Medicaid Program Integrity: CMS Should Build on Current Oversight Efforts by Further Enhancing Collaboration with States
Published: 2017-03-15T00:00:00

Fast Facts:
The Centers for Medicare & Medicaid Services reviews states' efforts to reduce improper Medicaid payments, and encourages them to use collaborative audits—where CMS contractors and states work together to review the accuracy of payments made. However, some states have reported barriers (such as staff burden) to participating in collaborative audits.
We also found that CMS lacks a systematic approach to collecting and communicating information about state practices to reduce Medicaid improper payments. We recommended that the agency collect and share these practices, and work to increase states' participation in collaborative audits.

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid remains a high-risk program, partly due to concerns about improper payments. CMS oversees and supports states, in part, by reviewing their program integrity activities, hiring contractors to audit providers, and providing training. In recent years, CMS made changes to its Medicaid program integrity efforts, including a shift to collaborative audits.
GAO was asked to examine CMS's oversight and support of states' Medicaid program integrity efforts. GAO examined, among other issues, (1) how CMS tailors its reviews to states' circumstances; (2) states' experiences with collaborative audits; and (3) CMS's steps to share promising program integrity practices. GAO reviewed CMS documents, including state program integrity reports, and data on collaborative audits. GAO interviewed officials from CMS and eight states selected based on expenditures, managed care use, and number of collaborative audits, among other factors.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS) has tailored its state program integrity reviews—in which the agency reviews states' program integrity activities—to states' managed care delivery systems and other areas at high risk for improper payments. From 2014 through 2016, CMS conducted on-site reviews in 31 states. The reviews usually addressed state oversight of managed care plans, and some reviews addressed other high-risk areas such as provider enrollment. CMS and states have found the reviews to be beneficial in identifying areas for improvement. To expand oversight to more states, CMS also began off-site desk reviews of certain state program integrity efforts.
Collaborative audits—in which CMS contractors and states work in partnership—have identified substantial potential overpayments to providers, but barriers have limited their use. CMS encourages states to use collaborative audits, but states decide whether to pursue them. Several states reported positive collaborative audit experiences, while others cited barriers—such as staff burden or problems communicating with contractors—that prevented them from seeking audits or hindered the success of audits. Federal internal control standards indicate that organizations should identify and respond to risks related to achieving objectives. Absent additional CMS action to address barriers, some states may choose not to pursue collaborative audits, or may encounter challenges after doing so.
CMS lacks a systematic approach to collecting promising state progam integrity practices and communicating them to other states. CMS's main approach—the state program integrity reviews—inconsistently identified promising practices, and those identified are neither published in a timely way nor easily searched electronically. Other CMS approaches, such as courses offered by the Medicaid Integrity Institute (a national training program for states), were not designed for sharing promising practices and do not systematically communicate them to all states. Both CMS and the states have a role in identifying promising program integrity practices. Absent further agency action, states may not have access to the range of promising state program integrity practices, which is inconsistent with federal internal control standards on the use and external communication of necessary quality information to achieve program objectives.
section_title: What GAO Recommends
paragraphs: To further improve its support of states' Medicaid program integrity activities, CMS should identify opportunities to address barriers that limit states' participation in collaborative audits, and, in collaboration with states, take additional steps to collect and share promising program integrity practices. The Department of Health and Human Services concurred with GAO's recommendations.

section_title: Letter
paragraphs: Improper payments are a significant and growing cost to the Medicaid  program, most recently increasing from an estimated 9.8 percent ($29  billion) of federal Medicaid expenditures in fiscal year 2015 to 10.5  percent ($36 billion) in fiscal year 2016. Medicaid covered about 72  million low-income and medically needy individuals in fiscal year 2016,  and is the largest health insurance program by enrollment in the United  States. In fiscal year 2016, federal and state Medicaid expenditures were  projected to be $576 billion, with the federal government spending $363  billion and states spending a combined $213 billion. Due to its size,  diversity, and growth, we have had long-standing concerns about the  integrity of the Medicaid program, and it has been on our list of high-risk  programs since 2003.
The federal government and the states play key roles in oversight of the  Medicaid program. The Centers for Medicare & Medicaid Services (CMS),  within the Department of Health and Human Services (HHS), is responsible for broad oversight of the program, while states are primarily  responsible for administering their respective Medicaid programs’ day-to- day operations. Within federal requirements, states have significant  flexibility to design and implement their programs, resulting in 56 distinct  state-based programs. States have also had primary responsibility for  ensuring the integrity of the Medicaid program by preventing, identifying,  and correcting improper payments. They therefore remain the first line of  defense against Medicaid improper payments.
The Deficit Reduction Act of 2005 established the Medicaid Integrity  Program, under which CMS is required to use contractors to audit  Medicaid claims for improper payments and provide education and  training to states, providers, and others; develop and publish a  comprehensive plan to address Medicaid program integrity; and report  annually to Congress on the effectiveness and use of program funding.  CMS hired contractors in 2007 to perform analyses and audits of  Medicaid providers using federal data. In 2010, CMS revised its approach  to these audits and adopted a new audit model in which its contractors  and states may work in partnership on “collaborative audits.” As a result  of the Deficit Reduction Act, CMS also established the Medicaid Integrity  Institute (MII) in 2007, in collaboration with the Department of Justice. The  MII is the first national training program for state program integrity  officials.
You asked us to review CMS’s efforts to prevent and reduce improper  payments, in particular its efforts to oversee and support states’ program  integrity activities. In this report, we examine  1.  how CMS tailors its reviews of states’ Medicaid program integrity  activities to account for differences in states’ health care delivery  systems and program integrity needs;  2.  states’ experiences with collaborative audits;  3.  how the Medicaid Integrity Institute supports states’ efforts to address  program integrity vulnerabilities; and  4.  the steps CMS has taken to share promising program integrity  practices.
To examine how CMS tailors its reviews, we focused on CMS’s state  program integrity reviews, which are intensive, on-site reviews of states’  program integrity efforts. These visits result in State Program Integrity  Review Reports, which include information on state compliance with  federal requirements and other information on states’ program integrity  efforts. We reviewed all 30 of CMS’s State Program Integrity Review  Reports for fiscal years 2013 through 2015 that were published on or  before September 2, 2016, as well as CMS’s most recent Program  Integrity Review Annual Summary Reports. We also reviewed CMS’s  internal guidance for performing state program integrity reviews and  documentation about its desk reviews, which are off-site reviews that  target specific aspects of states’ program integrity programs. In addition,  we reviewed several published reports related to CMS’s Medicaid  program integrity activities, including its Comprehensive Medicaid  Integrity Plans and its reports to Congress. We interviewed officials from  CMS’s Center for Program Integrity and state officials in eight selected  states. The eight states we selected were Arizona, Colorado,  Connecticut, Florida, Massachusetts, Michigan, New York, and  Tennessee. This judgmental sample of states was chosen to reflect a  range of different characteristics, including Medicaid expenditures,  delivery systems (both fee-for-service and managed care), and  geographic diversity. We also selected states based on the year they  had their most recent state program integrity review, and on the number  of collaborative audits conducted by CMS’s audit contractors, known as  Medicaid Integrity Contractors (MIC). We also included a mix of states  that expanded their Medicaid programs as allowed under the Patient  Protection and Affordable Care Act (PPACA) and those that did not. The  experiences of the Medicaid officials in the eight selected states are not  generalizable to other states.
To examine states’ experiences with the collaborative audits, we  reviewed the materials noted above and discussed the audits with both  CMS and state officials. In addition, we collected CMS data on each  collaborative audit assigned from October 1, 2011, through June 30,  2016. We also reviewed CMS information on potential overpayments  identified through collaborative audits, from fiscal year 2012 through fiscal  year 2015. We assessed the reliability of these data by talking with CMS  and state officials, reviewing related documentation, and assessing the  data for internal consistency and obvious errors, and determined that they  were sufficiently reliable for the purposes of our reporting objective. We  also assessed the degree to which the collaborative audit program is  consistent with standards for internal controls in the federal government— specifically those related to identifying and responding to risks, and to  information and communication.
To examine how the MII supports states’ efforts to address program  integrity vulnerabilities, we interviewed state officials in the eight selected  states to learn the extent to which the MII courses were useful and  addressed the states’ training needs. Further, we analyzed data on the  MII course offerings and attendees by state from fiscal year 2012 through  March 1, 2016. We assessed the reliability of these data by talking with  CMS and state officials, reviewing related documentation, and checking  the data for internal consistency and obvious errors, and determined that  they were sufficiently reliable for the purposes of our reporting objective.  We also reviewed summaries of participants’ initial course evaluations for  a selection of seven courses offered in fiscal year 2015 and 2016, and  60-day course evaluations for five of those seven courses. We also  reviewed the two most recent versions of CMS’s Annual Summary Report  of the Medicaid Integrity Institute and Related Educational Activities,  published in 2013 and 2014, and interviewed officials from CMS and the  Department of Justice’s (DOJ) National Advocacy Center. CMS and DOJ  have an interagency agreement in which DOJ provides support for the  institute and houses it at the National Advocacy Center.
To examine the steps CMS has taken to share promising program  integrity practices, we reviewed the results from the analyses described  above relating to the state program integrity reviews and the MII. In  addition, we reviewed agendas from and documentation about the  Medicaid Fraud, Waste and Abuse Technical Advisory Group’s (TAG)  monthly calls with CMS, MII, and the states, and several program integrity  toolkits developed by CMS. We also asked state officials in the eight  selected states about CMS’s efforts to share promising practices and how  they learned of other states’ strategies to improve program integrity. We  assessed the extent to which CMS’s approaches for sharing promising  program integrity practices is consistent with standards for internal  controls in the federal government—specifically those related to  information and communication.
We conducted this performance audit from September 2015 to March  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Medicaid is a significant and growing component of federal and state  budgets. It is the second largest health insurance program after Medicare  as measured by expenditures, and was estimated to account for the  second largest share of total state spending as well, exceeded only by  state spending on elementary and secondary education.
Further, Medicaid is undergoing a period of transformative change, as  enrollment is growing under PPACA, and program spending is projected  to increase 66 percent to over $950 billion by fiscal year 2025. Growth  in enrollment is primarily due to more than half of the states choosing to  expand their Medicaid programs by covering certain low-income adults  not historically eligible for Medicaid coverage, as authorized under  PPACA. Growth in expenditures is due to a variety of factors, including  the expansion of eligibility, provider rate increases and the higher cost of  health care, including prescription drugs. In addition, states’ use of  managed care plans to deliver services has been growing. More than  half of all Medicaid beneficiaries are now enrolled in managed care plans,  and nearly 40 percent of expenditures are for health care services  delivered through managed care.
The Medicaid program allows for substantial flexibility for states to design  and implement their programs, which has implications for program  oversight. For example, in a fee-for-service delivery system, state  oversight relies on claims data that health care providers submit to states  in order to be paid for services. In general, this involves pre- and post- payment reviews of claims to identify payments that are improper, billing  anomalies, or aberrant claims. In contrast, state oversight of managed  care plans often occurs through contracts and reporting requirements,  and may also involve encounter data. State oversight is different under  the managed care delivery model, because the managed care plans are  responsible for providing services and bear financial risk if spending on  services and administration exceeds payments from the state.
In 2014, we found that the federal government and the states were not  well positioned to identify improper payments made to, or by, managed  care plans. For example, CMS had largely delegated program integrity  oversight of managed care plans to the states, but states generally  focused on fee-for-service claims. State officials told us that one reason  for not focusing on audits of services provided by managed care plans  was that they were more complex than audits of fee-for-service claims.
We made three recommendations to improve federal and state oversight  of Medicaid managed care expenditures. Since then, CMS has addressed  these recommendations. CMS has, for example, issued a final rule on  Medicaid managed care, which requires states to conduct periodic audits  of financial data submitted by, or on behalf of, each Medicaid managed  care plan.
subsections: section_title: CMS’s Oversight of Medicaid Program Integrity
paragraphs: CMS’s Center for Program Integrity is the agency’s focal point for  Medicaid and Medicare program integrity issues. Initially, CMS’s Medicaid  program integrity activities were administered by a unit separate from its  Medicare program integrity activities. In an effort to strengthen and better  coordinate its program integrity efforts, CMS reorganized the Center for  Program Integrity in 2014 to align functional activities and integrate  Medicaid and Medicare program integrity efforts where possible. CMS  has a range of program integrity activities that are important to overseeing  and supporting states’ Medicaid programs. Several of its core activities  have undergone changes in recent years. For example:  1.  Reviews of state program integrity efforts. Each year, CMS selects  a group of states and reviews aspects of their program integrity  efforts. From 2007 to 2013, CMS conducted comprehensive, on-site  regulation-based reviews of each state’s program integrity activities  every 3 years. In fiscal year 2014, CMS shifted the focus of the state  program integrity reviews from a comprehensive review approach to a  “focused review” approach. According to CMS, this new approach to  state program integrity reviews is intended to focus on high-risk areas  of concern particular to each state, reduce the burden on states, and  identify more opportunities to provide technical assistance to the  states. Since 2014, CMS has conducted focused reviews on selected  high-risk areas each year; although these reviews have been  narrower in scope than the comprehensive regulatory reviews, they  still involve on-site visits to states. As with previous reviews, CMS  continues to publish its findings in state-specific review reports. CMS  also publishes reports that compile findings from individual state- specific reports. States are required to submit corrective action plans  for addressing any areas of regulatory non-compliance that CMS  identifies, and CMS follows up on states’ planned corrective actions.  In 2016, CMS began off-site desk reviews of states’ program integrity  efforts to supplement the focused reviews.  2.  Collaborative federal-state audits. In accordance with the Deficit  Reduction Act, CMS contracts with eligible entities to review the  actions of Medicaid providers, and audit providers’ claims to identify  overpayments. In 2012, we made several recommendations to  improve the efficiency of these audits, and CMS took action to  address our recommendations. For example, CMS has shifted from  its previous audit approach—in which CMS contractors, the MICs,  used extracts of often incomplete federal data to identify providers for  audits—to a new “collaborative audit” model in which states agree to  post-payment audits and provide state data to the MICs. As a part of  the collaborative audit process, the state—together with CMS— determines the audit processes the MICs follow. In some instances,  the MIC conducts the entire audit; in other cases, it supplements state  resources by providing medical review staff and other resources.  States are responsible for collecting overpayments identified by the  MICs, and are permitted 1 year from the date of discovery to return  the federal share.
Beginning in 2016, as a component of CMS’s efforts to strengthen  and consolidate its program integrity efforts, CMS began shifting from  the three regional MICs focused on Medicaid to five new regional  Unified Program Integrity Contractors (UPIC) responsible for a range  of Medicare and Medicaid program integrity activities previously  performed by other contractors. According to CMS, the purpose of  the UPICs is to coordinate provider investigations across Medicare  and Medicaid; improve collaboration with states by providing a  mutually beneficial service; and increase contractor accountability  through coordinated oversight. According to CMS officials, aspects of  the UPIC program—such as the goal of having contractors work  collaboratively with states—reflect their prior experiences with the  collaborative audits. CMS began awarding UPIC contracts in 2016; it  plans to award all the contracts by the end of 2017, and ultimately  phase out the MICs.  3.  Medicaid Integrity Institute. In 2007, CMS established the MII, the  first national Medicaid training program for state program integrity  officials. CMS entered into an interagency agreement with the  Department of Justice to house the MII at the National Advocacy  Center, located at the University of South Carolina. The MII offers  substantive training and support in a structured learning environment  at no cost to the states, with the first trainings offered in fiscal year  2008. The MII trainings include multi-day on-site courses and  workgroups, as well as webinars. The MII has offered from 19 to 22  on-site courses, 1 to 3 workgroups, and 2 to 13 webinars each year  from fiscal years 2012 through 2015. In fiscal year 2015, individual  course sizes ranged from 25 participants to the largest class  accommodating over 70 participants. Almost 3,800 attendees  participated in on-site courses from fiscal years 2012 through 2015.  (See app. I for attendance by state for fiscal years 2012 through  2015.) In fiscal year 2013, the MII began the Certified Program  Integrity Professional credentialing program. The MII also provides a  secure online platform for state-to-state information sharing known as  the Regional Information Sharing System. State officials must register  to gain access to the Regional Information Sharing System, and  participation is voluntary. Currently there are approximately 360 users.  4.  State provider enrollment and screening. CMS has taken steps to  support and oversee states’ efforts to enroll and screen providers for  participation in Medicaid. For example, CMS has published guidance  regarding the enhanced provider screening and enrollment  requirements under PPACA. CMS has also conducted site visits to  assist states with challenges in implementing these requirements, and  has provided education, outreach, and assistance to states through  webinars, training calls, an optional data compare service, and other  means, according to CMS.
In addition, CMS estimates the rate of improper payments in Medicaid,  and provides information, guidance, and technical assistance to states.  CMS’s Medicaid Payment Error Rate Measurement (PERM) program  estimates improper payments in Medicaid in three component areas: (1)  fee-for-service claims, (2) managed care, and (3) eligibility. CMS  calculates a national Medicaid improper payment rate, as well as  improper payment rates for each state.
CMS also provides states with information and opportunities for  collaboration with the federal government and other states in a number of  ways, including through Medicaid Fraud, Waste and Abuse TAG  meetings; quarterly teleconferences with regional program integrity  directors; and webinars (separate from the training webinars of the MII)  for state Medicaid program integrity staff on topics such as the use of the  CMS Fraud Investigation Database. To support state program integrity  efforts, CMS issues guidance and publishes educational toolkits for  providers and beneficiaries and toolkits for state program integrity  officials. Toolkits for state program integrity officials address issues such as frequent findings from state program integrity reviews in the area of  provider enrollment, provider payment suspension, and assessing data  analytic capabilities. CMS also provides technical assistance in  response to states’ needs, such as responses to state inquiries about  specific program integrity areas and suggestions for resources to help  address states’ program integrity concerns.
section_title: CMS Tailors Its Focused Reviews of State Program Integrity Efforts to Managed Care and Other High-Risk Areas
paragraphs: CMS has tailored its focused program integrity reviews to states’  managed care delivery systems and other areas that are at high risk for  improper payments. CMS also recently began using targeted off-site desk  reviews of certain state program integrity efforts to expand its oversight  efforts.
subsections: section_title: CMS’s Focused Reviews Have Emphasized Oversight of Managed Care and Other High-Risk Areas
paragraphs: From fiscal years 2014 through 2016, CMS conducted focused reviews of  state program integrity efforts in 31 states, reviewing 10 or 11 states  annually. CMS reviewed one or two high-risk areas per state, including  states’ oversight of managed care plans in 28 states. (See table 1.) CMS  selected which states to review based on factors such as whether a state  contracted with a managed care plan to deliver services, and when the  agency last conducted a program integrity review in a state.
For each state, CMS tailored its focused reviews to the states’ managed  care plans and relevant other high-risk areas including provider  enrollment and screening, personal care services, and non-emergency  medical transportation. CMS identified these areas based on its  assessment of high-risk program integrity areas nationwide and on input  from state officials about important program integrity issues.
Managed care. CMS assessed state oversight of managed care  plans, and the program integrity activities of selected managed care  plans that delivered services to Medicaid enrollees. For example,  CMS reviewed state efforts to ensure plan compliance with  contractual requirements for program integrity activities, and reviewed  plans’ procedures for identifying, recovering, and reporting on  overpayments made to providers.
Provider enrollment and screening. CMS examined state  implementation of enhanced provider enrollment and screening  requirements under PPACA. For example, CMS reviewed whether  states checked certain federal databases to determine providers’  eligibility to participate in Medicaid fee-for-service programs, and  whether they terminated the participation of providers that had been  revoked by Medicare or terminated by Medicaid and Children’s Health  Insurance Program (CHIP) programs in other states.
Personal care services. CMS assessed the extent of state oversight,  including state processes for enrolling providers and monitoring  services provided.
Non-emergency medical transportation. CMS assessed the extent  of state oversight and the program integrity activities of organizations  that provide non-emergency medical transportation services.
State Comments on CMS’s Focused State  Program Integrity Review   Officials from one state said CMS’s focused  review was a “huge improvement” over the  prior approach.  In the past they felt CMS  reviewed too many issues with no depth, and  there was a large burden on staff.  In contrast,  the focused review was in-depth and involved  “tremendously less work” for staff.  As a result  of the review, officials felt CMS understood  how their state operated and that CMS was  “on our side,” and state officials “absolutely”  saw benefits from the review.
CMS and state officials we spoke with told us that the tailored oversight of  CMS’s focused reviews has been beneficial and helped identify areas for  improvement. According to CMS officials, the reviews have allowed CMS  to focus in-depth on important program integrity vulnerabilities, and have  been less of a burden on state staff. Five of the eight states we selected  had a focused review in fiscal year 2014 or fiscal year 2015. Officials from  all five states said that CMS’s tailored approach was an improvement  over the agency’s prior approach. They noted that CMS tailored the  reviews to high-risk areas that were appropriate for their states, and that  within each of those high-risk areas, CMS had focused on issues that  were important to their program integrity efforts. State officials indicated  that while the focused reviews still took a substantial amount of staff time,  they were less of a burden on staff and they got feedback from CMS in a  timely way. In addition, officials in two states added that they felt that  CMS was now working with them more in partnership to address any  vulnerabilities; they also appreciated that CMS shared feedback about  what their states were doing well and did not focus solely on where their  states needed to improve.
CMS and state officials shared examples of how the focused reviews  were beneficial to their program integrity efforts in their specific high-risk  areas.
Managed care reviews. CMS officials said that they found substantial  variation across states’ managed care programs, but that their  reviews identified some common issues, such as a low number of  investigations conducted by managed care plans and a low amount of  recoveries by plans. As a result, CMS officials recommended that  states take steps to improve their oversight of plans. Officials from all  four states we selected where CMS reviewed managed care  programs cited benefits. For example, officials from three states noted  that the meetings with CMS and managed care plan officials helped  them learn more about the plans’ program integrity efforts. Further,  officials from three states said that CMS’s review gave them leverage  in dealing with managed care plans or led plans to focus more on  program integrity. Officials in one state noted that CMS provided  helpful recommendations for how to improve state oversight of  managed care plans, including plans’ fraud referrals.
Provider enrollment and screening. CMS officials said that their  fiscal year 2014 reviews in this area found that many states were not  meeting requirements for checking certain federal provider databases  or had not made much progress revalidating provider enrollment.  CMS officials said they have since worked with states and there has  been substantial improvement. State officials said that the reviews  helped identify areas where they could improve. In addition, officials  from one state whose focused review had not included provider  enrollment and screening said they were concerned about this area,  and that it would be helpful for CMS to review their provider  enrollment and screening processes to help the state identify what  they are doing well and what they need to improve.
Personal care services and non-emergency medical  transportation. CMS officials said they generally found a lack of  sufficient state oversight of personal care services and non- emergency medical transportation, and recommended states take  action. For example, in one state, CMS found that there were limited  program integrity requirements in the state’s contract with the  organization that conducts program integrity activities related to  personal care services. The contract did not require oversight that  involved unannounced visits of personal care service providers, or  provide sufficient direction about the re-enrollment of those providers.  We spoke with officials in one state where CMS had reviewed  personal care services. The state officials noted that this is a high-risk  area in their state, and that due to CMS’s review, they would pay  increased attention to certain vulnerabilities. These state officials  added that CMS’s focused reviews can help bring program integrity  vulnerabilities to the attention of state Medicaid staff responsible for  administering the program, not just their program integrity staff.
Although officials from our selected states generally had positive  feedback about CMS’s focused reviews, some identified areas where  CMS could make improvements. For example, officials in two states said  that some CMS reviewers did not sufficiently understand aspects of the  states’ program or policies. In one state, this created delays during the  on-site portion of the review as state officials spent time clarifying reasons  for certain state practices. Those officials suggested that CMS ensure  that all of their reviewers are knowledgeable about the state by allowing  more time for state officials to clarify state policy with all CMS reviewers  before they arrive on-site. Officials with one state said that CMS could  enhance the reviews by including state Medicaid Fraud Control Unit staff  as part of their interviews about state program integrity issues.
CMS officials told us that they plan to continue conducting focused  reviews related to managed care and personal care services in fiscal year  2017.
section_title: CMS Uses Targeted Desk Reviews to Expand Oversight of High-Risk Areas
paragraphs: To expand its oversight to conduct more frequent reviews of states, CMS  recently began supplementing its focused reviews with targeted desk  reviews—off-site reviews of certain program integrity efforts designed to  address high-risk areas. According to CMS officials, CMS has conducted  desk reviews of one or more efforts in 40 states in 2016. Desk reviews  are intended to allow the agency to address additional potential  vulnerabilities, and assess and assist more states each year, thus  reviewing states more often than would otherwise be feasible using on- site focused reviews alone.
For this first year of desk reviews, CMS officials targeted four program  integrity efforts it determined important to mitigating risks and selected  states based on a range of factors, including whether a state had recently  had an on-site focused state program integrity review and whether a state  had an active state Recovery Audit Contractor contract. In particular,  CMS assessed how states implemented corrective action plans from the  PERM program and state program integrity reviews, states’ use of  Recovery Audit Contractors, or whether states had terminated certain  providers from participating in Medicaid or CHIP. (See table 2.) The desk  reviews were in progress in 2016, and CMS planned to conduct desk  reviews in these same four areas in 2017. CMS officials said they will  assess the results of their focused reviews and new desk reviews to see  whether this combined approach is an effective and efficient strategy for  overseeing and assisting states, and whether they could make  improvements for future reviews.
section_title: Collaborative Audits Identified Substantial Potential Overpayments, but Some States Reported Barriers to Audit Participation and Success
paragraphs: Collaborative audits identified substantial potential overpayments to  health care providers. However, some states cited investment of staff  time without commensurate benefit and communication issues as barriers  to audit participation and success.
subsections: section_title: Collaborative Audits Continue to Identify Substantial Potential Overpayments, but State Participation Varied
paragraphs: States’ collaborative audits with MICs have identified a substantial  amount of potential overpayments to providers in recent years.  Overpayments identified by collaborative audits increased from $2 million  in fiscal year 2012 to $36 million in fiscal year 2015. (See fig. 1.)  According to CMS officials, the increase in overpayments identified by  collaborative audits was due to improved data, improved engagement  and collaboration with states, increased state participation in audits, and  to greater experience with targeting and conducting these audits.
CMS encourages states to use collaborative audits, but states determine  whether to have collaborative audits. CMS officials noted that they  educate states on how MICs can provide audit assistance, conduct  outreach to explore states’ interest in pursuing collaborative audits, and  sometimes suggest that states consider certain types of audit targets. For  example, CMS officials said that they have encouraged additional states  to consider collaborative audits of hospice providers, based on prior  collaborative audits that were successful in identifying overpayments to  hospice providers. CMS does not require states to have collaborative  audits, and while in the past the agency has independently identified and  assigned MICs to conduct audits in states, it does not do so for  collaborative audits.
Although most states have participated in a collaborative audit, we found  that states’ use of audits varied significantly—and many states have had  few or no new collaborative audits assigned in recent years. Overall, 41  states had at least one collaborative audit assigned from fiscal year 2012  through June 2016, and the remaining 11 states had none. (See fig. 2.)  Collaborative audits vary in their scope, complexity, and results, thus the  number of audits in a state does not necessarily indicate the amount of  contractor and state resources needed to complete the audits, or reflect  the total amount of potential overpayments identified. However, these  data illustrate states’ widely varying use of collaborative audits.
Nearly all collaborative audits have been of Medicaid fee-for-service  providers, but CMS would like to expand the use of these audits to  examine services delivered under managed care. CMS officials told us  that in three states there have been 14 collaborative audits of providers  that are part of Medicaid managed care networks. There has also been a  collaborative audit of a managed care organization in one of those states.  CMS officials said they are looking to build on these experiences and  expand the use of audits in managed care environments. Officials from  one state we spoke with said they discussed having collaborative audits  of managed care network providers, but that there were challenges with  how to select audit targets and conduct the audits, partly because they  would be relying on different types of data—managed care encounter  data—rather than fee-for-service data.
section_title: Several States Had Positive Collaborative Audit Experiences, While Others Reported Barriers that May Limit Audit Participation and Success
paragraphs: Officials from the eight states we interviewed reported mixed experiences  with and interest in collaborative audits. Three states had positive  experiences with collaborative audits and were likely to seek future  audits. Two states had prior or ongoing collaborative audits, but were  unlikely to seek future audits due to negative audit experiences. Two  other states had not sought or participated in collaborative audits and  were unlikely to seek them in the future. The remaining state had sought  its first collaborative audits and was waiting for CMS approval to proceed.  States’ negative audit experiences and reluctance to seek collaborative  audits may limit CMS’s ability to fully leverage federal contractors to  identify and recover improper payments in the future.
One State’s Positive Experience with  Collaborative Audits  Officials from one state said their audit efforts  “would not be complete” without their MIC  supplementing the state’s own staff and audit  efforts. This state used their MIC for “single  issue” audits focusing on specific areas, which  state officials said was more efficient than  doing audits on a wider range of topics.
Officials from the three states with positive collaborative audit  experiences said the MICs were valuable partners that had augmented  their states’ audit resources and identified substantial overpayments to  providers that posed program integrity concerns. Officials noted that  collaborative audits allowed them to target audits to their specific needs,  which in their view was a significant improvement over the earlier non- collaborative audit model. For example, officials in one state said that  their MIC conducted collaborative audits in areas where the state had its  own audits, but needed additional support, as well as audits in areas  where the state did not have experience or expertise. The state’s  collaborative audits identified over $5 million in potential overpayments in  fiscal years 2014 and 2015. Another state’s first two collaborative audits  identified over $2 million in potential overpayments related to personal  care services in fiscal year 2015. All three states were likely to seek future  collaborative audits.
One State’s Negative Experience with  Collaborative Audits  Officials from one state found the audits had  only limited success in identifying improper  payments, and led to “an excessive amount”  of administrative burden for state staff.  Officials said their MIC did not communicate  sufficiently about audits, and that they did not  always agree with the MIC’s findings. they noted problems with collaborative audits. In particular, officials in  both states said that it took a substantial amount of time for state staff to  work with the MICs on the collaborative audits. These officials also  indicated that their MICs had not communicated with them sufficiently  about the collaborative audits. Officials from one of the states said the  audits had limited success in identifying overpayments. Officials from the  other state reported barriers to completing audits of high-risk providers  where they expected to identify overpayments. For example, officials said  that insufficient MIC staff and other factors led to lengthy audit delays. As  of May 2016, the six collaborative audits that began in this state in 2014  had not all been finalized, preventing the state from collecting  overpayments in a timely way. Further, some providers went out of  business before the audits were complete, preventing this state from  recovering any overpayments. CMS officials stated that they work  closely with states to determine audit plans and timeframes, but  acknowledged that sometimes issues arise during audits or the appeals  process that can create challenges.
Officials from the two states that had not sought collaborative audits said  that the potential burden on staff, MICs’ lack of familiarity with state  programs or policy, and communication concerns were among the  barriers that made them unlikely to seek collaborative audits. Officials  said they believed that collaborative audits would lead to a burden for  state staff without commensurate benefits and preferred to conduct audits  themselves. Officials from one state said they had a well-established  audit department with staff familiar with the state’s programs and  regulations, and it would not be worth the effort to have those staff work  with MICs on audits and deal with any resulting provider appeals. Officials  in the other state said that their MIC had not taken the time to understand  the state’s program and policies, and had approached the state with audit  ideas geared more to Medicare or to another state. They also said the  fact that the MIC would report potential program integrity vulnerabilities— and any resulting findings—to CMS, rather than communicating primarily  with the state, limited their interest in collaborative audits. These officials  said improvements in collaboration and communication might increase  their interest in having audits.
Finally, one state had requested its first collaborative audits, in which they  expected to identify substantial overpayments, but had encountered  delays in obtaining CMS approval to start. These state officials said they  began collaborating with their MIC on potential pharmacy audit targets in  November 2015, but as of June 2016, were waiting for CMS approval to  proceed with finalizing their agreement with the MIC to conduct the  audits. CMS officials told us that they had not approved these audits  because they did not want the MIC to start audits and then have to  transfer them to the UPIC. CMS officials said they have since had  conversations with this state about these audits and the role of the UPIC.
States’ varying experiences with collaborative audits indicates that there  are opportunities for CMS to build upon its experience with these audits,  and enhance its collaboration with states and contractors on future audits.  Collaborative audits have been driven by states’ interest in and capacity  for audits, and CMS’s collaborative approach to audits has yielded  benefits for some states. However, four states we spoke with described  barriers—such as staff burden, problems with MIC availability, or  communication issues—that prevented them from seeking collaborative  audits or from having audits that yield sufficient benefits. Federal internal  control standards indicate that organizations should identify, analyze, and  respond to risks related to achieving objectives. CMS officials involved  with collaborative audits said they had refined the collaborative audit  program over time and that they would continue to explore ways to  improve their audit support for states. CMS expects to continue the  collaborative approach to audits. It is too soon to tell how states will  view the collaborative audits once the transition to UPICs is complete,  and whether states will encounter barriers similar to those that states  reported to us. Unless CMS can successfully address the potential  barriers encountered by states, some states may choose not to pursue  collaborative audits—or may pursue audits only to encounter challenges  that were not effectively minimized or prevented. In both cases, states  and CMS may not identify and recover additional overpayments. As such,  CMS might be missing opportunities to better align collaborative audit  efforts with states that could benefit from them.
section_title: The Medicaid Integrity Institute Is an Important Training Resource, but State Demand Exceeded Institute Capacity
paragraphs: The MII is an important source of program integrity training for many  states; however, states’ demand for MII courses frequently exceeded the  institute’s capacity. In fiscal year 2015, the MII hosted participants from all  states; the number from each state ranged from 2 in Puerto Rico to 54 in  Florida. (See fig. 3.) Officials in all eight of our selected states identified  the MII as one of their main resources for program integrity training.  Officials from two of these states noted that their program integrity staff  would have no or limited access to training without the MII.
The MII course offerings are generally well received by the states and  participants. Of the eight selected states, officials in six states said that  the MII courses aligned well with their program integrity needs, and the  MII obtained state input regarding courses to offer. Officials from the two  other states indicated that MII courses do not always align with their  current needs.
The Value of the Medicaid Integrity  Institute to Attendees  One course participant commented that the  training offered at the MII is the only job  training they receive as program integrity  professionals, besides on the job training, and  the opportunity to attend these trainings has  made the participant a more valuable  employee.
The Benefit of the Medicaid Integrity  Institute  Officials from one state told GAO that the  networking opportunities that present  themselves at the MII allow program integrity  staff to establish a network of resources that  they can leverage once they have completed  the training; state staff often reach out to  people they have met at the MII, so the  benefits last well beyond the actual training  dates.
One of the important benefits of the MII reported by state officials and  course participants in their course evaluations is the opportunity to meet  with and learn from program integrity officials from across the country.  Learning occurs on a formal and informal basis while on-site at the MII. In  the classroom, participants learn from state officials who serve as faculty  for the MII courses, and from each other through in-class discussions.  While on-site at the MII, there are also informal opportunities for  information sharing that can lead to further state-to-state collaboration.  According to one state official we spoke with, when serving as MII faculty  he discussed a problematic provider in his state. A participant recognized  that they had a similar issue in their state. As a result of this conversation,  the state official and participant learned that it was the same provider and  a multi-state investigation resulted in the provider’s arrest. State officials  in our sample also noted that collaboration and sharing continues once  they leave the MII. Officials in one state mentioned the benefit of being  on-site at the MII is that it is a safe place to raise program integrity  questions and concerns without the fear of that resulting in a CMS audit.
From fiscal year 2014 to fiscal year 2016, states’ demand for their staff to  attend MII courses was high and frequently exceeded the institute’s  capacity. Officials from six of our selected states indicated that they would  like to send more program integrity staff to the MII, but are limited by the  courses offered and MII’s limit on how many staff states can nominate to  attend. Further, officials in three of these states said that they wanted  additional staff to attend the certification courses, and one state official  observed that due to high demand it might take several nominations  before one of their staff is accepted into a course. The MII maintains a  waitlist for each class with open enrollment. All but one course with open  enrollment offered in fiscal year 2015 had a waitlist with between 2 to 41  potential participants on it. Currently, if an individual is unable to attend a  course, the open space is transferred to the next individual on the  waitlist—who is not necessarily from that same state. MII officials said  that they use the waitlist to fill spaces due to cancellations in the order on  the list, precluding them from simply replacing cancellations with other  nominees from the same state. Officials from one state, however, said  that—in the event of an unexpected cancellation for a reserved slot—the  state should be able to send a replacement.
States’ Demand for Medicaid Integrity  Institute Exceeds Capacity  Officials in one state said it would be helpful to  be able to have more than one or two people  attend per class to benefit from what is being  taught, so they would send more people to  the MII if they could.
MII officials are aware of the demand for the MII offerings, but were  limited in their ability to expand their capacity by classroom space  constraints and staffing vacancies in fiscal year 2016. These constraints  also limited the number and types of courses and webinars the institute  could offer. MII officials noted that their fiscal year 2016 schedule  included many “core” courses, such as Coding for Non-Coders and  Managed Care Oversight Seminar (each offered twice) because the MII  did not have staff to develop new courses. For example, the Pharmacy  Symposium course was cancelled, because they did not have staff to  develop the course. For fiscal year 2017, CMS officials indicated that  there are 23 planned courses, and many of the courses contain updated  agendas and course content. There will be courses focused on managed  care oversight, provider audits, and provider enrollment, which will include  opportunities to share best practices, among other things. CMS officials  said that the courses on emerging trends in Medicaid will focus on  personal care services and beneficiary fraud.
MII began webinar offerings in fiscal year 2011, with the goal of  expanding MII capacity and bringing course content to a larger audience.  However, the number of webinar offerings in fiscal year 2016 was also  limited by MII staffing vacancies. MII officials indicated that they are in the  process of hiring someone to expand their webinar offerings in fiscal year  2017 and beyond to try to meet states’ demand for courses. States  reported finding the webinars useful, as they can cover timely topics,  reach a wider audience than the on-site courses, and do not require staff  to travel to participate. However, state officials find that the webinar  format is not as effective in encouraging questions and discussion as the  on-site offerings, and they cannot replicate the benefits of the face-to-face  interactions that occur at the MII.
section_title: CMS Lacks a Systematic Approach to Collecting and Communicating States’ Promising Program Integrity Practices
paragraphs: CMS uses focused state program integrity reviews as its primary method  of collecting and communicating promising program integrity practices;  however, these practices are not collected in a consistent manner and the  published reports are not timely nor easily searched electronically. Other  mechanisms for collecting and sharing promising practices are available,  but CMS designed them for other purposes and does not use them to  broadly communicate promising practices.
subsections: section_title: Focused Review Reports Do Not Always Include Promising Program Integrity Practices and Are Not Easily Searched
paragraphs: CMS uses its focused reviews to collect and report promising program  integrity practices, but these reviews do not result in the systematic  inclusion of promising practices in state program integrity review  reports. Both CMS and the states have a role in ensuring that promising  program integrity practices are identified, collected, and shared.
According to CMS officials, its focused reviews of state program integrity  activities are their primary method of collecting states’ promising  practices; however, the number of CMS- and state-identified promising  practices included in these reports has declined from fiscal years 2013 to  2015. In the course of the review, CMS officials may or may not learn  about a state’s promising practices through direct observation, input from  the state, or prior experience with the state. In addition, CMS officials said  that individuals who perform the reviews ask states to identify promising  practices. Yet, officials from only one of the five states in our sample that  CMS reviewed in fiscal year 2014 or fiscal year 2015 said reviewers  asked them to identify promising practices.
In addition, due to the timing of the state program integrity reviews, CMS  may not be aware of the promising program integrity practices that states  implement in intervening years. According to CMS officials, the  combination of focused and desk reviews allows CMS to review more  states more often. However, the focused reviews do not cover as many  topic areas as prior reviews and desk reviews are scoped narrowly on  specific areas of interest. It is not clear that CMS officials would be  exposed to the full range of promising state practices. The number of  state reviews that include promising practices has decreased significantly,  from almost 80 percent of the published reviews in fiscal year 2013, to 25  percent in each of fiscal years 2014 and 2015. As such, CMS may not be  aware of the full range of promising practices that exist in states’ varied  environments. Federal internal control standards stipulate that  management should use quality information and externally communicate  the necessary quality information to achieve the entity’s objectives.
CMS publishes any identified promising program integrity practices in the  focused review reports, which are intended to help promote promising  practices among states. However, these reports are not a timely  mechanism for sharing the practices, in part, because of the intervals  between the reviews and publication. Although CMS officials said they  are working to reduce the time it takes to complete and publish the  focused review reports, the agency recently reported that the process still  took 278 days, on average, in fiscal year 2015, down from 489 days in  fiscal year 2014. Summaries of the state reviews, which include a section  on promising practices, are further delayed. For example, the most recent  summary was published in June 2014, and it included promising practices  identified from December 1, 2011 through December 31, 2012, and CMS  officials could not say when a more updated version would be published.  CMS officials said they are exploring ways to disseminate promising  practices faster than the current reports allow. These delays can mean  that identified promising practices may be outdated or no longer relevant  by the time the report is published. For example, officials in one state said  that the promising program integrity practice identified in their most recent  review was no longer being used by the time their state report was  published.
Once published, the usefulness of these focused review reports to  communicate promising practices broadly to all states is limited by the  inconsistent inclusion of promising practices, and the inability to search  electronically across published reports or view all promising practices in a  single location. Of the reports published in fiscal years 2014 and 2015, 4  of 16 reports included promising practices; when reports do not include  promising practices is it unclear why. Currently, there is no search  function or index to easily find practices that relate to a specific interest  among the published reports; the only approach is to review each  published report to see whether there are any identified practices relevant  to a state. Officials from three of the eight selected states we interviewed  said that they use these reports to learn about promising program  integrity practices; the remaining five states did not comment on using  these reports for this purpose. All states referred to other mechanisms  that they use to learn about practices that have been effective in other  states.
section_title: CMS Does Not Broadly Communicate Promising Practices Identified through Other Mechanisms
paragraphs: Beyond focused reviews, CMS officials said that they identify and  communicate promising practices through a number of other  mechanisms, such as the MII, Medicaid Fraud, Waste and Abuse TAG  calls, Regional Information Sharing System, technical assistance to the  states, and mass email distributions; however, for the most part, these  mechanisms were not designed for the purposes of sharing promising  practices, and none ensures that information about promising practices is  communicated broadly to all states. Further, several mechanisms are  limited in their distribution, and, as a result, the promising practices might  not reach all relevant program integrity staff. While states have an interest  in learning about promising practices used in states other than their own,  the eight states in our sample did not have a uniform understanding of  how to systematically share or access information about promising  practices.
Medicaid Integrity Institute: State officials in seven of our eight selected  states said that attending the MII helped them learn about promising  program integrity practices used in other states, which is a part of CMS’s  intent for some of the offered courses. While the MII is a useful resource  for attendees—and state staff can, and in some cases are required to,  share the knowledge they learned with their colleagues when they  return— the information presented may not reach all state audiences that  could benefit. Specifically, there are limits to the number of state staff who  can participate in on-site MII courses, and participation and sharing is  dependent on states’ staff being able to take part in relevant classes as  participants or faculty.
Regional Information Sharing System: The Regional Information  Sharing System is DOJ’s secure, web-based system for information  sharing between state officials. It is intended to be a safe space where  state program integrity staff can discuss relevant issues without CMS  monitoring them. According to CMS officials, the Regional Information  Sharing System is a way CMS shares promising practices among state  program integrity staff. According to CMS officials, as of December 2016,  there were approximately 360 Regional Information Sharing System  users in the states. However, actual use by Regional Information Sharing  Systems users is unknown. Officials in one state thought that the  Regional Information Sharing System was not consistently used by all  states. No states in our sample identified the Regional Information  Sharing System as one of the ways that they identify promising practices,  although officials in one state did note that they use it to share promising  practices with other states.
Medicaid Fraud, Waste and Abuse TAG calls: CMS officials reported  that the monthly Medicaid Fraud, Waste and Abuse TAG calls between  CMS, MII, and senior state officials are a venue for discussing promising  state practices, among other program integrity issues. CMS officials said  they work with states to develop TAG call presentations and content that  helps states with program integrity administration. Officials from six of our  selected states said the calls were useful in helping them learn about  promising practices. However, topics that are discussed are dependent  on CMS and the specific state individuals participating in the call.  Medicaid Fraud, Waste and Abuse TAG calls are voluntary, and the  information shared might not always reach a wide range of state program  integrity officials.
Technical assistance to states: CMS shares relevant promising  practices when it responds to states requesting technical assistance.  CMS officials said that they are providing an increasing amount of  technical assistance—responding to 26 inquiries in the first quarter of  fiscal year 2016 to 96 inquiries in the fourth quarter. CMS officials  indicated that they rely on staff experience and knowledge of state  practices to make timely and relevant referrals.
Other mechanisms: CMS officials told us that they use mass email  distributions to share new policies, guidance, and best practices. When  we asked state officials in our eight selected states about other  mechanisms for sharing, they reported learning about and sharing  promising practices through online toolkits, at the annual National  Association for Medicaid Program Integrity conference, direct outreach to  other states, and issuing press releases and reports.
Although CMS has a variety of mechanisms to share promising program  integrity practices, states may not be able to easily and efficiently identify  relevant practices, because they would need to monitor multiple  communication mechanisms to ensure that they are receiving all  potentially relevant information. Officials in one state said that while they  do what they can to learn about promising practices from other states,  CMS could do more to share practices and help states to learn about  what is working well in other states. This statement is consistent with  federal internal control standards that stipulate that agencies should use  quality information to achieve the entity’s objectives and externally  communicate necessary quality information. Despite CMS’s various  efforts, none of these other communication mechanisms has a  consistently broad reach and the agency does not have a well-understood  communication strategy for using these mechanisms. As such, CMS is  missing an opportunity to support states’ program integrity efforts by  making the range of potential solutions across states broadly known to  states in a timely and efficient manner.
section_title: Conclusions
paragraphs: CMS has taken a number of important steps to tailor and improve its  oversight and support of states’ Medicaid program integrity efforts. CMS’s  use of focused reviews to address oversight of managed care plans and  other high-risk areas has been beneficial, and generally an improvement  over the agency’s earlier approach. It is too soon to tell how effective  CMS’s new desk reviews will be in enhancing oversight, but CMS plans to  assess how well these two types of reviews, together, meet the agency’s  needs and whether additional changes could be useful.
CMS’s shift to collaborative audits has helped identify a substantial  amount of potential overpayments and has yielded important benefits for  some states, including those who told us they viewed collaborative audits  as an important part of their program integrity efforts. Some states’  negative experiences with or reluctance to seek collaborative audits,  however, highlight potential areas of improvement as CMS transitions  Medicaid audits to the new UPICs. It is too soon to tell how and whether  the UPIC program will address states’ needs and the barriers we  identified, such as burden on state staff and communication issues.  However, our findings illustrate that there are opportunities for CMS to  build on both the successes and challenges states have experienced in  collaborative audits to help enhance its collaboration with states and  UPICs as it implements and oversees this new program. There are  opportunities, for example, for collaborative audits to help enhance  oversight of managed care expenditures.
Both CMS and the states have a role in identifying promising program  integrity practices that can be shared in order to help improve oversight of  the Medicaid program. Efforts that are based in the states—such as the  Regional Information Sharing System—are not used consistently. CMS’s  methods of collecting and communicating states’ promising program  integrity practices have not always been systematic, and often are limited  in their reach to state officials. Given the increasing improper payment  rate in Medicaid, it is in the interest of both CMS and the states to identify  and share practices that show promise in reducing improper payments in  as efficient a manner as possible. CMS could take a more centralized role  in collecting and communicating promising practices, providing a forum  through which states could learn about what is working well in other  states and consider whether such practices might succeed in their own  states.
section_title: Recommendations for Executive Action
paragraphs: To build upon CMS’s collaborative audit efforts and help enhance future  collaboration, CMS should identify opportunities to address barriers that  limit states’ participation in collaborative audits. Such opportunities could  include improving communication with states before, during, and after  audits are completed; and ensuring that audits align with states’ program  integrity needs, including the need for oversight of services provided in  managed care delivery systems.
To better support states’ efforts to reduce improper payments and  communicate effective program integrity practices across the states, CMS  should collaborate with states to develop a systematic approach to collect promising state program  create and implement a communication strategy for sharing promising  program integrity practices with states in an efficient and timely  manner.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS and DOJ for their review and  comment. In written comments, HHS concurred with our  recommendations. With regard to our recommendation that CMS identify  opportunities to address barriers that limit states’ participation in  collaborative audits, HHS noted that it continually seeks to collaborate  with states on Medicaid provider audits, and seeks to work through issues  so that actions to identify potentially improper payments may proceed.  HHS added that as it transitions its anti-fraud work from the MICs and  other contractors to the new UPICs, there will be opportunities for  improving communication with states and aligning MIC audits with states’  program integrity needs. With regard to our recommendations that CMS  collaborate with states on both collecting and sharing promising program  integrity practices, HHS said it would work to systematize the collection of  promising state program integrity practices, and to share such practices  with states in an accelerated manner. HHS noted that it is strongly  committed to program integrity efforts in Medicaid, and has a wide variety  of activities to oversee and support states’ Medicaid program integrity  efforts. HHS’s written comments are reproduced in appendix II. HHS also  provided technical comments, which we incorporated as appropriate. DOJ  did not provide formal written comments, but provided technical  comments, which we incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff that made key contributions to  this report are listed in appendix III.
section_title: Appendix I: Medicaid Integrity Institute Attendance for Fiscal Year 2012 through Fiscal Year 2015, by State
paragraphs: Rico, which we collectively refer to as “states.”
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Leslie V. Gordon (Assistant  Director), Robin Burke (Analyst-in-Charge), Drew Long, Emily Loriso, and  Elizabeth A. Miller made key contributions to this report. Also contributing  were Vikki Porter and Jennifer Whitworth.
section_title: Related GAO Products
paragraphs: Medicaid Program Integrity: Improved Guidance Needed to Better  Support Efforts to Screen Managed Care Providers. GAO-16-402.  Washington, D.C.: April 22, 2016.
Medicaid and CHIP: Increased Funding in U.S. Territories Merits  Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April  8, 2016.
Medicaid: Additional Actions Needed to Help Improve Provider and  Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14,  2015.
Medicaid Information Technology: CMS Supports Use of Program  Integrity Systems but Should Require States to Determine Effectiveness.  GAO-15-207. Washington, D.C.: January 30, 2015.
Medicaid Program Integrity: Increased Oversight Needed to Ensure  Integrity of Growing Managed Care Expenditures. GAO-14-341.  Washington, D.C.: May 19, 2014.
Medicaid: CMS Should Ensure That States Clearly Report  Overpayments. GAO-14-25. Washington, D.C.: December 6, 2013.
Medicaid: Enhancements Needed for Improper Payments Reporting and  Related Corrective Action Monitoring. GAO-13-229. Washington, D.C.:  March 29, 2013.
Medicaid Integrity Program: CMS Should Take Steps to Eliminate  Duplication and Improve Efficiency. GAO-13-50. Washington, D.C.:  November 13, 2012.
National Medicaid Audit Program: CMS Should Improve Reporting and  Focus on Audit Collaboration with States. GAO-12-627. Washington,  D.C.: June, 14, 2012.