National Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit Collaboration with States
Released: 2012-06-14T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Medicaid, the joint federal-state health care financing program for certain low-income individuals, has the second-highest estimated improper payments of any federal program. The Deficit Reduction Act of 2005 expanded the federal role in Medicaid program integrity, and the Centers for Medicare & Medicaid Services (CMS), the federal agency that oversees Medicaid, established the MIG, which designed the NMAP. Since the NMAP’s inception, the MIG has used three different audit approaches: test, MSIS, and collaborative. This report focuses on (1) the effectiveness of the MIG’s implementation of NMAP, and (2) the MIG’s efforts to redesign the NMAP. To do this work, GAO analyzed MIG data, reviewed its contractors’ reports, and interviewed MIG officials, contractor representatives, and state program integrity officials.

section_title: What GAO Found
paragraphs: Compared to the initial test audits and the more recent collaborative audits, the majority of the Medicaid Integrity Group’s (MIG) audits conducted under the National Medicaid Audit Program (NMAP) were less effective because they used Medicaid Statistical Information System (MSIS) data. MSIS is an extract of states’ claims data and is missing key elements, such as provider names, that are necessary for auditing. Since fiscal year 2008, 4 percent of the 1,550 MSIS audits identified $7.4 million in potential overpayments, 69 percent did not identify overpayments, and the remaining 27 percent were ongoing. In contrast, 26 test audits and 6 collaborative audits—which used states’ more robust Medicaid Management Information System (MMIS) claims data and allowed states to select the audit targets—together identified more than $12 million in potential overpayments. Furthermore, the median amount of the potential overpayment for MSIS audits was relatively small compared to test and collaborative audits.

The MIG reported that it is redesigning the NMAP, but has not provided Congress with key details about the changes it is making to the program, including the rationale for the change to collaborative audits, new analytical roles for its contractors, and its plans for addressing problems with the MSIS audits. Early results showed that this collaborative approach may enhance state program integrity activities by allowing states to leverage the MIG’s resources to augment their own program integrity capacity. However, the lack of a published plan detailing how the MIG will monitor and evaluate NMAP raises concerns about the MIG’s ability to effectively manage the program. Given that NMAP has accounted for more than 40 percent of MIG expenditures, transparent communications and a strategy to monitor and continuously improve NMAP are essential components of any plan seeking to demonstrate the MIG’s effective stewardship of the resources provided by Congress.

section_title: What GAO Recommends
paragraphs: GAO recommends that the CMS Administrator ensure that the MIG’s (1) update of its comprehensive plan provide key details about the NMAP, including its expenditures and audit outcomes, program improvements, and plans for effectively monitoring the program; (2) future annual reports to Congress clearly address the strengths and weaknesses of the audit program and its effectiveness; and (3) use of NMAP contractors supports and expands states’ own program integrity efforts through collaborative audits. HHS partially concurred with GAO’s first recommendation commenting that CMS’s annual report to Congress was a more appropriate vehicle for reporting NMAP results than its comprehensive plan. HHS concurred with the other two recommendations.

section_title: Letter
paragraphs: The Centers for Medicare & Medicaid Services (CMS) estimated that  $21.9 billion (8 percent) of Medicaid’s federal expenditures of $270 billion  in fiscal year 2011 involved improper payments, the second highest  amount reported by any federal program. Improper payments include  those made for treatments or services that were not covered by program  rules, that were not medically necessary, or that were billed for but never  provided. Since 2001, we have reported numerous times on improper  payments and our concerns about the adequacy of fiscal oversight in  Medicaid. The challenges inherent in overseeing a program of  Medicaid’s size and diversity make the program vulnerable to improper  payments. Because of the program’s risk of improper payments, as well  as insufficient federal and state oversight, Medicaid has been on our list  of high-risk programs since January 2003.

The Medicaid program consists of 56 distinct state-based programs that  operate within broad federal guidelines. defense against Medicaid improper payments. Specifically, they must  ensure the qualifications of the providers who bill the program, detect  improper payments, recover overpayments, and refer suspected cases of  fraud and abuse to law enforcement authorities. At the federal level, CMS  is responsible for oversight of the Medicaid program. Until the Deficit  Reduction Act of 2005 (DRA), Medicaid program integrity had been  primarily a state responsibility. The DRA created the Medicaid Integrity  Program to oversee and support state efforts and, among other actions,  directed CMS to hire contractors to review and audit state Medicaid  claims data, which CMS calls the National Medicaid Audit Program  (NMAP). CMS established the Medicaid Integrity Group (MIG) to  implement these DRA provisions.

The federal government matches states’ expenditures for most Medicaid services using a  statutory formula based on each state’s per capita income. The 56 Medicaid programs  include one for each of the 50 states, the District of Columbia, Puerto Rico, American  Samoa, Guam, the Commonwealth of the Northern Mariana Islands, and the U.S. Virgin  Islands. Hereafter, we refer to the 50 states and the District of Columbia as states; all  other entities were excluded from our work. additional CMS activities that oversee and support state Medicaid  program integrity.

To address both of our reporting objectives, we analyzed NMAP data  provided by the MIG and interviewed MIG officials. We assessed the  reliability of these data and found them sufficiently reliable for our  purposes. In addition, we reviewed annual lessons-learned reports  submitted by the MIG’s review and audit contractors and interviewed  representatives of each type of contractor. We also interviewed program  integrity officials in 11 states to obtain their perspectives on the NMAP  and collected additional information from 8 states where the MIG has  recently implemented changes to the NMAP. The 11 states were:  Arizona, California, Connecticut, Florida, Kentucky, New York, Ohio,  Pennsylvania, Texas, Washington, and Wisconsin. We selected these  states because of their geographic diversity and because together they  accounted for more than half of all Medicaid spending and beneficiaries.  Separately, we contacted the 9 states where CMS had implemented  changes to the NMAP to obtain their perspective on the redesign— Arkansas, California, Idaho, Maryland, Mississippi, New Jersey, Ohio,  Texas, and Washington. California did not respond to our questions  regarding the redesign. We reviewed relevant Department of Health and  Human Services Office of the Inspector General (HHS-OIG) reports, and  interviewed HHS-OIG officials involved in early assessments of the MIG’s  review and audit contractors. We conducted this audit work between July  2011 and June 2012 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  performance audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis or our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The MIG has taken three different approaches since establishing the  NMAP—test audits, Medicaid Statistical Information System (MSIS)  audits, and collaborative audits. In each approach, contractors  conducted post payment audits, that is, they reviewed medical  documentation and other information related to Medicaid claims that had  already been paid. The key differences among the three NMAP  approaches were (1) the data sources used to identify audit targets, and  (2) the roles assigned to states and contractors. In June 2007, the MIG  hired a contractor to conduct test audits, and it implemented MSIS audits  beginning in December 2007 by hiring separate review and audit  contractors for each of five geographic areas of the country. Collaborative  audits were introduced in January 2010.
subsections: section_title: Test Audits
paragraphs: In June 2007, the MIG hired a contractor to conduct test audits in five  states. Working with the MIG and the states, the contractor audited 27  providers. States provided the initial audit targets based on their own  analysis of Medicaid Management Information System (MMIS) data.  MMIS are mechanized claims processing and information retrieval  systems maintained by individual states, and generally reflect real-time  payments and adjustments of detailed claims for each health care service  provided. In some cases, states provided samples of their claims data  with which to perform the audits, and in other cases states provided a  universe of paid claims that the MIG’s contractor analyzed to derive the  sample. Twenty-seven test audits were conducted on hospitals,  physicians, dentists, home health agencies, medical transport vendors,  and durable medical equipment providers.

section_title: MSIS Audits
paragraphs: In December 2007, while test audits were still under way, the MIG began  hiring review and audit contractors to implement MSIS audits.audits differed from the test audits in three ways.

First, MSIS audit targets were selected based on the analysis of  Medicaid Statistical Information System (MSIS) data. MSIS is a  national data set collected and maintained by CMS consisting of  extracts from each state’s MMIS, including eligibility files and paid  claims files that were intended for health care research and evaluation  activities but not necessarily for auditing. As a subset of states’ more  detailed MMIS data files, MSIS data do not include elements that can  assist in audits, such as the explanations of benefit codes and the  names of providers and beneficiaries. In addition, MSIS data are not  as timely because of late state submissions and the time it takes  CMS’s contractor to review and validate the data. MIG officials told  us that they chose MSIS data because the data were readily available  for all states and the state-based MMIS data would require a  significant amount of additional work to standardize across states.  (See table 1 below.)

Second, MSIS audits were conducted over a wider geographic area;  44 states have had MSIS audits, compared with the small number of  states selected for test audits.

Third, MSIS audits use two types of contractors—review contractors  to conduct data analysis and help identify audit leads, and audit  contractors to conduct the audits. In the test audits, the states  provided the initial audit leads.

Review contractors. The MIG’s two review contractors analyze MSIS data  to help identify potential audit targets in an analytic process known as  data mining. The MIG issues monthly assignments to these contractors,  and generally allows the contractors 60 days to complete them. For each  assignment, the MIG specifies the state, type of Medicaid claims data,  range of service dates, and algorithm (i.e., a specific set of logical rules or  criteria used to analyze the data). The work of the review contractor is  summarized in an algorithm findings report, which contains lists of  providers ranked by the amount of their potential overpayment. The  January through June 2010 algorithm reports reviewed by the HHS-OIG   The  identified 113,378 unique providers from about 1 million claims.MIG’s Division of Fraud Research & Detection oversees the technical  work of the review contractors. A summary of the review contractor  activities for MSIS audits is shown in figure 1.

Audit contractors. The MIG’s audit contractors conduct postpayment  audits of Medicaid providers. Audit leads are selected by the MIG’s  Division of Field Operations, generally by looking at providers across one  or more applicable algorithms to determine if they have been overpaid or  demonstrated egregious billing patterns. From the hiring of audit  contractors in December 2007 through February 2012, the division  assigned 1,550 MSIS audits to its contractors. During an audit, the  contractor may request and review copies of provider records, interview  providers and office personnel, or visit provider facilities. If an  overpayment is identified, the contractor drafts an audit report, which is  shared with the provider and the state. Ultimately, the state is responsible  for collecting any overpayments in accordance with state law and must  report this information to CMS. A summary of the audit contractor  activities is shown in figure 2.

In June 2011, CMS released its fiscal year 2010 report to Congress,  which outlined a redesign of the NMAP with an approach that closely  resembled the test audits. The report described the redesign as an effort  to enhance the NMAP and assist states with their program integrity  priorities. CMS refers to this new approach as collaborative audits. In  these collaborative audits, MIG and its contractor primarily used MMIS  data and leveraged state resources and expertise to identify audit  targets. In contrast, MSIS audits used separate review contractors and  MSIS data to generate lists of providers with potential overpayments, and  the MIG selected the specific providers to be audited.

section_title: NMAP Contractor Expenditures
paragraphs: From June 2007 through February 2012, payments to the contractors for   On an annual  test, MSIS, and collaborative audits totaled $102 million.basis, these contractor payments account for more than 40 percent of all  of the MIG’s expenditures on Medicaid program integrity activities.  Contractor payments rose from $1.3 million in fiscal year 2007 and  reached $33.7 million in fiscal year 2011. (See fig. 3.) The total cost of the  NMAP is likely greater than $102 million because that figure does not  include expenditures on the salaries of MIG staff that support the  operation of the program.

section_title: The Majority of the MIG’s NMAP Audits Were MSIS Audits, Which Were Less Effective than Other Audit Approaches
paragraphs: The MSIS audits were less effective in identifying potential overpayments  than test and collaborative audits. The main reason for the difference in  audit results was the use of MSIS data. According to MIG officials, they  chose MSIS data because the data were readily available for all states,  they are collected and maintained by CMS, and are intended for health  care research and evaluation activities. However, the MSIS audits were  not well coordinated with states, and duplicated and diverted resources  from states’ program integrity activities.
subsections: section_title: MSIS Audits Were Less Effective than Test and Collaborative Audits
paragraphs: Compared with test and collaborative audits, the return on MSIS audits  was significantly lower. As of February 2012, a small fraction of the 1,550  MSIS audits identified $7.4 million in potential overpayments. In contrast,  26 test audits and 6 collaborative audits together identified $12.5 million  in potential overpayments (see fig. 4.) Appendix II provides details on the  characteristics of MSIS audits that successfully identified overpayments.  While the newer collaborative audits have not yet identified more in  overpayments than MSIS audits, only 6 of the 112 collaborative audits  have final audit reports (see app. III), suggesting that the total  overpayment amounts identified through collaborative audits will continue  to grow. In addition, the MSIS audits identified potential overpayments  for much smaller amounts. Half of the MSIS audits were for potential  overpayments of $16,000 or less, compared to a median of about  $140,000 for test audits and $600,000 for collaborative audits.

The use of MSIS data was the principal reason for the poor MSIS audit  results, that is, the low amount of potential overpayments identified and  the high proportion of unproductive audits. Over two-thirds (69 percent)  of the 1,550 MSIS audits assigned to contractors through February 2012  were unproductive, that is, they were discontinued (625), had low or no  findings (415), or were put on hold (37). (See fig. 5.) Our findings are  consistent with an early assessment of the MIG’s audit contractors, which  cited MSIS data issues as the top reason that MSIS audits identified a  lower amount of potential overpayments.

State program integrity officials, the HHS-OIG, and its audit contractors  told the MIG that MSIS data would result in many false leads because the  data do not contain critical audit elements, including provider identifiers;  procedure, product, and service descriptions; billing information; and  beneficiary and eligibility information. For example, the MIG assigned   81 MSIS audits in one state because providers appeared to be billing  more than 24 hours of service in a single day. However, all of these  audits were later discontinued because the underlying data were  incomplete and thus misleading; the audited providers were actually large  practices with multiple personnel, whose total billing in a single day  legitimately exceeded 24 hours. One state official told us that when states  met with the MIG staff during the roll out of the Medicaid Integrity  Program, the state officials emphasized that (1) MSIS data could not be  used for data mining or auditing because they were ‘stagnant,’ i.e., MSIS  does not capture any adjustments that are subsequently made to a claim  and (2) MMIS data were current and states would be willing to share their  MMIS data with CMS. In their annual lessons-learned reports, the audit  and review contractors told the MIG that the MSIS data were not timely or  accurate, and recommended that the MIG help them obtain access to  state MMIS data.based audits to its contractors; 78 percent of MSIS audits (1,208) were  assigned after the August 2009 HHS-OIG report.

Nevertheless, the MIG continued to assign MSIS- MIG officials told us that they chose MSIS data because the data were  readily available for all states, they are collected and maintained by CMS,  and are intended for health care research and evaluation activities.  However, when considering the use of MSIS data, officials said that they  were aware that the MSIS data had limitations for auditing and could  produce many false leads. MIG officials also told us that collecting states’  MMIS data would have been burdensome for states and would have  resulted in additional work for the review contractors because they would  need to do a significant amount of work to standardize the MMIS data to  address discrepancies between the states’ data sets. However, officials in  13 of the 16 states we contacted volunteered that they were willing to  provide the MIG with MMIS data if asked to do so. In addition, the review  contractors have had to do some work to standardize the state files within  the MSIS maintained by CMS.

section_title: MSIS Audits Were Not Well Coordinated with States and Diverted Resources from States’ Program Integrity Activities
paragraphs: The MIG did not effectively coordinate MSIS audits with states and as a  result, the MIG duplicated state program integrity activities. Officials from  several states we interviewed noted that some of the algorithms used by  the review contractor were identical to or less sophisticated than the  algorithms they used to identify audit leads. An official in one state told us  that even after informing the contractor that its work would be duplicative,  the review contractor ran the algorithm anyway. Officials in another state  told us that the MIG was unresponsive to state assertions that it had a  unit dedicated to reviewing a specific category of claims and the MIG was  still pursuing audits for this provider type. State officials also cited general  coordination challenges, including difficulty communicating with  contractors. MIG officials acknowledged that poor communications  resulted in the pursuit of many false leads that had not been adequately  vetted by the states. In addition, representatives of a review contractor we  interviewed told us that states did not always respond to requests to  validate overpayments in the algorithm samples provided and the MIG  may not have been aware of the lack of a state response when making  audit assignments.

State officials we interviewed told us that the review contractors’ lack of  understanding of state policy also contributed to the identification of false  leads, even though (1) the MIG required its contractors to become familiar  with each state’s Medicaid program, and (2) the MIG reviewed state  policies as a quality assurance step prior to assigning leads to its audit  contractors. Nonetheless, one state official described how the MIG and its  review and audit contractors had mistakenly identified overpayments for  federally qualified health centers because they assumed that centers  should receive reduced payments for an established patient on  subsequent visits. In fact, centers are paid on an encounter basis, which  uses the same payment rate for the first and follow-up visits.

Officials in seven of the states we spoke with described the resources  involved in assisting the MIG and its contractors. For example, states told  us that they had assigned staff to: (1) review the algorithms used by  review contractors to generate potential audit leads; (2) review lists of  audit leads created by the MIG; and (3) provide information and training  on state-level policies to audit contractors. One state official described  how it had clinical staff rerun algorithms using the state’s data system to  see if the audit targets chosen by the MIG had merit.state staff found that the MIG was pursuing a false lead, the state had to  provide the MIG and its contractors with detailed explanations of why the  suspect claims complied with state policies. While the state officials we  spoke with did not estimate the cost of their involvement in MSIS audits,  officials in some states said that participation in MSIS audits diverted staff  from their regular duties. MIG officials told us they were sensitive to state  burden and had attempted to minimize it.

section_title: MIG’s Redesign of the NMAP Has Potential Advantages, but MIG Has Not Been Transparent about Key Details of the Program’s Redesign
paragraphs: MIG’s redesigned NMAP focuses on collaborative audits, which may  enhance state Medicaid program integrity activities, and it also intends to  continue using MSIS data in some audits. As part of its NMAP redesign,  the MIG has assigned new activities to its review contractors, but it is too  early to assess their benefit. CMS has not reported to Congress key  details about the changes it is making to the NMAP, including the  rationale for the redesign of the program, but it plans to discuss these  changes in its upcoming 2012 strategic plan.
subsections: section_title: Collaborative Audits Enhance States’ Program Integrity Activities; MIG also Plans to Continue Using MSIS Data in Some Audits
paragraphs: As part of its redesign, the MIG launched collaborative audits with a small  number of states in early 2010 to enhance the MIG’s program and assist  states with their own program integrity priorities. The MIG did not have a  single approach for collaborative audits. For example, one state told us  that the MIG’s audit contractor suggested that together they discuss  conducting a collaborative audit with the MIG while in another state a  collaborative audit was initiated by the MIG, with the audit contractor’s  role limited to assistance during the audit (rather than leading it).

Generally, collaborative audits allow states to augment their own program  integrity audit capacity by leveraging MIG’s and its contractors’ resources.  For example, officials from six of the eight states we interviewed told us  the services targeted for collaborative audits were those that the state did  not have sufficient resources to effectively audit on its own. In some  cases, the MIG’s contractor staff conducted additional audits. In others,  contractors were used to assess the medical necessity of claims when  the states’ programs needed additional clinical expertise to make a  determination.

Officials from most of the states we interviewed agreed that the  investment in collaborative audits was worthwhile but some told us that  collaborative audits created some additional work for states. For example,  two state programs reported that their staff was involved in training the  MIG’s contractor staff. In one of these states, state program staff  dedicated a full week to train the MIG’s audit contractor so that the  contractor’s work would be in accordance with state policies. Another  state program official reported that staff had to review all audits and  overpayment recovery work, leading to a “bottleneck” in the state’s own  program integrity activities. Officials in one state suggested that the  collaborative audits could be improved if the MIG formalized a process for  communicating and resolving disagreements related to audit reports, and  minimized the changing of contractors in order to reduce the burden on  states. Most states were in favor of expanding the number of collaborative  audits. According to the MIG, the agency plans to expand its use of  collaborative audits to as many states as are willing to participate. In fact,  officials indicated that they are discussing collaborative audits with an  additional 12 states.

MIG officials noted that they do not foresee the collaborative audits  completely replacing audits based on MSIS data. According to MIG  officials, NMAP audits using MSIS data might be appropriate in certain  situations, including audits of state-owned and operated facilities and  states that are not willing to collaborate, as part of the MIG’s oversight  responsibilities. The MIG recognizes that MSIS-based audits are  hampered by deficiencies in the data, and noted that CMS has initiatives  under way to address these deficiencies through the Medicaid and CHIP  Business Information and Solutions Council (MACBIS). MACBIS is an  internal CMS governance body responsible for data planning, ongoing  projects, and information product development. According to MIG  officials, MACBIS projects include efforts to reduce the time from state  submission of MSIS data to the availability of these data; automation of  program data; improvements in encounter data reporting; and  automation, standardization, and other improvements in MSIS data  submissions. One MACBIS project is known as Transformed MSIS   (T-MSIS), which aims to add 1,000 additional variables to MSIS for  monitoring program integrity and include more regular MMIS updates.  MIG officials told us that CMS is currently engaged in a 10-state pilot to  develop the data set for T-MSIS, and anticipates that T-MSIS will be  operational in 2014.

section_title: Changes to the Role of Review Contractors Too Early to Assess
paragraphs: As part of its NMAP redesign, the MIG has assigned new activities to the  review contractors. Because these activities are new, it is too early to  assess their benefit. Although the review contractors were not involved in  early collaborative audits, the MIG expects that they will be involved in  future collaborative audits based on these new activities.

In redesigning the NMAP, the MIG tasked its review contractors in  November 2011 with using MSIS data to compare state expenditures for  a specific service to the national average expenditure for that service to  identify states with abnormally high expenditures. Once a state (or states)  with high expenditures is identified, then discussions are held with the  states about their knowledge of these aberrations and recovery activities  related to the identified expenditures. According to MIG officials, such  cross-state analyses were recently initiated and thus have not yet  identified any potential audit targets. The review contractor also indicated  that it would continue to explore other analytic approaches to identify  causes of aberrant state expenditures.

Additionally, as part of its redesign of the program’s audits, the MIG  instructed its review contractors in November 2011 to reexamine  successful algorithms from previously issued final algorithm reports.  According to the MIG, the purpose of this effort is to identify the factors  that could better predict promising audit targets and thereby improve audit  target selection in the future. Although some MSIS audits identified  potential overpayments, the value of developing a process using MSIS  data to improve audit target selection in the future is questionable.According to the MIG, MSIS audits are continuing but on a more limited  scale and with closer collaboration between states and the MIG’s  contractors.

section_title: CMS Has Not Reported Key Details of Its NMAP Redesign to Congress
paragraphs: In its 2010 annual report to Congress on the Medicaid Integrity Program,  CMS announced that it was redesigning the NMAP in an effort to  enhance MIG programs and assist states with their program integrity  priorities, but it did not provide key details regarding the changes. For  example, the report did not mention that the MSIS audits had a poor  return on investment, the number of unproductive audits, or the reasons  for the unproductive audits. Moreover, since issuing its 2010 annual  report, CMS has assigned new tasks to its review contractors such as  reexamining old final algorithm reports to improve provider target  selection and new cross-state analyses using MSIS data. But CMS has  not yet articulated for Congress how these activities complement the  redesign or how such activities will be used to identify overpayments.

The MIG is preparing a new strategic plan—its Comprehensive Medicaid  Integrity Plan covering Fiscal Years 2013 through 2017—which it plans to  submit to Congress in the summer of 2012. According to MIG officials, the  new strategic plan will generally describe shortcomings in the NMAP’s  original design and how the redesign will address those shortcomings.  However, MIG officials told us that they do not plan to discuss the  effectiveness of the use of funds for MSIS audits, or explain how the MIG  will monitor and evaluate the redesign. In its fiscal year 2013 HHS budget  justification for CMS, the department indicated that in the future CMS  would not report separately on the NMAP return on investment. HHS  explained that it had become apparent that the ability to identify  overpayments is not, and should not be, limited to the activities of the  Medicaid integrity contractors. Rather, HHS said it is considering new  measures that better reflect the resources invested through the Medicaid  Integrity Program. Federal internal control standards provide that effective  program plans are to clearly define needs, tie activities to organizational  objectives and goals, and include a framework for evaluation and  monitoring. Based on these standards, the poor performance of the MSIS  audits should have triggered an evaluation of the program, particularly  given the DRA requirement for CMS to report annually to Congress on  the effectiveness of the use of funds appropriated for the Medicaid  Integrity Program.

section_title: Conclusions
paragraphs: In approximately 5 years of implementation, the MIG has spent at least  $102 million on contractors for an audit program that has identified less  than $20 million in potential overpayments. Moreover, almost two-thirds of  these potential overpayments were identified in a small number of test  and collaborative audits that used different data and took a different  approach to identifying audit targets than the MSIS audits, which  comprised the vast majority of the program’s audits. The poor  performance of the MSIS audits can largely be traced to the MIG’s  decision to use MSIS data to generate audit leads, although evidence  showed that (1) these data were inappropriate for auditing, and   (2) alternative data sources were both available and effective in  identifying potential overpayments. Ineffective coordination with states  and a limited understanding of state Medicaid policies on the part of the  MIG’s contractors also contributed to the poor results of the MSIS audits.

Although the MIG recognizes that the MSIS audits have performed far  below expectations, it has not quantified how expenditures to date have  compared with identified recoveries. Currently, the MIG is experimenting  with a promising approach in which the states identify appropriate targets,  provide the more complete MMIS data, and actively participate in the  audits. This collaborative audit approach has identified $4.4 million in  potential overpayments and is largely supported by the states we spoke  with, even though they may have to invest their own resources in these  audits. However, the MIG has not articulated how its redesign will  address flaws in NMAP and it also plans to continue using MSIS data,  despite their past experience with these data, for cross-state analysis and  for states that are not willing to participate in collaborative audits. At this  time, the MIG is preparing a new comprehensive plan for Congress that  outlines the components of the NMAP redesign. The details provided in  such a plan will be critical to evaluating the effectiveness of the redesign  and the agency’s long-term plan to improve the data necessary to  conduct successful audits. Transparent communications and a well- articulated strategy to monitor and continuously improve NMAP are  essential components of any plan seeking to demonstrate that the MIG  can effectively manage the program.

section_title: Recommendations for Executive Action
paragraphs: To effectively redirect the NMAP toward more productive outcomes and  to improve reporting under the DRA, the CMS Administrator should  ensure that the MIG’s planned update of its comprehensive plan (1) quantifies the NMAP’s  expenditures and audit outcomes; (2) addresses any program  improvements; and (3) outlines plans for effectively monitoring the  NMAP program, including how to validate and use any lessons  learned or feedback from the states to continuously improve the  audits;  future annual reports to Congress clearly address the strengths and  weaknesses of the audit program and its effectiveness; and use of NMAP contractors supports and expands states’ own program  integrity audits, engages additional states that are willing to participate  in collaborative audits, and explicitly considers state burden when  conducting audit activities.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for comment. In its written  comments, HHS stated that we had not appropriately recognized the  progress CMS has made in evaluating and improving the Medicaid  Integrity Program, which included the agency’s redesign of NMAP.  Collaborative audits were the core of that redesign. HHS described  CMS’s redesign approach as a phased one in which not all elements had  been finalized when the agency announced the redesign in its June 2011  annual report to Congress (covering fiscal year 2010). HHS also  commented that we did not fully describe the reasons for CMS’s use of  MSIS data. HHS partially concurred with our first recommendation and  fully concurred with the other two recommendations. HHS’s comments  are reproduced in appendix IV.
subsections: section_title: General Comments
paragraphs: Although we characterized collaborative audits as a promising new  approach, HHS commented that we (1) did not acknowledge that CMS  had presented its rationale for the NMAP redesign in the agency’s June  2011 annual report to the Congress, and (2) inappropriately criticized  CMS for not including other redesign details in its report, which HHS said  had not yet been finalized. We continue to believe that a full articulation of  the redesign should include transparent reporting of the results of the  MSIS audits. However, we agree that the June 2011 report, which was  released 18 months after the initiation of collaborative audits, described  their advantages—use of better data, augmenting state resources, and  providing analytic support for states lacking that capability. Regarding the  use of MSIS data, HHS stated that we do not fully describe CMS’s reason  for its use or acknowledge that CMS sought alternative data sources to  supplement or replace MSIS data. We disagree because our report  provides CMS’s reasons for using MSIS data, acknowledges CMS’s  awareness of the MSIS data limitations, and discusses its Transformed  MSIS project to improve the quality of MSIS data. In addition, we pointed  out that officials in 13 of the 16 states we contacted volunteered that they  were willing to provide CMS with their own more complete and timely  MMIS data. We agree with HHS’s comment that not all of CMS’s plans for  the redesign may have been complete at the time the June 2011 annual  report to Congress was being finalized and therefore could not have been  included in that report. We have revised this report to acknowledge that  some of the elements of the redesign may not have been initiated until  after the June 2011 report was finalized.

section_title: Comments on Our Recommendations
paragraphs: HHS agreed with two of three elements related to our first  recommendation regarding CMS’s planned update of its Comprehensive  Medicaid Integrity Plan covering fiscal years 2013 to 2017. HHS agreed  that the planned update should (1) address any NMAP improvements  proposed by CMS, and (2) outline CMS’s plans for effectively monitoring  the NMAP. HHS commented that CMS considers transparency of the  program’s performance to be a top priority. However, HHS did not concur  that the update should quantify NMAP’s expenditures and audit  outcomes; CMS considers such information to be more appropriately  presented in the annual reports to Congress, which already includes  dollar figures on annual expenditures for NMAP and overpayments  identified in each fiscal year. CMS’s annual reports to Congress have  provided a snapshot of results that did not differentiate between the  effectiveness of the various audit approaches used. For example, in its  annual report covering fiscal year 2010, CMS reported that 947 audits  were underway in 45 states and that its contractors had identified  cumulative potential overpayments of about $10.7 million. Based on our  analysis of CMS’s data, MSIS audits had only identified overpayments of  $2.4 million as of September 30, 2010. The remaining $8.4 million in  overpayments were identified during the test audit phase, in which states  identified the audit targets and supplied their own MMIS data. We  continue to believe that CMS should more fully report on NMAP  expenditures and audit outcomes in its annual reports and provide an  overall assessment of NMAP in its next comprehensive plan.

HHS concurred with our recommendation that CMS should clearly  address NMAPs strengths, weaknesses, and effectiveness in the  agency’s annual reports to Congress. HHS noted that in CMS’s   December 7, 2011 congressional testimony the agency had reported its  awareness of the limitations of MSIS data and outlined steps to improve  contractors’ access to better quality Medicaid data. HHS also concurred  with our recommendation that CMS’s use of NMAP contractors should  support and expand states’ own audit activities, engage other willing  states, and explicitly consider state burden when conducting collaborative  audits. HHS reported that since February 2012 CMS had increased the  number of collaborative audits by 25—from 112 audits in 11 states to 137  in 15 states. Based on HHS comments, we made technical changes as  appropriate.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or yocomc@gao.gov. Contact points for our   Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Major contributions to this report are listed in  appendix V.

section_title: Appendix I: Status of Medicaid Statistical Information System (MSIS) Audits
paragraphs: Total (percent)  59 (4)  296 (19)  355 (23)  118 (8)  1,077 (69)  1,550 (100)

section_title: Appendix II: Information on Medicaid Statistical Information System Audits that Identified Potential Overpayments
paragraphs: The 59 MSIS audits that successfully identified potential overpayments  were conducted in 16 states, and most of these audits involved hospitals  (30 providers) and pharmacies (17 providers). These provider types also  had the highest potential overpayments—over $6 million for hospitals and  $600,000 for pharmacies. Arkansas and Florida accounted for over half of  the audits that identified potential overpayments, but the most substantial  overpayments were in Delaware ($4.6 million) and the District of  Columbia ($1.7 million). (See tables 3 and 4.)

section_title: Appendix III: Status of Collaborative Audits
paragraphs: Total (percent)  18 (16)  6 (5)  24 (21)  85 (76)  3 (3)  112 (100)

section_title: Appendix IV: Comments from the Department of Health and Human Services

section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Carolyn L. Yocom at (202) 512-7114 or yocomc@gao.gov.

section_title: Staff Acknowledgements
paragraphs: In addition to the contact named above, key contributors to this   report were: Water Ochinko, Assistant Director; Sean DeBlieck;   Leslie V. Gordon; Drew Long; and Jasleen Modi.

section_title: Related GAO Products
paragraphs: National Medicaid Audit Program: CMS Should Improve Reporting and  Focus on Audit Collaboration with States. GAO-12-814T. Washington,  D.C.: June 14, 2012.

Program Integrity: Further Action Needed to Address Vulnerabilities in  Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.:  June 7, 2012.

Medicaid: Federal Oversight of Payments and Program Integrity Needs  Improvement. GAO-12-674T. Washington, D.C.: April 25, 2012.

Medicaid Program Integrity: Expanded Federal Role Presents   Challenges to and Opportunities for Assisting States. GAO-12-288T.  Washington, D.C.: December 7, 2011.

Fraud Detection Systems: Additional Actions Needed to Support   Program Integrity Efforts at Centers for Medicare and Medicaid Services.  GAO-11-822T. Washington, D.C.: July 12, 2011.

Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.

Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.

Status of Fiscal Year 2010 Federal Improper Payments Reporting.   GAO-11-443R. Washington, D.C.: March 25, 2011.

Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.

Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. GAO-11-430T. Washington, D.C.:   March 2, 2011.

Opportunities to Reduce Potential Duplication in Government   Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP.  Washington, D.C.: March 1, 2011.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.:   February 2011.

Medicare Recovery Audit Contracting: Weaknesses Remain in  Addressing Vulnerabilities to Improper Payments, Although  Improvements Made to Contractor Oversight. GAO-10-143.   Washington, D.C.: March 31, 2010.

Medicaid: Fraud and Abuse Related to Controlled Substances   Identified in Selected States. GAO-09-1004T. Washington, D.C.:   September 30, 2009.

Medicaid: Fraud and Abuse Related to Controlled Substances Identified  in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009.

Improper Payments: Progress Made but Challenges Remain in  Estimating and Reducing Improper Payments. GAO-09-628T.  Washington, D.C.: April 22, 2009.

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax  System. GAO-08-239T. Washington, D.C.: November 14, 2007.

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax  System. GAO-08-17. Washington, D.C.: November 14, 2007.

Medicaid Financial Management: Steps Taken to Improve Federal  Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705.  Washington, D.C.: June 22, 2006.

Medicaid Integrity: Implementation of New Program Provides  Opportunities for Federal Leadership to Combat Fraud, Waste, and  Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006.


Question-summary annotations: questions: question: why weren't  Medicaid Integrity Group’s (MIG) audits as effective as the initial test audits ?
answer: Compared to the initial test audits and the more recent collaborative audits, the majority of the Medicaid Integrity Group’s (MIG) audits conducted under the National Medicaid Audit Program (NMAP) were less effective because they used Medicaid Statistical Information System (MSIS) data.

question: What is MSIS?
answer: MSIS is an extract of states’ claims data and is missing key elements, such as provider names, that are necessary for auditing.
child_questions: question: What is a big flaw of the MSIS?
answer: Since fiscal year 2008, 4 percent of the 1,550 MSIS audits identified $7.4 million in potential overpayments, 69 percent did not identify overpayments, and the remaining 27 percent were ongoing. In contrast, 26 test audits and 6 collaborative audits—which used states’ more robust Medicaid Management Information System (MMIS) claims data and allowed states to select the audit targets—together identified more than $12 million in potential overpayments.

question: How did MSIS differ from collaborative audits for finding potential overpayments?
answer: Furthermore, the median amount of the potential overpayment for MSIS audits was relatively small compared to test and collaborative audits.

questions: question: What might be problematic with MIG's decision of redesigning NMAP?
answer: The MIG reported that it is redesigning the NMAP, but has not provided Congress with key details about the changes it is making to the program, including the rationale for the change to collaborative audits, new analytical roles for its contractors, and its plans for addressing problems with the MSIS audits.
child_questions: question: Why redesigning NMAP might be difficult to execute?
answer: However, the lack of a published plan detailing how the MIG will monitor and evaluate NMAP raises concerns about the MIG’s ability to effectively manage the program.

question: What were the benefits of the collaborative approach?
answer: Early results showed that this collaborative approach may enhance state program integrity activities by allowing states to leverage the MIG’s resources to augment their own program integrity capacity.

question: Why does Congress believe NMAP is important?
answer: Given that NMAP has accounted for more than 40 percent of MIG expenditures, transparent communications and a strategy to monitor and continuously improve NMAP are essential components of any plan seeking to demonstrate the MIG’s effective stewardship of the resources provided by Congress.

questions: question: How do Medicaid's payments compare to those of other federal programs?
answer: Medicaid, the joint federal-state health care financing program for certain low-income individuals, has the second-highest estimated improper payments of any federal program.

question: How was Medicate impacted by the Deficit Reduction Act of 2005?
answer: The Deficit Reduction Act of 2005 expanded the federal role in Medicaid program integrity, and the Centers for Medicare & Medicaid Services (CMS), the federal agency that oversees Medicaid, established the MIG, which designed the NMAP. Since the NMAP’s inception, the MIG has used three different audit approaches: test, MSIS, and collaborative.

question: What is the main focus of this report?
answer: This report focuses on (1) the effectiveness of the MIG’s implementation of NMAP, and (2) the MIG’s efforts to redesign the NMAP.
child_questions: question: What  steps were taken by the GAO to prepare that report?
answer: To do this work, GAO analyzed MIG data, reviewed its contractors’ reports, and interviewed MIG officials, contractor representatives, and state program integrity officials.

questions: question: What were the GAO's recommendations regarding MIG?
answer: GAO recommends that the CMS Administrator ensure that the MIG’s (1) update of its comprehensive plan provide key details about the NMAP, including its expenditures and audit outcomes, program improvements, and plans for effectively monitoring the program; (2) future annual reports to Congress clearly address the strengths and weaknesses of the audit program and its effectiveness; and (3) use of NMAP contractors supports and expands states’ own program integrity efforts through collaborative audits.
child_questions: question: How did HHS respond to GAO's recommendation.
answer: HHS partially concurred with GAO’s first recommendation commenting that CMS’s annual report to Congress was a more appropriate vehicle for reporting NMAP results than its comprehensive plan. HHS concurred with the other two recommendations.