Medicaid Integrity Program: CMS Should Take Steps to Eliminate Duplication and Improve Efficiency
Released: 2012-12-10T00:00:00

Letter

Background

The MIG implemented its set of core activities gradually from fiscal years 2006 to 2009 when it reached its annual funding level of $75 million.example, the MIG initiated comprehensive reviews in fiscal year 2007, completing eight, week-long site visits and implemented NMAP audits in fiscal year 2009. To track the value of its program integrity activities, the MIG developed a formula to measure return on investment (ROI), including both direct and indirect benefits. The MIG, in conjunction with Center for Medicaid and CHIP Services, also developed a mechanism for states to report recoveries from fraud, waste, and abuse at a more detailed level than previously as a part of CMS’s fiscal oversight of state Medicaid expenditures.

NMAP Audits

The NMAP program accounts for about half of the $75 million appropriated annually for the Medicaid integrity program. In each of five geographic areas, two separate contractors are responsible for the review and audit functions (see fig. 1):

Review function. One contractor reviews states’ paid claims data to identify aberrant claims or billing anomalies.

Audit function. A different audit contractor conducts targeted provider audits to determine whether or not the provider received an overpayment.

As of July 2012, the MIG had two review contractors and three separate audit contractors.

Since its inception, the MIG has used three different approaches to conducting NMAP audits—test audits, Medicaid Statistical Information System (MSIS) audits, and, more recently, collaborative audits. As we noted in our June 2012 report on NMAP, the test and collaborative audits differed from the MSIS audits in two important ways: the test and collaborative audits (1) leveraged state expertise to identify potential audit targets, rather than having the MIG select potential targets on the basis of the work of its review contractors; and (2) primarily used state Medicaid Management Information System (MMIS) data rather than MSIS data. The MMIS is a mechanized claims-processing and information-retrieval system maintained by individual states that generally reflects real-time payments and adjustments of detailed claims for each health care service provided. The MSIS audits relied on MSIS data, which contains extracts from states’ MMIS databases. Because MSIS is a subset of states’ MMIS data files, MSIS data are missing elements that can assist in audits, such as the explanations of benefit codes and the names of providers and beneficiaries. In addition, MSIS data are not current because of late state submissions and the time it takes CMS’s contractors to review and validate the data.

We recently reported that the identified overpayments from MSIS audits were significantly lower than those identified by test and collaborative audits. As of February 2012, 59 of the 1,550 MSIS audits identified $7.4 million in potential overpayments. In contrast, 26 test audits and 6 collaborative audits together identified $12.5 million in potential overpayments (see fig. 2).yet identified more in overpayments than MSIS audits, only 6 of the 112 collaborative audits had final audit reports through February 2012, and thus the total overpayment amounts identified through collaborative While the newer collaborative audits have not audits will likely continue to grow. In addition, we reported that (1) half of the MSIS audits were for potential overpayments of $16,000 or less, compared to a median of about $140,000 for test audits and $600,000 for collaborative audits, and (2) over two-thirds (69 percent) of the 1,550 MSIS audits assigned to contractors were either discontinued (625), had low or no findings (415), or were put on hold (37). Finally, we also reported that the main reason the NMAP audits were ineffective was the use of MSIS data, which are inadequate for reviewing claims and selecting audit targets. Further, the MSIS audits were not well coordinated with states, duplicated state program integrity activities, and diverted resources from states’ activities. When we spoke about the MSIS audits with 11 states, some indicated that participation in MSIS audits diverted staff from their regular duties.

In addition to the NMAP, the MIG has implemented three activities that are the core of its support and oversight of state program integrity—the Medicaid Integrity Institute, comprehensive reviews, and SPIA. Less than half of the MIG’s $75 million annual budget supports these three activities. The MIG has also developed a methodology for computing the ROI for its activities.

Medicaid Integrity Institute. In 2007, the MIG established the Medicaid Integrity Institute, the first national Medicaid training program for state program integrity officials. CMS executed an interagency agreement with the Department of Justice to house the institute at the National Advocacy Center, located at the University of South Carolina. At no cost to states, the institute offers substantive training and support in a structured learning environment. In time, the institute intends to create a credentialing process to elevate the professional qualifications of state Medicaid program integrity staff.

Comprehensive reviews. In 2007, the MIG initiated triennial comprehensive state program integrity reviews, which assess each state’s Medicaid program integrity procedures and processes. Topics covered include program integrity organization and staffing, postpayment review and fraud identification, investigation, and referral. The objective of the reviews is to assess the effectiveness of states’ program integrity activities and compliance with federal program integrity laws. As of fiscal year 2011, the MIG had reviewed all states once (as well as the District of Columbia, and Puerto Rico) and 26 states twice. Eighteen states have been scheduled for review in fiscal year 2012.

State comprehensive reviews are guided by a detailed protocol and represent a significant investment of staff time and resources for both states and the MIG. In advance of a 1-week on-site review, state staff respond to the review protocol and provide documentation on a state’s program integrity activities (see fig. 3.) After the week-long visit, MIG staff draft a report, obtain state comments, and follow up with the state on the implementation of any corrective actions required to address findings. The culmination of a review is a final report that details the MIG’s assessment of each state’s program integrity vulnerabilities, compliance with federal laws, and effective practices. These reports are posted on CMS’s website and the MIG prepares an annual report that summarizes the results for all states reviewed each year.

State Program Integrity Assessments. Annually, the MIG collects information through a web-based portal from each state about its program integrity activities, which results in a publication of a one-page summary that provides statistics on states’ program integrity staffing, expenditures, audits for improper payments, and recoveries.officials, the SPIA represent the first national baseline collection of data According to MIG on state Medicaid integrity activities for the purpose of program evaluation and technical assistance. Although the profiles are published every year, there is a 2-year lag in the SPIA data collection. For example, the 2010 SPIA covered state fiscal year 2008 activities.

Return on Investment. Federal law requires HHS to annually report to Congress on the effectiveness of the use of the funds appropriated for the Medicaid Integrity Program. However, the benefit derived from some of the activities, such as the Medicaid Integrity Institute or technical assistance, are difficult to quantify because they contribute to cost avoidance rather than recoveries of overpayments. The MIG has developed a strategy for reporting the ROI for the NMAP and its other activities, which has changed over the program’s existence. Typically, an ROI is calculated as a percentage—the benefits identified through a program or set of activities relative to the total costs of that program or activities.

Medicaid Overpayment Recovery Reporting

CMS has had a long-standing requirement that states report the aggregated amount of recoveries from provider overpayments as a part of their quarterly reporting on Medicaid program expenditures. During fiscal year 2009, the MIG helped the CMS unit responsible for validating state reporting of Medicaid expenditures develop more detailed reporting of states’ recoveries of provider overpayments. Beginning in fiscal year 2010, CMS required states to report recoveries for specific activities separately, such as NMAP, state program integrity activities, or the activities of the HHS-OIG. The more detailed reporting of fraud, waste, and abuse recoveries was initiated to allow CMS to track recouped amounts according to specific program activities. CMS regional office staff validates and audits the reported expenditure data and accompanying detailed information; state officials must also attest to the data’s accuracy.states’ Medicaid expenditures, which forms the basis for computing the federal share of program costs.

Use of Separate Review and Audit Contractors Was Inefficient, Led to Duplication, and Contributed to a Longer Audit Process

The MIG’s decision to establish separate review and audit contractors for each state was inefficient and led to duplication because key functions such as data analysis were performed by both types of contractors. In turn, these inefficiencies contributed to lengthy MSIS audits, which, on average, took almost 2 years to complete.

Use of Separate Review and Audit Contractors Was Inefficient and Led to Duplication

The MIG’s decision to establish separate review and audit contractors for each state was inefficient and led to duplication in two key areas—state Medicaid policies and data analysis. The DRA required CMS to hire contractors to review and audit provider claims. According to MIG officials, they initially believed that the DRA required the use of separate contractors but, in hindsight, concluded that these activities could have been performed by one contractor.

State Medicaid policies. The MIG’s decision to use separate review and audit contractors meant that both entities had to master the details of numerous state Medicaid policies related to eligibility, benefits, and claims processing in order to appropriately assess whether payments were improper. Although MIG officials told us that they were sensitive to the burden placed on states by the establishment of NMAP, the use of separate review and audit contractors nonetheless increased states’ administrative burden because both types of contractors performed the same function and states had to review the contractors’ work to ensure that state policies were applied correctly. States provided feedback about the samples prepared by the review contractors, which in some cases reflected a misunderstanding of state policy. In addition, state officials told us that they found themselves educating audit contractors about state Medicaid policies. The MIG’s two review contractors were responsible for learning and correctly applying the policies of 22 and 28 states, respectively, while the three audit contractors were required to master the policies of from 8 to as many as 24 states. Officials from one state noted that becoming fully knowledgeable about all the policies affecting state program integrity audits could take 2 to 3 years. According to several state officials, the lack of an in-depth knowledge of state policy contributed to unproductive provider audits. For example, according to one state official, the MIG and its contractors had mistakenly identified overpayments for federally qualified health centers because they assumed that centers should receive reduced payments for an established patient on subsequent visits. The contractors were not aware that these types of centers are paid on an encounter basis, which makes the same payment for the first and follow-up visits.

Data analysis. The use of separate review and audit contractors increased inefficiencies in data analysis, which also led to duplication of effort. The review contractors’ primary function was using algorithms to analyze MSIS data with the goal of identifying potential improper payments. Audit contractors also analyzed MSIS data to learn more about targeted providers and the services for which they billed. However, the audit contractors duplicated certain data analyses that had already been performed by the review contractors, such as performing their own verification of the completeness and accuracy of MSIS data. For example, one audit contractor reported that the presence of large numbers of duplicate claims in the MSIS data resulted in a significant commitment of the contractor’s analytical and data management resources for 66 audit targets that were subsequently discontinued.

The inefficiencies of having both review and audit contractors were exacerbated by the MIG’s communication policies. All communication, whether between review and audit contractors or between contractors and states, went through a multistep process controlled by the MIG and, as a result, the audit contractors could not easily communicate with the review contractors to verify specific details of the review contractors’ data analyses. Two audit contractors’ lessons-learned reports recommended closer collaboration between audit and review contractors during the algorithm vetting process and target selection to prevent duplicative data analysis. In addition, the inability to communicate freely inhibited contractors from taking full advantage of states’ knowledge of their own Medicaid policies. The HHS-OIG reported a similar finding that the MIG’s communication policy also contributed to a duplication of contractor functions. To improve coordination and communication between the contractors, MIG officials told us they began monthly conference calls in mid-2011 that included both the review and audit contractors working in the same geographic area. One audit contractor stated that the improved communication with the review contractor has increased the efficacy of their audits specifically related to early readmissions and hospice.

Several of the MIG’s recent changes to NMAP may reduce, but not eliminate, duplication. Although review contractors were not initially involved in collaborative audits, MIG officials told us that collaborative audits were evolving and in some cases the review contractors are conducting data analysis on state supplied MMIS data or are continuing to analyze MSIS data in order to identify potential audit targets. However, they told us that review contractors are collaborating more closely with states to validate any MSIS data findings using MMIS data. Moreover, in July 2012, the MIG told us that while it planned to retain two review contractors, it would reduce their workload overall and realign their geographic areas of responsibility to ensure that all states are still supported. Despite these changes, both review and audit contractors must still correctly apply states’ Medicaid policies because both continue to be involved in collaborative audits.

MSIS Audits Were Lengthy

According to MIG officials, in cases where MMIS data are not available at the outset, the review contractors run algorithms on MSIS data. The review contractors conducted data analysis on 34 percent of the 112 collaborative audits assigned to the MIG’s audit contractors from January 2010 through December 2011. length of time from assignment of audit until submission of the final audit report for these 58 successful MSIS audits was 23 months, ranging from 11 months to 38 months, with half of these audits taking 23 months or more to complete (see fig. 4). In addition, for the 118 audits that were assigned from 2009 to 2011 and still in progress, the average duration as of February 2012 was 21 months. As the MIG shifts to collaborative audits, preliminary results suggest these audits are completed more quickly than MSIS audits. Although only six collaborative audits had final audit reports as of February 2012, the average duration of those successful audits was 16 months compared to 23 months for successful MSIS audits.

Successful MSIS audits, those that identified overpayments, took nearly 2 years to complete, longer than some states and HHS-OIG typically allow for Medicaid provider audits. Several state officials we interviewed told us that MSIS audits took too long to complete. One state official indicated that the state expected its new recovery audit contractor would produce results within 9 months of the start of the contract, and an official from a different state said that his staff attempt to produce draft audit reports within 60 days of initiating an audit. Additionally, the HHS-OIG allows about a year for audits to be conducted and completed before reviewing or reporting on them. MIG officials told us that they were aware of the time-consuming nature of MSIS audits and do track audit progress, such as “days remaining to completion.” On the basis of a 2010 suggestion by one of its audit contractors, the MIG is taking steps to build the capability to generate audit aging reports that would be available to its contractors in its new workflow management system, but officials told us that these changes are still in the implementation and testing phase.

Other MIG Activities Show Mixed Results in Overseeing and Supporting States’ Program Integrity Activities

The MIG’s modest spending on the Medicaid Integrity Institute enhances states’ capabilities. Comprehensive reviews, a MIG oversight activity, have the potential to inform state selection for federal audits. But, the data collected through the SPIA, another MIG oversight activity, has been of limited value as it is inconsistently reported, not validated, and overlaps with information collected through comprehensive reviews and other state reporting mechanisms.

Modest MIG Spending on Training through the Institute Enhances States’ Program Integrity Capabilities

Spending on the Medicaid Integrity Institute is a small fraction of the MIG’s overall budget, and the 11 state program integrity officials we interviewed affirmed the value of the institute for the substantive training it provided. In addition, officials from 10 states described the benefits derived from the opportunity to network with other states (see text box for examples of state officials’ comments). The cost of the institute is modest compared with overall MIG funding; the MIG reported that $1.7 million of the approximately $75 million appropriated for the Medicaid Integrity Program in fiscal year 2011 was spent on the institute.2008 to 2012, the institute trained over 3,000 state employees. While officials from the 11 states we spoke with commended the institute, some also offered suggestions for expanding the reach of the institute’s activities: From fiscal years

Officials from three states suggested that the MIG expand opportunities for additional staff to attend, such as staff from the Medicaid Fraud Control Units (MFCU) or the clinical staff that work with program integrity staff, or allow attendance by more staff from larger states.

Furthermore, officials from three states recommended that the institute offer Medicaid audit certification to state program integrity staff.

The National Association of Medicaid Directors and the Medicaid and CHIP Payment and Access Commission also recommended that CMS expand the institute to make it more accessible to state officials.

The MIG’s Comprehensive Reviews Could Help Inform the Selection of States for NMAP Audits

Comprehensive reviews yield important information about all aspects of states’ program integrity capabilities and vulnerabilities, and such information could be used to target NMAP audits towards states with serious vulnerabilities. In its comprehensive reviews of 51 states, the MIG identified 7 states as having serious program integrity infrastructure vulnerabilities, such as not maintaining a centralized program integrity function, yet 5 of these states had less than the typical number of audits Two of the 7 states had no NMAP audits assigned, 3 states assigned.had less than 1 percent of assigned audits in their states, and 2 other states had 16 and 23 audits, respectively; these last 2 states ranked 29th and 22nd in the assignment of 1,662 NMAP audits as of February 2012. (See table 1.) In the same set of 51 state comprehensive reviews, the MIG identified 6 states that had a limited or ineffective Surveillance Utilization Review Subsystem (SURS), another serious vulnerability involving the required claims-data surveillance system. Only 1 of these states was among the top 10 states for assigned NMAP audits. The number of assigned audits in these 6 states ranged from 0 to 110, with 3 states having 10 or fewer audits, 2 states having about 30 audits, and one state having 110 audits. The state with the highest number of NMAP audits was Louisiana, which accounted for 10 percent of all NMAP audits (195); yet, according to the MIG’s comprehensive review, the state did not have a vulnerable program integrity infrastructure or any identified SURS weaknesses. (See app. I for the number of NMAP audits assigned to each state.)

As a part of its comprehensive reviews, the MIG identifies findings or vulnerabilities that continue to persist from the state’s prior comprehensive review. Of the 51 comprehensive reviews we analyzed, the MIG found that one quarter of states had uncorrected repeat or partial repeat findings or vulnerabilities that had not been addressed since the prior reviews. Nonetheless, of the 10 states that received 62 percent of the 1,662 NMAP audits, 8 states had no uncorrected repeat findings or vulnerabilities.

SPIA Data Are Not Validated, Are Inconsistently Reported, and Overlap with Other Efforts

On an annual basis, states self-report the data submitted to the SPIA, and MIG staff told us that they do not review all 220 state-reported data elements or validate the data for reliability. Yet, MIG staff told us that they do check the states’ data submissions for reasonableness and follow up with states to confirm extreme responses. We have reported that the SPIA contained significant errors and were inconsistent with data reported in state comprehensive reviews covering the same year. Overall, the data are not reported in a consistent enough manner to allow for comparisons across states. For example, the instructions specify which collections a state may include in the category of recovered overpayments, but one state official told us the state’s recoveries included collections that were supposed to be excluded. State reporting is further complicated because the collection instrument does not allow state officials to comment on or explain their responses. Thus, states unable to report data as requested also cannot explain why or how their data deviates from what was requested, resulting in inconsistent reporting and blank items.

According to CMS, not all of the information that the SPIA collects on expenditures is available through quarterly reports. For example, unlike the quarterly reporting form, the SPIA asks for expenditure information by activity. Many states, however, do not report such information and the information provided is not validated. If CMS believed that such detailed program integrity expenditure data were valuable, it could revise states’ quarterly reporting requirements. organizational structure, number of staff, use of contractors, SURS, and recoveries—are also collected during the comprehensive reviews every 3 years and included in the published reports available on the MIG’s website. MIG officials acknowledged that the SPIA duplicated other requests for information and told us they were examining ways to reduce the duplication.

MIG officials told us that states use the SPIA as a reference tool to familiarize themselves with other states’ program integrity activities, plan program integrity activities and training, and identify how the MIG can provide support to them. However, representatives from 10 out of 11 states we spoke with told us that they had not looked at other states’ assessment data posted on the MIG’s website. One state official explained that smaller states or those with newer program integrity activities may refer to the SPIA, but the larger states we contacted had not. In addition, representatives from 4 states commented that SPIA reporting is not consistent or comparable across states.

Correcting inconsistencies in the SPIA data, however, would be of limited value. The 2-year time lag in the SPIA data undermines its usefulness in determining which states would benefit from technical assistance and developing measures to assess states’ performance. Other sources, such as comprehensive reviews, provide more timely and useful information.

Reporting on Program Integrity Results Is Inadequate

CMS’s limited reporting on the ROI from the Medicaid Integrity Program is inadequate. State reporting of recoveries is similarly insufficient because we found that most states were not fully reporting recoveries according to specific program integrity activities and that almost half appeared to underreport aggregate annual recoveries.

CMS’s Limited ROI Reporting Is Inadequate

CMS’s annual reports to Congress do not provide a clear picture of the ROI for NMAP audits because they combined the results of MSIS and test audits, which performed very differently. In its annual report covering fiscal year 2010, CMS reported that 947 MSIS and test audits were underway in 45 states and that its contractors had identified cumulative potential overpayments of about $10.7 million.data, which summarized these results by audit approach, found that over three-fourths of the overpayments—$8.4 million—were identified by the small number of test audits, in which states identified the audit targets and supplied their own data. Reporting combined overpayments for MSIS and test audits gave the impression that NMAP was more successful than was the case. Moreover, the annual report did not provide information on the number of audits that were discontinued because of no or low overpayments. Finally, the $42 million in expenditures for Medicaid integrity contractors reported in the fiscal year 2010 annual report combined the cost of both NMAP and education contractors, making it difficult to compute an ROI for NMAP.

Our analysis of CMS’s ROI reporting for the Medicaid Integrity Program as a whole has changed over time.

For fiscal year 2008, HHS’s budget justification for CMS reported an ROI of 300 percent for the test audits covering a 3-month period—the amount of identified overpayments from the test audits as a percentage of the contractor expenses for that time period.

For fiscal year 2009, the ROI formula was broadened to capture MIG overpayment identification activities beyond the NMAP. As such, it included the identification and recovery of overpayment amounts through the MIG’s identification of systematic errors in state payment systems and comprehensive state program integrity reviews as a percentage of its fiscal year 2009 funding for the Medicaid Integrity Program. HHS reported a 2009 ROI of 175 percent using this new formula.

Although an ROI has not been released for fiscal years 2010 or 2011, HHS has announced that it will calculate the ROI to better reflect the resources invested through the Medicaid Integrity Program and will discontinue reporting an ROI for the NMAP.

In several reports to the Congress, CMS has indicated that it was developing a methodology for calculating an ROI based on its activities. The MIG has not published its ROI methodology, but did provide it to us The methodology incorporates identified overpayments for our review.from activities for which the MIG was directly responsible as well as benefits from activities where the MIG provided support and assistance (see table 2).

The MIG’s ROI strategy includes a variety of elements, some of which may be difficult to quantify, and others that may be less valid or duplicative of other ROI calculations. For example, although difficult to measure, the MIG is attempting to quantify cost savings realized from states’ participation at the institute so that they can be incorporated into an overall calculation of the ROI for the MIG’s activities. However, it also incorporates a percentage of the identified overpayments reported on the SPIA, which are self-reported and not validated. Given that the MIG’s methodology already includes the benefit from comprehensive reviews and technical assistance to states, its rationale for claiming an additional percentage of states’ own identified overpayments is questionable.

Most States Are Not Fully Reporting Recoveries

Even though the reporting of aggregated program integrity recoveries has been a longstanding requirement, many states appear to be underreporting aggregate annual recoveries when compared with other data sources, such as their CMS comprehensive program integrity reviews or reports states prepare on the results of their program integrity activities. For example:

One state reported aggregate recoveries of $3 million for federal fiscal years 2009 and 2010—$0 and $3 million—but about $37 million for state fiscal years 2009 and 2010 in its comprehensive review.

Another state reported aggregate recoveries of about $195,000 over 3 years to CMS—$0, $130,000, and $65,000—but about $36 million in its annual report to the governor for 2 of these years.

A third state reported about $6,000 in aggregate recoveries for federal fiscal year 2009 but about $3 million for state fiscal year 2009 in its comprehensive review.

Overall from federal fiscal years 2009 through 2011, 15 states reported no fraud, waste, and abuse recoveries in at least 1 fiscal year (see app. II). These results appear questionable given that 5 of the 15 states were among the 20 states with the highest Medicaid expenditures in fiscal year 2010. Additionally, total reported recoveries for all states in fiscal year 2010 represented only about 0.28 percent of state Medicaid expenditures, significantly less than CMS’s estimate that improper payments accounted for about 8 percent of state Medicaid expenditures in fiscal year 2011.

In addition, although CMS implemented more detailed state reporting of recovered overpayments beginning in fiscal year 2010, we found that most states were not fully reporting recoveries by the specific type of activity that resulted in the recovery. In fiscal year 2011, the second year of detailed reporting of program integrity recoveries, 36 or more states reported no recoveries for specific state-based activities that generally produce program integrity recoveries, such as state data analysis, provider audits, or MFCU investigations (see fig. 5).

The underreporting of program integrity recoveries occurs despite CMS’s validation efforts. CMS’s financial review protocols specify that quarterly desk reviews must be completed for every state in every quarter, and yearly on-site reviews must be completed for the 20 states with the greatest Medicaid expenditures in the preceding fiscal year. On-site review protocols explicitly instruct the reviewer to verify the reported aggregated amount of fraud, waste, and abuse recoveries, and CMS regional office staff may conduct on-site reviews in additional states as appropriate. CMS staff told us that its financial review protocols encompass hundreds of pages and that reporting of fraud, waste, and abuse recoveries is a small portion of the items they are responsible for validating. They commented that their limited reviews did not allow them to know whether or not fraud, waste, and abuse recoveries were listed elsewhere as a part of the state’s quarterly expenditure reporting because states may report recoveries as an offset to other expenditures or may report them comingled with other credits that are not fraud, waste, or abuse-related.

Further, CMS staff offered several explanations for the reporting gaps we identified, including the observation that it is not unusual for states to take several years to come into compliance with new reporting requirements. This delay may reflect the fact that states’ accounting processes may differ from the new instructions and states may need to change their processes or data systems to accommodate the new reporting requirements. CMS officials also said that states may have reported their recoveries as an adjustment that decreased claims from prior quarters. While it is plausible that state accounting systems may differ from the recently implemented federal reporting requirements, states have had a long-standing requirement to report their recoveries of overpayments in the aggregate. Additionally, states report recovered overpayments as a part of their state comprehensive reviews, and some states include the results of their program integrity activities in their Medicaid annual reports.

Conclusions

The MIG’s activities to support and oversee state Medicaid program integrity efforts are relatively new and have had mixed success. The Medicaid Integrity Institute is widely acclaimed by state officials. However, the MIG has had to make significant changes to NMAP, the use of comprehensive reviews have shortcomings, and the SPIAs are unreliable. In addition, CMS and states’ reporting on the results of their program integrity activities are not transparent and are incomplete. Specifically:

The MIG’s decision to hire separate review and audit contractors was inefficient and contributed to overlap and duplication. For example, both types of contractors were engaged in data analysis and both had to be cognizant of state Medicaid policies, which increased the burden on states.

Although the MIG’s comprehensive reviews yield considerable information about state structural and data-analysis vulnerabilities, there is no apparent connection between the reviews’ findings and the selection of states for NMAP audits. Thus, states with serious program integrity vulnerabilities often had few NMAP audits.

Information that the MIG collects through the SPIAs is unreliable. Even if SPIAs were accurate, their value is unclear because similar and more timely information is collected through other sources, such as the comprehensive reviews.

Computing an ROI for the entire Medicaid Integrity Program that reflects the outcomes from all MIG expenditures is complex because it involves measuring both direct and indirect benefits. To date, CMS has provided a misleading picture of the ROI for NMAP audits and its unpublished methodology incorporates a percentage of identified overpayments reported on the SPIA, which is questionable.

A full accounting of state and NMAP-related recoveries is an important yardstick for measuring the effectiveness of efforts to reduce improper payments. The apparent gaps in state reporting of such recoveries, however, hamper federal efforts to quantify the results of state and federal activities and make it difficult to determine whether states are returning the federal share of recovered overpayments.

Given the magnitude of the estimated Medicaid improper payments, federal support and oversight of Medicaid program integrity is important, and it is essential that federal efforts are carried out efficiently without placing an undue burden on states.

Recommendations for Executive Action

To strengthen the Medicaid Integrity Program, we are making five recommendations to the CMS Acting Administrator:

To eliminate duplication and more efficiently use audit resources, the CMS Acting Administrator should merge the functions of the federal review and audit contractors within a state or geographic region.

To ensure that the MIG’s comprehensive reviews inform its management of NMAP, the CMS Acting Administrator should use the knowledge gained from the comprehensive reviews as a criterion for focusing NMAP resources towards states that have structural or data- analysis vulnerabilities.

To avoid unnecessary duplication overlap with other efforts, as well as the reporting of unverified and inaccurate data, the CMS Acting Administrator should discontinue the annual state program integrity assessments.

To ensure the most effective use of federal Medicaid program integrity funding, the CMS Acting Administrator should reevaluate the agency’s methodology for calculating an ROI for the Medicaid Integrity Program, including reporting separately on the NMAP, and share its methodology with Congress and the states.

To ensure the appropriate tracking of the results of states’ program integrity activities, the CMS Acting Administrator should increase the agency’s efforts to hold states accountable for reliably reporting program integrity recoveries as a part of their quarterly expenditure reporting.

Agency Comments and Our Evaluation

We provided a draft of this report to HHS for comment. In its written comments, HHS stated that CMS was currently revising its Comprehensive Medicaid Integrity Plan covering fiscal years 2013 through 2017 in order to address the duplication and inefficiencies that we had identified in the Medicaid Integrity Program. According to HHS, the plan will unveil significant changes to improve the efficiency of the agency’s Medicaid integrity activities. In response to our five recommendations, HHS concurred with three recommendations and partially concurred with two others.

Review and audit contractor functions. HHS said that it concurred with our recommendation to merge the functions of its review and audit contractors in order to eliminate duplication and use contractor resources more efficiently. The department stated that it was evaluating options for consolidating its contractors’ work within current statutory and procurement requirements.

Comprehensive reviews and recovery reporting. HHS also concurred with our recommendations to (1) use the comprehensive program integrity reviews to better inform NMAP, and (2) increase efforts to hold states accountable for reliably reporting program integrity recoveries as part of their quarterly expenditure reporting. With regard to the comprehensive reviews, HHS stated that CMS would work to improve the integration of the knowledge gained from the comprehensive reviews to help identify the states and program areas representing the greatest risks to the Medicaid program, which, in turn, would influence the agency’s national audit strategy. In terms of holding states accountable, the department indicated that it would work through its regional offices to include state recovery reporting in the risk assessment used to select areas for financial management reviews, which validate state reported data. In addition, it will continue to provide the necessary training to states to help facilitate reliable recovery reporting.

ROI methodology and reporting. HHS partially concurred with our recommendation to reevaluate the methodology used to calculate an ROI for the Medicaid Integrity Program, including reporting separately on NMAP, and to share its methodology with Congress and the states. HHS indicated that CMS annually reevaluates the methodology and has provided descriptions of the methodology in documents that are, or will soon be, available to the public, such as the fiscal year 2013 annual budget justification for CMS. We found that those descriptions were limited and that the budget justification was less detailed than the ROI methodology that CMS shared with us, which is summarized in table 2 of this report. HHS also noted that CMS’s methodology will become public when our report is published. HHS said that CMS will be reviewing the scope of what should be included in the calculation of ROI for the Medicaid Integrity Program but it did not address our concern that taking an additional percentage of states’ own identified overpayments was questionable. HHS did not concur that an ROI should be reported separately for NMAP because it believes that CMS’s Medicaid program integrity investments interact with one another and NMAP ROI would be a misleading index of the work and impact of the Medicaid Integrity Program. We continue to believe that separately reporting an NMAP ROI is essential to hold CMS accountable for the effective operation of those audits, which constituted about half of CMS’s annual expenditures on the Medicaid Integrity Program.

SPIA. HHS partially concurred with our recommendation and said that it would suspend the annual state program integrity assessments while taking steps to address the limitations that we had identified. HHS stated that the triennial comprehensive state program integrity reviews alone may not provide adequate data to inform CMS oversight. Although the department acknowledged the reporting overlap between the SPIA and comprehensive reviews, it stated that CMS was now working to streamline the comprehensive review questionnaires to eliminate duplication. HHS also indicated that CMS’s forthcoming Comprehensive Medicaid Integrity Plan would outline plans to enhance the SPIA by refining the data collection tool, reducing the reporting time lag, and providing for data validation and correction by CMS staff during the triennial comprehensive reviews. We believe that CMS’s efforts to address overlap by eliminating duplicative information collected though the comprehensive reviews does not take into account the considerable resources that states devote to filling out the comprehensive review questionnaires, which CMS officials have the opportunity to discuss and verify during week-long site visits. In contrast, SPIA data are collected through a web-based survey, which is inconsistently completed and viewed as a burden by states. Although CMS believes the annual SPIA data are important to its program integrity mission and plans to reduce the current reporting time lag, it has not clearly articulated how it will or could use this information to inform its oversight. In addition, state recoveries and program integrity expenditures are reported to CMS on a quarterly basis, which would provide a more reliable financial accounting of states’ program integrity activities. As a result, we continue to believe that the SPIA should be permanently, not just temporarily, discontinued.

HHS’s comments are reproduced in appendix III. HHS also provided technical comments, which we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff has any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Number of National Medicaid Audit Program Audits

Appendix II: Recoveries from State Medicaid Program Integrity Activities

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, key contributors to this report were: Water Ochinko, Assistant Director; Leslie V. Gordon; Drew Long; and Jasleen Modi.

Related GAO Products

National Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit Collaboration with States. GAO-12-814T. (Washington, D.C.: June 14, 2012).

National Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit Collaboration with States. GAO-12-627. (Washington, D.C.: June 14, 2012).

Program Integrity: Further Action Needed to Address Vulnerabilities in Medicaid and Medicare Programs. GAO-12-803T. (Washington, D.C.: June 7, 2012).

Medicaid: Federal Oversight of Payments and Program Integrity Needs Improvement. GAO-12-674T. Washington, D.C.: April 25, 2012.

Medicaid Program Integrity: Expanded Federal Role Presents Challenges to and Opportunities for Assisting States. GAO-12-288T. Washington, D.C.: December 7, 2011.

Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011.

Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011.

Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.

Status of Fiscal Year 2010 Federal Improper Payments Reporting. GAO-11-443R. Washington, D.C.: March 25, 2011.

Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.

Medicare: Program Remains at High Risk Because of Continuing Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 2011.

Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011.

Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010.

Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-1004T. Washington, D.C.: September 30, 2009.

Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009.

Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009.

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax System. GAO-08-239T. Washington, D.C.: November 14, 2007.

Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax System. GAO-08-17. Washington, D.C.: November 14, 2007.

Medicaid Financial Management: Steps Taken to Improve Federal Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705. Washington, D.C.: June 22, 2006.

Medicaid Integrity: Implementation of New Program Provides Opportunities for Federal Leadership to Combat Fraud, Waste, and Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006.

Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: June 28, 2005.

Major Management Challenges and Program Risks: Department of Health and Human Services. GAO-03-101. Washington, D.C.: January 2003.