other states in which the provider purports to be licensed, as well.  Two states we examined, Arizona and Michigan, review licenses  throughout the country. Arizona uses the National Practitioner Data Bank  for license verification. The National Practitioner Data Bank is an HHS  nationwide system that is primarily an alert or flagging system intended to  facilitate a comprehensive review of the professional credentials of  health-care practitioners, health-care entities, providers, and suppliers.  The National Practitioner Data Bank contains adverse actions including  certain licensure, clinical privileges, and professional-society membership  actions, as well as Drug Enforcement Administration controlled-substance  registration actions, and exclusions from participation in Medicare,  Medicaid, and other federal health-care programs. Michigan, on the other  hand, uses a private-company dataset that periodically monitors providers  for licenses and licensure actions. New Jersey and Florida both screen  the providers within their states, as required. However, neither state uses  a nationwide system, such as FSMB or the National Practitioner Data  Bank, to validate licenses or determine whether the provider has been  sanctioned.verification, which is allowable under Medicaid, all four states periodically  reviewed licenses to ensure that providers are licensed to practice  medicine in their states to meet the CMS requirement.
section_title: Federal Regulation on Enrollment Does Not Apply to MCO Providers
paragraphs: According to CMS’s February 2011 regulation, ordering and referring  providers participating in Medicaid in a risk-based managed-care  environment are not required to enroll in Medicaid, and therefore are not  subject to screening provisions discussed previously. As explained in its  final rule, HHS did not require Medicaid managed-care providers to enroll  with Medicaid programs because doing so would have resulted in  unequal treatment of managed-care providers under the Medicare  program, which does not require managed-care providers to enroll.  Although not required, HHS officials stated that they do encourage states  to screen managed-care network providers.
In this regard, in May 2014, we reported that neither state nor federal  entities are well positioned to identify improper payments made to MCOs,  nor are they able to ensure that MCOs are taking appropriate actions to  identify, prevent, or discourage improper payments.improving federal and state efforts to strengthen Medicaid managed-care  program integrity takes on greater urgency as states that choose to  expand their Medicaid programs under PPACA are likely to do so with  managed-care arrangements, and will receive a 100 percent federal  match for newly eligible individuals from 2014 through 2016. As we  reported in May 2014, unless CMS takes a larger role in holding states  accountable, and provides guidance and support to states to ensure  adequate program-integrity efforts in Medicaid managed care, the gap  between state and federal efforts to monitor managed-care program  integrity will leave a growing portion of federal Medicaid dollars vulnerable  to improper payments. In the May 2014 report, we recommended that  CMS increase its oversight of program-integrity efforts by requiring, in  part, that CMS update its guidance on Medicaid managed-care program   We stated that  integrity. In May 2014, HHS agreed with our recommendation, but as of  February 2015 had not issued new guidance.
Officials in Arizona, Florida, and Michigan said that their respective states  require that all managed-care network providers enroll or register with the  state Medicaid agency. We believe this standardization potentially  eliminates discrepancies found in states when the credentialing standards  for the managed-care network may differ from the state’s enrollment  processes, and the state relies on contracted MCOs to collect network- provider disclosures, check providers and affiliated parties for exclusions,  and oversee other aspects of the provider-enrollment process. Thus, by  requiring that all MCO providers be enrolled directly with the states, those  three states maintain centralized control over the screening and  registration process and may be better positioned to ensure the integrity  of their Medicaid programs.
section_title: Challenges in Data Sharing Hamper Selected States from More- Efficiently Screening for Provider Enrollment Fraud
paragraphs: We have found that fraud prevention is the most efficient and effective  means to minimize fraud, waste, and abuse rather than trying to recover  payments once they are made. Thus, controls that prevent potentially  fraudulent health-care providers from entering the Medicaid program or  submitting claims are the most-important element in an effective fraud- prevention program. Effective fraud-prevention controls require that,  where appropriate, organizations enter into data-sharing arrangements  with each other to perform validation. System edit checks (i.e., built-in  electronic controls) are also crucial in identifying and rejecting potentially  fraudulent enrollment applications.
Although CMS has taken steps through its program regulations in  providing guidance to states for screening providers, the states we  examined reported difficulties in implementing the regulations. One  provision in the 2011 HHS regulation allowed states to rely on the results  of provider screening by Medicare contractors to determine provider  eligibility for Medicaid. According to HHS, this provision would eliminate  additional screening and enrollment requirements for Medicaid providers,  and also eliminate additional costs and burdens for separate screening  for state Medicaid programs.
To administer the provider screening, application fee, and revalidation  requirements successfully, as specified in federal regulations, CMS  determined that states must have access to Medicare enrollment data to  determine whether a provider is currently enrolled in the Medicare  program, has been denied enrollment, or is currently enrolling. According  to CMS, in April 2012, CMS established a process by which states would  have direct access to Medicare’s enrollment database—the Provider  Enrollment, Chain and Ownership System (PECOS). Each state is given  “read only,” manual access to PECOS. CMS provided the states access  to PECOS in hopes that the states will be able to use these data in  minimizing the amount of screening and costs that are associated with  providers that are already enrolled in Medicare.
However, according to our discussions with officials in the four selected  states, the states are using PECOS to screen a segment of their provider  population but none currently utilize PECOS for their entire provider  population. Arizona officials stated that they use PECOS in the screening  of out-of-state providers. Michigan officials stated that they use PECOS  on medium- or high-risk providers to determine whether a site visit is  warranted. New Jersey officials stated they use PECOS to confirm an  out-of-state provider’s Medicare provider status and view the results of  the most-recent site-visit inspection. Florida officials said that they do not  screen all providers using PECOS. With regard to using PECOS for all  Medicaid providers in their screening processes, we determined the  following:
State officials told us that PECOS required manual lookups of  individual providers, a task that one state characterized as inefficient  and administratively burdensome. According to CMS officials, as of  October 2013, CMS began providing all interested states access to a  monthly PECOS data-extract file that contains basic Medicare  enrollment information; the state officials we interviewed were  unaware that they could obtain automated data extracts from PECOS.
Additionally, state officials from Florida, Michigan, and New Jersey  said that they use a limited amount of pertinent information,  specifically site-visit information, from PECOS to perform the  necessary provider screening. However, there is additional  information in PECOS, such as ownership information, that is  necessary for state Medicaid agencies to screen providers properly  and that is not included in the information that they use. Only Arizona  officials stated they are able to utilize PECOS ownership information  for providers. According to CMS officials, ownership information on  providers can be obtained through a detailed-level view of PECOS.  However, CMS has not made ownership information available to the  states through the monthly PECOS data-extract file.
Some state officials noted that full electronic access to all information in  the PECOS system would streamline provider-screening efforts, resulting  in a more-efficient and more-effective process. Additional CMS guidance  to the states on requesting automated information through PECOS and  ensuring that such information includes key ownership information could  help states improve efficiency of provider screening.
section_title: Conclusions
paragraphs: The Medicaid program is a significant expenditure for the federal  government and the states, representing over $310 billion in federal  outlays in fiscal year 2014. Because of the size and continued expansion  of the Medicaid program, it is important that the federal government and  the states continue to find ways to prevent and reduce improper  payments, including fraud, in the program. Since 2011, CMS has taken  steps to strengthen Medicaid beneficiary and provider enrollment- screening controls. As part of this ongoing endeavor, increasing  information and data-sharing efforts between the federal government and  state Medicaid programs could help enhance efforts to identify improper  payments and potentially fraudulent activities. As the federal overseer of  the Medicaid program, CMS is well positioned to provide additional  guidance on accessing information in federal databases, such as SSA  information about deceased individuals and automated information on  providers through Medicare’s enrollment database—the Provider  Enrollment, Chain and Ownership System (PECOS)—that would help  identify and prevent benefits and payments to those individuals and  providers who are ineligible to participate in Medicaid.
section_title: Recommendations for Executive Action
paragraphs: To further improve efforts to limit improper payments, including fraud, in  the Medicaid program, we recommend that the Acting Administrator of  CMS take the following two actions:  issue guidance to states to better identify beneficiaries who are  deceased; and provide guidance to states on the availability of automated information  through Medicare’s enrollment database—the Provider Enrollment,  Chain and Ownership System (PECOS)—and full access to all  pertinent PECOS information, such as ownership information, to help  screen Medicaid providers more efficiently and effectively.
section_title: Agency and Third- Party Comments and Our Evaluation
paragraphs: We provided a draft copy of this report to HHS, SSA, and state Medicaid  program offices for Arizona, Florida, Michigan, and New Jersey. Written  comments from HHS, SSA, the Arizona Health Care Cost Containment  System (AHCCCS), the Florida Agency for Healthcare Administration,  and the Michigan Department of Community Health are summarized  below and reprinted in appendixes II–VI. HHS concurred with our  recommendations. SSA did not comment on the findings and  recommendations but provided clarifying comments on the full DMF.  AHCCCS disagreed with out methodology and provided detailed  comments on our findings, as described below. The Florida Agency for  Healthcare Administration said it supports our efforts to identify provider  and beneficiary fraud. The Michigan Department of Community Health  agreed with our findings and supports our recommendations. In an e-mail  received on March 24, 2015, the Chief of Investigations of the New  Jersey Office of the State Comptroller, Medicaid Fraud Division, did not  provide comments on the findings but provided a technical comment,  which we incorporated as appropriate. The Florida Department of  Children and Families also provided technical comments, which we  incorporated as appropriate.
HHS concurred with both of our recommendations. Regarding our first  recommendation, to issue guidance to states to better identify  beneficiaries who are deceased, HHS stated that it will work with states to  determine additional approaches to better identify deceased beneficiaries  and continue to provide state-specific technical assistance as needed. In  response to our second recommendation, HHS indicated that it will  continue to educate states about the availability of PECOS information  and how to use that information to help screen Medicaid providers more  effectively and efficiently. HHS also outlined steps the agency has taken  to address beneficiary and provider eligibility fraud since fiscal year  2011—the time frame for the data used in our study—many of which were  mentioned in our report. As described in our report, we used fiscal year  2011 data because it was the most-recent consistently comparable data  available.
In its written comments, SSA did not comment on the report’s findings  and recommendations but provided clarifying information regarding  access to the full Death Master File (DMF), which we incorporated as  appropriate. Additionally, SSA stated that CMS already has access to the  full DMF and can share that information with states to ensure proper  payment of Medicaid benefits. We believe that such action by CMS could  address our first recommendation.
In its written comments, AHCCCS said that it takes exception to being  included in a series of findings that are global in nature and offer no state- specific detail. As we noted in our meetings with all state agencies  included in our study, we did not provide state-level detail for two primary  reasons. First, because CMS was the audited agency for our work,  conducting analysis at the state-level would be outside the scope of our  work and would put the focus on a comparison between the states, rather  than on CMS oversight. In addition, due to the age and limitations of the  data, as noted in the report, we would not be referring specific cases for  follow-up. AHCCCS further stated that our report contained  misstatements that cannot be attributed to either state. Because  AHCCCS did not provide any examples, we cannot address this assertion  but stand by the findings and recommendations in our report.
AHCCCS also stated that most of the findings on our report are derived  from data sources that are considered unreliable. In our report, we outline  the steps we took to assess the reliability of our data and determine that  they were sufficiently reliable for performing our work. Additionally, we  note the key limitations of the data sources we use for our report and  provide the appropriate caveats, as applicable, for the findings from our  data analysis. Further, AHCCCS uses several of the same data sources  for its eligibility screening as we used in our report. For example,  AHCCCS notes that Arizona has found that the SSA death file is  unreliable. It further notes that it uses SSA’s real-time State Online Query  system to obtain date of death information. According to SSA in its written  response to the draft report, the source for the State Online Query system  data used by Arizona is the SSA DMF.
AHCCCS also states that the findings of our report do not reflect the  current eligibility-screening process in Arizona. We acknowledge the  limitations stemming from the age of the MSIS data (fiscal year 2011) and  the passage of PPACA in 2011. Furthermore, we directly address this  limitation in the report where we discuss actions CMS has taken to  strengthen certain Medicaid enrollment-screening controls. Specifically,  we state that CMS has taken regulatory action since 2011 to enhance  beneficiary-screening procedures and provider-screening procedures that  may address the improper-payment indicators found in our report. We  then discuss the current eligibility-screening process at the federal and  state level. We did not make any changes to the report based on these  AHCCCS comments, because we believe the essence of the comments  was already acknowledged within the report.
AHCCCS also provided comments on specific sections of our analysis,  beginning with incarcerated beneficiaries. First, AHCCCS identified  reliability and timeliness issues with the SSA incarceration file. This  comment is not pertinent to our work, as this file was not a data source  used in our analysis. As we note in appendix I, we used each state’s  department of corrections prisoner database for individuals incarcerated  for any period during fiscal year 2011. Second, AHCCCS states that we  failed to distinguish whether incarcerated individuals were hospitalized.  To the contrary, we note that we reviewed these claims’ type of service to  determine that none qualified for federal matching funds. Accordingly, this  would exclude individuals that were hospitalized.
Regarding our analysis using the USPS address-management tool,  AHCCCS incorrectly states that our report assumes that all physical  addresses are known to USPS. We do not state this in our report.  Specifically, the report notes that federal law requires states to make  Medicaid available to eligible individuals who do not reside in a  permanent dwelling or do not have a fixed home or mailing address.  Therefore, there are no requirements related to listing actual physical  addresses for beneficiary enrollment and eligibility determinations.  Further, the focus of our analysis was CMRAs used as the residential  address, not the validity of all addresses listed on beneficiary  applications. As such, the comment from AHCCCS is not supported by  the actual content and analyses in our report.
AHCCCS notes that our analysis of provider controls is an extrapolation  from the combined set of states’ data. This is incorrect. Our report does  not extrapolate, or make any population estimates, of provider eligibility  fraud. We provided a descriptive analysis of potential improper payments  and provider-eligibility fraud based on the data from fiscal year 2011. As  stated earlier, we listed the appropriate caveats to our findings to ensure  that the results of our analysis were not taken in an inappropriate context,  as implied by AHCCCS.
Finally, AHCCCS identified three recommendations that it believes would  improve Medicaid program-integrity issues. Specifically AHCCCS stated  CMS should allow states to use disclosures conducted by Medicare or another  state Medicaid program in the enrollment of Medicaid providers, allow states to access the federal criminal database to conduct initial  and periodic background checks on providers, and promote other national initiatives for data sharing on Medicare and  provider license verifications.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Commissioner of Social Security, relevant state  agencies, and interested congressional committees. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: In this report, we (1) identify and analyze indicators of improper or  potentially fraudulent payments to Medicaid beneficiaries and providers  and (2) examine the extent to which federal and state oversight policies,  controls, and processes are in place to prevent and detect fraud and  abuse in determining eligibility for Medicaid beneficiaries and enrolling  providers.
To identify indicators of improper or potentially fraudulent payments to  Medicaid beneficiaries and providers, we obtained and analyzed Medicaid  claims paid in fiscal year 2011, the most-recent consistently comparable  data, for four states: Arizona, Florida, Michigan, and New Jersey.  Medicaid payments to these states constituted about 13 percent of all  Medicaid payments made during fiscal year 2011. These four states were  selected primarily because they had reliable data and were among states  with the highest Medicaid enrollment. The results of our analysis of  these states cannot be generalized to other states. We obtained Centers  for Medicare & Medicaid Services (CMS) Medicaid Statistical Information  System (MSIS) beneficiary, provider, and other services claims data, as  well as state Medicaid Management Information System (MMIS) claims  identification data to perform our work. Managed-care organizations   As a result, the Medicaid  (MCO) receive a monthly capitated payment.paid amounts associated with managed care may not be reflected in the  state claims that were submitted to CMS for medical services, and hence  our estimate is likely understated. All of the states included in our  review—Arizona, Florida, Michigan, and New Jersey—had MCO  arrangements in place.
To identify beneficiaries that submitted applications with identification  information (name, date of birth, and Social Security number ) that  did not match with Social Security Administration (SSA) records, we used  the SSA Enumeration Verification System. Specifically, we processed  unique beneficiary identification information from the MSIS and MMIS  files through the SSA Enumeration Verification System to determine the  extent to which SSN information in the MSIS files was accurate. We  analyzed the output codes from the SSA Enumeration Verification System  to identify unique individuals who had Medicaid application identification  information that did not match SSA records. Applications may have  inaccuracies due to simple errors such as inaccurate data entry or  incomplete sections, making it difficult to determine whether these cases  involve fraud through data matching alone. In addition, there may be  situations where an individual does not have an SSN (for example, a  newborn child). Nonetheless, these applications pose a higher risk of  fraud because there is no complete electronic record of beneficiaries’  identities.
To identify providers and beneficiaries with identities associated with  deceased individuals at the time of their Medicaid services, we matched  Medicaid data—MMIS and MSIS—to the SSA complete file of death  information from October 2012. We matched records using the SSN and  full name of the individual. We then identified unique individuals who had  Medicaid claims processed where the date of death in the SSA file  occurred before the beginning service date in the Medicaid claims file.
To identify providers and beneficiaries with identities associated with  incarcerated individuals at the time of their Medicaid services, we  matched our selected states’ MMIS data to the states’ departments of  corrections prisoner databases. Prisoner data included individuals  incarcerated for any period during fiscal year 2011. For Arizona, Florida,  and New Jersey, we identified provider and beneficiary records for which  the Medicaid SSN and names matched that of a person who was  incarcerated in fiscal year 2011 in any of the four states. Michigan did not  provide SSNs in its incarceration data. For Michigan, we identified  provider and beneficiary records for which the Medicaid name and birth  day exactly matched that of a person who was incarcerated in fiscal year  2011 in any of the four states. We then identified Medicaid claims  associated with the identified individuals by matching to the MSIS data.  We compared the beginning service date of the claims to the individual’s  admittance and release date to identify all claims that occurred while the  associated beneficiary or provider identity was incarcerated. Additionally,  we reviewed these claims’ type of service to determine that none qualified  for federal matching funds.
It is not possible to determine from data matching alone whether these  matches definitively identify recipients who were deceased or  incarcerated without reviewing the facts and circumstances of each case.  For example, it is possible that individuals can be erroneously listed in the  full Death Master File (DMF). Similarly, a provider or beneficiary may  have an SSN, name, and date of birth similar to an individual in state  prison records. Alternatively, our matches may also understate the  number of deceased or incarcerated individuals receiving assistance  because matching would not detect applicants whose identifying  information in the Medicaid data differed slightly from their identifying  information in other databases.
To identify claims that are associated with missing or invalid addresses,  we used the United States Postal Service (USPS) Address Matching  System Application Programming Interface (USPS address-management  tool). To identify providers and beneficiaries with invalid addresses, we  submitted all MMIS data through that USPS address-management tool for  fiscal year 2014. The USPS address-management tool provides  information such as whether an address is undeliverable, unknown, a  Commercial Mail Receiving Agency (CMRA), or contains an invalid city,  state, or ZIP code. Additionally, the address-management tool  standardized and corrected addresses based on the information  submitted. We considered invalid addresses to be unknown/blank,  CMRAs, or foreign addresses. To identify providers with CMRAs, we  identified all records where the address-management tool identified and  confirmed the address with private-mailbox-number information. We  conducted further analysis to remove any provider records that were not  for the physical service location of their business, such as a billing or  correspondence address for a provider. To identify beneficiaries with  commercial addresses, we identified all records where the address- management tool identified the residential address as a commercial  address with or without private-mailbox-number information. To identify  providers and beneficiaries with unknown addresses, we identified all  records where the USPS address-management tool identified the address  as not found or blank. To identify providers and beneficiaries with foreign  addresses, we identified and reviewed all records where the USPS  address-management tool identified the address as having an invalid city  or state. We removed records that had been corrected by the USPS  address-management tool as well as military bases. We then conducted  additional analysis to identify MSIS claims associated with both the  providers and beneficiaries with invalid addresses. It is not possible to  determine through data matching alone whether the identified claims  were definitely associated with invalid addresses without reviewing  additional information for each claim due to the difference in MMIS and  address-management tool data age. For example, it is possible that an  address was valid in fiscal year 2011 and was no longer recognized in  fiscal year 2014.
To identify Medicaid beneficiaries who received benefits in two or more  states concurrently, we identified all beneficiary SSNs that appeared in  two or more states’ MMIS data in fiscal year 2011. We then found all  claims associated with the beneficiary identities. We conducted further  analysis to determine the states in which each beneficiary identity  appears and the service ranges—first and last date of service—for those  states. We defined a concurrent claim as a claim that occurred within the  service range of a second state for the same beneficiary identity. For  each claim, we compared its date of service to the service ranges for the  beneficiary identity to determine whether it was a concurrent claim. It is  not possible to definitely say through data matching alone that a  beneficiary was improperly receiving Medicaid benefits in two or more  states concurrently without looking into further information for each claim  and beneficiary. For example, a beneficiary could have been a resident in  one state and received services, then changed residency to a second  state and received benefits for a brief period, before finally relocating  again back to the original state and receiving additional services. In this  case, the claims could have been identified as a concurrent claim even if  the beneficiary did not receive any services from the original state during  his or her relocation period in the second state.
To identify claims that might have been improperly processed and paid by  the Medicaid program because the federal government had excluded  these providers from providing services to Medicaid beneficiaries, we  compared the Medicaid claims to the exclusion and debarment files from  the Department of Health and Human Services’ (HHS) Office of Inspector  General (OIG) and the General Services Administration (GSA).  Specifically, we used the HHS List of Excluded Individuals and Entities  (LEIE) file from September 2012 and the GSA Excluded Parties List  System (EPLS) database extract from October 2011 to perform our  match. We matched MMIS and MSIS Medicaid data using SSN and  individual name with both the LEIE and the EPLS data extracts. We then  identified unique individuals who had Medicaid claims processed where  the date of exclusion occurred before the beginning service date in the  Medicaid claims file.
To identify claims that might be improperly processed and paid by the  Medicaid program because the provider had a revoked or suspended  license, we compared Medicaid claims data to the Federation of State  Medical Boards (FSMB) Physician Data Center database extract from  calendar year 2014. We identified providers with actions that, in some  cases, may be prohibited under federal Medicaid regulations that resulted  in a suspended or revoked license. We matched these providers with our  Medicaid claims data by SSN and provider name. We identified unique  individuals who had Medicaid claims processed where the date of license  action occurred before the beginning service date in the Medicaid claims  file.
To identify federal and state oversight policies, controls, and processes in  place to prevent and detect fraud and abuse in determining eligibility for  Medicaid beneficiaries and enrolling providers, we reviewed federal  statutes, CMS regulations, and state Medicaid policies pertinent to  program-integrity structures, met with agency officials, and visited state  Medicaid offices that perform oversight functions. We used federal  standards for internal control, GAO’s Fraud Prevention Framework,federal statutes, and Medicaid eligibility regulations to evaluate these  functions.
To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  federal and selected states’ databases that we used to perform our work.  We also interviewed officials responsible for their respective databases,  and reviewed documentation related to the databases and literature  related to the quality of the data. On the basis of our discussions with  agency officials and our own testing, we concluded that the data elements  used for this report were sufficiently reliable for our purposes.
We identified criteria for Medicaid fraud controls by examining federal and  state policies, laws, and guidance, including policy memos and manuals.  We interviewed officials from CMS and the state governments of Arizona,  Florida, Michigan, and New Jersey involved in Medicaid program  administration and Medicaid fraud response.
We conducted this performance audit from March 2014 to May 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  audit findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: Comments from the Social Security Administration
section_title: Appendix IV: Comments from the Arizona Health Care Cost Containment System
section_title: Appendix V: Comments from the Agency for Health Care Administration, State of Florida
section_title: Appendix VI: Comments from the Department of Community Health, State of Michigan
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Matthew Valenta (Assistant  Director), John Ahern, Mariana Calderón, Melinda Cordero, Julia DiPonio,  Lorraine Ettaro, Colin Fallon, Barbara Lewis, Maria McMullen, Kevin  Metcalfe, Rubén Montes de Oca, James Murphy, Christine San, Paola  Tena, and Carolyn Yocom made key contributions to this report.