Patient Protection and Affordable Care Act: Final Results of Undercover Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015
Released: 2016-09-12T00:00:00

Letter

Background

Under PPACA, health-care marketplaces were intended to provide a single point of access for individuals to enroll in private health plans, apply for income-based subsidies to offset the cost of these plans— which, as noted, are not paid directly to enrollees, but instead are paid to health-insurance issuers—and, as applicable, obtain an eligibility determination or assessment of eligibility for other health-coverage programs. These other programs include Medicaid and the Children’s Health Insurance Program. CMS, a unit of HHS, is responsible for overseeing the establishment of these online marketplaces, and the agency maintains the federal Marketplace.

To be eligible to enroll in a “qualified health plan” offered through a marketplace—that is, one providing essential health benefits and meeting other requirements under PPACA—an individual must be a U.S. citizen or national, or otherwise be lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). To be eligible for Medicaid, individuals must meet federal requirements regarding residency, U.S. citizenship or immigration status, and income limits, as well as any additional state-specific criteria that may apply.

When applying for coverage, individuals report family size and the amount of projected income. Based, in part, on that information, the Marketplace will calculate the maximum allowable amount of advance premium tax credit. An applicant can then decide if he or she wants all, some, or none of the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment.

Marketplaces are required by PPACA to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant’s Social Security number, if one is provided; verifying citizenship, status as a U.S. national, or lawful presence by comparison with Social Security Administration or Department of Homeland Security records; and verifying household income and family size by comparison with tax-return data from the Internal Revenue Service, as well as data on Social Security benefits from the Social Security Administration.

PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another method approved by HHS. To implement this verification process, CMS developed the data services hub, which acts as a portal for exchanging information between the federal Marketplace, state-based marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other federal agencies. The Marketplace uses the data services hub in an attempt to verify that applicant information necessary to support an eligibility determination is consistent with external data sources.

In February 2016, we issued a report addressing CMS enrollment controls and the agency’s management of enrollment fraud risk for the federal Marketplace. Based on our 2014 undercover testing for qualified health plans and related work, this report included eight recommendations to HHS to strengthen oversight of the federal Marketplace. HHS concurred with our recommendations; however, it is too early to determine whether HHS will fully address the issues we identified. Our recommendations addressed issues also relevant to our 2015 testing described in this report, including studying changes to improve eligibility determinations and the data services hub process; tracking the value of subsidies terminated or adjusted for failure to resolve application inconsistencies; implementing procedures for resolving Social Security number inconsistencies; and conducting a comprehensive fraud risk assessment of the potential for fraud in the process for applying for qualified health plans through the federal Marketplace.

Results of Undercover Attempts to Obtain Qualified Health-Plan Coverage from the Federal Marketplace and Selected State Marketplaces

Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for qualified health plans remains vulnerable to fraud. As shown in figure 1, the federal Marketplace or selected state marketplaces approved each of our 10 fictitious applications for subsidized qualified health plans. We subsequently paid premiums to put these policies into force.

As figure 1 shows, for these 10 applications, we were approved for subsidized coverage—the premium tax credit, paid in advance, and cost- sharing reduction subsidies—for all cases. The monthly amount of the advance premium tax credit for these 10 applicants totaled approximately $2,300 per month, or about $28,000 annually, equal to about 70 percent of total premiums. For 4 of these applications, we used Social Security numbers that could not have been issued by the Social Security Administration. For 4 other applications, we said our fictitious applicants worked at a company—which we also created—that offered health insurance, but the coverage did not provide required minimum essential coverage under PPACA. For the final 2 applications, we used an identity from our prior undercover testing of the federal Marketplace to apply for coverage concurrently at two state marketplaces. Thus, this fictitious applicant received subsidized qualified health-plan coverage from the federal Marketplace and the two selected state marketplaces at the same time.

For 8 applications among this group of 10, we failed to clear an identity- checking step during the “front end” of the application process, and thus could not complete the process. In these cases, we were directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces and our applications were subsequently approved. The other two applicants were accepted by phone.

For each of the 10 fictitious applications where we obtained qualified health-plan coverage, the respective marketplace directed that our applicants submit supplementary documentation. The marketplaces are required to seek postapproval documentation in the case of certain application “inconsistencies”—instances in which information an applicant has provided does not match information contained in data sources that the marketplace uses for eligibility verification at the time of application, or such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved using “back-end” controls. Under these controls, applicants will be asked to provide additional information or documentation for the marketplaces to review in order to resolve the inconsistency. As part of our testing, and to respond to the marketplace directives, we provided counterfeit follow-up documentation, such as fictitious Social Security cards with impossible Social Security numbers, for all 10 undercover applications.

For all 10 of these fictitious applications, we maintained subsidized coverage beyond the period during which applicants may file supporting documentation to resolve inconsistencies. In one case, the Kentucky marketplace questioned the validity of the Social Security number our applicant provided, which was an impossible Social Security number. In fact, the marketplace told us the Social Security Administration reported that the number was not valid. Nevertheless, the Kentucky marketplace notified our fictitious applicant that the applicant was found eligible for coverage. For the four fictitious applicants who claimed their employer did not provide minimum essential coverage, the marketplace did not contact our fictitious employer to confirm the applicant’s account that the company offers only substandard coverage.

In August 2015, we briefed CMS, California, and Kentucky officials on the results of our undercover testing, to obtain their views. According to these officials, the marketplaces only inspect for documents that have obviously been altered. Thus, if the documentation submitted does not appear to have any obvious alterations, it would not be questioned for authenticity. In addition, according to Kentucky officials, in the case of the impossible Social Security number, the identity-proofing process functioned correctly, but a marketplace worker bypassed identity-proofing steps that would have required a manual verification of the fictitious Social Security card we submitted. The officials told us they plan to provide training on how to conduct manual verifications to prevent this in the future. Further, California officials told us in June 2016 that the marketplace is upgrading its system in an effort to prevent use of impossible Social Security numbers. In the case of applicant identity verification in particular, Covered California officials told us they believed it was likely our applicants had their identities confirmed because they ultimately submitted paper applications, signed under penalty of perjury. That attestation satisfied identity verification requirements, the officials said.

As for our employer-sponsored coverage testing, CMS and California officials told us that during the 2015 enrollment period, the marketplaces accepted applicants’ attestation on lack of minimum essential coverage. As a result, the marketplaces were not required to communicate with the applicant’s employer to confirm whether the attestation is valid. In June 2016, California officials further told us the marketplace is updating its application process to provide tools to consumers to help them determine whether their employer-sponsored insurance meets minimum essential coverage standards. They also told us the marketplace is updating policies and procedures for sending notices to employers and developing longer-term plans for an automated system to send notices to employers. Kentucky officials told us after our 2015 testing that applicant-provided information is entered into its system to determine whether the applicant’s claimed plan meets minimum essential coverage standards. If an applicant receives a qualified health-plan subsidy because the applicant’s employer-sponsored plan does not meet the guidelines, the Kentucky marketplace sends a notice to the employer asking it to verify the applicant information. The officials told us the employer letter details, among other things, the applicant-provided information and minimum essential coverage standards. However, our fictitious company did not receive such notification.

After our 2015 testing, CMS, California, and Kentucky officials also told us there was no process to identify individuals with multiple enrollments through different marketplaces. California officials noted in June 2016 that the federal government has not made data available that would allow California to identify duplicate enrollments through different marketplaces. CMS officials told us it was unlikely an individual would seek to obtain subsidized qualified health-plan coverage in multiple states. We conducted this portion of our testing, however, to evaluate whether such a situation, such as a stolen identity, would be possible. CMS officials told us the agency would need to look at the risk associated with multiple coverages.

Kentucky officials told us that in response to our 2015 findings, call-center staff were retrained on identity-proofing processes, and that they are improving training for other staff as well. They also said they plan to make changes before the next open-enrollment period so that call-center representatives cannot bypass identity-proofing steps, as occurred with our applications. Further, they said they plan to improve the process for handling of applications where employer-sponsored coverage is at issue. Also in response to our findings, California officials said they are developing process improvements and system modifications to address the issues we raised.

Finally, in the case of the federal Marketplace in particular, for which, as noted, we conducted undercover testing previously, we asked CMS officials for their views on our second-year results compared to the first year. They told us the eligibility and enrollment system is generally performing as designed. According to the officials, a key feature of the system, when applicant information cannot immediately be verified, is whether proper inconsistencies are generated. This is important so that such inconsistencies can be addressed later, after eligibility is granted at time of application. CMS officials noted to us in June 2016 that PPACA and federal regulations provide for instances when an individual who is otherwise eligible can receive coverage while an inconsistency is being resolved. CMS officials told us the overall approach is that CMS must balance consumers’ ability to effectively and efficiently select Marketplace coverage with program-integrity concerns.

Results of Undercover Attempts to Obtain Medicaid Coverage through the Federal Marketplace and Selected State Marketplaces

For our additional eight fictitious applications for Medicaid coverage in 2015, we were approved for subsidized health-care coverage in seven of the eight applications. As shown in figure 2, for three of the eight applications, we were approved for Medicaid, as originally sought. For four of the eight applications, we did not obtain Medicaid approval, but instead were subsequently approved for subsidized qualified health-plan coverage. The monthly amount of the advance premium tax credit for these four applicants totaled approximately $1,100 per month, or about $13,000 annually. For one of the eight applications, we could not obtain Medicaid coverage because we declined to provide a Social Security number.

As with our applications for qualified health plans described earlier, we also failed to clear the initial identity-checking step for six of eight Medicaid applications. In these cases, we were likewise directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces.

However, as shown in figure 2, the California marketplace did not continue to process one of our Medicaid applications. In this case, our fictitious phone applicant declined to provide what was a valid Social Security number, citing privacy concerns. A marketplace representative told us that, to apply, the applicant must provide a Social Security number. The representative suggested that as an alternative, we could apply for Medicaid in person with the local county office or a certified enrollment counselor. After we discussed the results of our undercover testing with California officials in 2015, they told us their system requires applicants to provide either a Social Security number or an individual taxpayer-identification number to process an application. As a result, because our fictitious applicant declined to provide a Social Security number, our application could not be processed.

Details of Medicaid Applications through the Federal Marketplace

For the four fictitious Medicaid applications submitted to the federal Marketplace for 2015, we were told that we may be eligible for Medicaid but that the respective Medicaid state offices might require more information. For three of the four applications, federal Marketplace representatives told us we would be contacted by the Medicaid state offices within 30 days. However, the Medicaid offices did not notify us within 30 days for any of the applications. As a result, we subsequently contacted the state Medicaid offices and the federal Marketplace to follow up on the status of our applications.

For the two New Jersey Medicaid applications, we periodically called the state Medicaid offices over approximately 4 months in 2015, attempting to determine the status of our applications. In these calls, New Jersey representatives generally told us they had not yet received Medicaid information from the federal Marketplace and, on several occasions, said they expected to receive it shortly. After our calls to New Jersey Medicaid offices, we phoned the federal Marketplace to determine the status of our Medicaid applications.

In one case, the federal Marketplace representative told us New Jersey determined that our applicant did not qualify for Medicaid. As a result, the phone representative stated that we were then eligible for qualified health-plan coverage. We subsequently applied for coverage and were approved for an advance premium tax credit plus the cost- sharing reduction subsidy.

In the other case, the federal Marketplace representative told us the Marketplace system did not indicate whether New Jersey received the application or processed it. The representative advised we phone the New Jersey Medicaid agency. Later on that same day, we phoned the federal Marketplace again and falsely claimed that the New Jersey Medicaid office denied our Medicaid application. Based on this claim, the representative said we were eligible for qualified health-plan coverage. We subsequently applied for coverage and were approved for an advance premium tax credit plus the cost-sharing reduction subsidy. The federal Marketplace did not ask us to submit documentation substantiating our Medicaid denial from New Jersey.

In July and August 2015, we offered to meet with New Jersey Medicaid officials to discuss the results of our testing, but they declined our offer. CMS officials told us at the time that New Jersey had system issues that may have accounted for problems in our Medicaid application information being sent to the state. CMS officials told us that this system issue is now resolved. In addition, CMS officials told us they do not require proof of a Medicaid denial when processing qualified health-plan applications; nor does the federal Marketplace verify the Medicaid denial with the state. CMS officials said that, instead, they accept the applicant’s attestation that the applicant was denied Medicaid coverage.

For our North Dakota Medicaid application in which we did not provide a Social Security number but did provide an impossible immigration document number, we called the North Dakota Medicaid agency to determine the status of our application. An agency representative told us the federal Marketplace denied our Medicaid application and therefore did not forward the Medicaid application file to North Dakota for a Medicaid eligibility determination. We did not receive notification of denial from the federal Marketplace. Subsequently, we called the federal Marketplace and applied for subsidized qualified health-plan coverage. The federal Marketplace approved the application, granting an advance premium tax credit plus the cost-sharing reduction subsidy. Because we did not disclose the specific identities of our fictitious applicants, CMS officials could not explain why the federal Marketplace originally said our application may be eligible for Medicaid but subsequently notified North Dakota that it was denied.

For the North Dakota Medicaid application for which we did not provide a valid Social Security identity, we received a letter from the state Medicaid agency about a month after we applied through the federal Marketplace. The letter requested that we provide documentation to prove citizenship, such as a birth certificate. In addition, it requested a Social Security card and income documentation. We submitted the requested documentation, such as a fictitious birth certificate and Social Security card. The North Dakota Medicaid agency subsequently approved our Medicaid application and enrolled us in a Medicaid plan.

After our undercover testing in 2015, we briefed North Dakota Medicaid officials and obtained their views. They told us the agency likely approved the Medicaid application because our fake Social Security card would have cleared the Social Security number inconsistency. The officials told us they accept documentation that appears authentic. They also said the agency is planning to implement a new system to help identify when applicant-reported information does not match Social Security Administration records.

Details of Medicaid Applications through State Marketplaces

As with our applications for coverage under qualified health plans, described earlier, the state marketplace for Kentucky directed two of our Medicaid applicants to submit supplementary documentation. As part of our 2015 testing and in response to such requests, we provided counterfeit follow-up documentation, such as a fake immigration card with an impossible numbering scheme, for these applicants. The results of the documentation submission are as follows:

For the application where the fictitious identity did not match Social Security records, the Kentucky agency approved our application for Medicaid coverage. In our discussions with Kentucky officials, they told us they accept documentation submitted—for example, copies of Social Security cards—unless there are obvious alterations.

For the Medicaid application without a Social Security number and with an impossible immigration number, the Kentucky state agency denied our Medicaid application. A Kentucky representative told us the reason for the denial was that our fictitious applicant had not been a resident for 5 years, according to our fictitious immigration card. The representative told us we were eligible for qualified health-plan coverage. We applied for such coverage and were approved for an advance premium tax credit and the cost-sharing reduction subsidy. In later discussions with Kentucky officials, they told us the representative made use of an override capability, likely based on what the officials described as a history of inaccurate applicant immigration status information for a refugee population. Kentucky officials also said their staff accept documentation submitted unless there are obvious alterations, and thus are not trained to identify impossible immigration numbers. Finally, Kentucky officials said they would like to have a contact at the Department of Homeland Security with whom they can work to resolve immigration-related inconsistencies, similar to a contact that they have at the Social Security Administration to resolve Social Security–related inconsistencies.

By contrast, during the Medicaid application process for one applicant, California did not direct that we submit any documentation. In this case, our fictitious applicant was approved over the phone even though the fictitious identity did not match Social Security records. We shared this result with California officials, who said they could not comment on the specifics of our case without knowing details of our undercover application.

Agency Comments

We provided a draft of this report to HHS, the California Department of Health Care Services, Covered California, the Kentucky Department for Medicaid Services, the Kentucky Health Benefit Exchange, and the North Dakota Department of Human Services. HHS and Covered California provided written comments, reproduced in appendixes II and III. HHS said it is committed to verifying eligibility of consumers who apply for health coverage through the federal Marketplace. The agency is continuing to make improvements to strengthen program integrity and Marketplace controls, HHS said. The Marketplace will continue to end coverage or adjust advance premium tax credit or cost-sharing reduction subsidies for failure to provide satisfactory documentation, HHS said. Covered California said it is committed to improving its processes with lessons learned from results of our undercover testing. Covered California said it takes vulnerabilities to fraud seriously and stressed the importance of effective fraud risk management, including an emphasis on consumer protection. HHS and Covered California also provided us with technical comments, which we have incorporated, as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report, which concludes work we initially presented in a testimony in October 2015, are to describe for the 2015 coverage year (1) results of undercover attempts to obtain qualified health-plan coverage from the federal Health Insurance Marketplace (Marketplace) and selected state marketplaces under the Patient Protection and Affordable Care Act (PPACA), for the act’s second open-enrollment period, for 2015 coverage; and (2) results of undercover attempts to obtain Medicaid coverage through the federal Marketplace and selected state marketplaces.

For both objectives, to perform our undercover testing of the federal and selected state eligibility and enrollment processes for the 2015 coverage year, we created 18 fictitious identities for the purpose of making applications for health-care coverage by telephone and online. The undercover results, while illustrative, cannot be generalized to the full population of enrollees. For all 18 fictitious applications, we used publicly available information to construct our scenarios. We also used publicly available hardware, software, and materials to produce counterfeit or fictitious documents, which we submitted, as appropriate for our testing, when instructed to do so. We then observed the outcomes of the document submissions, such as any approvals received or requests to provide additional supporting documentation.

Because the federal government, at the time of our review, operated a marketplace on behalf of the state in about two-thirds of the states, we focused part of our work on two states using the federal Marketplace— New Jersey and North Dakota. We chose these two states because they had expanded Medicaid eligibility and also delegated their Medicaid eligibility determinations to the federal Marketplace at the time of our testing. In addition, we chose two state marketplaces, California and Kentucky, for our undercover testing. We chose these two states based on factors including Medicaid expansion; population size (selection of California allowed inclusion of a significant portion of all state-based marketplace activity); differences in population (California is about nine times as populous as Kentucky); and progress made in reducing the percentage of uninsured residents. Our testing included only applications through a marketplace and did not include, for example, applications for Medicaid made directly to a state Medicaid agency.

For our first objective, we used 10 applicant scenarios to test controls for verifications related to qualified health-plan coverage. Specifically, we created application scenarios with fictitious applicants claiming to have impossible Social Security numbers; claiming to be working for an employer that offers health insurance, but not coverage that meets “minimum essential” standards; or already having existing qualified health-plan coverage. We made 4 of these 10 applications online and the other 6 applications by phone. In these tests, we also stated income at a level eligible to obtain both types of income-based subsidies available under PPACA—a premium tax credit, to be paid in advance, and cost- sharing reduction.

For our second objective, we used 8 additional applicant scenarios to test controls for verifications related to Medicaid coverage. Specifically, our fictitious applicants provided invalid Social Security identities, where their information did not match Social Security Administration records, or claimed they were noncitizens lawfully present in the United States and declined to provide Social Security numbers. In situations where we were asked to provide immigration document numbers, we provided impossible immigration document numbers. We made half of these applications online and half by phone. In these tests, we also stated income at a level eligible to qualify for coverage under the Medicaid expansion, where the federal government is responsible for reimbursing the states for 100 percent of the Medicaid costs in 2015. In cases where we did not obtain approval for Medicaid, we instead attempted, as appropriate, to obtain coverage for subsidized qualified health plans in the same manner as described earlier.

To protect our undercover identities, we did not provide the marketplaces with specific applicant identity information. CMS and selected state officials generally told us that without such information, they could not fully research handling of our applicants. We created our applicant scenarios without knowledge of specific control procedures, if any, that CMS or other federal agencies may use in accepting or processing applications. We thus did not create the scenarios with intent to focus on a particular control or procedure.

Overall, our review covered the act’s second open-enrollment period, for 2015 coverage, as well as follow-on work after close of the open- enrollment period. We shared details of our work with CMS and the selected state marketplaces. We had additional discussions with federal and state marketplace officials in June 2016.

For both objectives, we also reviewed statutes, regulations, and other policy and related information.

We conducted this performance audit from November 2014 to September 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with investigative standards prescribed by the Council of the Inspectors General on Integrity and Efficiency.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: Comments from Covered California

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Matthew Valenta, Philip Reiff, and Gary Bianchi, Assistant Directors; Maurice Belding, Jr.; Mariana Calderón; Ranya Elias; Colin Fallon; Suellen Foth; Maria McMullen; James Murphy; George Ogilvie; Ramon Rodriguez; Christopher H. Schmitt; Julie Spetz; and Elizabeth Wood made key contributions to this report.