American Samoa, CNMI, Guam, Puerto Rico, and the U.S. Virgin Islands are five territories of the United States. With the exception of Puerto Rico, the populations in the territories are small relative to the states, and are generally poorer. Within broad federal guidelines and under federally approved plans, territories have some discretion in setting Medicaid and CHIP eligibility standards and provider payment rates; determining the amount, scope, and duration of covered benefits; and developing their own administrative structures. For example, similar to the states, unless they have obtained a waiver, the territories' Medicaid programs are required to cover certain benefits--known as mandatory Medicaid benefits--and can choose to cover additional benefits, known as optional benefits. While the states also have similar discretion, the territories have been afforded greater flexibility, including the ability to set their own income eligibility levels for certain populations and determine income eligibility using a locally established poverty level instead of the federal poverty level (FPL). Also like the states, territories can operate their CHIP programs as a separate program, include CHIP-eligible children in their Medicaid program, or use a combination of the two approaches. Significant differences exist in how Medicaid and, to a lesser extent, CHIP are funded in the territories as compared with the states. For example, the federal matching rate for states' Medicaid programs, the Federal Medical Assistance Percentage (FMAP), is based on a state's per capita income in relation to the national per capita income, with poorer states receiving higher federal matching rates than wealthier states. In contrast, the Medicaid FMAP for the territories does not recognize their capacity to pay for program expenses. Although PPACA increased the territories' FMAP from 50 to 55 percent, this percentage is fixed at the lower end of the range available to states. For the CHIP program, the federal government matches states' and territories' program spending at a rate higher than Medicaid, known as the enhanced FMAP. However, territories' matching rate for CHIP spending is similarly fixed at the lower end of the range available to the states. Additionally, federal Medicaid funding in states is not subject to a limit, provided the states contribute their share of program expenditures for services provided. In contrast, federal Medicaid funding in each territory is subject to a statutory cap. In general, once their Medicaid and CHIP funding is exhausted, territories must assume the full costs of their programs. These funding differences, along with differences in the costs of health care in the territories compared with the states, have contributed to lower federal and territory Medicaid program expenditures in the territories. For example, in the aggregate, total Medicaid expenditures in all five territories comprised less than one half of one percent of the total national Medicaid expenditures in fiscal year 2014. However, when examined separately, Puerto Rico had Medicaid enrollment and expenditures similar to some states. Specifically, in fiscal year 2014, Puerto Rico ranked 11th in Medicaid enrollment nationally and ranked 42nd in total Medicaid expenditures. Like the states, territories must report their quarterly program expenditures for Medicaid and CHIP on the CMS-64 no later than 30 days after the end of each quarter, which is used to reimburse them for their federal share of these expenditures. In recent years, legislation to provide temporary increases in Medicaid and CHIP funding has been enacted. For example, the American Recovery and Reinvestment Act of 2009 (Recovery Act) provided the territories with a 30 percent increase in their Medicaid caps from fiscal year 2009 through the first quarter of fiscal year 2011, as well as federal matching funds to encourage Medicaid providers to undertake health information technology (HIT) initiatives. Most recently, PPACA appropriated $7.3 billion in additional Medicaid funding to the territories, the majority of which is available through fiscal year 2019. According to CMS officials, this funding can be used once territories expend their Medicaid and CHIP funding each year. PPACA also permanently increased territories' Medicaid FMAPs and CHIP enhanced FMAPs to 55 percent and 68.5 percent, respectively. Federal law generally requires state, territory, and federal entities to ensure program integrity by protecting the Medicaid and CHIP programs from fraud, waste, and abuse. Like the states, territories have primary responsibility for such program integrity because they enroll providers, establish payment policies, process claims, and pay for services furnished to beneficiaries. To execute this responsibility, territories may undertake a variety of efforts. For example, although not required, they can establish program integrity units, which are tasked with identifying and recovering improper payments. Territories, like the states, are also required to implement certain program integrity mechanisms or receive an exemption from CMS for doing so. For example, territories must establish Medicaid Fraud Control Units (MFCU), which are tasked with investigating Medicaid fraud and other health care law violations, or receive an exemption from CMS from establishing one. The territories are also required to implement a Medicaid Management Information System (MMIS), which is a claims processing and information retrieval system that includes capabilities for reporting claims data, enrollee encounter data, and conducting pre- and post-payment review. Such information can assist in identifying improper payments. Federal mechanisms are also available to assist in program oversight. For example, CMS can conduct comprehensive or focused program integrity reviews, which assess the effectiveness of state and territory program integrity efforts, including compliance with federal statutory and regulatory requirements. Further, through the Payment Error Rate Measurement (PERM) program, CMS requires states to estimate improper payments in the Medicaid and CHIP program to identify program vulnerabilities and actions to reduce improper payments; however, the agency has excluded the territories from this program. Additionally, OMB's annual A-133 single audits examine internal controls and compliance deficiencies in certain federal programs, including Medicaid and CHIP, and can be a resource to inform program oversight. Due to the flexibility territories have in administering their Medicaid and CHIP programs, the territories' program eligibility and benefits not only reflect their unique circumstances, but also differ from one another and from the states. For example, a notable distinction among territories' program eligibility is that Puerto Rico is the only territory that uses its CHIP funds to cover additional children in its Medicaid programs whose income levels exceed Medicaid eligibility levels. The other four territories use their CHIP funds to pay for services provided to children up to the age of 19 in their Medicaid programs. Additionally, Guam, Puerto Rico and the U.S. Virgin Islands base program eligibility on local poverty levels (LPL) that are more restrictive than federal standards, which has resulted in lower program enrollment than would otherwise be the case. Additionally, unlike the states and other territories, American Samoa does not determine eligibility for its Medicaid program on an individual basis. Instead, it presumes that all individuals with incomes at or below 200 percent of the FPL are eligible. The different methods territories use to determine eligibility affect Medicaid enrollment in each territory, with the estimated percentage of territories' populations enrolled in Medicaid in fiscal year 2015 ranging from about 17 percent in the U.S. Virgin Islands to 88 percent in American Samoa. (See table 1.) Territories also vary in terms of the range of benefits covered by their respective Medicaid programs. Specifically, Guam covers all of the 17 mandatory Medicaid benefits; CNMI and the U.S. Virgin Islands cover nearly all of the benefits; and American Samoa and Puerto Rico cover 10 of the 17 benefits. American Samoa and CNMI operate their Medicaid programs under broad waiver authority under section 1902(j) of the Social Security Act and, therefore, are not required to cover all mandatory benefits. While the other territories do not operate under this broad waiver authority, CMS acknowledged that the agency has not required them to cover all mandatory Medicaid benefits, citing limited federal Medicaid funding and the unavailability of certain services. Examples of the mandatory benefits most commonly covered by all five territories include Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) services for individuals under 21; inpatient hospital services; outpatient hospital services; and physician services. In contrast, the territories' coverage of other benefits, such as nursing facility and rural health clinic services, was less widespread, and only Guam covered freestanding birth center services. (See fig. 1.) Officials from the four territories that do not cover all mandatory Medicaid benefits cited multiple reasons for not doing so, including limited funding and a lack of infrastructure. In particular, officials from Puerto Rico and American Samoa said that their programs do not cover nursing facility services due to insufficient funding and because they do not have nursing homes; CNMI officials noted that its program does not cover freestanding birth center services because there are no such facilities in the territory; and due to the lack of available providers, certain specialty services covered by American Samoa, CNMI, and Guam are only available off- island. For example, in CNMI, most cardiac, orthopedic, chemotherapy, and radiation services are only available off-island; in Guam, pediatric oncology, hematology, dermatology, and procedures such as cardiac bypass surgery, are only available off-island. In addition to mandatory Medicaid benefits, each territory has chosen to cover optional benefits, with all five territories providing coverage for outpatient prescription drugs, clinic services, dental and eyeglasses, prosthetics, physical therapy, and rehabilitative services. Optional services commonly covered by states--such as targeted case management, personal care services, and intermediate care facilities for individuals with intellectual disabilities--are not covered by any of the five territories. (See fig. 2.) The recent temporary increases in federal funding have enabled the territories to increase Medicaid and CHIP spending, and avoid federal funding shortfalls. Most notably, PPACA's appropriation of an additional $7.3 billion in Medicaid funding for the territories--available for expenditure through at least fiscal year 2019--provided them flexibility in terms of when they choose to draw down the additional funds. For example, between fiscal year 2010 when PPACA funds were not available and fiscal year 2014 when they were, the average annual percentage change in total Medicaid and CHIP spending in CNMI and Guam was 23 percent and 19 percent, respectively, with total spending in these territories more than double in fiscal year 2014 compared to fiscal year 2010. (See table 2.) Prior to the availability of these temporary funds, the territories often exhausted their Medicaid funds anywhere from the first through the third quarter of each fiscal year, and generally utilized all of their CHIP funding each year. The territories used various strategies to address these federal funding shortfalls. For example, Puerto Rico officials said that prior to the PPACA funding, the federal Medicaid funds covered only 16 percent of their planned annual expenditures and were expended during the first quarter of the federal fiscal year, after which time the territory had to rely entirely on local funding to cover program spending. Further, a CNMI official said it was normal for their providers to provide services in one year and be paid the following year. In addition to all five territories avoiding federal funding shortfalls, officials in three of the territories noted that these temporary funds have allowed them to improve their programs by covering more benefits, enrolling more providers, or both. For example, American Samoa officials said they plan to use some of their PPACA funds to pay for services provided by new providers, thereby expanding access to services beyond the island's only hospital. Puerto Rico officials said they used some of their PPACA funds to add coverage for certain organ transplants, which, according to CMS officials, the territory must cover due to other changes in law enacted under PPACA. Despite the influx of temporary PPACA funding, territories may nonetheless experience funding shortfalls in the near future, according to CMS and territory officials. Specifically, certain territories may exhaust their PPACA funding before the end of fiscal year 2019, as there are no restrictions on the rate at which territories may access their allotted funds. For example, CNMI and Puerto Rico, which used 49 percent and 56 percent of their allotments between fiscal years 2011 and 2015, respectively, are spending these temporary funds at a rate that could deplete their allotments early, as the amount they have spent has increased each year. (See table 3.) While the rate of expenditures to date may not reflect future spending rates, some territory officials expressed concerns about the temporary availability of the PPACA funds and the fact that their capped allotments will be reduced to pre-PPACA levels beginning in fiscal year 2019, or earlier if they expend the PPACA funds before 2019. As a result, the territory officials noted that the territories may run out of the temporary funding early, have to make program cuts once the funding is exhausted, or both. For example, Puerto Rico Medicaid officials said they determined they could exhaust their entire PPACA allotment as early as fiscal year 2017. Additionally, officials from Puerto Rico and Guam expressed concern that they may need to restrict eligibility or reduce benefits once the PPACA funding is exhausted. Territory and federal oversight efforts provide little assurance that the territories' Medicaid and CHIP funds are protected from fraud, waste, and abuse. Citing limited resources, territory officials acknowledge a general lack of program integrity efforts. Further, federal officials cite the territories' smaller Medicaid expenditures in limiting their program integrity efforts to technical assistance. Although the territories have primary responsibility for Medicaid program oversight, limited assurance exists that they are identifying and recovering improper payments or investigating fraud in their Medicaid programs. With the exception of Puerto Rico, the territories have not established program integrity units, which are dedicated to identifying and reducing improper payments. Although Medicaid agencies are not required to establish program integrity units, the lack of a separate entity is counter to internal controls standards regarding segregation of key duties and responsibilities for reducing the risk of error and fraud. Specifically, in four of the territories, the Medicaid Director is responsible for program oversight, including program integrity efforts, according to CMS officials. This lack of segregation of key duties and responsibilities could be remedied through the establishment of a program integrity unit or other division of labor. According to CMS officials, the territories have not established separate program integrity units because they lack adequate funding and personnel to do so, and funds spent on such an oversight effort would reduce the amount of funds available for the provision of health care services. Further, an American Samoa official said the territory is very interested in undertaking program integrity efforts, but is unable to hire additional staff to do so because of budgetary constraints. Although Puerto Rico has a program integrity unit, according to Puerto Rico officials, this unit's responsibilities are limited to eligibility fraud and acting as a liaison regarding concerns of provider fraud with the Administracion de Seguros de Salud de Puerto Rico (ASES), the Puerto Rico government entity that manages managed care organization (MCO) contracts. ASES delegates primary responsibility for program integrity efforts to the MCOs and requires them to have policies and procedures for the identification, investigation, and referral of suspected fraud. Both we and the HHS-OIG have previously reported concerns that MCOs might not have an incentive to identify and recover improper payments. For example, as we previously reported, officials from state program integrity units noted that they believed MCOs were not consistently reporting improper payments in order to avoid appearing vulnerable to fraud and abuse. In this same report, state program integrity unit officials also noted a potential conflict of interest for MCOs because reporting improper payments could reduce their future federal funding. In addition to the general absence of program integrity units, none of the territories has established a MFCU--units that investigate and prosecute Medicaid fraud and other health care law violations--or obtained an exemption from the requirement to establish one from CMS. According to CMS officials, territories have not established MFCUs because the costs associated with establishing them count against the territories' capped Medicaid allotment and would reduce the funds available for providing services. Further, Puerto Rico officials told us they had considered developing a MFCU, but decided against it after learning that the funds used to develop it would reduce funds for services. These officials said they made this decision despite knowing that a MFCU could eventually be cost effective because they believed they could not afford the initial investment. While the establishment of a MFCU may not make sense, given the size and spending of the territories, the territories are required to demonstrate that minimal fraud exists in their programs if they do not have a MFCU. The territories' incomplete service-level expenditure reporting also contributes to limited assurance of Medicaid program integrity in the territories. Specifically, the limited detail on the types and volume of services provided in the territories can hinder program integrity efforts, including making it difficult to identify potential fraud, waste, and abuse. As with states, different reporting requirements exist for fee-for-service and managed care spending in the territories. According to CMS officials, the health care delivery systems in American Samoa, CNMI, Guam, and the U.S. Virgin Islands are entirely fee-for-service, and therefore these territories are required to report service-level spending on the CMS-64. CMS officials cited the CMS-64 as the only data source for Medicaid and CHIP spending in these territories, underscoring the importance of accurate service-level expenditure reporting for territories' program integrity efforts. However, we reviewed the territories' Medicaid spending for fiscal year 2014 and found that none of the territories had reported service-level spending for all the Medicaid benefits they covered. Specifically, for the benefits we reviewed, American Samoa, CNMI, and Guam reported service-level spending for 24 percent, 55 percent, and 63 percent, respectively, of the Medicaid benefits they covered. (See table 4.) This limited reporting is the result of various circumstances. For example, Medicaid enrollees in American Samoa are serviced by a single hospital that reports costs by only three mandatory benefits--inpatient hospital services, outpatient hospital services, and emergency services for certain legalized aliens and undocumented aliens. With regard to managed care, Puerto Rico's Medicaid managed care program, which provides coverage to all Medicaid and CHIP enrollees, is not subject to service-level reporting requirements. However, under their contracts with Puerto Rico Medicaid, the MCOs in Puerto Rico are required to submit encounter data to ASES. Although these data could provide insight on service-level utilization, CMS officials told us they do not collect or review these data on a regular basis. With regard to program oversight, CMS's general practice has been to conduct comprehensive program integrity reviews in all of the states; however, of the five territories, it has conducted such reviews only in Puerto Rico, the most recent of which was released in January 2012 and produced multiple findings. CMS officials told us they are switching from comprehensive and more focused program integrity reviews in the states and plan to conduct such a review for Puerto Rico in 2016. Citing the other territories' smaller Medicaid expenditures, however, CMS has neither conducted similar reviews of their Medicaid programs, nor does it plan to conduct more focused program reviews. While Medicaid spending in the territories is small as a proportion of total Medicaid spending, such limited federal oversight efforts provide little assurance that Medicaid is protected from fraud, waste, and abuse, and are inconsistent with federal internal control standards regarding the identification, analysis, and response to relevant risks as part of achieving program objectives. Given that governmental, economic, industry, regulatory, and operating conditions continually change--such as when PPACA significantly increased territory Medicaid funding--mechanisms should be provided to identify and manage any special risks prompted by such changes in program conditions. Additionally, other factors--such as the lack of enforcement of program integrity mechanisms and information systems--have contributed to the limited federal program integrity efforts in the territories. For example, CMS has neither required the territories to establish MFCUs, nor has the agency granted them an exemption, because agency officials were unclear whether they had the authority to grant such exemptions. Additionally, until recently, CMS regulations exempted territories from the requirement to develop an MMIS, which could provide more detail on the territories' Medicaid and CHIP spending, including increasing the level of detail on the territories' CMS-64 reporting. In December 2015, CMS amended its regulations to eliminate the MMIS exemptions for the territories, effective January 1, 2016. Despite the fact that an exemption had been in place, the U.S. Virgin Islands established a partnership with West Virginia, which allowed territory officials to make use of the state's MMIS beginning in 2013. This has improved the level of detail on the U.S. Virgin Islands' CMS-64 reporting. Specifically, in fiscal year 2012, prior to the implementation of its MMIS, the U.S. Virgin Islands reported service-level expenditures for 30 percent of the Medicaid benefits they covered; after the implementation, this percentage increased to 91 percent in fiscal year 2014. According to Puerto Rico Medicaid officials, the territory's Medicaid agency is in the process of establishing a similar partnership with Florida and anticipates implementation by the end of 2016. Having additional details on program spending could strengthen CMS's and territories' program oversight. According to agency officials, CMS has assigned officials to the five territories to assist in program integrity efforts, and their role is generally focused on providing technical assistance. The activities of these officials vary across the territories, ranging from resolving complaints to more proactive efforts to identify trends indicating fraud, waste, and abuse. In addition, CMS officials reported that Puerto Rico and the U.S. Virgin Islands requested and received on-site training on the proper reporting of federal expenditures. Other federal oversight efforts provide insight on Medicaid program integrity needs in the territories, and CMS has reported making use of these efforts. Specifically, OMB's annual A-133 single audits--conducted by contracted independent auditors--examine internal controls and compliance in the territories' programs, and have identified deficiencies in each of the territories. Examples of the findings from the 2013 single audits are listed below. CNMI - the single audit found a significant deficiency in internal control over compliance. Specifically, the payments for certain Medicaid services and medications exceeded permissible amounts. This finding was resolved and closed in September 2015. Guam - the single audit found a material weakness in internal control over compliance. Specifically, the single audit found that no documentation was provided to show that eligibility specialists used the available income and eligibility verification system to determine eligibility. This finding was resolved and closed in February 2015. U.S. Virgin Islands - the single audit found a material weakness in internal control over compliance. Specifically, the audit revealed that sufficient controls did not exist for the required investigation of Medicaid utilization related to fraud. As a result, there may be prolonged, ongoing cases of fraud, which may be unreported. As of March 2015, according to CMS officials, the status of this finding was cleared, meaning that the next step is for the U.S. Virgin Islands to develop a corrective action plan for approval by CMS. CMS has a single audit coordinator that receives the single audit reports and notifies CMS's regional offices, which are then responsible for working with the territories to correct any deficiencies that were identified. For example, CMS regional office officials help the territories develop corrective action plans, if required. However, CMS officials noted that it is not uncommon for territories to take multiple years to resolve certain deficiencies. CMS officials told us that the limited funding and staff created particular challenges for the territories when responding to single audit findings. For example, CNMI officials reported to CMS that the territory lacked sufficient staff to perform post-payment reviews in response to a finding from a single audit that found the territory incorrectly paid certain Medicaid claims. The Medicaid and CHIP programs provide critical financial support to the U.S. territories' health care systems. However, citing the territories' limited resources and the relatively small size of their programs, CMS has not required the territories to follow certain program requirements. In particular, this includes requirements for complete service-level expenditure reporting and the establishment of a MFCU or the receipt of an exemption--obtained by demonstrating that the operation of such a unit would not be cost effective, because minimal fraud exits in a territory's Medicaid program. Although American Samoa and CNMI's Medicaid programs operate under broad waivers that exempt them from many of these requirements, this is not the case for Guam, Puerto Rico, and the U.S. Virgin Islands, which have not received exemptions or waivers from these requirements. Despite acknowledging the territories' limited resources, CMS provides limited assurance and oversight to support program integrity efforts in the territories, and undertakes limited efforts of its own in this regard. Such limited federal efforts in the territories are inconsistent with federal internal control standards regarding identifying and responding to relevant risks when conditions change, such as when PPACA significantly increased territories' federal Medicaid funding. Without additional efforts by CMS, there is limited assurance that territories have the capacity to identify fraud, recover improper payments, or provide complete information on program spending. While Medicaid funding to the territories represents a small share of national program expenditures and may not warrant the same level of program integrity oversight as the states, additional actions are needed by CMS to ensure an appropriate level of program integrity in these areas. To ensure the appropriate level of Medicaid program integrity oversight in the territories, we recommend that the Acting Administrator of CMS reexamine CMS's program integrity strategy and develop a cost-effective approach to enhancing Medicaid program integrity in the territories. Such an approach could select from a broad array of activities, including--but not limited to--establishing program oversight mechanisms, such as requiring territories to establish a MFCU or working with them to obtain necessary exemptions or waivers from applicable program oversight requirements; assisting territories in improving their information on Medicaid and CHIP program spending; and conducting additional program assessments of program integrity as warranted. We provided a draft of this report to the HHS and the Department of the Interior (DOI) for comment. In its written comments, HHS concurred with our recommendation and acknowledged that many territories face challenges in addressing program integrity and finding a balance between applying funds towards providing services and program integrity efforts. Further, HHS noted that it will work with territory Medicaid officials to determine the feasibility of enhancing program integrity activities, including, but not limited to, establishing MFCUs or obtaining the necessary exemptions when MFCUs are not warranted. HHS also provided technical comments, which we incorporated as appropriate. In its written comments, DOI noted the financial and infrastructure challenges related to health care faced by all territories, despite the additional funding under PPACA, which is temporary, and raised concerns about future reductions in Medicaid once PPACA funds are depleted. HHS's and DOI's comments are reproduced in appendices I and II. As arranged with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days after its issuance date. At that time, we will send copies of this report to the Secretary of Health and Human Services and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix II. In addition to the contact named above, Susan Anthony, Assistant Director; Manuel Buentello; Sandra George; Giselle Hicks; Drew Long; Amber Sinclair; and Teresa Tam made key contributions to this report.

Summary:
Notable differences exist in the funding and operation of Medicaid and CHIP--joint federal-state health financing programs for low-income and medically needy individuals--in the territories versus the states. For example, the territories are subject to certain funding restrictions, such as capped annual federal funding, that are not applicable to the states. Further, certain federal requirements regarding eligibility, benefits, and program integrity do not apply to the territories' programs, and certain otherwise applicable requirements have not been enforced. In recent years, various laws--such as PPACA--have increased funding for Medicaid and CHIP in the territories. This report examines (1) eligibility and benefit characteristics of the territories' Medicaid and CHIP programs, (2) Medicaid and CHIP spending in the territories, and (3) Medicaid and CHIP program integrity efforts in the territories. GAO reviewed laws and regulations, data on five territories' Medicaid and CHIP spending, and federal internal control standards. GAO also interviewed CMS and territory Medicaid officials. Eligibility and benefits for Medicaid and the state Children's Health Insurance Program (CHIP) in five U.S. territories--American Samoa, Commonwealth of the Northern Mariana Islands (CNMI), Guam, Puerto Rico and the U. S. Virgin Islands--differ from one another and from the states, generally reflecting the territories' unique circumstances. For example, Guam is the only territory that covers all 17 mandatory Medicaid benefits, while American Samoa and Puerto Rico cover 10 of the 17 benefits. Officials from the territories that do not cover all mandatory benefits cited multiple reasons for not doing so, including limited funding and a lack of infrastructure, and, in some cases, exercised available flexibility to exclude certain benefits. Temporary increases in federal funding have enabled the territories to increase Medicaid and CHIP spending. Unlike the states, whose Medicaid funding is not subject to a capped allotment--provided they contribute their share--territories are subject to a capped allotment, and historically have exhausted available federal Medicaid and CHIP funds each year. Most notably, the Patient Protection and Affordable Care Act (PPACA) provided the territories an additional $7.3 billion through at least fiscal year 2019. Officials in four territories cited positive effects of the additional funding, such as the ability to enroll more providers and cover more services; however, some officials also expressed concerns about the temporary nature of the funding, noting that they may have to make program cuts once the funding is exhausted--and that future shortfalls remain a concern. Despite temporary increases in Medicaid funding, GAO found little assurance that territory Medicaid funds are protected from fraud, waste, and abuse. Program oversight mechanisms : Only Puerto Rico has developed a program integrity unit, which, although not required, is tasked with identifying and recovering improper payments and is a management best practice. Additionally, no territory has established a Medicaid Fraud Control Unit--which identify and prosecute Medicaid fraud--or received an exemption from doing so, as required by federal law. Program information : Territories lack detail on the types and volume of services they provide, contrary to federal reporting requirements, resulting in limited information on how territories spend their federal Medicaid funding. Until recently, the Centers for Medicare & Medicaid Services (CMS), within the Department of Health and Human Services (HHS), exempted the territories from the requirement to implement a claims processing and information retrieval system with program integrity capabilities, although the U.S. Virgin Islands has established a partnership to use such a system. Program assessments : CMS has performed assessments on Medicaid program integrity effectiveness and compliance only for Puerto Rico. Although not required, such assessments have been conducted on all states. CMS does provide technical assistance, with the activities of CMS officials varying across the territories. Officials from CMS noted that funding for program integrity would count against the territories' capped allotments. Nonetheless, such limited efforts by the territories and federal government are inconsistent with federal internal control standards regarding identifying and responding to risks, particularly in light of increased federal Medicaid spending in the territories as a result of PPACA. GAO recommends that the Acting Administrator of CMS examine and select from a broad array of activities--such as establishing program oversight mechanisms, assisting in improving program information, and conducting program assessments--to develop a cost-effective approach to protecting territories' Medicaid programs from fraud, waste, and abuse. HHS concurred with GAO's recommendation.