Medicaid Financial Management: Steps Taken to Improve Federal Oversight but Other Actions Needed to Sustain Efforts
Published: 2006-06-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid--the federal-state health care financing program--covered over 56 million people at a cost of $295 billion in fiscal year 2004, the latest fiscal year for which complete data are available. The Centers for Medicare & Medicaid Services (CMS) is the federal agency responsible for overseeing states' Medicaid programs and ensuring the propriety of expenditures reported by states for federal reimbursement. In 2002, GAO reported on weaknesses in CMS's oversight of Medicaid financial management and made recommendations to CMS to strengthen its oversight process. In fiscal year 2003, CMS started receiving funds from the Health Care Fraud and Abuse Control (HCFAC) program to help improve Medicaid financial management. GAO was asked to evaluate CMS's financial management activities, including following up on prior recommendations. In this report, GAO examined (1) the extent to which CMS has improved its ability to identify and address emerging issues that put federal Medicaid dollars at risk and (2) how CMS used funds for Medicaid from the HCFAC account.
section_title: What GAO Found
paragraphs: CMS has undertaken several steps to improve its Medicaid financial management activities, including its efforts to oversee state claims for federal reimbursement and to identify payment errors. CMS hired about 90 funding specialists, thus enhancing its ability to address high-risk state funding practices that inappropriately increase federal costs. CMS also created a new unit that centralized responsibility for approving state plan amendments related to reimbursement. CMS continued to identify billions of dollars in questionable federal reimbursement through focused financial reviews. CMS also set goals aimed at reducing questionable federal reimbursement and holding financial managers accountable and enhanced its internal processes for tracking results of its financial management activities. These and other efforts, such as CMS's approach for measuring payment errors under the Improper Payments Information Act, represent improvements in the processes that CMS uses in its oversight of states. While these actions also address previously identified weaknesses and recommendations from our 2002 report, it is too soon to assess the impact they will have on improving overall financial management and addressing emerging issues that put federal Medicaid dollars at risk because some have just recently been initiated and results are not known yet. Further, there are a number of previously identified weaknesses that the agency has not yet addressed. Specifically, CMS has not instituted mechanisms to measure how the risk of inappropriate federal reimbursement has changed as a result of corrective actions taken. In addition, CMS has not incorporated the use of the Medicaid Statistical Information System database into its oversight of states' claims or other systems projects intended to improve its analysis capabilities. Further, CMS has not developed profiles to document information on state fraud and abuse controls to use in its oversight of state claims. Finally, CMS has not developed a strategic plan specific to its Medicaid financial management activities. Because these issues are important to further improving and sustaining CMS's oversight activities, we reiterate and build on our prior recommendations in these areas. During fiscal years 2003 through 2005, CMS received almost $46 million from the HCFAC account that it used to help fund programs related to its oversight of the Medicaid program, including about $12 million for the funding specialists for fiscal years 2004 and 2005. The funding specialist positions have been funded on an annual basis with appropriations from the HCFAC account. There is the chance that adequate funding might not be provided through the HCFAC process in any given year for the funding specialists; therefore, creating permanent funding specialist positions is important. CMS used the other $34 million for other projects such as researching options for automating the Medicaid state plan process, and interagency agreements with the OIG to conduct audits of high-risk areas. GAO obtained documentation to support the use of HCFAC funds for these projects.

section_title: Letter
paragraphs: Medicaid—the federal-state program financing health care for certain low- income children, families, and individuals who are aged or disabled— covered over 56 million people at an estimated cost of $295 billion in fiscal  year 2004. Within broad federal guidelines, states administer their  Medicaid programs by paying qualified health providers for a range of  covered services provided to eligible beneficiaries and then seeking  reimbursement for the federal share of those payments. The Department  of Health and Human Services’ (HHS) Centers for Medicare & Medicaid  Services (CMS) is the federal agency responsible for overseeing states’  Medicaid programs and ensuring the propriety of expenditures reported by  states for federal reimbursement. States can design and administer their  Medicaid programs in a manner that helps them ensure that they receive  the maximum allowable federal share of expenditures they incur for  covered services provided to eligible beneficiaries under a CMS-approved  state Medicaid plan, as long as they do so within the framework of federal  law, regulation, and CMS policy.
For more than a decade, we have reported concerns relating to actions by  some states that result in excessive federal reimbursement. We have also  reported concerns about CMS’s oversight of states’ claims for  reimbursement and CMS’s efforts to detect and reduce improper payments  in the Medicaid program. In 2002, we made 13 recommendations to CMS  to strengthen oversight of states and certain activities to address fraud and  abuse. In 2003, we added Medicaid to our list of high-risk federal  programs because the challenges inherent in overseeing a program of  Medicaid’s size, growth, and diversity put the program at high risk for  waste, abuse, and exploitation.
Congress and CMS have taken actions to (1) curtail certain abusive  financing schemes that some states have used to generate excessive  federal reimbursement and (2) strengthen Medicaid fraud and abuse  control activities. Further, CMS received almost $46 million of Health Care  Fraud and Abuse Control (HCFAC) funds during fiscal years 2003 through  2005 for programs related to its oversight of Medicaid, including hiring  new staff to identify and review state practices related to funding their  Medicaid programs.
Because of your continued concern about the stewardship of federal  Medicaid funds, you raised questions about CMS’s oversight. The focus of  this report is on CMS’s financial management activities, including its  efforts to oversee state claims for federal reimbursement and to identify  payment errors. We also focus on how CMS has responded to our 2002  recommendations to strengthen financial oversight and certain activities  to address fraud and abuse. Specifically, in this report, we address the  following questions:  1. To what extent has CMS improved its oversight, including its ability to  identify and address emerging issues that put federal Medicaid dollars at  risk?  2. How has CMS used funds provided through the HCFAC program that  were specifically for Medicaid?
To identify the extent to which CMS has improved its oversight, including  its ability to identify and address emerging issues that put federal Medicaid  dollars at risk, we performed work at CMS headquarters and two regional  offices. We reviewed and assessed aspects of CMS’s financial oversight  processes, which include identifying high-risk areas in order to develop an  annual regional office financial management workplan and conducting  focused financial reviews of high-risk areas. We reviewed our prior  reports, and reports by HHS’s Office of Inspector General (OIG) and  others. We also interviewed officials and staff at the CMS central office in  Baltimore, Maryland, and two regional offices—New York and Chicago.
To determine how CMS used funds from the HCFAC account for fiscal  years 2003 through 2005, we obtained from CMS a list of Medicaid projects  that were funded from the HCFAC account during those 3 years. We  obtained and examined documentation from CMS such as invoices; grant  awards; interagency agreements; and accounting, budget, and payroll  records that support the information provided by CMS on how it used  HCFAC funds for that time frame.
See appendix I for more details about our scope and methodology. We  requested written comments on a draft of this report from the  Administrator of CMS or his designee. His written comments are reprinted  in appendix III. We conducted our review from February 2005 to May 2006  in accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: Medicaid is the third largest social program in the federal budget and one  of the largest components of state budgets. States and CMS share  responsibility for instituting financial practices for the Medicaid program  that are in compliance with applicable rules, laws, and regulations. In  general, the federal government matches state Medicaid spending for  medical assistance according to a formula based on each state’s per capita  income. The federal contribution ranged from 50 to 77 cents of every state  dollar spent on medical assistance in fiscal year 2004. For most state  Medicaid administrative costs, the federal match rate is 50 percent. For  skilled professional medical personnel, 75 percent federal matching is  available. States are responsible for providing the state share of Medicaid  funding and submitting plans, budgets, and expenditure reports to CMS  that accurately report on the administration of their Medicaid programs  and how they expend Medicaid funds. CMS is responsible for reviewing  the states’ plans, budgets, expenditures, and operations to ensure  compliance with all applicable laws and regulations. Each state develops  its own administrative structure and establishes its own eligibility  standards, scope of covered services, and payment rates in accordance  with Medicaid statute and within broad federal guidelines. States are  required to describe the nature and scope of their programs in a  comprehensive plan submitted to CMS, with federal funding depending on  CMS’s approval of the plan. State Medicaid plans specify the services to be  provided and how the state will establish the amount it will pay for those  covered services. Amendments to states’ plans are also subject to approval  by CMS. Table 1 shows the amount of state and federal expenditures for  Medicaid for fiscal years 2003 and 2004, the most recent years for which  data are available.
CMS’s Center for Medicaid and State Operations (CMSO) shares Medicaid  program administration and financial management responsibilities with  the 10 CMS regional offices. Two divisions in CMSO’s Finance, Systems,  and Budget Group—the Division of Financial Management (DFM) and  DRSF—have primary responsibility for Medicaid financial management.  Figure 1 outlines CMS’s organizational structure related to Medicaid.
DFM’s mission includes effectively administering the Medicaid program  budget and grants, financial management policy, and administrative cost  policy processes. Among other things, DFM staff in the central office are  responsible for (1) determining and issuing state grant awards based on  regional decision reports resulting from reviews of budget and  expenditure reports, (2) reconciling state expenditure and budget reports,  (3) reviewing and approving draft focused financial review reports, and   (4) preparing annual financial management workplans based on input  from regional offices.
DRSF’s responsibilities include, but are not limited to (1) reviewing state  plan amendments that involve reimbursement, (2) providing training to  and coordinating the work of the funding specialists, (3) providing  technical assistance to states on institutional and noninstitutional  reimbursement, and (4) identifying and addressing state financing  practices that could inappropriately increase federal Medicaid costs.
CMS has approximately 65 regional financial analysts who are responsible  for performing activities such as (1) reviewing state quarterly budget  estimates and expenditure reports, (2) preparing decision reports that  document approvals for federal reimbursement or deferrals or  disallowances of claims for federal reimbursement, (3) assisting in  assessing issues that put federal Medicaid dollars at risk and determining  which issues to review in a fiscal year, (4) performing focused financial  reviews, (5) providing technical assistance to the states on financial  matters, and (6) serving as liaison to the states and audit entities.
CMS has about 90 funding specialists who are responsible for, among  other things, (1) gaining an understanding of their assigned state’s  organizational structure, program structure, and budget process related to  the state’s Medicaid program; (2) assisting in reviews of state plan  amendments; (3) conducting reviews of state financing practices; and   (4) providing technical assistance to the states.
States submit quarterly budget and expenditure reports to CMS. The  financial analysts in the 10 regional offices have traditionally reviewed  these reports and prepared a Regional Office Decision memorandum  which they submit to DFM in the central office. In some regions, the new  funding specialists now have responsibility for reviews of state budget  reports. Also, in some cases, the funding specialists assist financial  analysts with reviews of state expenditure reports.
section_title: Steps Taken to Improve Oversight Activities but Some Previously Identified Weaknesses Remain
paragraphs: CMS has undertaken several steps to improve its Medicaid financial  management activities including its efforts to oversee state claims for  federal reimbursement and to identify payment errors. CMS hired about 90  funding specialists who are examining high-risk state funding practices  and working with states to eliminate those practices that inappropriately  increase federal costs. CMS also created a new unit, DRSF, which reviews  state plan amendments for reimbursement to identify and work with states  to eliminate payment methodologies that could result in higher federal  costs. CMS has continued to use focused financial reviews and OIG audits  to identify inappropriate state claims for federal reimbursement and  recommend changes to states’ internal control practices. In addition, CMS  recently established a new performance goal for its Medicaid financial  management staff to reduce cumulative questionable federal  reimbursement by 10 percent in fiscal year 2006. These and other recent  efforts represent improvement in CMS’s oversight activities and address  weaknesses and recommendations we identified in our 2002 report.  However, it is too soon to assess the impact they will have on improving  overall financial management and addressing emerging issues that put  federal Medicaid dollars at risk because some have just recently been  initiated, and results are not known yet. Further, there are other  previously identified weaknesses that the agency has not addressed. CMS  has not instituted mechanisms to measure how the risk of inappropriate  federal reimbursement has changed as a result of corrective actions taken.  CMS also has not incorporated the use of the MSIS in its oversight of state  claims or other systems projects intended to help improve its analysis  capabilities. Further, CMS has not developed profiles to document  information on state fraud and abuse controls to use in its oversight of  state claims. Finally, CMS has not developed a strategic plan to guide its  financial management activities. Because these issues are important to  further improving and sustaining CMS’s oversight activities, we reiterate  our prior recommendations in these areas.
subsections: section_title: Additional Staff and Creation of New Division Have Improved Oversight Activities
paragraphs: In late 2004, CMS began hiring for 100 new funding specialist positions.  These new staff have enabled CMS to perform more in-depth reviews of  high-risk issues. The funding specialists’ positions were established to help  CMS gain a better understanding of how states budget for and finance  their portion of Medicaid expenditures and help CMS proactively identify  state payment and funding practices that could result in inappropriate  claims for federal reimbursement or increased federal costs. These new  funding specialists augment the activities of approximately 65 financial  analysts in 10 regional offices who had previously performed many of the  state financial oversight activities, including assisting the financial analysts  with reviews of state budget and expenditure reports. In addition, the  funding specialists performed activities that have enabled CMS to collect  and summarize more information on states’ Medicaid programs to help  CMS target its oversight efforts to high-risk issues such as certain payment  arrangements that have been problematic in the past.
A major activity of the funding specialists during their first year was the  completion of state funding profiles. These profiles document the states’  Medicaid programs’ organizational structure, programmatic structure, and  budget process. For many years, states only needed to provide general  information on their payment methodologies, so these newly created  profiles provide more detail to help CMS in its review and oversight of  states’ financial issues. For example, the profiles    describe the sources of each state’s nonfederal share of Medicaid funds  and state payment methodologies; and  include a “watch list” section where the funding specialists can highlight  significant funding-related concerns that may need to be addressed in the  future. For example, one state profile identifies a concern about the state’s  lack of oversight of the certified public expenditures certification process  for hospitals. This type of information can be helpful in ensuring proper  review of future state plan amendments, among other things.
CMS officials told us the state funding profiles have been made available  to all CMS staff through CMS’s intranet, and said the profiles will be  updated annually to account for changes in state programs, thus allowing  CMS to have current information.
In addition to completing state funding profiles and reviewing state  budgets and expenditures, the funding specialists carry out other oversight  activities, including the following:    meeting with state Medicaid officials and monitoring state legislative  activity, including hearings, budget sessions, and committee meetings  related to states’ Medicaid programs and proposed bills to proactively  identify issues that need CMS attention;  reviewing state payment arrangements that CMS previously deemed  problematic and that the states agreed to end to determine if the  arrangements have in fact ended;    assisting in the resolution of OIG audit findings;    providing technical assistance to the states concerning funding and    attending training and workshops to learn about and stay abreast of CMS  policy and operations.
Directing the activities of the new funding specialists is one of the efforts  of the central office’s DRSF, which was created in early 2005. CMS  established DRSF to consolidate responsibility for all state Medicaid  payment policy and funding issues. A role of DRSF is to ensure that state  plan amendments for reimbursement of noninstitutional and institutional  services are consistently reviewed and that CMS policy is consistently  applied across the nation. The activities of DRSF have improved CMS’s  ability to effectively deploy its resources to carry out more targeted  oversight activities. DRSF’s National Institutional Reimbursement Team  and the Non-Institutional Payment Team are part of CMS’s effort to  collect information on states’ funding methodologies before approving  state plan amendments, including high-risk payment methodologies that  have been troublesome in the past.
DRSF reviews all institutional reimbursement state plan amendments  before they are approved by the Director of CMSO, thus eliminating the  decentralized approval process that had been in place at all 10 regional  offices. This has helped to clarify the lines of authority and responsibility  for the state plan amendment process—states still submit amendments to  their respective region for review but they are approved by CMS’s central  office. DRSF also helped clarify responsibilities between central and  regional office staff by using the 10 central office funding specialists as  liaisons to each of the 10 regional offices. The DRSF funding specialists  help to ensure that regional funding specialists are informed and kept up  to date on funding policies and matters. The funding specialists also help  in conducting a series of monthly calls that DRSF has instituted between  the regions and central office financial management staff to improve  communication and coordination. These calls help to ensure that all staff  stay informed and up to date on matters that impact state claiming and the  approval of state plan amendments.
These activities, which we consider significantly underway, help improve  CMS’s ability to better target its oversight activities and specifically  address the recommendation in our 2002 report to increase in-depth  oversight of areas of higher risk as identified from the risk assessment  efforts and apply fewer resources to lower risk areas. See appendix II for a  complete listing of our prior recommendations and our assessment of  whether or not each has been fully addressed by CMS’s actions to improve  its oversight activities. These activities also help address our overarching  concerns that CMS’s organizational structure created challenges to  effective oversight because of unclear lines of authority and responsibility  between the regions and the central office.
section_title: Focused Financial Reviews and OIG Audits Continued to Identify Problems and Needed Corrective Actions
paragraphs: In 2001, CMS began a risk analysis process to identify Medicaid issues that  put federal dollars at risk and address those issues by conducting focused  financial reviews or referring the issues to the OIG for its review. Since  then, at the beginning of each fiscal year, central office and regional office  financial management staff work together to identify risks and plan  focused financial reviews of the issues identified. CMS’s financial  management staff consider factors such as the amount of dollars involved,  involvement of consultants, and time elapsed since last audit to identify  risk areas. CMS’s analyses provide insight into what some of the  continuing problematic Medicaid issues and potential emerging issues are.  Table 2 shows which areas have consistently been identified as needing in- depth review in fiscal years 2003 through 2006.
The focused financial reviews of the issues identified from the risk  analyses have helped CMS identify billions of dollars in unallowable costs  outside of those detected through the review of quarterly expenditure  reports, as well as deficiencies in states’ financial management practices.  In fiscal years 2003 and 2004, focused financial reviews resulted in CMS  questioning or disallowing about $1.3 billion and about $1 billion,  respectively, of state claims for federal reimbursement, according to CMS.  The value of these reviews lies not just in identifying disallowances but  also in providing feedback on policy issues and programmatic  vulnerabilities, and in elevating the attention of both states and federal  staff. CMS conducted about 57 focused financial reviews each year from  fiscal years 2003 through 2005. Starting in fiscal year 2006, the number of  planned focused financial reviews almost doubled from fiscal year 2005  due to the inclusion of planned reviews to be done by the funding  specialists.
We reviewed 35 of the 113 focused financial reviews performed by  regional office financial analysts in fiscal years 2003 and 2004 to assess   (1) the consistency with which the reviews were performed and reported  on and (2) the extent to which states took actions to address the issues  identified by CMS. We concluded that the 35 review reports were generally  consistent across the regions. CMS also provided information to support  that states are taking the recommended actions to address the issues  identified. CMS issued reports to the states that contained  recommendations requesting the states to (1) return federal  reimbursement that CMS determined was not allowable (disallowances),  (2) provide additional documents for CMS to determine the allowability of  questionable claims (deferrals), or (3) improve certain state controls or  processes.
CMS gets additional coverage of risk areas from the reviews conducted by  HHS’s OIG. During fiscal years 2003 through 2005, CMS contracted with  OIG using funds from the HCFAC account to conduct 20 or more audits  each year of issues identified from the risk assessment process. We  reviewed interagency agreements between CMS and OIG for fiscal years  2003 through 2005 that provided over $3 million of HCFAC funds each year  for OIG to do 20 or more audits each year relating to Medicaid issues. The  interagency agreements supplemented OIG’s overall efforts to monitor  Medicaid. Table 3 shows the issues that OIG agreed to audit in selected  states pursuant to the interagency agreements for fiscal years 2003  through 2005.
We reviewed 21 audits done by OIG in fiscal year 2004 pursuant to the  interagency agreement to assess (1) the extent of the additional coverage  given to issues identified by CMS as high risk and (2) the extent to which  states took actions to address the issues identified by OIG. OIG identified  about $13.6 million that it believed was inappropriate federal  reimbursement to the states in 15 of the 21 audits. States returned about  $4.5 million of disallowed claims identified in 10 of the 15 audits; CMS was  still pursuing the remaining $9.1 million as of the end of our field work.  OIG also made numerous other recommendations to states to improve  their internal controls such as implementing controls to identify and  prevent duplicate payments and complete reconciliation procedures for  overpayments in a timely manner.
section_title: Goal for Reducing Questionable Federal Reimbursement Helps Promote Accountability
paragraphs: CMS has recently developed a specific goal aimed at reducing  questionable federal reimbursement and evaluating its oversight activities.  CMS has established a goal to reduce by 10 percent in fiscal year 2006 the  amount of federal reimbursement that has been questioned by CMS or  OIG. CMS is collecting data on questionable claims for federal  reimbursement identified from sources such as quarterly expenditure  reviews, focused financial reviews, and OIG audits. According to a CMS  official, as part of this process, CMS has identified a baseline amount of  about $8 billion dollars in cumulative questionable federal reimbursement,  which represents state claims that (1) CMS has determined may not be  allowable or has deferred payment pending review of additional support  from the states, or (2) OIG has questioned as a result of an audit. The goal  for fiscal year 2006 is to resolve at least 10 percent of this $8 billion by   (1) recovering amounts ultimately determined to be unallowable or   (2) determining after further review that the claims are allowed. CMS  officials acknowledge that the goal may not be attainable each year given  the varying facts and circumstances of the questionable amounts.  However, if properly established and tracked, goals of this nature should  help in improving the effectiveness of CMS oversight activities.
CMS has also included the goal to reduce by 10 percent the amount of  questionable federal reimbursement in the fiscal year 2006 performance  agreements of CMS senior financial managers in the central office.  According to CMS officials, it will continue to hold managers accountable  for this type of goal each fiscal year. CMS has also included specific goals  and performance standards in regional office financial managers’  performance agreements. For example, one regional office has a goal for  its managers to ensure that the financial analysts and funding specialists  complete nine focused financial reviews and five funding source reviews  in fiscal year 2006.
CMS has improved its processes for tracking its financial management  activities and the attainment of the goals it has set. The Financial  Management Activities Report (FMAR) tracks the amount of regional  office resources (staff time, personnel costs, and travel costs) spent on the  various categories of activities in the financial management workplans.  The Financial Issues Report tracks all questionable state claims for  reimbursement identified by regional financial analysts and funding  specialists in focused financial reviews, quarterly expenditure reviews,  and any other activities that could result in a disallowance or deferral of  state claims, including findings from OIG reports. The Financial  Performance Spreadsheet is the CMS tool used to track the fiscal year  2006 goal to resolve 10 percent of the amount of cumulative, questioned  claims for federal reimbursement.
These actions, which we consider significantly underway, help improve  CMS’s ability to monitor, measure, and evaluate its financial oversight  activities and specifically address the following recommendations from  our 2002 report:  Include specific Medicaid financial oversight performance standards in  senior managers’ performance agreements.
Collect, analyze, and compare trend information on the results of  oversight control activities, particularly deferral and disallowance  determinations, focused financial reviews, and technical assistance.
Use the information collected above to assess overall quality of financial  management oversight.
section_title: Other Efforts Help CMS’s Oversight of Medicaid Finances
paragraphs: CMS has initiated two other programs to help carry out its responsibility at  the federal level for helping ensure the propriety of Medicaid finances and  comply with the Improper Payments Information Act of 2002—the  Payment Accuracy Measurement pilot project, which was initiated in July  2001 and is now called the Payment Error Rate Measurement (PERM)  project, and the Medicare-Medicaid data match project. Under the PERM  program, states use a CMS-developed methodology to measure state  Medicaid payment errors. By fiscal year 2007, CMS plans to have a national  Medicaid payment error rate based on a sample of states and claims within  those states. Under PERM, states will be expected to ultimately reduce  their payment error rates over time by better targeting their activities to  prevent and detect improper payments made to providers. Under the  Medicare-Medicaid data match project, CMS facilitates the sharing of  information between the Medicare and Medicaid programs by matching  Medicare and Medicaid claims information on providers and beneficiaries  to identify improper billing and utilization patterns which could indicate  fraudulent schemes.
These two projects, which we consider significantly underway, have  helped CMS’s efforts to oversee state Medicaid finances and specifically  address the following two recommendations from our 2002 report:    Complete efforts to develop an approach to payment accuracy reviews at  the state and national levels.  Incorporate advanced control techniques, such as data mining, data  sharing, and neural networking, where practical to detect potential  improper payments.
section_title: Some Previously Identified Weaknesses in Oversight Activities Have Yet to be Addressed
paragraphs: While CMS has taken a number of actions that improve its oversight and  address several weaknesses we identified in our prior report, there are  previously identified weaknesses that the agency has not yet addressed.  Specifically, CMS has not instituted mechanisms to measure how the risk  of inappropriate federal reimbursement has changed as a result of  corrective actions taken. In addition, CMS has not incorporated the use of  the MSIS database into its oversight of states claims or other systems  projects intended to improve its analysis capabilities. CMS also has not  developed profiles to document information on state fraud and abuse  controls to use in its oversight of state claims. Finally, CMS has not  developed a strategic plan specific to its Medicaid financial management  activities.
Measuring how risks have changed—In our 2002 report, we  recommended that CMS develop and institute mechanisms to make risk  assessment a continuous process and to measure whether risks have  changed as a result of corrective actions taken to address them. CMS has  processes in place to identify risks, and management has established  procedures to mitigate important risks, such as detailed reviews of certain  high-risk issues. However, CMS’s processes still do not have the elements  of risk management that are key to assessing whether actions to mitigate  risks need to be adjusted either because (1) they are not effective, (2) they  are effective but need to be expanded, or (3) they are no longer needed  because the risks have been resolved or reduced to a tolerable level.
For example, CMS identified several Medicaid issues as part of its current  risk assessment process that have been the subject of focused financial  reviews across several states, for several years—issues such as those  related to claims for skilled professional medical personnel, family  planning, and school-based administrative services. As discussed earlier,  CMS has issued reports to the states on these issues that contained  recommendations requesting the states to (1) return federal  reimbursement that CMS determined was not allowable (disallowances),  (2) provide additional documents for CMS to determine the allowability of  questionable claims (deferrals), or (3) improve certain state controls or  processes. However, CMS’s current risk assessment process does not  indicate how the corrective actions taken to address these issues have  changed their assessment of risk or their future strategies for mitigating  the risk that these issues pose.
To CMS’s credit, it has recently taken steps to change policies related to  state claims for targeted case management services, an issue that has  been the subject of multiple focused financial reviews. While it is not clear  from CMS’s risk assessment why this issue was given a higher priority than  other issues identified from its risk assessment, CMS officials explained  that their process for determining what might be a high-risk issue comes  from continuous coordination between financial management staff and  Medicaid program staff that have in-depth program knowledge about  Medicaid policy and procedures. The officials further explained that the  results of their coordination and the fact that an issue is a high priority  may not be noticeable to others until policy changes are included, for  example, in HHS’s budget submission or other legislation that is signed by  the President.
Documenting how the outcomes of detailed reviews are used to determine  whether additional or fewer corrective actions are needed is an important  step in risk management. For fiscal year 2006, CMS is planning to conduct  additional detailed reviews intended to ensure that states have stopped  certain intergovernmental transfers and other funding practices that have  resulted in billions of dollars in inappropriate federal reimbursement. It  will be important to use the results of these follow-up reviews as a basis to  determine whether its prevention and mitigation steps are adequate and  effective and then to adjust them accordingly. Fully documenting the  results of these types of activities will help inform planning for future  mitigation efforts.
Because CMS has not fully implemented mechanisms to measure how  risks have changed as a result of actions to address the risks, we are  reiterating our prior recommendation in this area.
Improving analysis capabilities—In our 2002 report, we recommended  that CMS use comprehensive Medicaid payment data that states must  provide to the national MSIS database. Use of these data could improve  CMS’s analysis capabilities. MSIS contains Medicaid program information  including data on billions of claims. This database could be used to  identify trends in certain Medicaid services from prior-year claims that  could be useful in analyzing current-year state claims. According to a CMS  official, CMS has not yet developed the ability to make these data available  for use by the financial analysts and funding specialists in their oversight  activities. Further, only a few CMS staff with the requisite systems  capabilities are currently able to access and analyze the data. CMS officials  said they plan to make these data more accessible in the future. Because  CMS has not yet incorporated use of MSIS in its oversight activities, we are  reiterating our prior recommendation.
CMS also has not yet completed two other systems projects intended to  help improve its analysis capabilities. CMS started to develop the:   (1) Transactions, Information Inquiry, and Program Performance System  project—an integrated financial management tool intended to link existing  Medicaid data systems and tools; and (2) Automated Medicaid State Plans  Project—a project to explore collecting electronic submission of state  plans that would provide timely access to critical program information.  CMS officials told us that due to funding constraints, these two projects  have yet to be completed. Determining the systems projects needed to  enhance CMS’s analysis capabilities is important given the challenges of  evaluating state Medicaid expenditures and funding practices.
Collecting and using information on state fraud and abuse control  activities—In our 2002 report, we recommended that CMS enhance the  information that it uses in its oversight of state claims by creating profiles  that document each state’s activities to oversee its Medicaid program and  prevent fraud and abuse. For example, we recommended that the profiles  include information on provider screening procedures and payment  accuracy studies. CMS currently collects some information on these and  other state program integrity efforts as part of compliance reviews that are  conducted by program integrity staff in DFM and the 10 regional offices.  These compliance reviews are to assess whether state Medicaid program  integrity efforts comply with federal requirements such as those governing  provider enrollment, claims review, and coordination with each state’s  Medicaid Fraud Control Unit. However, CMS officials told us that there is  limited coordination between the staff that conduct the compliance  reviews and the financial management staff that oversee state claims.  Further, the compliance reviews have focused on state compliance and  have not evaluated the effectiveness of the states’ fraud and abuse  prevention and detection activities.
CMS is starting to develop strategies as part of the recently created  Medicaid Integrity Program that could address the weaknesses that we  have identified. The Deficit Reduction Act of 2005, enacted in February  2006, provided for the creation of a Medicaid Integrity Program and  required CMS to develop a comprehensive plan for how it would  implement the program. CMS officials have recently begun to develop the  plan and have included proposals for hiring contractors to assess states’  program integrity activities.
Information on states’ activities to oversee their Medicaid programs and  prevent fraud and abuse is important to determine the appropriate level of  federal oversight that should be applied to each state’s claims. Because  CMS is just starting to develop its plan and results are not known yet, we  are reiterating our prior recommendations in this area.
Developing a strategic plan to guide Medicaid financial  management activities—In our 2002 report, we reported that CMS was  starting several initiatives, similar to what we are currently reporting, to  bring about improvements in its financial management activities and  oversight. At the time of our 2002 review, CMS did not have a written  strategic plan that described its many oversight activities and initiatives  and the staff responsible for implementing them. Therefore, we  recommended that CMS develop a written plan and strategy for Medicaid  financial oversight. However, CMS still has not published a comprehensive  plan that describes the many aspects of its Medicaid financial management  strategy and its plans for continuing and sustaining its recent improvement  efforts.
A strategic plan is a key management tool that can help clarify  organizational priorities and unify agency staff in the pursuit of shared  goals. Strategic plans are the starting point and basic underpinning for a  system of program goal-setting and performance measurement. In  accordance with the Government Performance and Results Act of 1993  (GPRA), a multiyear strategic plan articulates the fundamental mission  (or missions) of an organization, and lays out its long-term general goals  for accomplishing that mission, including the resources needed to reach  these goals. The clearer and more precise these goals are, the better able  the organization will be to maintain a consistent sense of direction,  regardless of leadership changes.
HHS prepares a strategic plan as required by GPRA. The HHS strategic  plan contains eight broad program performance goals related to the  missions and programs of its operating divisions. However only one goal  relates to Medicaid financial management—an overall goal for all HHS  programs to “achieve excellence in management practices.” Unlike the  Medicare program that started publishing a separate comprehensive plan  for financial management in fiscal year 2001 that outlined problems and  plans to address weaknesses in the Medicare program’s internal controls,  oversight, and financial systems, the Medicaid program has not  developed its own plan for financial management that includes an  appropriate level of detail to be useful as a tool to guide its financial  managers.
Medicaid officials told us that they have several planning documents— such as the annual financial management work plans, the FMAR, and the  Financial Issues Report that we previously discussed—that they use in  managing financial management activities. While these documents provide  information on aspects of CMS’s financial management activities, they do  not clearly define the mission of Medicaid financial management, lay out  the goals for continuously implementing the mission, or provide a  complete description of the operational processes, skills, technology, and  other resources required to meet CMS’s financial management goals and  objectives.
Without a strategic plan, CMS lacks an appropriate “roadmap” to guide  activities for ensuring sound financial management of the Medicaid  program. Therefore, we are reiterating our recommendation in this area.
section_title: Use of HCFAC Funds to Enhance Medicaid Oversight Initiatives
paragraphs: During fiscal years 2003 through 2005, CMS received almost $46 million  from the HCFAC account that it has used to help fund programs related to  its oversight of Medicaid. Congress enacted the HCFAC program as part of  the Health Insurance Portability and Accountability Act of 1996 to  consolidate and strengthen ongoing efforts to combat fraud and abuse in  health care programs, including the Medicare and Medicaid programs. The  legislation required the establishment of the national HCFAC program and  it established the HCFAC account within the Medicare Federal Hospital  Insurance Trust Fund, which is funded by appropriations out of the Trust  Fund. The HCFAC program is administered by HHS and the Department of  Justice and is designed to coordinate federal, state, and local law  enforcement activities with respect to health care fraud and abuse. HHS’s  OIG, the Federal Bureau of Investigation, and the Medicare Integrity  Program receive direct appropriations from the HCFAC account, while the  Medicaid program must request funds from the HCFAC account and  compete with other HHS programs, such as the Administration on Aging  and the Office of General Counsel, for allocations from the discretionary  part of the HCFAC account. Table 4 shows the discretionary HCFAC  funds available to CMS in fiscal years 2003 through 2005 and the portion  allocated to the Medicaid program run by CMSO for Medicaid financial  management projects.
CMSO used this money to help fund projects related to its oversight of  Medicaid. Table 5 shows the various projects for the 3 fiscal years and the  amounts allocated to those projects.
The HCFAC account provided about $12 million to CMS for the funding  specialists for fiscal years 2004 and 2005. The funding specialists have  been funded on an annual basis with appropriations from the HCFAC  account. There is the chance that adequate funding might not be provided  through the HCFAC process in any given year for the funding specialists;  thus CMS officials have told us they would like to pursue ways of making  the funding specialist positions permanent. CMS officials told us that there  was a provision in its fiscal year 2007 budget submission, but the provision  was rejected during department-level discussions, so the funding  specialists will continue to be funded on an annual basis with HCFAC  funds. CMS officials also told us that some of the turnover of funding  specialist staff was due to the uncertainty of funding and whether the  positions would become permanent. Creating permanent funding  specialist positions is important, given how CMS has been using them in  performing reviews of high-risk issues.
Other Medicaid projects included in table 5 that CMS used HCFAC funds  for include:  interagency agreements between CMS and OIG for OIG audits of high-risk  issues such as family planning services in managed care, skilled  professional medical personnel, upper payment limits, school-based  claims, home- and community-based services, and Medicaid administrative  costs reported by state agencies other than the Medicaid single state  agency;    Medicare-Medicaid data match project developed to identify improper  billing and utilization patterns by matching Medicare and Medicaid claims  information on providers and beneficiaries;    Payment Accuracy Measurement, PERM, and SCHIP Error Rate Pilot  Projects, which allow states to test a methodology to determine improper  payment error rates in their SCHIP and/or Medicaid programs;    Transaction, Information, Inquiry and Program Performance System to  develop and enhance an integrated financial management tool linking  existing CMSO data systems and tools containing critical financial,  statistical, administrative, and other data;    an organizational study of Medicaid financial processes within CMS done  by OIG under an interagency agreement with OIG;    a project referred to as the Annuities Project, which used both qualitative  and quantitative research methods to develop a comprehensive picture of  states’ experience with the use of annuities as an asset-sheltering device  by Medicaid applicants and their spouses;    a Waiver Management System Database project, which updated a current  Waiver Management System Database; and    a project to research options for automating the Medicaid state plan  process from the creation and submission of state plan amendments at the  state level through approval at the central office and regional offices.
We obtained documentation to support the use of HCFAC funds for the  above projects.
section_title: Conclusions
paragraphs: Since we last reported in 2002, CMS has made improvements to the  processes it uses in its efforts to oversee states and identify payment  errors. Efforts undertaken, such as the hiring of the funding specialists,  consolidating the review of reimbursement state plan amendments, and  the Medicare-Medicaid data match project have enhanced CMS’s ability to  identify issues that put federal Medicaid dollars at risk. While CMS’s  actions address previously identified weaknesses and recommendations  from our 2002 report related to (1) targeting resources to higher risk areas,  (2) monitoring performance, (3) establishing mechanisms for ensuring  accountability, (4) developing an approach to payment accuracy reviews  and (5) incorporating advanced control techniques, it is too soon to assess  the impact they will have on improving overall financial management and  addressing emerging issues that put federal Medicaid dollars at risk  because the results of some efforts are not known yet.
In addition, several weaknesses remain in CMS’s oversight that could be  addressed by implementing our prior recommendations that remain open.
Specifically, CMS still lacks processes to adjust oversight activities for  changes in risk; therefore, we reiterate our prior recommendation related  to measuring whether risks have changed as a result of corrective actions  to address them. Also, because CMS has not yet addressed weaknesses we  identified in its analysis capabilities, we reiterate our prior  recommendation for CMS to incorporate using MSIS data in its analysis of  state claims. We also reiterate our prior recommendations to CMS for  collecting and using information on state fraud and abuse control  activities because this information is important to determining the  appropriate level of federal oversight of state claims.
The absence of a strategic plan could hinder CMS in sustaining its current  efforts and addressing the weaknesses that we have identified. Therefore,  we reiterate our prior recommendation that CMS develop a strategic plan  specific to Medicaid financial management. Also, CMS may not have the  staff and systems needed to continuously identify and target high-risk  issues. Therefore, we stress the importance of creating permanent funding  specialist positions and determining what systems projects are needed to  improve their analysis capabilities.
section_title: Recommendations for Executive Action
paragraphs: To further improve and sustain CMS’s oversight of state claims, including  its ability to identify and address emerging issues, we recommend that the  Administrator of CMS take the following two additional actions:    Create permanent funding specialist positions.    Determine what systems projects are needed to further enhance data  analysis capabilities.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, which are reprinted in  appendix III, CMS agreed with our findings and recommendations and  stated that it will continue examining issues raised in this report, including  prior recommendations from our 2002 report that are still outstanding.  CMS also stated that it will work to implement the two recommendations  made in this report. CMS expressed its support for our recommendation to  create permanent funding specialist positions, which are currently funded  with HCFAC dollars, and stated it will consider alternative approaches to  provide adequate resources. CMS further stated it will follow our second  recommendation and begin the process of determining the system projects  that are needed to further enhance data capabilities. CMS also provided  additional information on several of the activities we reported on,  including additional activities of the funding specialists and actions being  taken on our prior recommendations.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days  from the date of this letter. We will then send copies to the Secretary of  Health and Human Services, Administrator of CMS, Inspector General of  HHS, and other interested parties. Copies will be made available to others  upon request. In addition, this report will be available at no charge on the  GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-8341 or calboml@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors are acknowledged in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To identify the extent to which the Centers for Medicare & Medicaid  Services (CMS) has improved its oversight, including its ability to identify  and address emerging issues that put federal Medicaid dollars at risk, we  performed work at CMS headquarters and two regional offices. We  reviewed and assessed aspects of CMS’s financial oversight processes,  which include identifying high-risk areas in order to develop an annual  regional office financial management workplan and conducting focused  financial reviews of high-risk areas. We reviewed 35 of the 113 focused  financial reviews conducted by CMS regional offices for fiscal years 2003  and 2004. We selected reviews of specific issues that were reviewed across  regions and fiscal years, such as disproportionate share hospital payments  and school-based administrative services. We did not select certain issues,  such as upper payment limits and intergovernmental transfers, because  these issues have been well-covered in other reports and by CMS’s actions.  We looked for consistency of the reviews among regions and fiscal years  and the extent to which states implemented CMS’s recommendations. We  obtained and reviewed documentation showing the activities and work  performed by the new funding specialists hired by CMS during 2004 and  2005 as part of its efforts to improve its financial management of the  Medicaid program. We reviewed our prior reports and reports by the  Department of Health and Human Service’s Office of Inspector General  (OIG) and others. We also reviewed interagency agreements between CMS  and OIG. We interviewed OIG staff, and CMS officials and staff at the CMS  central office in Baltimore, Maryland, and two regional offices—New York  and Chicago. We selected the New York and Chicago regional offices to  visit based on the number of focused financial reviews we selected to  review that were performed by these regions. Sixteen of the 35 focused  financial reviews we selected to review were performed by these two  regions; the remaining 19 focused financial reviews were done by seven  other regional offices. We also considered the Comptroller General’s  Standards for Internal Control in the Federal Government.
To determine how CMS used funds from the Health Care Fraud and Abuse  Control (HCFAC) account for fiscal years 2003 through 2005, we obtained  from CMS a list of Medicaid projects that were funded from the HCFAC  account in fiscal years 2003 through 2005. We obtained and examined  documentation from CMS such as invoices; grant awards; interagency  agreements; and accounting, budget, and payroll records that support the  information provided by CMS on how it spent HCFAC funds for fiscal  years 2003 through 2005. We also reviewed the HCFAC program and  funding legislation, 42 U.S.C. §§ 1320a-7c, 1395i(k).
We requested written comments on a draft of this report from the  Administrator of CMS or his designee. His written comments are reprinted  in appendix III. We conducted our review from February 2005 to May 2006  in accordance with generally accepted government auditing standards.
section_title: Appendix II: Status of Prior Recommendations
section_title: Appendix III: Comments from the Centers for Medicare & Medicaid Services
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: Staff members who made key contributions to this report include  Kimberly Brooks (Assistant Director), Theresa Bowman, Lisa Crye, Abe  Dymond, Diane Morris, Michelle Smith, and Edward Tanaka.
section_title: Related GAO Products
paragraphs: Medicaid Integrity: Implementation of New Program Provides  Opportunities for Federal Leadership to Combat Fraud, Waste, and  Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006.
Medicaid Fraud and Abuse: CMS’s Commitment to Helping States  Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.:  June 28, 2005.
Medicaid: States’ Efforts to Maximize Federal Reimbursements  Highlight Need for Improved Federal Oversight. GAO-05-836T.  Washington, D.C.: June 28, 2005.
Medicaid Financing: States’ Use of Contingency-Fee Consultants to  Maximize Federal Reimbursements Highlights Need for Improved  Federal Oversight. GAO-05-748. Washington, D.C.: June 28, 2005.
Health Care Fraud and Abuse Control Program: Results of Review of  Annual Reports for Fiscal Years 2002 and 2003. GAO-05-134.  Washington, D.C.: April 29, 2005.
High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January  2005.
Medicaid Program Integrity: State and Federal Efforts to Prevent and  Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004.
Medicaid: Intergovernmental Transfers Have Facilitated State  Financing Schemes. GAO-04-574T. Washington, D.C.: March 18, 2004.
Medicaid: Improved Federal Oversight of State Financing Schemes Is  Needed. GAO-04-228. Washington, D.C.: February 13, 2004.
Major Management Challenges and Program Risks: Department of  Health and Human Services. GAO-03-101. Washington, D.C.: January  2003.
Medicaid Financial Management: Better Oversight of State Claims for  Federal Reimbursement Needed. GAO-02-300. Washington, D.C.: February  28, 2002.