Medicaid, by design, allows significant flexibility for states to design and implement their programs. Within broad federal guidelines and under federally approved plans, states have some discretion in setting Medicaid eligibility standards and provider payment rates; determining the amount, scope, and duration of covered benefits, and how these benefits are delivered; and developing their own administrative structures. For example, states may pay health care providers for each service they provide on a fee-for-service (FFS) basis; contract with managed care organizations (MCO) to provide a specific set of Medicaid-covered services to beneficiaries and pay them a set amount per beneficiary per month; or rely on a combination of both delivery systems. This flexibility has influenced the development of the program and has resulted in over 50 distinct state-based programs that vary in how health care is delivered, financed, reimbursed, and overseen. Medicaid expenditures are financed by both the federal government and the states. The rate at which the federal government matches most state expenditures--the Federal Medical Assistance Percentage (FMAP)--also varies by state and by beneficiary eligibility type, which also contributes to program variation. Specifically, the federal government pays a higher portion of Medicaid expenditures in states with low per capita incomes relative to the national average, and pays different portions for expenditures for beneficiaries qualifying for Medicaid under traditional eligibility rules and those qualifying under a PPACA expansion. The resulting variation complicates program oversight efforts, which are shared by the federal government and the states, and are aimed, in part, at ensuring that funds are used appropriately and that enrollees have access to covered benefits. (See table 1.) To help inform its oversight, CMS relies on data that states submit from their respective Medicaid Management Information Systems (MMIS). MMIS are claims processing and information retrieval systems that support the administration of the program, which states are required to implement in order to receive federal matching funds. Two data sets derived from state MMIS provide CMS with state data on program expenditures and utilization. The CMS-64 contains service expenditures and administrative expenses that are not linked to individual enrollees. State Medicaid agencies must submit this information each quarter 30 days after a quarter has ended. CMS-64 data are reported at a state aggregate level, such as a state's total expenditures for such categories as inpatient hospital services and prescription drugs, and are the basis for determining federal reimbursements to states for Medicaid expenditures. The CMS-64 also includes expenditures for supplemental payments, including disproportionate share hospital (DSH) payments. The Medicaid Statistical Information System (MSIS) is an eligibility and claims data set, and is the federal source of state Medicaid expenditure and utilization data that can be linked to a specific enrollee. For each Medicaid beneficiary, MSIS provides data on eligibility status, service utilization, and expenditures, and CMS uses these data for policy analysis and forecasting expenditures. State Medicaid agencies are required to provide CMS, through MSIS, quarterly electronic files approximately 45 days after a quarter has ended. These files contain (1) information on persons covered by Medicaid, known as "eligible files"; and (2) adjudicated claims, known as the "paid claims file," for medical services reimbursed by the Medicaid program. To support external researchers' analyses of the Medicaid program, CMS also makes excerpts of MSIS data available through the Medicaid Analytic eXtract (MAX), which includes data on Medicaid enrollment, service use, and expenditures, and the MSIS Annual Person Summary file, which includes aggregated expenditure and utilization data for each beneficiary. (See fig. 1.) Based on our review of reports issued by GAO and other entities, we determined that available Medicaid expenditure and utilization data do not provide CMS with sufficient information to consistently ensure that payments are proper or that beneficiaries have access to covered services, which is inconsistent with federal internal control standards that state that management should use quality information to achieve the entity's objectives. CMS should rely on quality information to oversee the Medicaid program. The CMS-64, which serves as the basis of calculating the amount of federal matching funds for states, and MSIS, which is designed to report individual beneficiary claims data, have the potential to offer a robust view of payments and overall spending in the Medicaid program. However, as the following examples from our work on supplemental payments, states' sources of financing, and beneficiary eligibility under PPACA demonstrate, the usefulness of the CMS-64 and MSIS data is limited, because of issues with completeness, accuracy, and timeliness. For example, neither the CMS-64 nor the MSIS is designed to capture detailed information on payments made to individual providers or the non- state sources of the state share of Medicaid payments. Without more transparent information on program payments and state funding sources, CMS is unable to determine the appropriateness of program expenditures and ensure the fiscal integrity of the program. States report aggregate data regarding supplemental payments on the CMS-64, but neither the CMS-64 nor MSIS identifies supplemental payments made to individual providers. As a result, we had to rely on alternative sources to determine Upper Payment Limit (UPL) supplemental payment amounts in conducting two reviews. In particular, we examined states' mandatory DSH reports, which include some information on UPL supplemental payments made to DSH hospitals, and interviewed providers from selected states to identify their uses of these payments. Based on these efforts, we made the following observations, among others. Thirty-nine states made UPL supplemental payments to 505 hospitals that, along with their regular Medicaid payments, exceeded those hospitals' total costs of providing Medicaid-funded care by $2.7 billion. Certain hospitals use these payments for a wide range of purposes, from covering the costs of uninsured patients to funding general hospital operations, maintenance, and capital purchases, such as a helicopter. These findings suggest that further examination of UPL supplemental payments is warranted; however, data on these payments are incomplete as states are not required to report such payments to non-DSH hospitals or to other providers at the provider level. By not collecting complete or consistent data about these payments to all providers--either through the CMS-64 or another vehicle--CMS is missing an opportunity to ensure that such payments were made for Medicaid purposes and were consistent with Medicaid payment principles. States' sources of financing States have increasingly relied on health care providers and other non- state sources to fund the state share of Medicaid payments. However, CMS does not collect accurate and complete data on state sources of funds to finance the Medicaid program, thus complicating CMS's ability to fully assess whether state financing of the nonfederal share complies with federal law, or the extent to which the increased reliance on providers and local governments serves to provide fiscal relief to states and shifts costs to the federal government. We and MACPAC found that CMS does not have complete data on the sources or amounts of local government funds states use to finance their nonfederal share. We and CRS also determined that the CMS-64 contained incomplete data on provider taxes, and we noted that CMS has not assessed the accuracy and completeness of those data. For a 2014 report, we asked states to identify and quantify the sources of their nonfederal share, and 47 states indicated that they had at least one provider tax or donation in effect in 2012. In comparing these responses to the provider tax and donation data they reported on the CMS-64 for the same year, we found that 6 states did not report one or more provider taxes. As of October 2016, over 30 states have opted to expand their Medicaid program under PPACA. Because the FMAP rate can vary by beneficiary eligibility type, it is critical that CMS apply the correct matching rate for each respective eligibility group in these states to ensure proper payment amounts. However, CMS does not collect accurate state data on Medicaid enrollment by eligibility type in the CMS-64, thus complicating its ability to identify erroneous expenditures due to incorrect eligibility determinations. For example We reviewed state eligibility reviews and noted that, in 8 of the 9 states reviewed, the state identified errors that resulted in incorrect eligibility determinations, including enrollment of individuals with incomes exceeding Medicaid standards--totaling up to $48,000 in improper payments identified in one state alone. At the time of our review, CMS had not reviewed federal Medicaid eligibility determinations in the 10 states that had delegated authority to the federal government to make these determinations, thus creating a substantial gap in its oversight of Medicaid eligibility determinations. MSIS is the primary data source available to CMS on beneficiaries' utilization of services as it includes claims data submitted by FFS providers and encounter data submitted by MCOs. However, we and HHS-OIG have identified incomplete and untimely state MSIS data, particularly managed care encounter data. Without better MSIS data, CMS may not be able to identify billing patterns that indicate inappropriate provider billing or ensure that beneficiaries have access to covered services. In July 2015, HHS-OIG reviewed states' compliance with federal requirements regarding the submission of Medicaid encounter data and determined that 11 states did not report encounter data for all managed care plans operating in their states as required. In that same year, we could not assess utilization patterns for Medicaid managed care beneficiaries in 32 states, because MSIS data were either not available or were unreliable. The lack of complete and reliable encounter data presents a significant oversight challenge for CMS given that over three-quarters of Medicaid beneficiaries were enrolled in managed care in 2014. We and HHS-OIG found evidence of states not reporting MSIS data on time. For example, in an October 2012 report examining consistencies between CMS-64 and MSIS data, we found that 37 states were late reporting their quarterly MSIS data by six quarters in July 2012. Although CMS requires states to submit MSIS data within 45 days of the end of a fiscal quarter, we found that states' reporting of MSIS data and the subsequent validation process are up to 3 years late. Similarly, the July 2015 HHS-OIG report noted above, also identified 8 of the 38 states it reviewed as not reporting any MSIS encounter data by the required deadline. In a 2015 review of Medicaid prescription-drug fraud controls, we also identified how inaccurate and incomplete encounter data can affect state program integrity efforts. Data from 4 of the 11 states we reviewed had missing or unreliable provider information or encounter data, thus affecting those states' ability to identify incidents of fraud, waste, or abuse. CMS officials identified the Transformed Medicaid Statistical Information System (T-MSIS) initiative as the agency's primary effort to improve Medicaid expenditure and utilization data, and highlighted aspects of the initiative intended to improve their accuracy, completeness, and timeliness. However, less than half of the states are submitting T-MSIS data files to CMS, and it is uncertain when the remaining states will submit these data or how CMS will ensure their quality or use them for oversight purposes. CMS has acknowledged the need for improved Medicaid data, and has undertaken a number of steps aimed at streamlining and improving the quality of data currently reported by states and available to CMS for oversight purposes. For example, since 2011, CMS has been working to implement the T-MSIS initiative to increase and improve the data collected through MSIS. T-MSIS is to include data about enrollees, services, and costs, including FFS claims, managed care encounters, beneficiary eligibility and demographics, and provider enrollment. According to CMS officials, T-MSIS includes aspects designed to improve the completeness, accuracy, and timeliness of available state data, as well as their utility for states. Completeness: T-MSIS is designed to capture significantly more data from states than is the case with MSIS. CMS requires states to report data on approximately 550 variables across eight data files in T-MSIS, a significant contrast to the approximately 200 variables required in MSIS. T-MSIS requires states to report three additional data files, including specific files on providers, third-party liability, and MCOs, thus collecting data not previously reported that could provide CMS information to enhance its oversight efforts. The provider file includes a unique identifier for each provider, as well as data fields to show provider specialty and practice locations. Each of these has the capacity to assist CMS oversight in terms of providing insight on provider referrals, Medicaid payments to specific providers, and identifying ineligible providers. The third party liability file includes data on whether a beneficiary has any health insurance in addition to Medicaid, which would provide CMS with data on potentially liable third parties. The managed care file includes more detailed information on MCOs, such as type and name of managed care plans, covered eligibility groups, service areas, and reimbursement arrangements. In addition to identifying failure to report encounter data, this file could help CMS's oversight by allowing the agency to identify excess plan profit and volatility of expenditures for some enrollee groups across states. In addition to the data variables associated with the three new files, CMS expanded the scope of data to be collected through the existing MSIS files. For example, according to CMS officials, T-MSIS is to collect more detailed information on enrollees, including their citizenship, immigration, and disability status, as well as expanded diagnosis and procedure codes associated with their treatments. Accuracy: Within T-MSIS, there exist aspects aimed at improving the accuracy of data initially submitted by states. For example, T-MSIS includes approximately 3,500 automated quality checks, which provide states with feedback on data format and consistency, in contrast to MSIS, which has relatively few automated checks. T-MSIS quality checks include ensuring that a beneficiary's date of birth is a valid date and that a beneficiary's age is under a reasonable limit. Other quality checks are to ensure logical relationships across T- MSIS files, such as ensuring that the beginning date of service on claims are on or after a beneficiary's date of birth. According to agency officials, CMS accepts state data for subsequent processing, provided the data are correctly formatted. According to CMS officials, states have access to error reports that are generated as a result of processing their T-MSIS data. Timeliness: CMS requires states to report T-MSIS data to CMS monthly, versus quarterly, as is the case with MSIS data. Utility for states: T-MSIS includes aspects aimed at improving state oversight and reducing state burden. For example, while states have not relied on MSIS data to oversee their Medicaid programs, T-MSIS is intended to eventually provide states with the capability to analyze and compare their program data to other states, potentially enhancing their ability to manage expenditures and identify concerns regarding access to care. According to CMS officials, the agency also intends to access certain state data directly through T-MSIS, rather than separately requesting such data from the states, thereby reducing the number of data requests that CMS makes to states. In addition to its ongoing implementation of T-MSIS, CMS has taken other actions--for example, issuing regulations and guidance--to improve data reporting and enhance available data; however, given the recent nature or future implementation dates of these actions, their effect on CMS's ability to oversee the Medicaid program is not fully known. The May 2016 managed care rule includes provisions intended to strengthen data the agency collects on managed care utilization and relevant for program integrity, which could help improve MCO oversight, the need for which was identified in several GAO reports. For example, the rule requires states to include provisions regarding the maintenance of encounter data in contracts with MCOs and limited benefit plans, to have procedures in place to ensure that enrollee encounter data these entities submit are complete and accurate, and includes financial consequences for lack of compliance. Although MCOs have been expressly required to report encounter data under statute since 2010, CMS's May 2016 rule provides more clarity regarding the format and collection of these data. However, because these rules will not take effect until 2017 and 2018, their success in improving data is dependent on state and CMS implementation. In addition, the managed care rule increases and clarifies state responsibilities related to overseeing payments to and by MCOs, which addresses a GAO recommendation that CMS hold states accountable for managed care program integrity by requiring them to conduct audits of MCOs. In particular, the managed care rule requires that states, at least once every 3 years, audit encounter and financial data submitted by MCOs. A December 2015 final rule includes more targeted financial consequences for states that do not comply with data submission requirements, including T-MSIS. While CMS previously had the authority to reduce federal financial participation for system operations from 75 percent to 50 percent if any system failed to meet any or all requirements, the final rule provides CMS with the option to tailor the federal matching rate reduction to the specific operational expenditures related to the system component that does not meet applicable requirements. Having the ability to impose more targeted funding reductions may enable CMS to more effectively leverage improved state compliance with reporting requirements. In December 2015, in response to a GAO recommendation to routinely monitor and share information regarding key third-party liability efforts and challenges across states, CMS provided states with an updated guide on Medicaid third-party liability practices with information to help make states more aware of such efforts and challenges. This updated guide is an important tool that could help states ensure that Medicaid pays only after other liable third parties. In its Comprehensive Medicaid Integrity Plan for fiscal years 2014- 2018, CMS noted that it is leveraging available Medicare data to assist states in identifying providers who are enrolled in both Medicare and Medicaid, and may be involved in fraudulent or abusive billing practices. CMS officials also reported they adjusted the CMS-64 to improve states' reporting of eligibility categories and UPL supplemental payments and trained states on how to report UPL supplemental payments. Although T-MSIS may ultimately provide CMS with improved data to enhance its oversight of the Medicaid program, it is unclear when T-MSIS data will be available from all states. Federal internal control standards require agency management to complete actions to improve deficiencies on a timely basis; however, T-MSIS implementation, which began in March 2011 as a pilot program in 12 states, has been delayed for several years. The original date for nationwide submission was July 2014; as of October 2016, 18 states were submitting T-MSIS data, and CMS officials were uncertain as to when the remaining 33 states would begin submitting these data. Agency officials stated that for a state to be considered submitting T-MSIS data, it must submit all eight data files, but not necessarily all data variables within each file. CMS officials currently estimate that states representing over 70 percent of the Medicaid population will be submitting T-MSIS data by the end of calendar year 2016. To expedite states' implementation of T-MSIS, CMS officials noted that they are focusing their efforts on the states they have determined are closest to implementing T-MSIS. According to these officials, CMS has had calls with these states to inquire about their plans, including what help the state may need from the agency. CMS has categorized the remaining states according to their readiness to begin submitting T-MSIS data. CMS and state officials identified several factors contributing to states' delayed T-MSIS implementation. For example, in addition to requiring states to submit significantly more information than they have in the past, T-MSIS implementation also coincides with the ongoing efforts of over 30 states to redesign or replace their Medicaid information technology systems--an effort that states are undertaking, in part, to facilitate their efforts to comply with a multitude of federal requirements, only one of which is T-MSIS. A group representing state Medicaid directors also noted that state efforts to implement T-MSIS have been hindered by unclear and changing federal requirements. According to this group, CMS's ongoing revisions to T-MSIS requirements have created challenges and costs for states. In addition to uncertainty regarding states' implementation of T-MSIS, CMS has not fully developed its plans for assessing and ensuring the quality of state data and, according to agency officials, is still trying to determine the best way to summarize and communicate what it has learned about the data's quality to internal users and to states. According to CMS officials, the agency is producing data quality reports for internal users and anticipates sharing such reports with the public in 2017. While CMS officials identified seven broad priority areas for assessing the quality of the data--eligibility, expenditures, all utilization, FFS utilization, managed care utilization, providers, and third party liability--they have not yet delineated priorities within these areas for further review or identified specific data variables for priority validation--associated with improper payments or otherwise. Nonetheless, CMS officials noted that they have taken some steps to address the quality of state data. For example, in addition to the automated front-end data quality checks, the agency's contractor has developed 2,000 quality measures to determine whether data are within expected ranges. For instance, if a state's data suggested a Medicaid population that is 70 percent male, CMS would examine the data further as its data indicate the Medicaid population is predominantly female. CMS officials emphasized that they continue to develop processes to ensure data quality and expect to identify trends in the data that would allow them to develop new quality checks or determine which checks are no longer relevant. Without fully developing, implementing, and expediting efforts to assess the quality of T-MSIS data, CMS cannot ensure the accuracy and completeness of T-MSIS data that states submit. CMS's plans for using T-MSIS to oversee states' Medicaid programs also remain preliminary, and the agency has not established specific time frames for their use. Officials report that the agency is currently examining available state T-MSIS data to identify any problematic trends and developing analytic tools designed to assist with monitoring and oversight. For example, CMS's Center for Program Integrity has begun to crosswalk T-MSIS provider data to Medicare data to develop an algorithm to assist with program integrity efforts. Additionally, CMS established the Division of Business and Data Analysis in 2015 to lead analysis and dissemination of Medicaid and CHIP data. Such efforts include working with states on improving the quality of their T-MSIS data and to support other CMS offices' use of data for program management and monitoring. According to CMS officials, the improved data will be used by CMS, states, and researchers for program monitoring, policy implementation, improving beneficiary health care, and lowering costs. Officials reported they anticipate that as more states submit T-MSIS data, and both states and CMS gain more experience with the process, the agency will develop additional and more complex uses of T-MSIS for program oversight purposes. The continuing increase in federal Medicaid improper payments-- estimated at over $36 billion in fiscal year 2016--underscores the need for improved program oversight. We and others have expressed long- standing concerns about the completeness, accuracy, and timeliness of available Medicaid data, and the effect of these insufficiencies on CMS's ability to ensure the fiscal integrity of the program. CMS's continued reliance on inaccurate, incomplete, and untimely data, and the ongoing uncertainty about the scope and timing of its remedial actions, is inconsistent with federal internal control standards. As a steward of the program, CMS must take immediate steps to ensure the appropriate use of scarce federal and state dollars. CMS acknowledges the need for improved Medicaid data and is taking actions aimed at improving available data. Thus far, CMS actions have focused on guidance and regulations, continued oversight of program integrity, and improved reporting of specific expenditures, such as supplemental payments. It is unknown whether these actions, while important, will significantly improve CMS's ability to oversee this complex and growing program. In the longer term, CMS cites T-MSIS as its primary effort to streamline and improve data. T-MSIS includes aspects aimed at improving the quality of state data available to CMS, yet uncertainty remains as to when these data will be available from all states; how CMS will ensure their quality; or how CMS will use these data for oversight purposes. Without an improved focus on ensuring the accuracy of data--and setting priorities for the data that are most likely to improve program oversight--the effectiveness of T-MSIS cannot be assured. We recommend that the Administrator of CMS take immediate steps to assess and improve the data available for Medicaid program oversight, including, but not limited to, T-MSIS. Such steps could include refining the overall data priority areas in T-MSIS to better identify those variables that are most critical for reducing improper payments, and expediting efforts to assess and ensure the quality of these T-MSIS data. We provided a draft of this report to HHS for comment. In its written comments, HHS concurred with our recommendation and acknowledged the importance of having robust, timely, and accurate data to ensure the highest financial and program performance in the Medicaid program. HHS highlighted aspects of T-MSIS aimed at improving state data, which would strengthen program monitoring and oversight, policy implementation, and provide a framework for identifying potential areas of concern so that additional efforts may be taken that could reduce future instances of potential fraud, waste, and abuse. Further, HHS noted its ongoing efforts to work with states to ensure compliance with T-MSIS reporting requirements, reduce reporting errors, and improve the quality of their data submissions. HHS also provided a technical comment, which we incorporated. HHS's comments are reproduced in appendix I. As arranged with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days after its issuance date. At that time, we will send copies of this report to the Secretary of Health and Human Services and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix II. In addition to the contact named above, Susan Anthony (Assistant Director), Manuel Buentello (Analyst-in-Charge), Ricky Harrison Jr., and Kate Nast Jones made key contributions to this report. Also contributing were Sandra George and Drew Long. The following are selected GAO products pertinent to the issues discussed in this report. Other products may be found at GAO's web site at www.gao.gov. Medicaid: Federal Guidance Needed to Address Concerns About Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: February 5, 2016. Medicaid: Improving Transparency and Accountability of Supplemental Payments and State Financing Methods. GAO-16-195T. Washington, D.C.: November 3, 2015. Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C.: October 16, 2015. Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, D.C.: July 30, 2015. Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug Fraud Controls. GAO-15-390. Washington, D.C.: July 8, 2015. Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. GAO-15-481. Washington, D.C.: May 29, 2015. Medicaid: CMS Oversight of Provider Payments is Hampered by Limited Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015. High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 11, 2015. Medicaid: Additional Federal Action Needed to Further Improve Third- Party Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015. Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity of Growing Managed Care Expenditures. GAO-14-341. Washington, D.C.: May 19, 2014. Medicaid Financing: States' Increased Reliance on Funds from Health Care Providers and Local Governments Warrants Improved CMS Data Collection. GAO-14-627. Washington, D.C.: July 29, 2014. Medicaid: Completed and Preliminary Work Indicate that Transparency around State Financing Methods and Payments to Providers Is Still Needed for Oversight. GAO-14-817T. Washington, D.C.: July 29, 2014. Medicaid: More Transparency and Accountability for Supplemental Payments are Needed. GAO-13-48. Washington, D.C.: November 26, 2012. Medicaid: Data Sets Provide Inconsistent Picture of Expenditures. GAO-13-47. Washington, D.C.: October 29, 2012. Medicaid: States Reported Billions More in Supplemental Payments in Recent Years. GAO-12-694. Washington, D.C.: July 20, 2012. National Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit Collaboration with States. GAO-12-627. Washington, D.C.: June 14, 2012. Medicaid and CHIP: Reports for Monitoring Children's Health Care Services Need Improvement. GAO-11-293R. Washington, D.C.: April 5, 2011.

Summary:
To inform its oversight of Medicaid, CMS relies on state-reported data that contain information on multiple aspects of the program, including expenditures and service utilization. Recent increases in Medicaid improper payments, which were an estimated $36 billion in fiscal year 2016, have exacerbated concerns about the quality of data available to CMS for program oversight. GAO was asked to examine the usefulness of Medicaid data for oversight purposes and any efforts to improve known limitations. This report (1) describes how available Medicaid expenditure and utilization data affect CMS's ability to oversee the Medicaid program; and (2) examines CMS's efforts to improve these data. To address these objectives, GAO reviewed agency guidance, laws, regulations, and federal internal control standards; reviewed reports from GAO and others published from March 2010 through September 2016; and interviewed CMS officials about continuing data challenges and initiatives to improve data. GAO found that available Medicaid expenditure and utilization data do not provide CMS with sufficient information to consistently ensure that payments are proper or that beneficiaries have access to covered services. The Centers for Medicare & Medicaid Services (CMS), the agency within the Department of Health and Human Services (HHS) that administers the Medicaid program, relies on two key data sources for program oversight: the CMS-64, which serves as the basis for calculating the amount of federal matching funds for states, and the Medicaid Statistical Information System (MSIS), which is designed to report individual beneficiary claims data. The CMS-64 and MSIS have the potential to offer a robust view of payments, overall spending, and services in the Medicaid program; however, GAO found that the usefulness of these data is limited because of issues with completeness, accuracy, and timeliness. Available expenditure data do not provide complete or accurate information on how states finance their portion of program costs, such as complete data on the sources or amounts of local government funds used to finance states' share of Medicaid costs, thus complicating CMS's ability to assess the appropriateness of states' financing. Available utilization data, particularly for Medicaid managed care, are incomplete and are reported up to 3 years late, complicating CMS's ability to identify billing patterns that indicate inappropriate provider behavior or ensure that beneficiaries have access to covered services. CMS has acknowledged the need for improved Medicaid data and cites the Transformed Medicaid Statistical Information System (T-MSIS) as its key initiative to improve Medicaid data and program oversight. T-MSIS includes aspects aimed at improving the completeness, accuracy, and timeliness of state data available to CMS, yet uncertainty remains as to when these data will be available from all states as implementation has been delayed for several years. As of October 2016, 18 states were submitting T-MSIS data. Although CMS officials were uncertain when the remaining states would begin submitting data, they estimated that states representing over 70 percent of the Medicaid population would be submitting T-MSIS data by the end of calendar year 2016. CMS officials identified several factors contributing to states' delayed T-MSIS implementation, such as coinciding with the ongoing efforts of over 30 states to redesign or replace their Medicaid information technology systems. Moreover, CMS has not fully developed its plans to ensure the quality of T-MSIS data, and its plans for using these data for oversight purposes remain preliminary. Through rulemaking and other guidance, CMS has taken other actions to improve data; however, given that these actions have recently or not yet been implemented, it is unclear how they will affect CMS's oversight. CMS's continued reliance on inaccurate, incomplete, and untimely data, and the ongoing uncertainty about the scope and timing of its remedial actions, hamper effective oversight and are inconsistent with federal internal control standards, which require entities to rely on quality and timely information to oversee their programs and take timely actions to improve deficiencies. GAO recommends that CMS take immediate steps to improve Medicaid data available for program oversight, such as expediting efforts to assess and ensure the quality of T-MSIS data. HHS concurred with GAO's recommendation.