Patient Protection and Affordable Care Act: Final Results of Undercover Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015
Released: 2016-09-12T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans or apply for Medicaid. The act requires verification of applicant information to determine enrollment or subsidy eligibility. In addition, PPACA provided for the expansion of the Medicaid program. GAO was asked to examine enrollment and verification controls for the marketplaces.

This report, which follows earlier testimony, provides final results of GAO testing and describes (1) undercover attempts to obtain health-plan coverage from the federal Marketplace and selected state marketplaces for 2015, and (2) undercover attempts to obtain Medicaid coverage through the federal Marketplace and the selected state marketplaces. GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online. Ten applications tested controls related to obtaining subsidized coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these states based partly on range of population and whether the state had expanded Medicaid eligibility under PPACA. The other 8 applications tested controls for determining Medicaid eligibility. The results, while illustrative, cannot be generalized. GAO discussed results with CMS and state officials to obtain their views. The states identified several actions being taken in response to GAO's findings.

section_title: What GAO Found
paragraphs: Under the Patient Protection and Affordable Care Act (PPACA), health-insurance marketplaces are required to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies or Medicaid. Verification steps include reviewing and validating an applicant's Social Security number, if one is provided; citizenship, status as a U.S. national, or lawful presence; and household income and family size.

GAO's undercover testing for the 2015 coverage year found that the health-care marketplace eligibility determination and enrollment process for qualified health plans—that is, coverage obtained from private insurers—remains vulnerable to fraud. The federal Health Insurance Marketplace (Marketplace) or selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued, such as numbers starting with “000.” Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.

For eight additional fictitious applications, initially made for Medicaid coverage, GAO was approved for subsidized health-care coverage in seven of the eight cases, through the federal Marketplace and the two selected state marketplaces.

Three of GAO's applications were approved for Medicaid, which was the health-care program for which GAO originally sought approval. In each case, GAO provided identity information that would not have matched Social Security Administration records. For two applications, the marketplace or state Medicaid agency directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone.

For four, GAO was unable to obtain approval for Medicaid but was subsequently able to gain approval of subsidized health-plan coverage. In one case, GAO falsely claimed that it was denied Medicaid and was able to obtain the subsidized health plan when in fact no Medicaid determination had been made at that time.

For one, GAO was unable to enroll into Medicaid, in California, because GAO declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications.

For both sets of testing, GAO submitted fictitious documentation as part of the application and enrollment process. According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplace or Medicaid office only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity.

section_title: Letter
paragraphs: The Patient Protection and Affordable Care Act (PPACA) provides  subsidies to those eligible to purchase private health-insurance plans who  meet certain income and other requirements. With those subsidies and  other costs, the act represents a significant, long-term fiscal commitment  for the federal government. According to the Congressional Budget  Office, the estimated cost of subsidies and related spending under the act  is $56 billion for fiscal year 2017, rising to $106 billion for fiscal year 2026,  and totaling $866 billion for fiscal years 2017–2026.

While subsidies under the act are not paid directly to enrollees,  participants nevertheless benefit financially through reduced monthly  premiums or lower costs due at time of service, such as copayments.  Because subsidy costs are contingent on who obtains coverage,  enrollment controls that help ensure only qualified applicants are  approved for subsidized coverage are a key factor in determining federal  expenditures under the act. In addition, PPACA provided for the  expansion of the Medicaid program. Under the expansion, states may  choose to provide Medicaid coverage to nonelderly adults who meet  income limits and other criteria. Under PPACA, the federal government is  to fully reimburse states through calendar year 2016 for the Medicaid  expenditures of “newly eligible” individuals who gained Medicaid eligibility  through the expansion. According to the Office of the Actuary of the  Centers for Medicare & Medicaid Services (CMS), federal expenditures  for the Medicaid expansion are estimated at $430 billion from 2014  through 2023.

PPACA provides for the establishment of health-insurance marketplaces  to assist consumers in comparing and selecting among insurance plans  offered by participating private issuers of health-care coverage. Under  PPACA, states may elect to operate their own health-care marketplaces,  or they may rely on the federal Health Insurance Marketplace  (Marketplace), known to the public as HealthCare.gov.

In light of the government’s substantial fiscal commitment under the act,  we have conducted a body of work examining enrollment and verification  controls of the federal Marketplace. Specifically, in July 2014, we  presented testimony on the results of our initial work, which focused on  application for, and approval of, coverage for fictitious applicants for the  2014 coverage year—the first under the act—through the federal  Marketplace. In July 2015, we testified on the final results of that work,  including the maintenance of the fictitious applicant identities and  extension of coverage through 2014 and into 2015, payment of federally  subsidized premiums on policies we obtained, and the Marketplace’s  verification process for applicant documentation. You asked us to  continue to examine enrollment and verification controls of the federal  Marketplace and state marketplaces as well, for the 2015 coverage  year—the second under the act. We testified in October 2015 on the  preliminary results of our undercover testing of the federal Marketplace  and selected state marketplaces, for application, enrollment, and  eligibility-verification controls, for both qualified health-care plans and  Medicaid, during the act’s second open-enrollment period ending  February 2015. This report provides the final results of that testing and  includes formal comments from the Department of Health and Human  Services (HHS) and a marketplace in the selected states in response to  our findings. Specifically, this report describes for the 2015 coverage year  (1) results of undercover attempts to obtain qualified health-plan coverage  from the federal Marketplace and selected state marketplaces, and (2)  results of undercover attempts to obtain Medicaid coverage through the  federal Marketplace and selected state marketplaces.

For both objectives, to perform our undercover testing of the federal and  selected state eligibility and enrollment processes for the 2015 coverage  year, we created 18 fictitious identities for the purpose of making  applications for health-care coverage by telephone and online. The  undercover results, while illustrative, cannot be generalized to the full  population of enrollees. For all 18 applications, we used publicly available  information to construct our scenarios. We also used publicly available  hardware, software, and materials to produce counterfeit or fictitious  documents, which we submitted, as appropriate for our testing, when  instructed to do so. We then observed the outcomes of the document  submissions, such as any approvals received or requests to provide  additional supporting documentation.

Because the federal government, at the time of our review, operated a  marketplace on behalf of the state in about two-thirds of the states, we  focused part of our work on two states using the federal Marketplace— New Jersey and North Dakota. We chose these two states because they  had expanded Medicaid eligibility and also delegated their Medicaid  eligibility determinations to the federal Marketplace at the time of our  testing. In addition, we chose two state marketplaces, California and  Kentucky, for our undercover testing. We chose these two states, in part,  based on the states having expanded Medicaid eligibility and differences  in population.

For our first objective, we used 10 applicant scenarios to test controls for  verifications related to qualified health-plan coverage. We stated income  at a level eligible to obtain both types of income-based subsidies  available under PPACA—a premium tax credit, to be paid in advance,  and cost-sharing reduction. For our second objective, we used 8  additional applicant scenarios to test controls for verifications related to  Medicaid coverage. In cases where we did not obtain approval for  Medicaid, we instead attempted, as appropriate, to obtain coverage for  subsidized qualified health plans.

For both objectives, after concluding our undercover testing for 2015, we  briefed officials from CMS; officials from the state marketplaces; and  Medicaid officials from California, Kentucky, and North Dakota on our  results. We offered to brief Medicaid officials from New Jersey but they  declined our offer. To protect our undercover identities, we did not provide  the marketplaces with specific applicant identity information. CMS and  selected state officials generally told us that without such information,  they could not fully research handling of our fictitious applicants. We also  reviewed statutes, regulations, and other policy and related information.  For a full discussion of our scope and methodology, see appendix I.

We conducted this performance audit from November 2014 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
paragraphs: Under PPACA, health-care marketplaces were intended to provide a  single point of access for individuals to enroll in private health plans,  apply for income-based subsidies to offset the cost of these plans— which, as noted, are not paid directly to enrollees, but instead are paid to  health-insurance issuers—and, as applicable, obtain an eligibility  determination or assessment of eligibility for other health-coverage  programs. These other programs include Medicaid and the Children’s  Health Insurance Program. CMS, a unit of HHS, is responsible for  overseeing the establishment of these online marketplaces, and the  agency maintains the federal Marketplace.

To be eligible to enroll in a “qualified health plan” offered through a  marketplace—that is, one providing essential health benefits and meeting  other requirements under PPACA—an individual must be a U.S. citizen or  national, or otherwise be lawfully present in the United States; reside in  the marketplace service area; and not be incarcerated (unless  incarcerated while awaiting disposition of charges). To be eligible for  Medicaid, individuals must meet federal requirements regarding  residency, U.S. citizenship or immigration status, and income limits, as  well as any additional state-specific criteria that may apply.

When applying for coverage, individuals report family size and the  amount of projected income. Based, in part, on that information, the  Marketplace will calculate the maximum allowable amount of advance  premium tax credit. An applicant can then decide if he or she wants all,  some, or none of the estimated credit paid in advance, in the form of  payment to the applicant’s insurer that reduces the applicant’s monthly  premium payment.

Marketplaces are required by PPACA to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. These verification steps  include validating an applicant’s Social Security number, if one is  provided; verifying citizenship, status as a U.S. national, or lawful  presence by comparison with Social Security Administration or  Department of Homeland Security records; and verifying household  income and family size by comparison with tax-return data from the  Internal Revenue Service, as well as data on Social Security benefits  from the Social Security Administration.

PPACA requires that consumer-submitted information be verified, and  that determinations of eligibility be made, through either an electronic  verification system or another method approved by HHS. To implement  this verification process, CMS developed the data services hub, which  acts as a portal for exchanging information between the federal  Marketplace, state-based marketplaces, and Medicaid agencies, among  other entities, and CMS’s external partners, including other federal  agencies. The Marketplace uses the data services hub in an attempt to  verify that applicant information necessary to support an eligibility  determination is consistent with external data sources.

In February 2016, we issued a report addressing CMS enrollment  controls and the agency’s management of enrollment fraud risk for the  federal Marketplace. Based on our 2014 undercover testing for qualified  health plans and related work, this report included eight  recommendations to HHS to strengthen oversight of the federal  Marketplace. HHS concurred with our recommendations; however, it is  too early to determine whether HHS will fully address the issues we  identified. Our recommendations addressed issues also relevant to our  2015 testing described in this report, including studying changes to  improve eligibility determinations and the data services hub process;  tracking the value of subsidies terminated or adjusted for failure to resolve  application inconsistencies; implementing procedures for resolving Social  Security number inconsistencies; and conducting a comprehensive fraud  risk assessment of the potential for fraud in the process for applying for  qualified health plans through the federal Marketplace.

section_title: Results of Undercover Attempts to Obtain Qualified Health-Plan Coverage from the Federal Marketplace and Selected State Marketplaces
paragraphs: Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for  qualified health plans remains vulnerable to fraud. As shown in figure 1,  the federal Marketplace or selected state marketplaces approved each of  our 10 fictitious applications for subsidized qualified health plans. We  subsequently paid premiums to put these policies into force.

As figure 1 shows, for these 10 applications, we were approved for  subsidized coverage—the premium tax credit, paid in advance, and cost- sharing reduction subsidies—for all cases. The monthly amount of the  advance premium tax credit for these 10 applicants totaled approximately  $2,300 per month, or about $28,000 annually, equal to about 70 percent  of total premiums. For 4 of these applications, we used Social Security  numbers that could not have been issued by the Social Security  Administration. For 4 other applications, we said our fictitious applicants  worked at a company—which we also created—that offered health  insurance, but the coverage did not provide required minimum essential  coverage under PPACA. For the final 2 applications, we used an identity  from our prior undercover testing of the federal Marketplace to apply for  coverage concurrently at two state marketplaces. Thus, this fictitious  applicant received subsidized qualified health-plan coverage from the  federal Marketplace and the two selected state marketplaces at the same  time.

For 8 applications among this group of 10, we failed to clear an identity- checking step during the “front end” of the application process, and thus  could not complete the process. In these cases, we were directed to  contact a contractor that handles identity checking. The contractor was  unable to resolve the identity issues and directed us to call the  appropriate marketplace. We proceeded to phone the marketplaces and  our applications were subsequently approved. The other two applicants  were accepted by phone.

For each of the 10 fictitious applications where we obtained qualified  health-plan coverage, the respective marketplace directed that our  applicants submit supplementary documentation. The marketplaces are  required to seek postapproval documentation in the case of certain  application “inconsistencies”—instances in which information an applicant  has provided does not match information contained in data sources that  the marketplace uses for eligibility verification at the time of application, or  such information is not available. If there is an application inconsistency,  the marketplace is to determine eligibility using the applicant’s  attestations and ensure that subsidies are provided on behalf of the  applicant, if qualified to receive them, while the inconsistency is being  resolved using “back-end” controls. Under these controls, applicants will  be asked to provide additional information or documentation for the  marketplaces to review in order to resolve the inconsistency. As part of  our testing, and to respond to the marketplace directives, we provided  counterfeit follow-up documentation, such as fictitious Social Security  cards with impossible Social Security numbers, for all 10 undercover  applications.

For all 10 of these fictitious applications, we maintained subsidized  coverage beyond the period during which applicants may file supporting  documentation to resolve inconsistencies. In one case, the Kentucky  marketplace questioned the validity of the Social Security number our  applicant provided, which was an impossible Social Security number. In  fact, the marketplace told us the Social Security Administration reported  that the number was not valid. Nevertheless, the Kentucky marketplace  notified our fictitious applicant that the applicant was found eligible for  coverage. For the four fictitious applicants who claimed their employer did  not provide minimum essential coverage, the marketplace did not contact  our fictitious employer to confirm the applicant’s account that the  company offers only substandard coverage.

In August 2015, we briefed CMS, California, and Kentucky officials on the  results of our undercover testing, to obtain their views. According to these  officials, the marketplaces only inspect for documents that have obviously  been altered. Thus, if the documentation submitted does not appear to  have any obvious alterations, it would not be questioned for authenticity.  In addition, according to Kentucky officials, in the case of the impossible  Social Security number, the identity-proofing process functioned correctly,  but a marketplace worker bypassed identity-proofing steps that would  have required a manual verification of the fictitious Social Security card  we submitted. The officials told us they plan to provide training on how to  conduct manual verifications to prevent this in the future. Further,  California officials told us in June 2016 that the marketplace is upgrading  its system in an effort to prevent use of impossible Social Security  numbers. In the case of applicant identity verification in particular,  Covered California officials told us they believed it was likely our  applicants had their identities confirmed because they ultimately  submitted paper applications, signed under penalty of perjury. That  attestation satisfied identity verification requirements, the officials said.

As for our employer-sponsored coverage testing, CMS and California  officials told us that during the 2015 enrollment period, the marketplaces  accepted applicants’ attestation on lack of minimum essential coverage.  As a result, the marketplaces were not required to communicate with the  applicant’s employer to confirm whether the attestation is valid. In June  2016, California officials further told us the marketplace is updating its  application process to provide tools to consumers to help them determine  whether their employer-sponsored insurance meets minimum essential  coverage standards. They also told us the marketplace is updating  policies and procedures for sending notices to employers and developing  longer-term plans for an automated system to send notices to employers.  Kentucky officials told us after our 2015 testing that applicant-provided  information is entered into its system to determine whether the applicant’s  claimed plan meets minimum essential coverage standards. If an  applicant receives a qualified health-plan subsidy because the applicant’s  employer-sponsored plan does not meet the guidelines, the Kentucky  marketplace sends a notice to the employer asking it to verify the  applicant information. The officials told us the employer letter details,  among other things, the applicant-provided information and minimum  essential coverage standards. However, our fictitious company did not  receive such notification.

After our 2015 testing, CMS, California, and Kentucky officials also told us  there was no process to identify individuals with multiple enrollments  through different marketplaces. California officials noted in June 2016 that  the federal government has not made data available that would allow  California to identify duplicate enrollments through different marketplaces.  CMS officials told us it was unlikely an individual would seek to obtain  subsidized qualified health-plan coverage in multiple states. We  conducted this portion of our testing, however, to evaluate whether such a  situation, such as a stolen identity, would be possible. CMS officials told  us the agency would need to look at the risk associated with multiple  coverages.

Kentucky officials told us that in response to our 2015 findings, call-center  staff were retrained on identity-proofing processes, and that they are  improving training for other staff as well. They also said they plan to make  changes before the next open-enrollment period so that call-center  representatives cannot bypass identity-proofing steps, as occurred with  our applications. Further, they said they plan to improve the process for  handling of applications where employer-sponsored coverage is at issue.  Also in response to our findings, California officials said they are  developing process improvements and system modifications to address  the issues we raised.

Finally, in the case of the federal Marketplace in particular, for which, as  noted, we conducted undercover testing previously, we asked CMS  officials for their views on our second-year results compared to the first  year. They told us the eligibility and enrollment system is generally  performing as designed. According to the officials, a key feature of the  system, when applicant information cannot immediately be verified, is  whether proper inconsistencies are generated. This is important so that  such inconsistencies can be addressed later, after eligibility is granted at  time of application. CMS officials noted to us in June 2016 that PPACA  and federal regulations provide for instances when an individual who is  otherwise eligible can receive coverage while an inconsistency is being  resolved. CMS officials told us the overall approach is that CMS must  balance consumers’ ability to effectively and efficiently select Marketplace  coverage with program-integrity concerns.

section_title: Results of Undercover Attempts to Obtain Medicaid Coverage through the Federal Marketplace and Selected State Marketplaces
paragraphs: For our additional eight fictitious applications for Medicaid coverage in  2015, we were approved for subsidized health-care coverage in seven of  the eight applications. As shown in figure 2, for three of the eight  applications, we were approved for Medicaid, as originally sought. For  four of the eight applications, we did not obtain Medicaid approval, but  instead were subsequently approved for subsidized qualified health-plan  coverage. The monthly amount of the advance premium tax credit for  these four applicants totaled approximately $1,100 per month, or about  $13,000 annually. For one of the eight applications, we could not obtain  Medicaid coverage because we declined to provide a Social Security  number.

As with our applications for qualified health plans described earlier, we  also failed to clear the initial identity-checking step for six of eight  Medicaid applications. In these cases, we were likewise directed to  contact a contractor that handles identity checking. The contractor was  unable to resolve the identity issues and directed us to call the  appropriate marketplace. We proceeded to phone the marketplaces.

However, as shown in figure 2, the California marketplace did not  continue to process one of our Medicaid applications. In this case, our  fictitious phone applicant declined to provide what was a valid Social  Security number, citing privacy concerns. A marketplace representative  told us that, to apply, the applicant must provide a Social Security  number. The representative suggested that as an alternative, we could  apply for Medicaid in person with the local county office or a certified  enrollment counselor. After we discussed the results of our undercover  testing with California officials in 2015, they told us their system requires  applicants to provide either a Social Security number or an individual  taxpayer-identification number to process an application. As a result,  because our fictitious applicant declined to provide a Social Security  number, our application could not be processed.
subsections: section_title: Details of Medicaid Applications through the Federal Marketplace
paragraphs: For the four fictitious Medicaid applications submitted to the federal  Marketplace for 2015, we were told that we may be eligible for Medicaid  but that the respective Medicaid state offices might require more  information. For three of the four applications, federal Marketplace  representatives told us we would be contacted by the Medicaid state  offices within 30 days. However, the Medicaid offices did not notify us  within 30 days for any of the applications. As a result, we subsequently  contacted the state Medicaid offices and the federal Marketplace to follow  up on the status of our applications.

For the two New Jersey Medicaid applications, we periodically called the  state Medicaid offices over approximately 4 months in 2015, attempting to  determine the status of our applications. In these calls, New Jersey  representatives generally told us they had not yet received Medicaid  information from the federal Marketplace and, on several occasions, said  they expected to receive it shortly. After our calls to New Jersey Medicaid  offices, we phoned the federal Marketplace to determine the status of our  Medicaid applications.

In one case, the federal Marketplace representative told us New  Jersey determined that our applicant did not qualify for Medicaid. As  a result, the phone representative stated that we were then eligible for  qualified health-plan coverage. We subsequently applied for coverage  and were approved for an advance premium tax credit plus the cost- sharing reduction subsidy.

In the other case, the federal Marketplace representative told us the  Marketplace system did not indicate whether New Jersey received the  application or processed it. The representative advised we phone the  New Jersey Medicaid agency. Later on that same day, we phoned the  federal Marketplace again and falsely claimed that the New Jersey  Medicaid office denied our Medicaid application. Based on this claim,  the representative said we were eligible for qualified health-plan  coverage. We subsequently applied for coverage and were approved  for an advance premium tax credit plus the cost-sharing reduction  subsidy. The federal Marketplace did not ask us to submit  documentation substantiating our Medicaid denial from New Jersey.

In July and August 2015, we offered to meet with New Jersey Medicaid  officials to discuss the results of our testing, but they declined our offer.  CMS officials told us at the time that New Jersey had system issues that  may have accounted for problems in our Medicaid application information  being sent to the state. CMS officials told us that this system issue is now  resolved. In addition, CMS officials told us they do not require proof of a  Medicaid denial when processing qualified health-plan applications; nor  does the federal Marketplace verify the Medicaid denial with the state.  CMS officials said that, instead, they accept the applicant’s attestation  that the applicant was denied Medicaid coverage.

For our North Dakota Medicaid application in which we did not provide a  Social Security number but did provide an impossible immigration  document number, we called the North Dakota Medicaid agency to  determine the status of our application. An agency representative told us  the federal Marketplace denied our Medicaid application and therefore did  not forward the Medicaid application file to North Dakota for a Medicaid  eligibility determination. We did not receive notification of denial from  the federal Marketplace. Subsequently, we called the federal Marketplace  and applied for subsidized qualified health-plan coverage. The federal  Marketplace approved the application, granting an advance premium tax  credit plus the cost-sharing reduction subsidy. Because we did not  disclose the specific identities of our fictitious applicants, CMS officials  could not explain why the federal Marketplace originally said our  application may be eligible for Medicaid but subsequently notified North  Dakota that it was denied.

For the North Dakota Medicaid application for which we did not provide a  valid Social Security identity, we received a letter from the state Medicaid  agency about a month after we applied through the federal Marketplace.  The letter requested that we provide documentation to prove citizenship,  such as a birth certificate. In addition, it requested a Social Security card  and income documentation. We submitted the requested documentation,  such as a fictitious birth certificate and Social Security card. The North  Dakota Medicaid agency subsequently approved our Medicaid application  and enrolled us in a Medicaid plan.

After our undercover testing in 2015, we briefed North Dakota Medicaid  officials and obtained their views. They told us the agency likely approved  the Medicaid application because our fake Social Security card would  have cleared the Social Security number inconsistency. The officials told  us they accept documentation that appears authentic. They also said the  agency is planning to implement a new system to help identify when  applicant-reported information does not match Social Security  Administration records.

section_title: Details of Medicaid Applications through State Marketplaces
paragraphs: As with our applications for coverage under qualified health plans,  described earlier, the state marketplace for Kentucky directed two of our  Medicaid applicants to submit supplementary documentation. As part of  our 2015 testing and in response to such requests, we provided  counterfeit follow-up documentation, such as a fake immigration card with  an impossible numbering scheme, for these applicants. The results of the  documentation submission are as follows:

For the application where the fictitious identity did not match Social  Security records, the Kentucky agency approved our application for  Medicaid coverage. In our discussions with Kentucky officials, they  told us they accept documentation submitted—for example, copies of  Social Security cards—unless there are obvious alterations.

For the Medicaid application without a Social Security number and  with an impossible immigration number, the Kentucky state agency  denied our Medicaid application. A Kentucky representative told us  the reason for the denial was that our fictitious applicant had not been  a resident for 5 years, according to our fictitious immigration card. The  representative told us we were eligible for qualified health-plan  coverage. We applied for such coverage and were approved for an  advance premium tax credit and the cost-sharing reduction subsidy. In  later discussions with Kentucky officials, they told us the  representative made use of an override capability, likely based on  what the officials described as a history of inaccurate applicant  immigration status information for a refugee population. Kentucky  officials also said their staff accept documentation submitted unless  there are obvious alterations, and thus are not trained to identify  impossible immigration numbers. Finally, Kentucky officials said they  would like to have a contact at the Department of Homeland Security  with whom they can work to resolve immigration-related  inconsistencies, similar to a contact that they have at the Social  Security Administration to resolve Social Security–related  inconsistencies.

By contrast, during the Medicaid application process for one applicant,  California did not direct that we submit any documentation. In this case,  our fictitious applicant was approved over the phone even though the  fictitious identity did not match Social Security records. We shared this  result with California officials, who said they could not comment on the  specifics of our case without knowing details of our undercover  application.

section_title: Agency Comments
paragraphs: We provided a draft of this report to HHS, the California Department of  Health Care Services, Covered California, the Kentucky Department for  Medicaid Services, the Kentucky Health Benefit Exchange, and the North  Dakota Department of Human Services. HHS and Covered California  provided written comments, reproduced in appendixes II and III. HHS said  it is committed to verifying eligibility of consumers who apply for health  coverage through the federal Marketplace. The agency is continuing to  make improvements to strengthen program integrity and Marketplace  controls, HHS said. The Marketplace will continue to end coverage or  adjust advance premium tax credit or cost-sharing reduction subsidies for  failure to provide satisfactory documentation, HHS said. Covered  California said it is committed to improving its processes with lessons  learned from results of our undercover testing. Covered California said it  takes vulnerabilities to fraud seriously and stressed the importance of  effective fraud risk management, including an emphasis on consumer  protection. HHS and Covered California also provided us with technical  comments, which we have incorporated, as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, and other  interested parties. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report, which concludes work we initially presented  in a testimony in October 2015, are to describe for the 2015 coverage  year (1) results of undercover attempts to obtain qualified health-plan  coverage from the federal Health Insurance Marketplace (Marketplace)  and selected state marketplaces under the Patient Protection and  Affordable Care Act (PPACA), for the act’s second open-enrollment  period, for 2015 coverage; and (2) results of undercover attempts to  obtain Medicaid coverage through the federal Marketplace and selected  state marketplaces.

For both objectives, to perform our undercover testing of the federal and  selected state eligibility and enrollment processes for the 2015 coverage  year, we created 18 fictitious identities for the purpose of making  applications for health-care coverage by telephone and online. The  undercover results, while illustrative, cannot be generalized to the full  population of enrollees. For all 18 fictitious applications, we used publicly  available information to construct our scenarios. We also used publicly  available hardware, software, and materials to produce counterfeit or  fictitious documents, which we submitted, as appropriate for our testing,  when instructed to do so. We then observed the outcomes of the  document submissions, such as any approvals received or requests to  provide additional supporting documentation.

Because the federal government, at the time of our review, operated a  marketplace on behalf of the state in about two-thirds of the states, we  focused part of our work on two states using the federal Marketplace— New Jersey and North Dakota. We chose these two states because they  had expanded Medicaid eligibility and also delegated their Medicaid  eligibility determinations to the federal Marketplace at the time of our  testing. In addition, we chose two state marketplaces, California and  Kentucky, for our undercover testing. We chose these two states based  on factors including Medicaid expansion; population size (selection of  California allowed inclusion of a significant portion of all state-based  marketplace activity); differences in population (California is about nine  times as populous as Kentucky); and progress made in reducing the  percentage of uninsured residents. Our testing included only applications  through a marketplace and did not include, for example, applications for  Medicaid made directly to a state Medicaid agency.

For our first objective, we used 10 applicant scenarios to test controls for  verifications related to qualified health-plan coverage. Specifically, we  created application scenarios with fictitious applicants claiming to have  impossible Social Security numbers; claiming to be working for an  employer that offers health insurance, but not coverage that meets  “minimum essential” standards; or already having existing qualified  health-plan coverage. We made 4 of these 10 applications online and the  other 6 applications by phone. In these tests, we also stated income at a  level eligible to obtain both types of income-based subsidies available  under PPACA—a premium tax credit, to be paid in advance, and cost- sharing reduction.

For our second objective, we used 8 additional applicant scenarios to test  controls for verifications related to Medicaid coverage. Specifically, our  fictitious applicants provided invalid Social Security identities, where their  information did not match Social Security Administration records, or  claimed they were noncitizens lawfully present in the United States and  declined to provide Social Security numbers. In situations where we were  asked to provide immigration document numbers, we provided impossible  immigration document numbers. We made half of these applications  online and half by phone. In these tests, we also stated income at a level  eligible to qualify for coverage under the Medicaid expansion, where the  federal government is responsible for reimbursing the states for 100  percent of the Medicaid costs in 2015. In cases where we did not obtain  approval for Medicaid, we instead attempted, as appropriate, to obtain  coverage for subsidized qualified health plans in the same manner as  described earlier.

To protect our undercover identities, we did not provide the marketplaces  with specific applicant identity information. CMS and selected state  officials generally told us that without such information, they could not  fully research handling of our applicants. We created our applicant  scenarios without knowledge of specific control procedures, if any, that  CMS or other federal agencies may use in accepting or processing  applications. We thus did not create the scenarios with intent to focus on  a particular control or procedure.

Overall, our review covered the act’s second open-enrollment period, for  2015 coverage, as well as follow-on work after close of the open- enrollment period. We shared details of our work with CMS and the  selected state marketplaces. We had additional discussions with federal  and state marketplace officials in June 2016.

For both objectives, we also reviewed statutes, regulations, and other  policy and related information.

We conducted this performance audit from November 2014 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigative standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.

section_title: Appendix II: Comments from the Department of Health and Human Services

section_title: Appendix III: Comments from Covered California

section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Matthew Valenta, Philip Reiff,  and Gary Bianchi, Assistant Directors; Maurice Belding, Jr.; Mariana  Calderón; Ranya Elias; Colin Fallon; Suellen Foth; Maria McMullen;  James Murphy; George Ogilvie; Ramon Rodriguez; Christopher H.  Schmitt; Julie Spetz; and Elizabeth Wood made key contributions to this  report.


Question-summary annotations: questions: question: What was the conclusion of GAO's undercover testing in 2015?
answer: GAO's undercover testing for the 2015 coverage year found that the health-care marketplace eligibility determination and enrollment process for qualified health plans—that is, coverage obtained from private insurers—remains vulnerable to fraud.
child_questions: question: How did the Marketplace handle GAO's fictitious applications?
answer: The federal Health Insurance Marketplace (Marketplace) or selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved.

question: How were the GAO applications designed to be fictitious?
answer: Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued, such as numbers starting with “000.” Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.

questions: question: How did Medicaid handle GAO's applications?
answer: Three of GAO's applications were approved for Medicaid, which was the health-care program for which GAO originally sought approval.
child_questions: question: How did GAO design these applications to be fictitious?
answer: In each case, GAO provided identity information that would not have matched Social Security Administration records.

question: How did GAO respond to directions to submit supporting documents?
answer: For two applications, the marketplace or state Medicaid agency directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved.
child_questions: question: How was the third application approved?
answer: For the third, the marketplace did not seek supporting documentation, and the application was approved by phone.

questions: question: How did GAO undergo undercover testing of CMS?
answer: For both sets of testing, GAO submitted fictitious documentation as part of the application and enrollment process.
child_questions: question: Why might the marketplace or Medicaid office ask for supporting documentation for an application?
answer: According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplace or Medicaid office only inspect for supporting documentation that has obviously been altered.

question: How are documents without signs of alteration handled?
answer: According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplace or Medicaid office only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity.

questions: question: What is the purpose of this report?
answer: This report, which follows earlier testimony, provides final results of GAO testing and describes (1) undercover attempts to obtain health-plan coverage from the federal Marketplace and selected state marketplaces for 2015, and (2) undercover attempts to obtain Medicaid coverage through the federal Marketplace and the selected state marketplaces.
child_questions: question: How did GAO conduct research for this report?
answer: GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online. Ten applications tested controls related to obtaining subsidized coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these states based partly on range of population and whether the state had expanded Medicaid eligibility under PPACA. The other 8 applications tested controls for determining Medicaid eligibility.
child_questions: question: How did GAO submit the fictitious applications?
answer: GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online.

question: How did GAO decide which states to test?
answer: GAO chose these states based partly on range of population and whether the state had expanded Medicaid eligibility under PPACA.

question: What kind of results did GAO find?
answer: The results, while illustrative, cannot be generalized.
child_questions: question: How did GAO communicate their findings?
answer: GAO discussed results with CMS and state officials to obtain their views.
child_questions: question: How did states respond to GAO's findings?
answer: The states identified several actions being taken in response to GAO's findings.