Medicaid is jointly financed by the federal government and the states, with the federal government matching most state Medicaid expenditures using a statutory formula that determines a federal matching rate for each state. Medicaid is a significant component of federal and state budgets, with estimated total outlays of $576 billion in fiscal year 2016, of which $363 billion is expected to be financed by the federal government and $213 billion by the states. Medicaid served about 72 million individuals, on average, during fiscal year 2016. As a federal-state partnership, both the federal government and the states play important roles in ensuring that Medicaid is fiscally sustainable over time and effective in meeting the needs of the populations it serves. States administer their Medicaid programs within broad federal rules and according to individual state plans approved by CMS, the federal agency that oversees Medicaid. Federal matching funds are available to states for different types of payments that states make, including payments made directly to providers for services rendered under a fee-for-service model and payments made to managed care organizations: Under a fee-for-service delivery model, states make payments directly to providers; providers render services to beneficiaries and then submit claims to the state to receive payment. States review and process fee-for-service claims and pay providers based on state- established payment rates for the services provided. Under a managed care delivery model, states pay managed care organizations a set amount per beneficiary; providers render services to beneficiaries and then submit claims to the managed care organization to receive payment. Managed care plans are required to report to the states information on services utilized by Medicaid beneficiaries enrolled in their plans--information typically referred to as encounter data. Most states use both fee-for-service and managed care delivery models, although the number of beneficiaries served through managed care has grown in recent years. Federal law requires each state, under both fee-for-service and managed care delivery models, to operate a claims processing system to record information about the services provided and report this information to CMS: Provider claims and managed care encounter data are required to include information about the service provided, including the general type of service; a procedure code that identifies the specific service provided; the location of the service; the date the service was provided; and information about the provider who rendered the service (e.g., provider identification number). Fee-for-service claims records must include the payment amount. Federal law requires states to collect managed care encounter data, but actual payment amounts to individual providers are not required. Long-term services and supports financed by Medicaid are generally provided in two settings: institutional facilities, such as nursing homes and intermediate-care facilities for individuals with intellectual disabilities; and home and community settings, such as individuals' homes or assisted living facilities. Under Medicaid requirements governing the provision of services, states generally must provide institutional care to Medicaid beneficiaries, while HCBS coverage is generally an optional service. Medicaid spending on long-term services and supports provided in home and community settings has increased dramatically over time--to about $80 billion in federal and state expenditures in 2014--while the share of spending for care in institutions has declined, and HCBS spending now exceeds long-term care spending for individuals in institutions (see fig. 1). All 50 states and the District of Columbia provide long-term care services to some Medicaid beneficiaries in home and community settings. Personal care services, a key type of HCBS, are typically nonmedical services provided by personal care attendants--home-care workers who may or may not have specialized training. The demand for personal care services is expected to increase as is the number of attendants providing these services in coming years. The number of Medicaid beneficiaries receiving personal care services at this time is not known, but likely in the millions. In calendar year 2012, the most recent and complete available data, an estimated 1.5 million beneficiaries in the 35 states reporting at the time received personal care services at least once. Total Medicaid spending for personal care services is also not known, as spending in managed care delivery systems is not reported by service. Total Medicaid spending for personal care services in fee-for-service delivery systems was about $15 billion in FY 2015. With approval from CMS, states can choose to provide personal care services under one or more types of authorities (referred to in this statement as programs) put in place over the past 41 years under different sections of the Social Security Act. The various types of programs provide states with options for permitting participant direction and choices about how to limit services, among other things (see table 1). CMS has implemented the different statutory requirements associated with these various program types by issuing regulations, as well as guidance to help states implement their Medicaid programs in accordance with applicable statutory and regulatory requirements. Guidance can include letters to state Medicaid directors, program manuals, and templates to help states apply for CMS approval to provide certain services like personal care. Together with federal statutes, the regulations and guidance issued by CMS establish a broad federal framework for the provision of personal care services. States are responsible for establishing and administering specific policies and programs within the federal parameters laid out in this framework. In our 2016 report examining the federal program requirements for the multiple programs under which personal care services are provided, we found significant differences in federal requirements related to beneficiary safety and ensuring that billed services are provided. These differences may translate to differences in beneficiary protections across program types. Program requirements can include general safeguards for ensuring beneficiary health and welfare, quality assurance measures, critical incident monitoring, and attendant screening. For example, states implementing an HCBS Waiver program or a State Plan HCBS program must: Describe to CMS how the state Medicaid agency will determine that it is assuring the health and welfare of beneficiaries. To do so, states must describe: the activities or processes related to assessing or evaluating the program; which entity will conduct the activities; the entity responsible for reviewing the results of critical incident investigations; and the frequency at which activities are conducted. Demonstrate to CMS, by providing specific details that an incident management system is in place, including incident reporting requirements that establish the type of incidents that must be reported, who must report incidents, and the timeframe for reporting. In contrast, states implementing a State Plan personal care services program or a Community First Choice program have fewer requirements for beneficiary safeguards. For example, for these programs, states are not required to do the following: Provide CMS with detailed information describing the activities they are taking to assure the health and welfare of beneficiaries. Demonstrate to CMS specific details about their critical incident management process and incident reporting system; instead they are required to describe more generally their "process for the mandatory reporting, investigating and resolution of allegations of neglect, abuse, or exploitation." Table 2 below illustrates more broadly the differences in federal program requirements that establish beneficiary safeguards and protections that we identified in our 2016 report. Differences in federal program requirements may also result in significant differences in the level of assurance that billed services are actually provided to beneficiaries. States implementing HCBS Waiver programs and State Plan HCBS programs, for example, are required by CMS to provide evidence that the state is only paying claims when services are actually rendered, while the State Plan personal care services and Community First Choice programs are not required to do so. Table 3 below highlights the federal Medicaid personal care services program requirements that we identified in our 2016 report to ensure that billed services are provided for each of the different type of HCBS program states may administer. The four selected states we examined as part of our 2016 report used different methods to ensure attendants provided billed services to beneficiaries, according to state officials. For example, for at least some personal care services programs, two states required beneficiaries to sign timesheets, and two states used electronic visit verification timekeeping systems. All four states performed quality assurance reviews for some personal care services programs to ensure billed services are received. The differing federal program requirements can create complexities for states and others in understanding federal requirements governing different types of HCBS programs, including personal care services. These different requirements may also result in significant differences in beneficiary safeguards and fiscal oversight, as illustrated in the following examples: Beneficiaries may experience different health and welfare safeguards depending on the program in which they are enrolled. For example, in one state we reviewed in 2016, the state required quarterly or biannual monitoring of beneficiaries for most of its personal care services programs. In contrast, for another program, the state required only annual monitoring contacts, in part, officials told us, due to the differing program requirements. Depending on the program type, CMS may have fewer assurances that beneficiaries' with similar levels of need are in programs with similar protections. For example, three of the four states we reviewed--Maryland, Oregon, and Texas-- have in recent years transitioned coverage of personal care services for beneficiaries who need an institutional level of care from personal care services programs with relatively more stringent federal beneficiary safety requirements to programs with relatively less stringent requirements. Although they were not required to do so, state officials in the three states reported that the states chose to continue using the same quality assurance measures in the new programs as the best way to ensure safety for beneficiaries. Without more harmonized requirements, we concluded that CMS has no assurance that states that transition personal care services from HCBS Waivers to Community First Choice in the future will make the same decisions. States can use different processes for each personal care services program to ensure that billed services are actually provided, and some programs may not be subject to federal personal care services requirements explicitly in this regard. For example, in one state we reviewed in 2016, steps taken to ensure billed services are provided under some types of personal care services programs were not required in another of the state's programs. A report we issued in 2012 reviewing states' implementation of different HCBS programs also suggested that states could benefit from more harmonization of program requirements. Officials in selected states we reviewed in 2012 noted the complexity of operating multiple programs. For example, officials from one state reported that the complexity resulted in a siloed approach, with different enrollment, oversight, and reporting requirements for each program. The administration and understanding of the programs available to beneficiaries was difficult for state staff and beneficiaries, according to officials in another state. The officials indicated that they would prefer CMS issue guidance on how states could operate different HCBS program types together, rather than issuing guidance on each program separately. In our 2016 report, we acknowledged certain efforts CMS had taken to harmonize requirements and improve oversight of personal care services programs. However, despite these efforts, we found that significant differences in program requirements existed. We recommended that CMS take additional steps to better harmonize and achieve a more consistent application of program requirements, as appropriate, across the different personal care services programs in a way that accounts for common risks faced by beneficiaries and to better ensure billed services were provided. CMS agreed with these recommendations, and has sought input by publishing a request for information on numerous topics related to Medicaid home and community-based services, including input on how to ensure beneficiary health and safety and program integrity across different types of personal care services programs. In our 2017 report examining the data CMS uses to monitor the provision of personal care services, we found that claims and encounter data collected by CMS were not timely. Data are typically not available for analysis and reporting by CMS or others for several years after services are provided. We found that this happens for two reasons. First, although states have 6 weeks following the completion of a quarter to report their claims data, their reporting could be delayed as a result of providers and managed care plans not submitting data in a timely manner, according to the CMS contractor responsible for compiling data files of Medicaid claims and encounters. For example, providers may submit claims for fee-for-service payments to the state late and providers may need to resubmit claims to make adjustments or corrections before they can be paid by the state. Second, once complete MSIS data are submitted by the states, the data must be compiled into annual person-level claims files that are in an accessible format, checked to identify and correct data errors, and consolidated for any claims with multiple records. This process, for one year of data, can take several years and, as a result, when information from claims and encounters becomes available for use by CMS for purposes of program management and oversight it could be several years old. We also found that Medicaid personal care services claims and encounter data that CMS collects were incomplete in two ways. First, specific data on beneficiaries' personal care services were not included in the calendar year 2012 MSIS data for 16 states, as of 2016, when we conducted our analysis. Nevertheless, these 16 states received federal matching funds for the $4.2 billion in total fee-for-service payments for personal care services that year--about 33 percent of total expenditures for personal care services reported by all states (see figure 2). Second, even for the 35 states for which 2012 MSIS claims and encounter data were available, certain data elements collected by CMS were incomplete. For example, for the records we analyzed, 20 percent included no payment information, 15 percent included no provider identification number to identify the provider of service, and 34 percent did not identify the quantity of services provided (see figure 3). Incomplete data limit CMS's ability to track spending changes and corroborate spending with reported expenditures because the agency lacked important information on a significant amount of Medicaid payments for personal care services. For example, among the 2012 claims we reviewed for personal care services under a fee-for-service delivery model, claims without a provider identification number accounted for about $4.9 billion in total payments. Similarly, payments for fee-for- service claims with missing information on the quantity of personal care services provided totaled about $5.1 billion. These data gaps represented a significant share of total personal care services spending, which totaled about $15 billion in fee-for-service expenditures in 2015. Even when states' claims and encounter data collected by CMS was complete, we found that it was often inconsistent, which limits the effectiveness of the data to identify questionable claims and encounters. For purposes of oversight, a complete record (claims or encounters) should include data for each visit with a provider or caregiver, with dates of when services were provided, the amount of services provided using a clearly specified unit of service (e.g., 15 minutes), and the type of services provided using a standard definition. Such a complete record would allow CMS and states to analyze claims to identify potential fraud and abuse. The following examples illustrate inconsistencies in data regarding when services were provided and the types of services that were provided from the 35 states whose data we reviewed: When services were provided. State-reported dates of service were overly broad. In the 35 states, some claims for personal care services had dates of services (i.e., start and end dates) that spanned multiple days, weeks, and in some cases months. For 12 of the 35 states, 95 percent of their claims were billed for a single day of service. However, in other states, a number of claims were billed over longer time periods. For example, for 10 of the states, 5 percent of claims covered a period of at least 1 month, and 9 states submitted claims that covered 100 or more days. When states report dates of service that are imprecise, it is difficult to determine the specific date for which services were provided and identify whether services were claimed during a period when the beneficiary is not eligible to receive personal care services--for example, when hospitalized for acute care services. Type of services provided. States used hundreds of different procedure codes for personal care services. Procedure codes on submitted claims and encounters were inconsistent in three ways: the number of codes used by states; the use of both national and state- specific codes; and the varying definitions of different codes across states. More than 400 unique procedure codes were used by the 35 states. CMS does not require that states use standard procedure codes for personal care services; instead, states have the discretion to use state-based procedure codes of their own choosing or national procedure codes. As a result, the procedure codes used for similar services differed from state to state, which limits CMS's ability to use this data as a tool to compare and track changes in the use of specific personal care services provided to beneficiaries because CMS cannot easily compare similar procedures by comparing service procedure codes. In our 2017 report we found that Medicaid personal care services expenditure data collected were not always accurate or complete, according to our analysis of expenditure data collected by CMS from states for calendar years 2012 through 2015. When submitting expenditure data, CMS requires states to report expenditures for personal care services on specific reporting lines. These reporting lines correspond with the specific types of programs under which states have received authority to cover personal care services, and can affect the federal matching payment amounts states receive when seeking federal reimbursement. For example, a 6 percent increase in federal matching is available for services provided through the Community First Choice program. For three other types of HCBS programs, CMS also requires states to report their expenditures for personal care services separately from other types of services provided under each program on what CMS refers to as feeder forms--that is, individual expenditure lines for different types of services that feed into the total HCBS spending amount for each program. We found that not all states were reporting their personal care services expenditures accurately, and, as result, personal care services expenditures may have been underreported or reported in an incorrect category. We compared personal care services expenditures for all states for calendar years 2012 through 2015 with each state's approved programs during this time period and found that about 17 percent of personal care services expenditure lines were not reported correctly. As illustrated in figure 4, nearly two-thirds of the reporting errors were a result of states not separately identifying and reporting personal care services expenditures using the correct reporting lines, as required by CMS. Without separate reporting of personal care expenditures as required, CMS is unable to ensure appropriate federal payment, monitor how spending changes over time across the different program types and have an accurate estimate of the magnitude of potential improper payments for personal care services. The other types of errors involved states erroneously reporting expenditures that did not correspond with approved programs. As a result, CMS is not able to efficiently and effectively identify and prevent states from receiving federal matching funds inappropriately, in part because it does not have accurate fee-for- service claims data that track payments by personal care program type that is linked with expenditures reported for purpose of federal reimbursement. These errors demonstrated that CMS was not effectively ensuring its reporting requirements for personal care expenditures were met. We concluded that by not ensuring that states are accurately reporting expenditures for personal care services, CMS is unable to accurately identify total expenditures for personal care services, expenditures by program, and changes over time. According to CMS, expenditures that states reported through MBES are subject to a variance analysis, which identifies significant changes in reported expenditures from year to year. However, CMS's variance analysis did not identify any of the reporting errors that we found. CMS officials told us that they would continue to review states' quarterly expenditure reports for significant variances and follow up on such variances. In our 2017 report, we acknowledged certain efforts CMS had taken to improve the data it collects. However, these efforts had not addressed data issues we identified that limited the usefulness of the data for oversight. We recommended that CMS take steps to improve the collection of complete and consistent personal care services data and better monitor the states' provision of and spending on Medicaid personal care services. Specifically, CMS agreed with recommendations to better ensure states comply with data reporting requirements and to develop plans for analyzing and using the data. The agency neither agreed nor disagreed with recommendations to issue guidance to ensure key data regarding claims and encounter data are complete and consistent, or with a recommendation to ensure claims data can be accurately linked with aggregate expenditure data. In light of our findings of inconsistent and incomplete reporting of claims and encounters, errors in reporting expenditures, and the high-risk of improper payments, we believe action in response to these recommendations is needed. In conclusion, Medicaid personal care services are an important benefit for a significant number of Medicaid beneficiaries and amount to billions of dollars in spending to the federal government and states. The demand and spending for personal care services continues to grow. However, the services are not without risk. Personal care services are at high risk for improper payments and beneficiaries may be vulnerable and at risk of unintentional harm and potential neglect and exploitation. Over the years, federal laws have given states a number of different options to provide home- and community- based services. Having various options for providing personal care services provides flexibilities for states in how they administer their programs and provide services to different groups of beneficiaries. At the same time, our work has also found a patchwork of federal requirements, resulting in varying levels of beneficiary safeguards and requirements to ensure that billed services are actually provided. As a result, beneficiaries with similar needs could be receiving services in programs with significantly different safeguards in place, depending on the program. Similarly, the level of assurance that billed services are actually provided could vary based on the type of program. Further, our work showed that the data CMS collects for oversight of these programs is not always timely, complete, accurate, and consistent. Without better data, CMS is hindered in effectively performing key management functions related to personal care services, such as ensuring state claims for enhanced federal matching funds are accurate. CMS has taken steps to improve the data it collects from states, and to establish more consistent administration of policies and procedures across the programs under which personal care services are provided. However, we found additional steps are warranted. Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee this concludes my prepared statement. I would be pleased to respond to any question that you might have at this time. If you or your staffs have any questions about this testimony, please contact Katherine M. Iritani at (202) 512-7114. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Tim Bushfield, Assistant Director; Anna Bonelli; Christine Davis; Barbara Hansen; Laurie Pachter; Perry Parsons; and Jennifer Whitworth. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
Medicaid, a joint federal-state health care program, provides long-term services and supports for disabled and aged individuals, increasingly in home and community settings. Federal and state Medicaid spending on home- and community-based services was about $80 billion in 2014. Personal care services are a key component of this care. States can offer personal care services through many different types of programs, and each may be subject to different federal requirements established by statute, regulations, and guidance. The provision of personal care in beneficiaries' homes can pose safety risks, and these services have a high and growing rate of improper payments, including cases where services for which the state was billed were not provided. In recent years Congress has directed HHS to improve coordination of these programs which could harmonize requirements--that is, implement a more consistent administration of policies and procedures--and enhance oversight. This statement highlights key issues regarding (1) the federal program requirements to protect beneficiaries' safety and ensure that billed services are provided, and (2) the usefulness of data collected by CMS for oversight. This testimony is based on reports GAO issued in 2016 and 2017. For these reports, GAO assessed CMS data on personal care services provided to beneficiaries and state spending. GAO also reviewed federal statutes, regulations, and guidance, and interviewed CMS officials. In its November 2016 report, GAO found a patchwork of federal requirements related to how states must protect the safety of beneficiaries in their personal care services programs and to how states ensure that billed services are actually provided. Personal care services help beneficiaries with basic activities of daily living such as bathing and dressing, in a home- or community-based setting. For two types of programs under which personal care services can be offered, states must describe to the Centers for Medicare & Medicaid Services (CMS) how they will ensure the health and welfare of beneficiaries. Similar requirements were not in place for several other programs GAO examined. In addition, for some but not all personal care services programs that GAO reviewed, states must provide evidence to CMS that the state is paying claims for services that have actually been provided. These differing federal program requirements result in uneven beneficiary safeguards and levels of assurances regarding states' beneficiary protections and oversight of billed services. GAO recommended that CMS take steps to harmonize and achieve a more consistent application of federal requirements across programs. CMS agreed with GAO's recommendation and sought input on how to do so by publishing a request for information. In its January 2017 report, GAO found limitations in the data that CMS collects to monitor the provision of personal care services and to monitor state spending on services. For example: Data on personal care services provided were often not timely, complete or consistent. The most recent data available during GAO's review (2016) were for 2012 and included data for only 35 states. Further, 15 percent of claims lacked provider identification numbers and 34 percent lacked information on the quantity of services provided. Data were also inconsistent as more than 400 different procedure codes were used by states to identify personal care services. Without timely, complete, and consistent data, CMS is unable to effectively oversee state programs and verify who is providing personal care services or the type, amount, and dates of services provided. Data on states' spending on CMS's expenditure reports, the basis for states' receipt of federal matching funds, were not always accurate or complete. From 2012 through 2015, 17 percent of expenditure lines were not reported correctly by states, according to GAO's analysis. Nearly two-thirds of these errors were due to states not separately identifying personal care services expenditures, as required by CMS, from other types of expenditures. Inaccurate and incomplete data limit CMS's ability to, among other oversight functions, ensure federal matching funds are appropriate. GAO made several recommendations to improve the data CMS collects to monitor the provision of and expenditures on personal care services. CMS agreed with some but not all of these recommendations.