Federal laws authorize both state and federal entities to protect the Medicaid program from fraud, waste, and abuse. Specifically, various provisions of federal law give CMS the authority to oversee Medicaid program integrity and to set requirements with which state Medicaid programs must comply. As a result, program integrity efforts consist of state and federal activities to detect and deter improper payments-- including fraud, waste, and abuse--that range from provider enrollment to post-payment claims review and investigation. Provider enrollment: States screen providers who seek to participate in Medicaid to verify their eligibility. As part of the enrollment process, states must collect certain information from providers, including MCOs, about their ownership interests and criminal background, search exclusion and debarment lists, and take action to exclude those providers who appear on those lists. In some states, MCOs are primarily responsible for enrolling participating providers. Pre-payment review: States conduct prepayment review of claims to ensure appropriateness. Typically, states use payment edits programmed into their claims processing systems to compare claims data in order to approve or deny claims, or flag them for further review. They may also analyze claims data against models of fraudulent behavior to identify potentially fraudulent providers for further investigation. Post-payment claims review: States and Medicaid contractors analyze paid claims, related provider records, and supporting documentation to ensure appropriate utilization, and to identify potential improper payments. These routine reviews may rely on the use of algorithms and data mining to identify potentially improper payments, which are subjected to additional review, including audits. Auditing: Payments to providers are audited to determine compliance with Medicaid billing rules. Investigation: When enrollment, prepayment review, post-payment review, or audits uncover potentially fraudulent claims, states must refer those claims or providers to law enforcement entities for investigation and possible prosecution. Recovery: Once a state has identified and documented improper payments through audit activity, the state generally has one year from the date of a final audit report to recover the overpayment from the provider before reporting the return of the federal share, which can reach up to 100 percent for certain newly enrolled populations under PPACA, to CMS. Federal law requires the state to return the federal share of the overpayment regardless of whether the state was able to recover it, unless the provider has been determined to be bankrupt or out of business. A variety of entities are engaged in Medicaid program integrity activities. States have primary responsibility for reducing, identifying, and recovering improper payments. Federal entities typically provide oversight, as well as program and law enforcement support. Figure 1 illustrates the various entities, both federal and non-federal, that are involved in Medicaid program integrity. See, e.g., 42 U.S.C. SSSS 1396a(a)(69), 1396u-6. PI units for corrective action and potential fraud cases to the state's MFCU. In addition, states are now required to contract with recovery audit contractors (RAC) to identify under- and over-payments as part of their program integrity activities. CMS oversees state Medicaid programs by providing states with guidance related to statutory and regulatory requirements, as well as technical assistance on specific program integrity activities such as data- mining. The DRA increased the federal government's role by establishing the Medicaid Integrity Program to support and oversee state program To carry out these responsibilities, CMS established the integrity efforts. Medicaid Integrity Group, which conducts comprehensive reviews of state Medicaid program integrity activities to assess these activities and the state's compliance with federal program integrity laws. In addition, the Medicaid Integrity Group works with MICs who review and audit Medicaid claims. The Medicaid Integrity Group also provides training to state program integrity staff through its Medicaid Integrity Institute. CMS also collects information from states on their recoveries of overpayments; however, we recently reported that most states were not fully reporting recoveries and recommended that CMS should increase efforts to hold states accountable for reliably reporting program integrity recoveries to ensure that states are returning the federal share of recovered overpayments. HHS-OIG oversees Medicaid program integrity through its audits, investigations, and program evaluations. It is also responsible for enforcing certain civil and administrative health care fraud laws. In addition, the HHS-OIG oversees the MFCUs, assessing their compliance with statutes, regulations, and HHS-OIG policy. HHS-OIG is also responsible for assessing MFCU performance and recommends program improvements where appropriate. States have traditionally provided Medicaid benefits using a fee-for- service system, where health care providers are paid for each service. However, according to CMS, in the past 15 years, states have more frequently implemented a managed care delivery system for Medicaid benefits. In a managed care delivery system, beneficiaries obtain some portion of their Medicaid services from an organization under contract with the state, and payments to MCOs are typically made on a predetermined, per person per month basis. In contrast, under the traditional fee-for-service delivery system, health care providers are paid for each unit of service delivered. Two-thirds of Medicaid beneficiaries now receive some of their services from MCOs, and many states are expanding their use of managed care to additional geographic areas and Medicaid populations. Nationally, approximately 27 percent, or $74.7 billion, of federal Medicaid expenditures in fiscal year 2011 were attributable to Medicaid managed care which, according to HHS, included the 57 percent of Medicaid beneficiaries who were enrolled in Medicaid MCOs as of July 1, 2011. States oversee MCOs that provide care to Medicaid beneficiaries through contracts and reporting requirements, which may include identifying improper payments to providers within their plans. In addition, CMS has developed requirements for states and MCOs to protect against fraud and abuse in Medicaid managed care. Among other things, CMS requires MCOs to implement compliance plans, train MCO employees, and monitor payments. Most state and federal program integrity officials we interviewed told us that they did not closely examine Medicaid managed care payments, but instead primarily focused their program integrity efforts on FFS claims. Moreover, federal entities have taken few steps to address Medicaid managed care program integrity. State PI unit officials from five of the seven states in our study and MFCU officials from four of the study states told us they primarily focus their program integrity efforts on Medicaid FFS claims. These officials said they have not begun to closely examine program integrity in Medicaid managed care, which is a growing portion of overall Medicaid State PI units and MFCUs are responsible for ensuring expenditures.Medicaid program integrity, part of which includes monitoring managed care program integrity. Each of the seven states included in our review had more than 60 percent of beneficiaries enrolled in managed care as of July 1, 2011, and expenditures attributable to managed care in the seven states varied, ranging from 18 to 38 percent of their total Medicaid spending in fiscal year 2011. PI unit officials from the seven states described differing levels of complexity in conducting Medicaid managed care program integrity activities, as shown in the examples that follow. At the most sophisticated level, PI unit officials from two of the seven states we spoke with told us they examined payments to MCO plans and providers to identify improper payments, conducted meetings with MCOs to discuss provider audits and investigations, and used data analytics to identify aberrant patterns among MCO providers. They also conducted independent audits of payments to MCO plans. PI unit officials in the remaining five states told us that they were still in the early stages of shifting the focus of program integrity efforts to Medicaid managed care, and thus reported more limited actions. PI unit officials from three of these five states told us they examined Medicaid managed care providers for improper payments and fraud by reviewing MCO reporting on improper payments. PI unit officials from the remaining two states told us they did not examine MCO encounter data, and one of these states told us they do not perform audits of MCO providers or actively search for fraudulent activities. MCOs have responsibility for identifying improper payments to providers within their plans; however, state officials suggested that MCOs might not have an incentive to identify and recover improper payments. Officials from two of the seven state PI units we spoke with told us that they believed MCOs were not consistently reporting improper payments to the state to avoid appearing vulnerable to fraud and abuse. Further, officials from three PI units described a potential conflict of interest because when MCOs report improper payment recoveries, future capitation rates could be reduced because of any improper payments identified. For example, officials from four PI units said their states account for improper payment recoveries and explained that it negatively impacts the MCO plans' rates for the following year. State officials we spoke with told us that one reason they have not focused on managed care program integrity is that MCO plan and provider audits and investigations are more complex than those in the FFS model. Similarly, almost all of the state MFCU officials we spoke with told us that extra effort was required to obtain detailed managed care claims data. While most states have access to managed care encounter data, states must rely on MCO plans to provide actual dollar amounts of claims, which are needed to audit and investigate providers and determine the amounts of overpayments. Obtaining the data from each MCO could require significant time and effort, which may hamper audits and investigations, particularly in states with several MCO plans. For example, according to CMS, as of July 1, 2011, four of the seven states included in our review had 20 or more MCOs operating in their state. State officials also told us that in order to be effective, PI unit and MFCU staff needed specialized training and federal support in the form of updated regulations, guidance, and technical assistance. For example, state program integrity staff from two states attending the 2013 National Association of Medicaid Program Integrity conference suggested that one way that CMS could enhance its assistance to states would be to redirect its Medicaid integrity contractors to focus their audit activities on managed care payments. Such an arrangement could help identify possible patterns or vulnerabilities across states and assist states as they work to acquire the necessary expertise in managed care program integrity. Without closer examination of Medicaid managed care payments, state PI units and MFCUs have limited ability to identify improper payments made to MCOs. They are also unable to ensure that MCOs are taking appropriate actions to identify, prevent, or discourage improper payments to providers. PPACA is expected to significantly expand the Medicaid program, with many of the new beneficiaries being enrolled in managed care and covered almost entirely by federal funds in 2014 through 2016. Considering managed care's growing share of federal Medicaid expenditures, Medicaid managed care is an area where program integrity activities are of growing importance to ensure the protection of federal dollars. Similar to states, federal entities--CMS and HHS-OIG--have taken few steps to address Medicaid managed care program integrity. For example, CMS officials told us that states have primary responsibility for direct oversight of MCOs' compliance with program integrity requirements. CMS provides on-going support and guidance to states regarding their managed care programs, including review and approval of states' managed care waivers and contracts, as well as assessment and guidance regarding program integrity in Medicaid managed care. For example, CMS's comprehensive reviews examine state compliance with federal regulations governing managed care contracts, such as ensuring that MCOs disclose certain ownership and control information. However, according to CMS officials, the comprehensive reviews do not require or check to ensure that states are conducting more in-depth managed care program integrity activities, such as audits of managed care claims. In 2000, CMS issued Medicaid managed care program integrity guidance to states; as of Nov. 18, 2013, however, this guidance was not available on the CMS website, and six of the seven state PI unit officials we spoke with did not mention it when asked about the guidance they relied on in CMS officials said they were conducting program integrity activities.updating this guidance, but did not have a timeline for its completion. According to CMS officials, states have requested additional support in ensuring managed care program integrity, and CMS has taken some actions to provide additional assistance. CMS officials said that states, including those with significant managed care experience, are still trying to understand their roles and responsibilities in overseeing managed care program integrity. In 2013, CMS offered two training sessions on Medicaid managed care program integrity through its Medicaid Integrity Institute. CMS officials told us that the sessions were well attended by PI unit staff and other Medicaid program staff. We reviewed the presentation materials, which provided extensive information regarding Medicaid managed care program integrity practices and strategies. Presentation materials are accessible to PI staff who did not attend the training if they register as users through the Medicaid Integrity Institute website. States and CMS ensure Medicaid program integrity by preventing, detecting, and recovering improper payments. Specifically, various provisions of the SSA authorize CMS to develop requirements for the proper and efficient operation of the Medicaid program, including reporting requirements and methods for prepayment and post-payment review. In addition, the SSA requires CMS to audit Medicaid claims, including cost reports and payments to MCOs and requires MCO contracts to contain provisions giving HHS and states audit and access authority over MCOs and their subcontractors. This contractual requirement also appears in CMS's regulations, although CMS does not require states to conduct such audits. Moreover, PPACA required state Medicaid programs to establish contracts consistent with state law and similar to the contracts established for the Medicare RAC program, and required CMS to coordinate this expansion with the states and to promulgate implementing regulations. CMS subsequently issued guidance to the states and a regulation implementing the Medicaid RAC program; however, this regulation allowed states to exclude Medicaid In comments managed care claims from review by Medicaid RACs.accompanying the final rule, issued in 2011, CMS indicated that it might require Medicaid RACs to review managed care claims during future rule- making, once a permanent Medicare managed care RAC program was fully operational or a viable state Medicaid model had been identified. During a February 2014 interview with CMS officials, the officials reiterated that they were open to revisiting the issue of whether the Medicaid RAC program should cover MCO claims, but the officials did not provide any specific details regarding how or when this might be accomplished. The need for CMS leadership on program integrity efforts in managed care is particularly important, given that some states' expansions of their Medicaid programs under PPACA may be accomplished through managed care arrangements. Until CMS takes steps to ensure the integrity of Medicaid managed care, state and federal Medicaid dollars remain vulnerable to fraud, waste, and abuse. The HHS-OIG has noted the emergence of MCO fraud among recent Medicaid fraud trends, citing the increase in the agency's workload on MCO fraud cases. During the 2013 National Association of Medicaid Program Integrity conference, the agency presented on the challenges associated with identifying different types of plan-based fraud schemes, some of which result in inflated payments to MCOs. While CMS does audit states' payments to MCOs to verify that the state is paying the capitated rates specified in the MCO's contract, CMS does not require states to audit the appropriateness of these payments, to ensure, for example, that these payments do not include improper payments by plans. In addition to plan-level fraud, the agency has noted the need for more emphasis on analyzing potential provider fraud in Medicaid managed care. On June 1, 2012, HHS-OIG issued updated performance standards directing MFCUs to take steps to ensure that state Medicaid agencies, MCOs, and other agencies refer suspected provider fraud cases to the MFCU. Additionally, the updated performance standards direct MFCUs to ensure their caseload mix reflects the proportion of Medicaid beneficiaries enrolled in managed care. As of March 10, 2014, HHS-OIG had published three MFCU evaluations that used the new performance standards. In one MFCU evaluation, HHS-OIG found that 55 percent of the state's Medicaid beneficiaries were enrolled in MCOs, but the state's MFCU only opened one case involving an MCO during the two year review period. The other two state MFCU evaluations did not mention managed care, although the states' MFCUs did not open or close any managed care provider cases during the review period. According to CMS officials, as of July 1, 2011, the two states had almost 78 percent and nearly 60 percent of their Medicaid beneficiaries enrolled in MCOs. The involvement of multiple state and federal entities in similar activities-- post-payment reviews, audits, and investigations--has resulted in fragmented program integrity activities. Typically, as we have found in past work, coordinating activities can alleviate many of the problems created by fragmentation, allowing entities to avoid unnecessary duplication and overlap. State program integrity officials we interviewed told us that coordination efforts helped them avoid unnecessary duplication, but presented additional challenges. Post-payment review activities are primarily led by states' PI units, which can include their SURS and RACs. Other state entities, such as state auditors' offices and other divisions in the state Medicaid agency may also participate in post-payment review activities. PI units coordinate these activities by (1) delegating specific data-mining targets to specific entities to avoid overlap, or (2) coordinating data-mining activities to ensure that the different entities are not duplicating each other's efforts to identify improper payments. For example, in four of the five states that had signed contracts with RACs, PI unit officials told us they require that before starting a data-mining project, the RAC must submit its plan to the PI unit for approval.data-mining activities to ensure that the RAC will not be duplicating the activities of other entities. Additionally, officials from one of these PI units told us they participate in a monthly meeting with the SURS, RAC, ZPIC, state auditor's office, and MFCU to discuss current data mining projects, and to decide who is best able to handle specific cases. Then, the PI unit checks the plan against other Although multiple state entities conduct post-payment review activities, their activities are not necessarily duplicative. State PI unit officials told us that the purposes of these reviews vary. For example, some PI unit officials told us other divisions within the state Medicaid agencies will use data mining to examine quality of care or clinical oversight issues. SURS post-payment reviews can include ensuring compliance with Medicaid payment policies. The involvement of multiple federal and state entities in audits leads to fragmentation. PI units, RACs, MICs, HHS-OIG--and in some states, the state auditor's office--perform audits. PI unit officials told us they take the lead in coordinating these audit activities to minimize overlap and duplication, as well as expand the types of providers and health care areas subject to review. For example, five of the states we selected for this study had signed contracts with RACs, and PI unit officials from these states told us they direct the RACs to focus audits on specific areas to avoid duplicating other efforts. For example, PI unit officials in one state noted that the RAC asked and was granted permission to examine home health claims, which was an area where the PI unit had been unable to focus. In some cases, PI units also coordinated with MICs on collaborative audits. For these audits, PI units typically identified audit targets using state claims data, and the MIC performed the audit. Officials from one state told us that collaborative audits with the MIC in their state had reviewed over $200 million in claims, from which the state expects some recoveries. With regard to fraud, fragmentation exists, in part, because multiple law enforcement entities may be responsible for the investigation of fraudulent claims. For example, fraud schemes may cross state lines thereby necessitating the involvement of multiple law enforcement entities. MFCUs have the primary responsibility for fraud investigations and coordinate with other state and federal law enforcement entities, including the HHS-OIG, U.S. Attorney's Offices, the Federal Bureau of Investigation, and state attorneys general. MFCUs coordinate with these entities to prevent duplicative investigations and to share knowledge on potential fraud schemes. MFCU officials from all of the states included in our review said they have regular meetings with federal entities to discuss cases, and officials from three MFCUs said they work cases with federal entities. HHS-OIG officials also said they work jointly with MFCUs and other entities to prevent a scenario where both entities would be conducting separate but duplicative investigations. To prevent duplication between fraud investigations and improper payment audits, all PI unit and MFCU officials we spoke with said they meet regularly to discuss current investigations and audits to ensure they are not pursuing the same target. All the MFCUs and PI units from the states that we reviewed had a memorandum of understanding, which describes the entities' relationship, consistent with federal regulation. Additionally, all of these entities said they seldom or never worked on cases involving the same provider at the same time. MFCU officials said that coordination helps with investigations because a PI unit pursuing a separate payment recovery action against a suspect provider could interfere with a criminal investigation. Coordination among PI units and MFCUs also allows the entities to share limited resources as the need arises. For example, MFCUs typically do not have clinical staff on hand, but can rely on the clinical expertise of PI units' and state Medicaid agencies' staff. MFCU officials from four states told us that coordination among entities helped improve their cases by better leveraging resources. Officials from one MFCU said their coordination meetings allow the entities to decide who is best suited to handle specific cases. Officials from two MFCUs said that working with other entities allows the MFCU to give assistance to or receive assistance from these other entities on investigations and executing warrants. Officials from another MFCU told us that other entities can take on cases that the MFCU would not have the authority to prosecute on their own. However, our previous work has shown that measuring the results of health care fraud investigations is difficult due to several factors. These factors include the difficulties of establishing a health care fraud baseline to determine whether the amount of fraud has changed over time, quantifying the effect of investigation and prosecution on deterring fraud, and establishing a causal link between the work and changes in health care fraud. Overall, PI unit officials generally described coordination efforts among program integrity offices positively. Officials from six of the seven PI units generally described their coordination efforts as requiring minimal resources and in some cases suggested that coordination improved program integrity functions, allowing the state to recover additional overpayments. For example, coordination among PI units and other entities--such as RACs or MFCUs--can allow entities to share limited resources and expertise. Officials from five MFCUs said their states' PI units will provide education to MFCU staff on various aspects of, and changes to, the Medicaid program. Officials from one PI unit said that MIC staff provided clinical expertise that was not available within the PI unit. However, some of the officials with whom we spoke said that coordination efforts have sometimes proven to be problematic. For example, officials from three PI units described challenges with some types of collaborations. Officials from one PI unit told us they have to expend resources to address inappropriate audit findings from other entities. For example, in some cases, the MIC had pursued audit findings that the PI unit was not able to successfully support in court. These officials also told us that due to the number of entities involved, the audit coordination process was somewhat convoluted and caused delays in the audit process. Officials from a second PI unit said collaborative audits, which were initially put into place by the Medicaid Integrity Group to enhance collaboration between states and MICs, were not useful. The officials noted that years of working with the MIC on one project have generated less than $1,000 in findings in their state. Officials from a third PI unit told us that they spent time directing RAC activities in order to steer the RAC away from unproductive audits. The PI unit officials said the RACs sometimes pursue audits that result in findings that are difficult to prove and can harm relations with providers. Additionally, officials from three PI units--including two of the above-- said they would prefer to handle the work of RACs or MICs on their own or otherwise consolidate this work, if resources were available. PI units and MFCU officials told us that their organizations coordinate their activities with multiple entities to avoid unnecessary duplication; however, the results of these coordinated efforts have been mixed. Despite the combined efforts of various program integrity entities, our previous work has found that some states appear to be recovering only a small portion of estimated improper payments. GAO identified a gap between state and federal efforts to ensure Medicaid managed care program integrity. Federal laws require the states and CMS to ensure the integrity of the Medicaid program, including payments under Medicaid managed care. However, most of the state PI units and MFCUs included in our review were not closely examining the activities of MCOs citing a lack of sufficient guidance and support. For example, CMS does not require states to audit the appropriateness of payments to MCOs to ensure payments have not been improperly inflated, nor does CMS require states to include review of payments to MCO providers as part of their Medicaid RAC programs. However, CMS has largely delegated managed care program integrity activities to the states. Without adequate federal support and guidance on ways to prevent or identify improper payments in a managed care setting, states are neither well-positioned to identify improper payments made to MCOs, nor are they able to ensure that MCOs are taking appropriate actions to identify, prevent, or discourage improper payments. Such efforts take on greater urgency as states that choose to expand their Medicaid programs under PPACA are likely to do so with managed care arrangements, receiving a 100 percent federal match for newly eligible individuals from 2014 through 2016. Unless CMS takes a larger role in holding states accountable, and provides guidance and support to states to ensure adequate program integrity efforts in Medicaid managed care, the gap between state and federal efforts to monitor managed care program integrity leaves a growing portion of federal Medicaid dollars vulnerable to improper payments. Program integrity activities are fragmented across multiple state and federal entities. If not carefully coordinated, these fragmented activities could result in additional overlap and unnecessary duplication. State PI units and MFCUs we reviewed coordinate with one another and federal entities to avoid duplication, but their coordination efforts present both benefits and challenges. As implemented across the states, newer program integrity efforts--such as RACs and MICs--may improve states' efforts to identify and recover improper payments; however, they will also increase the need for coordination to ensure maximum program coverage and minimum duplication and overlap of program integrity activities. Given that combined federal and state efforts have recovered only a small portion of the estimated improper payments, it will be important to continue to monitor federal and state program integrity efforts in Medicaid as a means of assessing whether the current structure is effective. In order to improve the efficiency and effectiveness of Medicaid program integrity efforts, we recommend that the Administrator of CMS take the following three actions: 1. hold states accountable for Medicaid managed care program integrity by requiring states to conduct audits of payments to and by managed care organizations; 2. update CMS's Medicaid managed care guidance on program integrity practices and effective handling of MCO recoveries; and 3. provide the states with additional support in overseeing Medicaid managed care program integrity, such as the option to obtain audit assistance from existing Medicaid integrity contractors. We provided a draft of this report to HHS for comment. In its written comments, HHS stated that the Department concurred with two of our recommendations, and stated that our first recommendation-- to hold states accountable for Medicaid managed care program integrity by requiring states to conduct audits of payments to and by managed care organizations--was unclear. In response to this recommendation, HHS listed current CMS activities that the Department believes address the first recommendation. These activities include the audits under the PERM program, the adoption of regulations requiring MCOs to have fraud and abuse compliance plans and to provide in their contracts for HHS and state audit and access authority. While the activities described by HHS support states in ensuring other aspects of Medicaid program integrity, they do not require states to conduct audits to ensure the appropriateness of payments to MCOs or payments by MCOs and therefore do not achieve the goal of our recommendation. Taking this additional step, particularly in combination with additional guidance and audit assistance, would help ensure that payments to MCO plans are appropriate and that providers within MCOs are also consistently reviewed, thus helping ensure the integrity of the Medicaid program. HHS agreed with our recommendation to update CMS's Medicaid managed care guidance on program integrity practices and effective handling of MCO recoveries. HHS stated that CMS is consulting with federal and state partners regarding strategies to improve Medicaid program integrity, and plans to address changes in future rulemaking or other guidance. Additionally, HHS agreed that states could benefit from additional Medicaid managed care guidance, particularly regarding improper payment recoveries, and that CMS would consider issuing guidance to states regarding the handling of overpayment recoveries. HHS also agreed with our recommendation that CMS provide states with additional support in overseeing Medicaid managed care program integrity, such as the option to obtain audit assistance from existing Medicaid integrity contractors. HHS stated that CMS currently offers assistance to states, including guidance in the use of tools for managed care program integrity. HHS also said that in 2014 CMS will conduct special in-depth reviews focused on managed care program integrity activities in selected states that are expanding the use of managed care. Additionally, HHS stated that CMS is working with two states with considerable managed care experience to develop a model for managed care audits for all states. HHS's comments are reproduced in appendix I. HHS also provided technical comments, which we incorporated as appropriate. We also provided an extract of this report to the state PI units and MFCUs that we selected for interviews. We incorporated their technical comments as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in Appendix II. In addition to the contact named above, key contributors to this report were: Tom Conahan, Assistant Director; Matthew Gever, Drew Long, Jasleen Modi, Dawn Nelson, and Jennifer Whitworth.

Summary:
In fiscal year 2013, the Medicaid program covered about 71.7 million individuals at a cost of $431.1 billion, of which CMS estimated that $14.4 billion (5.8 percent) were improper payments. Multiple state and federal entities are involved in program integrity efforts, such as payment review, auditing, and investigating fraud. GAO was asked to examine how these entities ensure comprehensive Medicaid program integrity. This report examines state and federal roles and responsibilities to identify potential (1) gaps in efforts to ensure Medicaid program integrity coverage; and (2) fragmentation, overlap, or duplication of program integrity efforts, and efforts to coordinate activities. GAO examined relevant federal laws and regulations, CMS guidance, and state program integrity reviews. GAO also interviewed officials from CMS and HHS's Office of Inspector General, as well as PI unit and MFCU officials from seven states. GAO identified a gap in state and federal efforts to ensure Medicaid managed care program integrity. Federal laws require the states and the Centers for Medicare & Medicaid Services (CMS) to ensure the integrity of the Medicaid program, including payments under Medicaid managed care, which are growing at a faster rate than payments under fee-for-service (FFS). However, five state program integrity (PI) units and four Medicaid Fraud Control Units (MFCU) from the seven states included in GAO's review said they primarily focus their efforts on Medicaid FFS claims and have not begun to closely examine program integrity in Medicaid managed care. In addition, federal entities have taken few steps to address Medicaid managed care program integrity. CMS, the federal agency within the Department of Health and Human Services (HHS) that oversees Medicaid has largely delegated managed care program integrity oversight activities to the states, but has not updated its program integrity guidance since 2000. Additionally, CMS does not require states to audit managed care payments, and state officials GAO interviewed said they require additional CMS support, such as additional guidance and the option to obtain audit assistance from existing Medicaid integrity contractors in overseeing Medicaid managed care program integrity. The involvement of multiple entities in conducting post-payment reviews, audits, and investigations has resulted in fragmented program integrity efforts; yet the effects of fragmentation are unclear. As GAO has found in past work, coordinating activities can alleviate many problems created by fragmentation, thus allowing entities to avoid unnecessary duplication and overlap. Most of the program integrity officials from the seven states GAO included in this review said that coordination efforts helped them manage overlap and avoid unnecessary duplication; however some officials said that coordination presented additional challenges for time and staff resources. Given that combined federal and state efforts have recovered only a small portion of the estimated improper payments, continued monitoring of federal and state program integrity efforts in Medicaid will be an important means of assessing whether the current structure is effective. Because of the gap GAO identified between state and federal program integrity efforts in managed care, neither state nor federal entities are well positioned to identify improper payments made to managed care organizations (MCOs), nor are they able to ensure that MCOs are taking appropriate actions to identify, prevent, or discourage improper payments. Improving federal and state efforts to strengthen Medicaid managed care program integrity takes on greater urgency as states that choose to expand their Medicaid programs under the Patient Protection and Affordable Care Act are likely to do so with managed care arrangements, and will receive a 100 percent federal match for newly eligible individuals from 2014 through 2016. Unless CMS takes a larger role in holding states accountable, and provides guidance and support to states to ensure adequate program integrity efforts in Medicaid managed care, the gap between state and federal efforts to monitor managed care program integrity will leave a growing portion of federal Medicaid dollars vulnerable to improper payments. GAO recommends that CMS increase its oversight of program integrity efforts by requiring states to audit payments to and by MCOs; updating its guidance on Medicaid managed care program integrity; and providing states additional support for managed care oversight, such as audit assistance from existing contractors. In its comments, HHS asked for clarification on the first recommendation and concurred with the other two. In response, GAO clarified its first recommendation--that CMS take the added step of requiring states to audit the appropriateness of payments to and by MCOs to better ensure Medicaid program integrity.