Patient Protection and Affordable Care Act: Results of Enrollment Testing for the 2016 Special Enrollment Period
Published: 2016-11-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Under PPACA, consumers can enroll in health insurance coverage, or change from one qualified health plan to another, through the federal and state marketplaces either (1) during the annual open enrollment period or (2) outside of the open enrollment period, if they qualify for an SEP. A consumer may qualify for an SEP due to specific triggering events, such as a nonvoluntary loss of health-care coverage. CMS reported that 1.6 million individuals made a plan selection through an SEP in 2015.
GAO was asked to test marketplace enrollment and verification controls for applicants attempting to obtain coverage during an SEP.
This report describes the results of GAO attempts to obtain subsidized qualified health-plan coverage during the 2016 SEP in the federal marketplace and two selected state-based marketplaces—California and the District of Columbia.
To perform the undercover testing of enrollment verification, GAO submitted 12 new fictitious applications for subsidized health-insurance coverage outside of the open enrollment period in 2016. GAO's applications tested verifications related to a variety of SEP triggering events. The results cannot be generalized to all enrollees.
GAO provided a draft of this report to CMS and the selected state agencies. In their written comments, CMS and the states reiterated that they are not required to verify an SEP event and instead rely on self-attestation. However, prudent stewardship and good management practices suggest that fraud risks be understood and managed to protect public funds.
section_title: What GAO Found
paragraphs: The Patient Protection and Affordable Care Act (PPACA) requires that federal and state-based marketplaces verify application information—such as citizenship or immigration status—to determine eligibility for enrollment in a health plan, potentially including a subsidy. However, there is no specific legal requirement to verify the events that trigger a Special Enrollment Period (SEP), which is an opportunity period to allow an individual to apply for health coverage after events such as losing minimum essential coverage or getting married. Prior to the start of GAO's enrollment tests, the Centers for Medicare & Medicaid Services (CMS), which maintains the federal Health Insurance Marketplace (Marketplace), implemented a policy to request that federal Marketplace applicants provide supporting documentation for certain SEP triggering events. According to CMS, ensuring that only qualified applicants enroll during an SEP is intended to prevent people from misusing the system to enroll in coverage only when they become sick. However, relying on self-attestation without verifying documents submitted to support an SEP triggering event, such as those mentioned above, could allow actual applicants to obtain subsidized coverage they would otherwise not qualify for.
The federal and selected state-based marketplaces approved health-insurance coverage and subsidies for 9 of 12 of GAO's fictitious applications made during a 2016 SEP. The remaining 3 fictitious applicants were denied. The marketplaces instructed 6 of 12 applicants to provide supporting documentation, such as a copy of a recent marriage certificate, related to the SEP triggering event; the remaining 6 of 12 were not instructed to do so. For 5 applicants, GAO provided no documents to support the SEP triggering event, but coverage was approved anyway. Officials from the marketplaces explained that they do not require applicants to submit documentation to support certain SEP triggering events. For other SEP triggering events, CMS officials explained that the standard operating procedure in the federal Marketplace is to enroll applicants first, and verify documentation to support the SEP triggering event after enrollment. The officials also noted that all applicants must attest to their eligibility for enrollment.
section_title: What GAO Recommends
paragraphs: GAO is not making any recommendations to the Department of Health and Human Services (HHS) in this report. However, GAO made eight recommendations to strengthen PPACA enrollment controls in a February 2016 report; these recommendations included conducting a fraud-risk assessment of the federal marketplace, consistent with the leading practices described in GAO's framework for managing fraud risks in federal programs. In formal comments on a draft of the February report, HHS concurred with the recommendations and outlined a number of steps it planned to take to implement them. In an April 2016 follow-up letter to GAO, HHS described a number of specific actions it had taken in response to the eight recommendations, such as creating an integrated project team to perform the Marketplace fraud-risk assessment. As of November 2016, GAO considers all eight recommendations to be still open, pending corroborating information, and will continue to monitor CMS's progress in implementing them. Implementing these recommendations by actions such as performing the fraud-risk assessment could help address the control vulnerabilities GAO identified during its most recent SEP tests.

section_title: Letter
paragraphs: The Patient Protection and Affordable Care Act (PPACA) provides  subsidies to those eligible to purchase private health-insurance plans who  meet certain income and other requirements. With those subsidies and  other costs, the act represents a significant, long-term fiscal commitment  for the federal government. While subsidies under the act are generally  not paid directly to enrollees, participants nevertheless benefit financially  through reduced monthly premiums or lower costs due at time of service,  such as copayments. Because subsidy costs are contingent on eligibility  for coverage, enrollment controls that help ensure only qualified  applicants are approved for coverage with subsidies are a key factor in  determining federal expenditures under the act.
Under PPACA, states may elect to operate their own health-care  marketplaces, or may rely on the federally facilitated marketplace, or  Health Insurance Marketplace (Marketplace), often known to the public as  HealthCare.gov. The Centers for Medicare & Medicaid Services (CMS),  a unit of the Department of Health and Human Services (HHS), is  responsible for overseeing the establishment of these marketplaces and  maintaining the federally facilitated marketplace.
Consumers can enroll in health-insurance coverage, or change from one  qualified health plan to another, through the federal and state-based  marketplaces either (1) during the annual open enrollment period or (2)  outside of the open enrollment period, if they qualify for a special  enrollment period (SEP). According to CMS, SEPs are an important way  to ensure that people who lose health insurance during the year or who  experience a major life event have the opportunity to enroll in coverage  through the health-insurance marketplaces outside of the annual open  enrollment period. A consumer may qualify for an SEP due to a major life  event, including if he or she loses health-care coverage, or gains or  becomes a dependent due to marriage, among other circumstances.  CMS reported that, as of March 21, 2016, 1.6 million individuals made a  plan selection through an SEP in 2015 through the HealthCare.gov  platform.
As described below, there is currently no specific legal requirement for  federal or state-based marketplaces to verify the events that trigger an  SEP. However, federal and some state-based marketplaces have begun  to request that applicants submit documents to verify certain SEP events,  as described in greater detail later in this report. According to CMS, this  development is in response to concerns that have been raised about  whether marketplace rules and procedures are sufficient to ensure that  only those who are eligible enroll through SEPs. In this regard, according to CMS officials, it is important to ensure that only eligible consumers can  enroll in marketplace health-care coverage during an SEP as a way of  preventing fraudulent access to the program and deterring potentially  improper payments. Further, according to CMS, ensuring that only eligible  applicants enroll during an SEP prevents people from misusing the  system to enroll in coverage only if they become sick.
In light of the government’s substantial financial commitment under  PPACA, you asked us to examine and test marketplace enrollment and  verification controls for an SEP for the 2016 coverage year. This report,  which is the latest in a series of reports examining various PPACA  enrollment-control issues, describes results of undercover attempts to  obtain subsidized qualified health-plan coverage outside the open  enrollment period for 2016; that is, during an SEP.
To perform our undercover testing on obtaining new coverage during an  SEP, we used 12 fictitious identities for the purpose of making  applications to obtain subsidized qualified health-plan coverage offered  through a marketplace by telephone and online. PPACA requires  marketplaces to verify application information to determine eligibility for  enrollment and, if applicable, determine eligibility for the income-based  subsidies or Medicaid. These verification steps include validating an  applicant’s Social Security number, if one is provided; verifying  citizenship, status as a U.S. national, or lawful presence in the United  States; and verifying household income. The 12 identities were designed  to pass these verification steps by providing supporting documentation— albeit fictitious—such as a copy of the Social Security card, driver’s  license, and proof of income.
We selected states within the federal Marketplace and state-based  marketplaces for our undercover applications, based on factors including  state population and percentage of a state’s population without health  insurance, among other factors. Specifically, we selected two states— Virginia and Florida—that elected to use the federal Marketplace rather  than operate a marketplace of their own. We also selected two state- based marketplaces—Covered California (California) and DC Health Link  (District of Columbia).
The results obtained using our limited number of fictional applicants are  illustrative and represent our experience with applications in the federal  and state-based marketplaces we selected. The results cannot, however,  be generalized to the overall population of applicants, enrollees, or  marketplaces.
Our undercover testing included fictitious applicants claiming to have  experienced an event that would trigger eligibility to enroll in health- insurance coverage during an SEP. Specifically, our 12 fictitious  applicants claimed to have experienced one of the following selected  events that may indicate eligibility, under certain circumstances, to enroll  in health coverage under an SEP: (1) lost minimum essential health  coverage; (2) gained access to new qualified health plans as a result of a  permanent move; (3) gained a dependent through marriage; (4)  experienced an exceptional circumstance, such as a serious medical  condition that prevented the consumer from enrolling during the annual  open enrollment period; (5) nonenrollment during the annual open  enrollment period was unintentional and the result of misinformation or  misrepresentation by a non-exchange entity providing enrollment  assistance or conducting enrollment activities; and (6) Medicaid  application filed during the annual open enrollment period was denied  after the open enrollment period had closed. We tested the six selected  triggering events in the federal Marketplace and the two selected state  marketplaces. We submitted three applications in each state and the  District of Columbia.
We made six of our applications online initially, and six by phone;  however, if, during online applications, we were directed to make phone  calls to complete the process or to mail or fax the application, we acted as  instructed. We also self-attested that the information provided in the  application was true, when instructed. In these tests, we also stated  income at a level eligible to obtain both types of income-based subsidies  available under PPACA—a premium tax credit and cost-sharing reduction  (CSR).
We designed the 12 fictitious applications to provide either no  documentation or fictitious documentation related to the SEP triggering  event, when instructed to do so. As mentioned, for all 12 fictitious  applicants, we submitted supporting documentation related to proof of  identity and income, such as a copy of the Social Security card, driver’s  license, and self-employment ledger. We then observed the outcomes of  the document submissions, such as any approvals received or requests  received to provide additional supporting documentation. For the  applications that were denied, we did not proceed with the appeals  process. A more detailed description of our scope and methodology is  included in appendix I.
After conducting our undercover testing, we briefed officials from the  federal and selected state-based marketplaces. To protect our fictitious  identities, we did not disclose specific applicant identity information. We  also reviewed statutes, regulations, and other policy and related  information.
We conducted our performance audit from May 2016 to November 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
subsections: section_title: Enrolling and Obtaining Health-Care Coverage through an SEP
paragraphs: Consumers can enroll in a PPACA qualified health plan offered through a  marketplace, or change their previously selected qualified health plan,  after the annual open enrollment period concludes if they qualify for an  SEP. Under CMS regulations, a consumer may qualify for an SEP due  to a specific triggering event, and generally would have up to 60 days  after the event to select and enroll in a qualified health plan. Examples of  qualifying events include but are not limited to  losing minimum essential health coverage of the individual or his or  her dependent; gaining a dependent or becoming a dependent through marriage,  birth, adoption, placement for adoption, or placement in foster care, or  through a child-support order or other court order; gaining access to new qualified health plans as a result of a not enrolling during the annual open enrollment period, or other  enrollment period for which the consumer qualified, was unintentional,  inadvertent, or erroneous and is the result of error, misrepresentation,  misconduct, or inaction by the Marketplace or its agents; applying for Medicaid or the Children’s Health Insurance Program  during the open enrollment period, or other enrollment period for  which the consumer qualified, and being determined ineligible after  the enrollment period ended; and demonstrating to the marketplace that the individual meets other  exceptional circumstances as the marketplace may provide.
While PPACA requires marketplaces to verify application information to  determine eligibility for enrollment and income-based subsidies—such as  verifying U.S. citizenship, nationality, or lawful presence—there is no  specific legal requirement to verify the events that trigger an SEP.  Specifically, there is no specific legal requirement that federal or state  marketplaces (1) request documents to support an SEP triggering event or (2) authenticate the documents submitted to support an SEP event to  determine whether those documents are fictitious. According to CMS  officials and state officials, consumers that claim eligibility to enroll during  an SEP must attest under penalty of perjury that they meet the conditions  of eligibility for an SEP.
In February 2016, however, CMS announced plans to begin requesting  supporting documentation to verify certain events that would trigger an  SEP. Specifically, CMS announced its intention to establish a Special  Enrollment Confirmation Process in which consumers who enroll or  change plans using an SEP through the federal Marketplace will be  directed to provide documentation for any of the following triggering  events: (1) loss of minimum essential coverage; (2) permanent move; (3)  birth; (4) adoption, placement for adoption, placement for foster care or  child support or other court order; or (5) marriage. According to the notice,  CMS will provide consumers with lists of qualifying documents, such as a  birth or marriage certificate. In June 2016, CMS announced that it would  begin requesting some supporting documentation beginning on June 17,  2016.
State-based marketplaces are not required to follow CMS’s Special  Enrollment Confirmation Process, but states may choose to follow this  guidance or establish their own processes, according to CMS officials.  States may also choose to accept a consumer’s attestation of the SEP  triggering event without further verification. For example, according to  state officials from Covered California, the state-based marketplace  accepts self-attestation and requests supporting documents for a random  sample of eligible consumers for certain SEP triggering events.  According to officials from the DC Health Benefit Exchange Authority, the  state-based marketplace accepts self-attestation for three of the six SEP  triggering events we tested.
section_title: Prior GAO Reports, Testimonies, and Recommendations Regarding PPACA Enrollment-Fraud Risk Controls
paragraphs: We have previously testified and reported on various aspects of PPACA  enrollment controls as part of our ongoing work in this area. For  example, in July 2014 we testified on our undercover attempts to obtain  health-care coverage offered by the federal Marketplace for coverage- year 2014 using fictitious identities and false documentation. We were  successful in 11 out of 12 attempts to do so. In October 2015, we testified  on similar undercover testing for coverage-year 2015 where we were  successful in 17 of 18 attempts. In February 2016 we issued a report  addressing CMS enrollment controls and the agency’s management of  enrollment-fraud risk. The February 2016 report included eight  recommendations, which are discussed below, to strengthen CMS  oversight of the Marketplace. In September 2016, we issued two reports  and testified about addressing the potential vulnerabilities to fraud in the  application, enrollment, and eligibility-verification controls of the federal  Marketplace and selected state marketplaces for PPACA’s second and  third open enrollment periods, for 2015 and 2016 coverage, respectively.
In our February 2016 report, we recommended that the Secretary of  Health and Human Services direct the Acting Administrator of CMS to: (1)  conduct a feasibility study and create a written plan on actions that CMS can take to monitor and analyze the extent to which data hub queries  provide requested or relevant applicant verification information; (2) track  the value of enrollee subsidies that are terminated or adjusted for failure  to resolve application inconsistencies, and use this information to inform  assessments of program risks; (3) regarding cost-sharing subsidies that  are terminated or adjusted for failure to resolve application  inconsistencies, consider and document whether it would be feasible to  create a mechanism to recapture those costs; (4) identify and implement  procedures to resolve Social Security number inconsistencies where the  Marketplace is unable to verify Social Security numbers or applicants do  not provide them; (5) reevaluate CMS’s use of certain incarceration status  data and determine to either use these data or accept applicant  attestation on status in all cases; (6) create a written plan and schedule  for providing Marketplace call center representatives with access to  information on the current status of eligibility documents submitted to  CMS’s documents processing contractor; (7) conduct a fraud-risk  assessment, consistent with best practices described in GAO’s  framework for managing fraud risks in federal programs, of the potential  for fraud in the process of applying for qualified health plans through the  federal Marketplace; and (8) fully document prior to implementation, and  have readily available for inspection thereafter, any significant decision on  qualified health-plan enrollment and eligibility matters, with such  documentation to include details such as policy objectives, supporting  analysis, scope, and expected costs and effects.
In formal comments on a draft of the report, HHS concurred with our  recommendations and outlined a number of steps it plans to take to  implement them. In an April 2016 letter, HHS described a number of  specific actions it had taken in response to our eight recommendations,  such as creating an integrated project team to perform the Marketplace  fraud-risk assessment. In May 2016, we requested that CMS provide  detailed documentation and other evidence to help corroborate the  various actions described in the HHS letter. As of November 2016, CMS’s  response to this request was pending. Consequently, we consider all  eight recommendations to remain open as of November 2016, pending  corroborating information. We will continue to monitor HHS’s progress in  implementing them. Implementing these recommendations as intended,  such as performing the fraud-risk assessment, could help address some  of the control vulnerabilities we identified during our SEP tests as well.
section_title: Results of Undercover Attempts to Obtain Subsidized Coverage during an SEP
paragraphs: Concerning our current work, the federal or selected state-based  marketplaces approved subsidized coverage for 9 of our 12 fictitious  applicants seeking coverage during an SEP for 2016. Three of our 12  fictitious applicants were denied. Figure 1 summarizes the outcome of the  12 fictitious applications, which are discussed in greater detail below.
The federal and selected state-based marketplaces requested supporting  documentation for 6 of our 12 fictitious applicants who initially applied  online or by telephone seeking coverage during an SEP. On the basis of  our design for the scenario, we provided the federal and selected state- based marketplaces either no supporting documentation or fictitious  documentation related to the SEP triggering event. As described below, in  some instances we provided fictitious documents to the federal and  selected state-based marketplaces to support the SEP triggering event  and were able to obtain and maintain subsidized health coverage. Our  applicant experiences are not generalizable to the population of  applicants or marketplaces.
subsections: section_title: Results of Undercover Attempts to Obtain Subsidized Qualified Health-Plan Coverage from the Federal Marketplace and Selected State-Based Marketplaces during an SEP
paragraphs: The federal or selected state-based marketplaces approved coverage  and subsidies for 9 of our 12 fictitious applicants who initially applied  online or by telephone seeking coverage during an SEP, as of October  2016. For these 9 applications, we were approved for APTC subsidies,  which totaled about $1,580 on a monthly basis, or about $18,960  annually. These 9 applicants also each were approved for CSR  subsidies, putting them in a position to further benefit if they used  medical services. However, in our tests, our fictitious applicants did not  seek medical services.
The federal or state-based marketplaces denied coverage for 3 of our 12  fictitious applicants. Specifically:
One applicant stated that the applicant did not receive any response  from the marketplace after attempting to enroll in a health plan in a  community center in January 2016. This fictitious applicant claimed  that the applicant had applied for coverage to the federal Marketplace  and that the applicant did not discover the applicant was not enrolled  in a health plan until June 2016—about 6 months after the applicant’s  claimed initial contact with the marketplace. The marketplace  representative stated that the applicant needed to follow up with the  marketplace and select a health plan within 60 days of the SEP- triggering event, which in this case was misinformation or  misrepresentation by a non-Marketplace entity providing enrollment  assistance in January of 2016. Under CMS regulations, for this type  of triggering event the marketplace may define the length of the SEP  as appropriate based on the circumstances, up to a maximum of 60  days.
The second fictitious applicant who applied for coverage to the state- based marketplace and was denied coverage claimed that the  applicant initially tried to enroll in January 2016 and was told by a  certified enrollment counselor that the applicant qualified for a high  deductible plan, but did not qualify for a premium tax credit or CSR.  When the applicant followed up with the state-based marketplace to  obtain additional information, the marketplace representative  requested the name of the enrollment counselor with whom the  applicant initially applied for health coverage in January 2016. The  applicant provided the representative with a fictitious enrollment  counselor name and location. The marketplace representative stated  that the marketplace’s application notes show that the applicant  applied outside open enrollment and informed the applicant that the  applicant could submit an appeal to further review the application. The  applicant later received a letter from the selected state-based  marketplace stating that, based on what the applicant told the  marketplace about the event that occurred in June 2016, the applicant  did not qualify for a special enrollment period at that time.
The third fictitious applicant who was denied claimed an inability to  apply for coverage during the open enrollment period because the  applicant experienced a serious medical condition, had been  hospitalized unexpectedly in January 2016, and needed rehabilitation  through May 2016. The federal marketplace representative stated that  the representative could not enroll the applicant in a health plan  outside of open enrollment because the SEP event was an  exceptional circumstance and CMS has to approve enrollment of  these types of SEP triggering events. The representative explained  that the representative would have to submit an escalation to CMS for  our fictitious applicant to be approved to enroll during the SEP. After  the application was escalated, the federal marketplace denied this  application, and a federal marketplace representative we spoke with  stated that the applicant could have applied in November and  December, before the unexpected hospitalization. According to  CMS officials, the federal marketplace makes eligibility determinations  on a case-by-case basis for those applicants who experience an  unexpected hospitalization that prevents them from enrolling during  the open enrollment period.
section_title: Details of Supporting Documentation Requested and Verified for Fictitious Applicants Seeking to Enroll during an SEP
paragraphs: The federal and selected state-based marketplaces requested supporting  documentation for 6 of our 12 fictitious applicants who initially applied  online or by telephone seeking coverage during an SEP. The 6  remaining fictitious applicants were not instructed to provide supporting  documentation related to the SEP triggering event. As previously  mentioned, the federal or state-based marketplaces approved subsidized  health-insurance coverage for 9 of our 12 fictitious applicants and denied  coverage for 3 of our 12 fictitious applicants.
As mentioned, for all 12 fictitious applicants, we submitted supporting  documentation related to proof of identity and income, such as a copy of  the Social Security card, driver’s license, and self-employment ledger. We  designed the 12 fictitious applications to provide either no documentation  or fictitious documentation related to the SEP event to note any  differences in outcomes. As previously mentioned, we used professional  judgement to determine what type of documentation we would submit  related to the SEP triggering event. For 9 of the 12 applications, GAO  provided no documents or fictitious documents to support the SEP  triggering event and was able to obtain and maintain subsidized health  coverage. Figure 2 summarizes document submissions and outcomes for  the 12 fictitious applications for subsidized qualified health-plan coverage  during an SEP.
Officials from the marketplaces explained that they do not require  applicants to submit documentation to support certain SEP triggering  events. For other SEP triggering events, CMS officials explained that the  standard operating procedure in the federal marketplace is to enroll  applicants first, and verify documentation to support the SEP triggering  event after enrollment.
As previously mentioned, there is no specific legal provision that requires  federal and state-based marketplaces to verify the events that trigger an  SEP, but in February 2016 CMS announced plans to begin a Special  Enrollment Confirmation Process, which involves requesting supporting  documentation to verify certain events that would trigger an SEP. CMS  announced that it would begin requesting supporting documentation from  consumers who enroll or change plans using an SEP for selected  triggering events on June 17, 2016. We started our testing after June 17,  2016. State-based marketplaces are not required to participate in the  CMS Special Enrollment Confirmation Process and may establish their  own processes. According to state and federal officials, all applicants  that apply for enrollment during an SEP must attest under penalty of  perjury that they meet the conditions of eligibility for the SEP. However,  relying on self-attestation without verifying documents submitted to  support a SEP triggering event could allow actual applicants to obtain  subsidized coverage they would otherwise not qualify for.
subsections: section_title: Documents Requested for Applicants to the Federal Marketplace
paragraphs: Three of our six fictitious applicants to the federal Marketplace claimed  eligibility based on an SEP triggering event covered by the CMS Special  Enrollment Confirmation Process and were instructed by the federal  marketplace to provide supporting documentation to prove eligibility to  enroll through the SEP. As of October 2016, the three fictitious applicants  that claimed eligibility based on an SEP triggering event covered by the  CMS Special Enrollment Confirmation Process are currently enrolled in a  subsidized qualified health plan. Two of these three fictitious applicants  were asked to submit documents to support their SEP event, but obtained  and maintained subsidized health coverage without providing any  documentation to support their SEP event. The third of these three  individuals submitted fictitious documents supporting the SEP event in  response to the federal Marketplaces’ request and subsequently obtained  and maintained subsidized health coverage.
The remaining three of six applicants to the federal Marketplace claimed  eligibility based on SEP events that were not covered by the CMS Special  Enrollment Confirmation Process and (as such) were not instructed to  provide supporting documentation to prove eligibility to enroll through the  SEP. For example, one of these three applicants to the federal  marketplace claimed to have applied for Medicaid during the annual open  enrollment but was subsequently denied Medicaid after open enrollment  had closed—which is not an event covered by the process. This applicant  did not provide documentation to support this claim, and the applicant  obtained subsidized coverage. The remaining two applicants to the  federal marketplace were denied, as described previously in this report.
section_title: Documents Requested for Applicants to Selected State- Based Marketplaces
paragraphs: Two of the six fictitious applicants to the selected state-based  marketplaces were instructed by the state-based marketplace to provide  supporting documentation proving eligibility to enroll through the SEP. For  one of the two fictitious applicants, we did so, and the fictitious applicant  is currently enrolled in a qualified health plan. The other applicant was  denied, as described previously in this report.
The remaining four of our six fictitious applicants to the selected state- based marketplaces were not instructed by the state marketplace to  provide supporting documentation to prove eligibility to enroll through the  SEP. Two of these four fictitious applicants were able to obtain and  maintain subsidized health insurance through the marketplace without  providing supporting documentation related to the SEP and are currently  enrolled in a qualified health plan.
section_title: Fictitious Documents Submitted to Support SEP Triggering Events
paragraphs: As mentioned, in some instances, we provided fictitious documents to the  federal and selected state-based marketplaces to support the SEP  triggering event and were able to obtain and maintain subsidized health  coverage. After the conclusion of our undercover testing, when we  spoke with federal and selected state-based marketplace officials about  the outcomes of our fictitious applicants, the federal and selected state- based marketplace officials told us that unless a document appeared  visibly altered, they accepted it. For example, one of our fictitious  applicants claimed that we were eligible to enroll during the SEP because  the applicant recently lost health coverage. In response to our application,  the federal marketplace required us to submit documentation to support  this SEP triggering event, such as submitting a letter from an employer  stating that coverage was terminated and the date the coverage ended.  We submitted a fictitious letter from a fictitious employer with a fictitious  telephone number indicating our coverage was terminated on a certain  date. A marketplace representative later told us that the marketplace had  received and verified the fictitious supporting documentation we  submitted. The fictitious applicant obtained subsidized health coverage  and has continued to maintain subsidized coverage to date.
In another example, one of our fictitious applicants claimed that the  applicant was eligible to enroll during the SEP because the applicant  experienced a serious medical condition that prevented the applicant from  enrolling in a plan during open enrollment. In response, the marketplace  required us to submit documentation to establish our SEP triggering  event. Specifically, the marketplace requested a letter from the doctor  explaining the nature of the condition that kept us from enrolling during  open enrollment. We submitted a fictitious doctor’s note with a fictitious  doctor’s name and address, as well as a fake phone number that we  could monitor. We were later notified that we had been approved. On the  basis of our records, no one called the fake number we provided before  we were approved for coverage. The fictitious applicant obtained  subsidized health coverage and has continued to maintain subsidized  coverage to date.
As mentioned, there is no specific legal requirement that federal or state- based marketplaces authenticate the documents submitted to support an  SEP event to determine whether those documents are fictitious. However,  according to federal and state officials, all applicants that apply for  enrollment during an SEP must attest under penalty of perjury that they  meet the conditions of eligibility for the SEP.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS, Covered California, and the  District of Columbia (DC) Health Benefit Exchange Authority. Written  comments from HHS, Covered California, and the DC Health Benefit  Exchange Authority are summarized below and reprinted in appendixes  II–IV, respectively.  In their written comments, in terms of overall context,  these agencies reiterated that they are not required to verify the events  that trigger an SEP and instead rely on self-attestation and the associated  penalties, which we acknowledge and state in this report. However,  prudent stewardship and good management practices suggest that fraud  risks be understood and managed to protect public funds. In addition to  their formal written comments, all three agencies provided us with  technical comments, which we incorporated, as appropriate, in this report.
In its written comments, HHS stated that SEPs are a critical way for  qualified consumers to obtain health coverage and that it is important that  SEPs are not misused or abused. HHS also described several actions it  is taking to better understand SEPs, including its efforts as part of the  agency’s Special Enrollment Confirmation Process, which we also  describe in this report. For example, according to HHS, beginning June  18, 2016, all consumers who complete a Marketplace application for an  SEP included in the Special Enrollment Confirmation Process will read in  their Eligibility Determination Notice next steps that they must take to  prove their SEP eligibility along with a list of examples of documents they  may submit. HHS noted that consumers who do not respond to requests  for documentation or do not provide sufficient documentation could be  found ineligible for their SEP and may lose coverage. In addition, HHS  stated that it is implementing steps to improve program integrity, such as  by conducting a fraud risk assessment of the Marketplace consistent with  GAO’s fraud risk framework. As mentioned, we believe that performing  a fraud-risk assessment consistent with our prior recommendations to  HHS in this area could help address the control vulnerabilities we  identified during our SEP tests.
In its written comments, Covered California also stated that it is important  to ensure that consumers who enroll in health coverage during an SEP  have, in fact, experienced a qualifying life event. Covered California  explained that its controls are in compliance with federal standards.  Covered California also described processes it has in place to verify  certain SEP events, such as the random sample of consumers who  experience two qualifying life events: (1) loss of minimum essential  coverage and (2) permanent move to and within California, as we  describe in this report. Covered California also suggested that any  requirement for marketplaces to authenticate documents provided by  applicants for an SEP should also consider the burden that document  authentication may impose on marketplaces, consumers, and the sources  of such documents, such as doctors and insurers. In this regard, we did  not evaluate the cost of authenticating such documents as part of our  work because it was outside the scope of our review.
In its written comments, the DC Health Benefit Exchange Authority  described its policies and processes for verifying SEP eligibility by relying  on self-attestation or reviewing information provided by consumers and  others. Additionally, in its written comments, the DC Health Benefit  Exchange Authority also raised concerns about our methodology. First,  the agency stated that the DC marketplace is too different from other  marketplaces to be an informative part of our review. Specifically, the  comments state that the age of individuals enrolled in health insurance  coverage in the DC marketplace – and enrolled through SEPs in  particular – suggests that there is no evidence that consumers are waiting  to get sick before enrolling in coverage. We did not evaluate the DC  marketplace’s data on its population of enrollees and did not evaluate the  DC marketplace’s conclusion that the age of its enrollee population shows  that there is no systemic abuse of SEPs. Rather, our work focused on  testing whether our fictitious applicants could obtain and maintain health  coverage during an SEP by submitting fictitious documents or no  documents to support our SEP triggering event. The DC marketplace is  similar to the federal Marketplace and the other state-based marketplace  we selected in that it relies on self-attestation to verify certain SEP  events.
The written comments from the DC Health Benefit Exchange Authority  also expressed concern that the results of our testing are not useful to  help improve the agency’s processes because we did not provide specific  details of our undercover testing scenarios to the states included in our  review. As we noted in our meetings with HHS and both of the state  agencies included in our review, we did not provide certain details on our  undercover testing scenarios to maintain the integrity of our undercover  tests. Specifically, we did not provide details about our undercover tests  that could risk inappropriately revealing the identities of our fictitious  applicants and preclude the use of such identities in any future reviews.   However, we did provide HHS and both of the state agencies with details  of the scenarios, including the type of application submitted; the type of  documentation we submitted; and the interaction with the marketplace  representatives, among other things. Providing additional, specific details  about our fictitious identities would not help the agency address any  systemic vulnerabilities stemming from their reliance on self-attestation to  verify eligibility for an SEP.
Further, the DC Health Benefit Exchange Authority commented that our  undercover tests are unrealistic because we produced fictitious  documents to support our SEP events; that lying under penalty of perjury  is a unique ability of our undercover investigators; and that our work  assumes a significant number of individuals perjure themselves to access  federal funds. These statements represent a misunderstanding of our  methodology. First, as stated in our report, we used publicly available  hardware, software, and materials to produce the counterfeit documents  that we submitted for our testing. Using these same tools, potential  fraudsters may realistically produce similarly counterfeit documents to  support an SEP triggering event. Second, potential fraudsters have the  ability—and very possibly the inclination—to lie under penalty of perjury to  perpetrate their illegal schemes. Finally, our report makes no statements  or assumptions about the number of individuals who perjure themselves  to access federal funds. Rather, our report focuses on the results of our  undercover testing of enrollment verification for 12 fictitious applications  for subsidized health-insurance coverage during an SEP in 2016 to  identify potential vulnerabilities in enrollment-verification controls. As  mentioned above, prudent stewardship and good management practices  suggest that fraud risks be understood and managed to protect public  funds.
The DC Health Benefit Exchange Authority’s written comments  additionally stated that relying on self-attestation is a well-accepted  practice in the federal government. The DC Health Benefit Exchange  Authority also suggested that any requirement for marketplaces to  authenticate documents provided by applicants for an SEP should  consider the burden on both the marketplace and consumers. In this  regard, we did not evaluate the cost of authenticating such documents as  part of our work because it was outside the scope of our review. Further,  while federal agencies may rely on self-attestation for certain aspects of  their programs, such as those noted in the DC Health Benefit Exchange  Authority’s written comments, federal agencies also take steps to verify  information needed to determine eligibility for programs and benefits. For  example, in compliance with the requirements of PPACA and CMS  regulations, the federal and state-based marketplaces (including DC  Health Link) verify information on applicant citizenship, nationality, or  legal presence status by matching applicant data with data from federal  agencies rather than relying on self-attestation for this information.  Additionally, our prior work has found that relying on self-reported  information can leave agencies vulnerable to fraud in some programs.  Thus, it would be misleading to characterize reliance on self-attestation  for conducting program integrity activities as a generally well-accepted  practice in the federal government.
Finally, the DC Health Benefit Exchange Authority’s written comments  stated that its approach to verifying SEP events is consistent with the best  practices in our fraud risk framework. For example, the DC Health Benefit  Exchange Authority stated that it has reviewed the characteristics of the  DC marketplace, consistent with the principles of our fraud risk  framework, and assessed risk to develop appropriate verification  procedures. However, we did not review, and are thus not able to  corroborate, the DC Health Benefit Exchange Authority’s claim that its  enrollment verification controls are consistent with our fraud risk  framework.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, and other  interested parties. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix V.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: We were asked to examine and test health-care marketplace enrollment  and verification controls for a special enrollment period (SEP) for the  2016 coverage year. This report describes results of undercover attempts  to obtain subsidized qualified health-plan coverage outside the open  enrollment period for 2016; that is, during an SEP. To perform our  undercover testing and describe the results of our undercover attempts to  obtain new coverage during an SEP, we used 12 fictitious identities for  the purpose of making applications to obtain subsidized qualified health- plan coverage offered through a marketplace by telephone and online.  The Patient Protection and Affordable Care Act (PPACA) requires  marketplaces to verify application information to determine eligibility for  enrollment and, if applicable, determine eligibility for the income-based  subsidies or Medicaid. These verification steps include validating an  applicant’s Social Security number, if one is provided; verifying  citizenship, U.S. nationality, or lawful presence in the United States; and  verifying household income. The 12 identities were designed to pass  these verification steps by providing supporting documentation—albeit  fictitious—such as a copy of the Social Security card, driver’s license, and  proof of income.
We selected states within the federal Health Insurance Marketplace  (Marketplace) and state-based marketplaces for our undercover  applications, based on factors including state population, percentage of  state’s population without health insurance, whether the state was  selected for testing as part of our prior work, whether the state  participates in the state-based marketplace or federal marketplace, and  whether the states make the eligibility determination or assessment for  other health-coverage programs, including Medicaid. Specifically, we  selected two states—Virginia and Florida—that elected to use the federal  marketplace rather than operate a marketplace of their own. We also  selected two state-based marketplaces—Covered California (California)  and DC Health Link (District of Columbia).
The results obtained using our limited number of fictional applicants are  illustrative and represent our experience with applications in the federal  and state marketplaces we selected. The results cannot, however, be  generalized to the overall population of applicants, enrollees, or  marketplaces.
Our undercover testing included fictitious applicants claiming to have  experienced an event that would trigger eligibility to enroll in health- insurance coverage during an SEP. Specifically, our 12 fictitious  applicants claimed to have experienced one of the following selected  events that may indicate eligibility, under certain circumstances, to enroll  in health coverage under an SEP: (1) loss of minimum essential health  coverage; (2) gained access to new qualified health plans as a result of a  permanent move to another state; (3) gained a dependent through  marriage; (4) experienced an exceptional circumstance, such as a serious  medical condition that prevented the consumer from enrolling during the  annual open enrollment period; (5) nonenrollment during the annual open  enrollment period was unintentional and the result of misinformation or  misrepresentation by a non-exchange entity providing enrollment  assistance or conducting enrollment activities; and (6) Medicaid  application filed during the annual open enrollment period was denied  after the open enrollment period had closed. We tested the six selected  triggering events in the federal marketplace. We also tested the six  selected triggering events in the two selected state-based marketplaces.  We submitted three applications in each state and the District of  Columbia.
We selected these six SEP triggering events to create a balance between  three events that are subject to the Centers for Medicare & Medicaid  Services (CMS) Special Enrollment Confirmation Process and three  events that are not subject to this process. In February 2016, CMS  announced plans to begin requesting supporting documentation to verify  certain events that would trigger an SEP. CMS announced that it would  begin requesting supporting documentation from consumers who enroll or  change plans using an SEP for selected triggering events on June 17,  2016. We started our testing after June 17, 2016. State-based  marketplaces are not required to follow CMS’s Special Enrollment  Confirmation Process, but states may choose to follow this guidance or  establish their own processes, according to CMS officials.
We made 6 of our applications online initially, and 6 by phone; however,  for all our fictitious applicant scenarios, we sought to act as an ordinary  consumer would in attempting to make a successful application. For  example, if, during online applications, we were directed to make phone  calls to complete the process or mail or fax the application, we acted as  instructed. We also self-attested that the information provided in the  application was true when instructed. In these tests, we also stated  income at a level eligible to obtain both types of income-based subsidies  available under PPACA—a premium tax credit, to be paid in advance,  and cost-sharing reduction (CSR).
As appropriate, in our applications for coverage and subsidies, we used  publicly available information to construct our scenarios. We also used  publicly available hardware, software, and material to produce counterfeit  documents, which we submitted, as appropriate for our testing, when  instructed to do so. We designed the 12 fictitious applications to provide  either no documentation or fictitious documentation related to the SEP  triggering event. We used professional judgement to determine what  type of documentation we would submit related to the SEP triggering  event. For example, for a marriage scenario, we did not provide a  marriage certificate or any documentation including the fictitious spouse’s  Social Security number. We did need to submit documentation related to  the fictitious applicant’s income in the form of a self-employment ledger  and avoided providing information supporting a fictitious spouse. In  another example, we had to submit proof of identity to pass the general  eligibility requirements for a scenario in which we claimed the applicant  permanently moved to another state within the past 60 days. Thus, to  avoid submitting documentation related to the SEP triggering event, we  submitted a driver’s license, but we ensured it was from the original state  and the issuance date was back-dated several years. We did not provide  any documentation to support our permanent move to the new state. We  did, however, self-attest to the permanent move. We then observed the  outcomes of the document submissions, such as any approvals received  or requests received to provide additional supporting documentation. For  the applications that we were denied, we did not proceed with the appeals  process.
We conducted our performance audit from May 2016 to November 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: Comments from Covered California
section_title: Appendix IV: Comments from the District of Columbia Health Benefit Exchange Authority
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Marcus Corbin; Ranya Elias;  Colin Fallon; Suellen Foth; Georgette Hagans; Barbara Lewis; Olivia  Lopez; Maria McMullen; James Murphy; Jonathon Oldmixon; Gloria Proa;  Christopher Schmitt; Julie Spetz; and Elizabeth Wood made key  contributions to this report.