Consumers can enroll in a PPACA qualified health plan offered through a marketplace, or change their previously selected qualified health plan, after the annual open enrollment period concludes if they qualify for an SEP. Under CMS regulations, a consumer may qualify for an SEP due to a specific triggering event, and generally would have up to 60 days after the event to select and enroll in a qualified health plan. Examples of qualifying events include but are not limited to losing minimum essential health coverage of the individual or his or her dependent; gaining a dependent or becoming a dependent through marriage, birth, adoption, placement for adoption, or placement in foster care, or through a child-support order or other court order; gaining access to new qualified health plans as a result of a not enrolling during the annual open enrollment period, or other enrollment period for which the consumer qualified, was unintentional, inadvertent, or erroneous and is the result of error, misrepresentation, misconduct, or inaction by the Marketplace or its agents; applying for Medicaid or the Children's Health Insurance Program during the open enrollment period, or other enrollment period for which the consumer qualified, and being determined ineligible after the enrollment period ended; and demonstrating to the marketplace that the individual meets other exceptional circumstances as the marketplace may provide. While PPACA requires marketplaces to verify application information to determine eligibility for enrollment and income-based subsidies--such as verifying U.S. citizenship, nationality, or lawful presence--there is no specific legal requirement to verify the events that trigger an SEP. Specifically, there is no specific legal requirement that federal or state marketplaces (1) request documents to support an SEP triggering event or (2) authenticate the documents submitted to support an SEP event to determine whether those documents are fictitious. According to CMS officials and state officials, consumers that claim eligibility to enroll during an SEP must attest under penalty of perjury that they meet the conditions of eligibility for an SEP. In February 2016, however, CMS announced plans to begin requesting supporting documentation to verify certain events that would trigger an SEP. Specifically, CMS announced its intention to establish a Special Enrollment Confirmation Process in which consumers who enroll or change plans using an SEP through the federal Marketplace will be directed to provide documentation for any of the following triggering events: (1) loss of minimum essential coverage; (2) permanent move; (3) birth; (4) adoption, placement for adoption, placement for foster care or child support or other court order; or (5) marriage. According to the notice, CMS will provide consumers with lists of qualifying documents, such as a birth or marriage certificate. In June 2016, CMS announced that it would begin requesting some supporting documentation beginning on June 17, 2016. State-based marketplaces are not required to follow CMS's Special Enrollment Confirmation Process, but states may choose to follow this guidance or establish their own processes, according to CMS officials. States may also choose to accept a consumer's attestation of the SEP triggering event without further verification. For example, according to state officials from Covered California, the state-based marketplace accepts self-attestation and requests supporting documents for a random sample of eligible consumers for certain SEP triggering events. According to officials from the DC Health Benefit Exchange Authority, the state-based marketplace accepts self-attestation for three of the six SEP triggering events we tested. We have previously testified and reported on various aspects of PPACA enrollment controls as part of our ongoing work in this area. For example, in July 2014 we testified on our undercover attempts to obtain health-care coverage offered by the federal Marketplace for coverage- year 2014 using fictitious identities and false documentation. We were successful in 11 out of 12 attempts to do so. In October 2015, we testified on similar undercover testing for coverage-year 2015 where we were successful in 17 of 18 attempts. In February 2016 we issued a report addressing CMS enrollment controls and the agency's management of enrollment-fraud risk. The February 2016 report included eight recommendations, which are discussed below, to strengthen CMS oversight of the Marketplace. In September 2016, we issued two reports and testified about addressing the potential vulnerabilities to fraud in the application, enrollment, and eligibility-verification controls of the federal Marketplace and selected state marketplaces for PPACA's second and third open enrollment periods, for 2015 and 2016 coverage, respectively. In our February 2016 report, we recommended that the Secretary of Health and Human Services direct the Acting Administrator of CMS to: (1) conduct a feasibility study and create a written plan on actions that CMS can take to monitor and analyze the extent to which data hub queries provide requested or relevant applicant verification information; (2) track the value of enrollee subsidies that are terminated or adjusted for failure to resolve application inconsistencies, and use this information to inform assessments of program risks; (3) regarding cost-sharing subsidies that are terminated or adjusted for failure to resolve application inconsistencies, consider and document whether it would be feasible to create a mechanism to recapture those costs; (4) identify and implement procedures to resolve Social Security number inconsistencies where the Marketplace is unable to verify Social Security numbers or applicants do not provide them; (5) reevaluate CMS's use of certain incarceration status data and determine to either use these data or accept applicant attestation on status in all cases; (6) create a written plan and schedule for providing Marketplace call center representatives with access to information on the current status of eligibility documents submitted to CMS's documents processing contractor; (7) conduct a fraud-risk assessment, consistent with best practices described in GAO's framework for managing fraud risks in federal programs, of the potential for fraud in the process of applying for qualified health plans through the federal Marketplace; and (8) fully document prior to implementation, and have readily available for inspection thereafter, any significant decision on qualified health-plan enrollment and eligibility matters, with such documentation to include details such as policy objectives, supporting analysis, scope, and expected costs and effects. In formal comments on a draft of the report, HHS concurred with our recommendations and outlined a number of steps it plans to take to implement them. In an April 2016 letter, HHS described a number of specific actions it had taken in response to our eight recommendations, such as creating an integrated project team to perform the Marketplace fraud-risk assessment. In May 2016, we requested that CMS provide detailed documentation and other evidence to help corroborate the various actions described in the HHS letter. As of November 2016, CMS's response to this request was pending. Consequently, we consider all eight recommendations to remain open as of November 2016, pending corroborating information. We will continue to monitor HHS's progress in implementing them. Implementing these recommendations as intended, such as performing the fraud-risk assessment, could help address some of the control vulnerabilities we identified during our SEP tests as well. Concerning our current work, the federal or selected state-based marketplaces approved subsidized coverage for 9 of our 12 fictitious applicants seeking coverage during an SEP for 2016. Three of our 12 fictitious applicants were denied. Figure 1 summarizes the outcome of the 12 fictitious applications, which are discussed in greater detail below. The federal and selected state-based marketplaces requested supporting documentation for 6 of our 12 fictitious applicants who initially applied online or by telephone seeking coverage during an SEP. On the basis of our design for the scenario, we provided the federal and selected state- based marketplaces either no supporting documentation or fictitious documentation related to the SEP triggering event. As described below, in some instances we provided fictitious documents to the federal and selected state-based marketplaces to support the SEP triggering event and were able to obtain and maintain subsidized health coverage. Our applicant experiences are not generalizable to the population of applicants or marketplaces. The federal or selected state-based marketplaces approved coverage and subsidies for 9 of our 12 fictitious applicants who initially applied online or by telephone seeking coverage during an SEP, as of October 2016. For these 9 applications, we were approved for APTC subsidies, which totaled about $1,580 on a monthly basis, or about $18,960 annually. These 9 applicants also each were approved for CSR subsidies, putting them in a position to further benefit if they used medical services. However, in our tests, our fictitious applicants did not seek medical services. The federal or state-based marketplaces denied coverage for 3 of our 12 fictitious applicants. Specifically: One applicant stated that the applicant did not receive any response from the marketplace after attempting to enroll in a health plan in a community center in January 2016. This fictitious applicant claimed that the applicant had applied for coverage to the federal Marketplace and that the applicant did not discover the applicant was not enrolled in a health plan until June 2016--about 6 months after the applicant's claimed initial contact with the marketplace. The marketplace representative stated that the applicant needed to follow up with the marketplace and select a health plan within 60 days of the SEP- triggering event, which in this case was misinformation or misrepresentation by a non-Marketplace entity providing enrollment assistance in January of 2016. Under CMS regulations, for this type of triggering event the marketplace may define the length of the SEP as appropriate based on the circumstances, up to a maximum of 60 days. The second fictitious applicant who applied for coverage to the state- based marketplace and was denied coverage claimed that the applicant initially tried to enroll in January 2016 and was told by a certified enrollment counselor that the applicant qualified for a high deductible plan, but did not qualify for a premium tax credit or CSR. When the applicant followed up with the state-based marketplace to obtain additional information, the marketplace representative requested the name of the enrollment counselor with whom the applicant initially applied for health coverage in January 2016. The applicant provided the representative with a fictitious enrollment counselor name and location. The marketplace representative stated that the marketplace's application notes show that the applicant applied outside open enrollment and informed the applicant that the applicant could submit an appeal to further review the application. The applicant later received a letter from the selected state-based marketplace stating that, based on what the applicant told the marketplace about the event that occurred in June 2016, the applicant did not qualify for a special enrollment period at that time. The third fictitious applicant who was denied claimed an inability to apply for coverage during the open enrollment period because the applicant experienced a serious medical condition, had been hospitalized unexpectedly in January 2016, and needed rehabilitation through May 2016. The federal marketplace representative stated that the representative could not enroll the applicant in a health plan outside of open enrollment because the SEP event was an exceptional circumstance and CMS has to approve enrollment of these types of SEP triggering events. The representative explained that the representative would have to submit an escalation to CMS for our fictitious applicant to be approved to enroll during the SEP. After the application was escalated, the federal marketplace denied this application, and a federal marketplace representative we spoke with stated that the applicant could have applied in November and December, before the unexpected hospitalization. According to CMS officials, the federal marketplace makes eligibility determinations on a case-by-case basis for those applicants who experience an unexpected hospitalization that prevents them from enrolling during the open enrollment period. The federal and selected state-based marketplaces requested supporting documentation for 6 of our 12 fictitious applicants who initially applied online or by telephone seeking coverage during an SEP. The 6 remaining fictitious applicants were not instructed to provide supporting documentation related to the SEP triggering event. As previously mentioned, the federal or state-based marketplaces approved subsidized health-insurance coverage for 9 of our 12 fictitious applicants and denied coverage for 3 of our 12 fictitious applicants. As mentioned, for all 12 fictitious applicants, we submitted supporting documentation related to proof of identity and income, such as a copy of the Social Security card, driver's license, and self-employment ledger. We designed the 12 fictitious applications to provide either no documentation or fictitious documentation related to the SEP event to note any differences in outcomes. As previously mentioned, we used professional judgement to determine what type of documentation we would submit related to the SEP triggering event. For 9 of the 12 applications, GAO provided no documents or fictitious documents to support the SEP triggering event and was able to obtain and maintain subsidized health coverage. Figure 2 summarizes document submissions and outcomes for the 12 fictitious applications for subsidized qualified health-plan coverage during an SEP. Officials from the marketplaces explained that they do not require applicants to submit documentation to support certain SEP triggering events. For other SEP triggering events, CMS officials explained that the standard operating procedure in the federal marketplace is to enroll applicants first, and verify documentation to support the SEP triggering event after enrollment. As previously mentioned, there is no specific legal provision that requires federal and state-based marketplaces to verify the events that trigger an SEP, but in February 2016 CMS announced plans to begin a Special Enrollment Confirmation Process, which involves requesting supporting documentation to verify certain events that would trigger an SEP. CMS announced that it would begin requesting supporting documentation from consumers who enroll or change plans using an SEP for selected triggering events on June 17, 2016. We started our testing after June 17, 2016. State-based marketplaces are not required to participate in the CMS Special Enrollment Confirmation Process and may establish their own processes. According to state and federal officials, all applicants that apply for enrollment during an SEP must attest under penalty of perjury that they meet the conditions of eligibility for the SEP. However, relying on self-attestation without verifying documents submitted to support a SEP triggering event could allow actual applicants to obtain subsidized coverage they would otherwise not qualify for. Three of our six fictitious applicants to the federal Marketplace claimed eligibility based on an SEP triggering event covered by the CMS Special Enrollment Confirmation Process and were instructed by the federal marketplace to provide supporting documentation to prove eligibility to enroll through the SEP. As of October 2016, the three fictitious applicants that claimed eligibility based on an SEP triggering event covered by the CMS Special Enrollment Confirmation Process are currently enrolled in a subsidized qualified health plan. Two of these three fictitious applicants were asked to submit documents to support their SEP event, but obtained and maintained subsidized health coverage without providing any documentation to support their SEP event. The third of these three individuals submitted fictitious documents supporting the SEP event in response to the federal Marketplaces' request and subsequently obtained and maintained subsidized health coverage. The remaining three of six applicants to the federal Marketplace claimed eligibility based on SEP events that were not covered by the CMS Special Enrollment Confirmation Process and (as such) were not instructed to provide supporting documentation to prove eligibility to enroll through the SEP. For example, one of these three applicants to the federal marketplace claimed to have applied for Medicaid during the annual open enrollment but was subsequently denied Medicaid after open enrollment had closed--which is not an event covered by the process. This applicant did not provide documentation to support this claim, and the applicant obtained subsidized coverage. The remaining two applicants to the federal marketplace were denied, as described previously in this report. Two of the six fictitious applicants to the selected state-based marketplaces were instructed by the state-based marketplace to provide supporting documentation proving eligibility to enroll through the SEP. For one of the two fictitious applicants, we did so, and the fictitious applicant is currently enrolled in a qualified health plan. The other applicant was denied, as described previously in this report. The remaining four of our six fictitious applicants to the selected state- based marketplaces were not instructed by the state marketplace to provide supporting documentation to prove eligibility to enroll through the SEP. Two of these four fictitious applicants were able to obtain and maintain subsidized health insurance through the marketplace without providing supporting documentation related to the SEP and are currently enrolled in a qualified health plan. As mentioned, in some instances, we provided fictitious documents to the federal and selected state-based marketplaces to support the SEP triggering event and were able to obtain and maintain subsidized health coverage. After the conclusion of our undercover testing, when we spoke with federal and selected state-based marketplace officials about the outcomes of our fictitious applicants, the federal and selected state- based marketplace officials told us that unless a document appeared visibly altered, they accepted it. For example, one of our fictitious applicants claimed that we were eligible to enroll during the SEP because the applicant recently lost health coverage. In response to our application, the federal marketplace required us to submit documentation to support this SEP triggering event, such as submitting a letter from an employer stating that coverage was terminated and the date the coverage ended. We submitted a fictitious letter from a fictitious employer with a fictitious telephone number indicating our coverage was terminated on a certain date. A marketplace representative later told us that the marketplace had received and verified the fictitious supporting documentation we submitted. The fictitious applicant obtained subsidized health coverage and has continued to maintain subsidized coverage to date. In another example, one of our fictitious applicants claimed that the applicant was eligible to enroll during the SEP because the applicant experienced a serious medical condition that prevented the applicant from enrolling in a plan during open enrollment. In response, the marketplace required us to submit documentation to establish our SEP triggering event. Specifically, the marketplace requested a letter from the doctor explaining the nature of the condition that kept us from enrolling during open enrollment. We submitted a fictitious doctor's note with a fictitious doctor's name and address, as well as a fake phone number that we could monitor. We were later notified that we had been approved. On the basis of our records, no one called the fake number we provided before we were approved for coverage. The fictitious applicant obtained subsidized health coverage and has continued to maintain subsidized coverage to date. As mentioned, there is no specific legal requirement that federal or state- based marketplaces authenticate the documents submitted to support an SEP event to determine whether those documents are fictitious. However, according to federal and state officials, all applicants that apply for enrollment during an SEP must attest under penalty of perjury that they meet the conditions of eligibility for the SEP. We provided a draft of this report to HHS, Covered California, and the District of Columbia (DC) Health Benefit Exchange Authority. Written comments from HHS, Covered California, and the DC Health Benefit Exchange Authority are summarized below and reprinted in appendixes II-IV, respectively. In their written comments, in terms of overall context, these agencies reiterated that they are not required to verify the events that trigger an SEP and instead rely on self-attestation and the associated penalties, which we acknowledge and state in this report. However, prudent stewardship and good management practices suggest that fraud risks be understood and managed to protect public funds. In addition to their formal written comments, all three agencies provided us with technical comments, which we incorporated, as appropriate, in this report. In its written comments, HHS stated that SEPs are a critical way for qualified consumers to obtain health coverage and that it is important that SEPs are not misused or abused. HHS also described several actions it is taking to better understand SEPs, including its efforts as part of the agency's Special Enrollment Confirmation Process, which we also describe in this report. For example, according to HHS, beginning June 18, 2016, all consumers who complete a Marketplace application for an SEP included in the Special Enrollment Confirmation Process will read in their Eligibility Determination Notice next steps that they must take to prove their SEP eligibility along with a list of examples of documents they may submit. HHS noted that consumers who do not respond to requests for documentation or do not provide sufficient documentation could be found ineligible for their SEP and may lose coverage. In addition, HHS stated that it is implementing steps to improve program integrity, such as by conducting a fraud risk assessment of the Marketplace consistent with GAO's fraud risk framework. As mentioned, we believe that performing a fraud-risk assessment consistent with our prior recommendations to HHS in this area could help address the control vulnerabilities we identified during our SEP tests. In its written comments, Covered California also stated that it is important to ensure that consumers who enroll in health coverage during an SEP have, in fact, experienced a qualifying life event. Covered California explained that its controls are in compliance with federal standards. Covered California also described processes it has in place to verify certain SEP events, such as the random sample of consumers who experience two qualifying life events: (1) loss of minimum essential coverage and (2) permanent move to and within California, as we describe in this report. Covered California also suggested that any requirement for marketplaces to authenticate documents provided by applicants for an SEP should also consider the burden that document authentication may impose on marketplaces, consumers, and the sources of such documents, such as doctors and insurers. In this regard, we did not evaluate the cost of authenticating such documents as part of our work because it was outside the scope of our review. In its written comments, the DC Health Benefit Exchange Authority described its policies and processes for verifying SEP eligibility by relying on self-attestation or reviewing information provided by consumers and others. Additionally, in its written comments, the DC Health Benefit Exchange Authority also raised concerns about our methodology. First, the agency stated that the DC marketplace is too different from other marketplaces to be an informative part of our review. Specifically, the comments state that the age of individuals enrolled in health insurance coverage in the DC marketplace - and enrolled through SEPs in particular - suggests that there is no evidence that consumers are waiting to get sick before enrolling in coverage. We did not evaluate the DC marketplace's data on its population of enrollees and did not evaluate the DC marketplace's conclusion that the age of its enrollee population shows that there is no systemic abuse of SEPs. Rather, our work focused on testing whether our fictitious applicants could obtain and maintain health coverage during an SEP by submitting fictitious documents or no documents to support our SEP triggering event. The DC marketplace is similar to the federal Marketplace and the other state-based marketplace we selected in that it relies on self-attestation to verify certain SEP events. The written comments from the DC Health Benefit Exchange Authority also expressed concern that the results of our testing are not useful to help improve the agency's processes because we did not provide specific details of our undercover testing scenarios to the states included in our review. As we noted in our meetings with HHS and both of the state agencies included in our review, we did not provide certain details on our undercover testing scenarios to maintain the integrity of our undercover tests. Specifically, we did not provide details about our undercover tests that could risk inappropriately revealing the identities of our fictitious applicants and preclude the use of such identities in any future reviews. However, we did provide HHS and both of the state agencies with details of the scenarios, including the type of application submitted; the type of documentation we submitted; and the interaction with the marketplace representatives, among other things. Providing additional, specific details about our fictitious identities would not help the agency address any systemic vulnerabilities stemming from their reliance on self-attestation to verify eligibility for an SEP. Further, the DC Health Benefit Exchange Authority commented that our undercover tests are unrealistic because we produced fictitious documents to support our SEP events; that lying under penalty of perjury is a unique ability of our undercover investigators; and that our work assumes a significant number of individuals perjure themselves to access federal funds. These statements represent a misunderstanding of our methodology. First, as stated in our report, we used publicly available hardware, software, and materials to produce the counterfeit documents that we submitted for our testing. Using these same tools, potential fraudsters may realistically produce similarly counterfeit documents to support an SEP triggering event. Second, potential fraudsters have the ability--and very possibly the inclination--to lie under penalty of perjury to perpetrate their illegal schemes. Finally, our report makes no statements or assumptions about the number of individuals who perjure themselves to access federal funds. Rather, our report focuses on the results of our undercover testing of enrollment verification for 12 fictitious applications for subsidized health-insurance coverage during an SEP in 2016 to identify potential vulnerabilities in enrollment-verification controls. As mentioned above, prudent stewardship and good management practices suggest that fraud risks be understood and managed to protect public funds. The DC Health Benefit Exchange Authority's written comments additionally stated that relying on self-attestation is a well-accepted practice in the federal government. The DC Health Benefit Exchange Authority also suggested that any requirement for marketplaces to authenticate documents provided by applicants for an SEP should consider the burden on both the marketplace and consumers. In this regard, we did not evaluate the cost of authenticating such documents as part of our work because it was outside the scope of our review. Further, while federal agencies may rely on self-attestation for certain aspects of their programs, such as those noted in the DC Health Benefit Exchange Authority's written comments, federal agencies also take steps to verify information needed to determine eligibility for programs and benefits. For example, in compliance with the requirements of PPACA and CMS regulations, the federal and state-based marketplaces (including DC Health Link) verify information on applicant citizenship, nationality, or legal presence status by matching applicant data with data from federal agencies rather than relying on self-attestation for this information. Additionally, our prior work has found that relying on self-reported information can leave agencies vulnerable to fraud in some programs. Thus, it would be misleading to characterize reliance on self-attestation for conducting program integrity activities as a generally well-accepted practice in the federal government. Finally, the DC Health Benefit Exchange Authority's written comments stated that its approach to verifying SEP events is consistent with the best practices in our fraud risk framework. For example, the DC Health Benefit Exchange Authority stated that it has reviewed the characteristics of the DC marketplace, consistent with the principles of our fraud risk framework, and assessed risk to develop appropriate verification procedures. However, we did not review, and are thus not able to corroborate, the DC Health Benefit Exchange Authority's claim that its enrollment verification controls are consistent with our fraud risk framework. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. We were asked to examine and test health-care marketplace enrollment and verification controls for a special enrollment period (SEP) for the 2016 coverage year. This report describes results of undercover attempts to obtain subsidized qualified health-plan coverage outside the open enrollment period for 2016; that is, during an SEP. To perform our undercover testing and describe the results of our undercover attempts to obtain new coverage during an SEP, we used 12 fictitious identities for the purpose of making applications to obtain subsidized qualified health- plan coverage offered through a marketplace by telephone and online. The Patient Protection and Affordable Care Act (PPACA) requires marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant's Social Security number, if one is provided; verifying citizenship, U.S. nationality, or lawful presence in the United States; and verifying household income. The 12 identities were designed to pass these verification steps by providing supporting documentation--albeit fictitious--such as a copy of the Social Security card, driver's license, and proof of income. We selected states within the federal Health Insurance Marketplace (Marketplace) and state-based marketplaces for our undercover applications, based on factors including state population, percentage of state's population without health insurance, whether the state was selected for testing as part of our prior work, whether the state participates in the state-based marketplace or federal marketplace, and whether the states make the eligibility determination or assessment for other health-coverage programs, including Medicaid. Specifically, we selected two states--Virginia and Florida--that elected to use the federal marketplace rather than operate a marketplace of their own. We also selected two state-based marketplaces--Covered California (California) and DC Health Link (District of Columbia). The results obtained using our limited number of fictional applicants are illustrative and represent our experience with applications in the federal and state marketplaces we selected. The results cannot, however, be generalized to the overall population of applicants, enrollees, or marketplaces. Our undercover testing included fictitious applicants claiming to have experienced an event that would trigger eligibility to enroll in health- insurance coverage during an SEP. Specifically, our 12 fictitious applicants claimed to have experienced one of the following selected events that may indicate eligibility, under certain circumstances, to enroll in health coverage under an SEP: (1) loss of minimum essential health coverage; (2) gained access to new qualified health plans as a result of a permanent move to another state; (3) gained a dependent through marriage; (4) experienced an exceptional circumstance, such as a serious medical condition that prevented the consumer from enrolling during the annual open enrollment period; (5) nonenrollment during the annual open enrollment period was unintentional and the result of misinformation or misrepresentation by a non-exchange entity providing enrollment assistance or conducting enrollment activities; and (6) Medicaid application filed during the annual open enrollment period was denied after the open enrollment period had closed. We tested the six selected triggering events in the federal marketplace. We also tested the six selected triggering events in the two selected state-based marketplaces. We submitted three applications in each state and the District of Columbia. We selected these six SEP triggering events to create a balance between three events that are subject to the Centers for Medicare & Medicaid Services (CMS) Special Enrollment Confirmation Process and three events that are not subject to this process. In February 2016, CMS announced plans to begin requesting supporting documentation to verify certain events that would trigger an SEP. CMS announced that it would begin requesting supporting documentation from consumers who enroll or change plans using an SEP for selected triggering events on June 17, 2016. We started our testing after June 17, 2016. State-based marketplaces are not required to follow CMS's Special Enrollment Confirmation Process, but states may choose to follow this guidance or establish their own processes, according to CMS officials. We made 6 of our applications online initially, and 6 by phone; however, for all our fictitious applicant scenarios, we sought to act as an ordinary consumer would in attempting to make a successful application. For example, if, during online applications, we were directed to make phone calls to complete the process or mail or fax the application, we acted as instructed. We also self-attested that the information provided in the application was true when instructed. In these tests, we also stated income at a level eligible to obtain both types of income-based subsidies available under PPACA--a premium tax credit, to be paid in advance, and cost-sharing reduction (CSR). As appropriate, in our applications for coverage and subsidies, we used publicly available information to construct our scenarios. We also used publicly available hardware, software, and material to produce counterfeit documents, which we submitted, as appropriate for our testing, when instructed to do so. We designed the 12 fictitious applications to provide either no documentation or fictitious documentation related to the SEP triggering event. We used professional judgement to determine what type of documentation we would submit related to the SEP triggering event. For example, for a marriage scenario, we did not provide a marriage certificate or any documentation including the fictitious spouse's Social Security number. We did need to submit documentation related to the fictitious applicant's income in the form of a self-employment ledger and avoided providing information supporting a fictitious spouse. In another example, we had to submit proof of identity to pass the general eligibility requirements for a scenario in which we claimed the applicant permanently moved to another state within the past 60 days. Thus, to avoid submitting documentation related to the SEP triggering event, we submitted a driver's license, but we ensured it was from the original state and the issuance date was back-dated several years. We did not provide any documentation to support our permanent move to the new state. We did, however, self-attest to the permanent move. We then observed the outcomes of the document submissions, such as any approvals received or requests received to provide additional supporting documentation. For the applications that we were denied, we did not proceed with the appeals process. We conducted our performance audit from May 2016 to November 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We conducted our related investigative work in accordance with investigative standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. In addition to the contact named above, Marcus Corbin; Ranya Elias; Colin Fallon; Suellen Foth; Georgette Hagans; Barbara Lewis; Olivia Lopez; Maria McMullen; James Murphy; Jonathon Oldmixon; Gloria Proa; Christopher Schmitt; Julie Spetz; and Elizabeth Wood made key contributions to this report.

Summary:
Under PPACA, consumers can enroll in health insurance coverage, or change from one qualified health plan to another, through the federal and state marketplaces either (1) during the annual open enrollment period or (2) outside of the open enrollment period, if they qualify for an SEP. A consumer may qualify for an SEP due to specific triggering events, such as a nonvoluntary loss of health-care coverage. CMS reported that 1.6 million individuals made a plan selection through an SEP in 2015. GAO was asked to test marketplace enrollment and verification controls for applicants attempting to obtain coverage during an SEP. This report describes the results of GAO attempts to obtain subsidized qualified health-plan coverage during the 2016 SEP in the federal marketplace and two selected state-based marketplaces--California and the District of Columbia. To perform the undercover testing of enrollment verification, GAO submitted 12 new fictitious applications for subsidized health-insurance coverage outside of the open enrollment period in 2016. GAO's applications tested verifications related to a variety of SEP triggering events. The results cannot be generalized to all enrollees. GAO provided a draft of this report to CMS and the selected state agencies. In their written comments, CMS and the states reiterated that they are not required to verify an SEP event and instead rely on self-attestation. However, prudent stewardship and good management practices suggest that fraud risks be understood and managed to protect public funds. The Patient Protection and Affordable Care Act (PPACA) requires that federal and state-based marketplaces verify application information--such as citizenship or immigration status--to determine eligibility for enrollment in a health plan, potentially including a subsidy. However, there is no specific legal requirement to verify the events that trigger a Special Enrollment Period (SEP), which is an opportunity period to allow an individual to apply for health coverage after events such as losing minimum essential coverage or getting married. Prior to the start of GAO's enrollment tests, the Centers for Medicare & Medicaid Services (CMS), which maintains the federal Health Insurance Marketplace (Marketplace), implemented a policy to request that federal Marketplace applicants provide supporting documentation for certain SEP triggering events. According to CMS, ensuring that only qualified applicants enroll during an SEP is intended to prevent people from misusing the system to enroll in coverage only when they become sick. However, relying on self-attestation without verifying documents submitted to support an SEP triggering event, such as those mentioned above, could allow actual applicants to obtain subsidized coverage they would otherwise not qualify for. The federal and selected state-based marketplaces approved health-insurance coverage and subsidies for 9 of 12 of GAO's fictitious applications made during a 2016 SEP. The remaining 3 fictitious applicants were denied. The marketplaces instructed 6 of 12 applicants to provide supporting documentation, such as a copy of a recent marriage certificate, related to the SEP triggering event; the remaining 6 of 12 were not instructed to do so. For 5 applicants, GAO provided no documents to support the SEP triggering event, but coverage was approved anyway. Officials from the marketplaces explained that they do not require applicants to submit documentation to support certain SEP triggering events. For other SEP triggering events, CMS officials explained that the standard operating procedure in the federal Marketplace is to enroll applicants first, and verify documentation to support the SEP triggering event after enrollment. The officials also noted that all applicants must attest to their eligibility for enrollment. GAO is not making any recommendations to the Department of Health and Human Services (HHS) in this report. However, GAO made eight recommendations to strengthen PPACA enrollment controls in a February 2016 report; these recommendations included conducting a fraud-risk assessment of the federal marketplace, consistent with the leading practices described in GAO's framework for managing fraud risks in federal programs. In formal comments on a draft of the February report, HHS concurred with the recommendations and outlined a number of steps it planned to take to implement them. In an April 2016 follow-up letter to GAO, HHS described a number of specific actions it had taken in response to the eight recommendations, such as creating an integrated project team to perform the Marketplace fraud-risk assessment. As of November 2016, GAO considers all eight recommendations to be still open, pending corroborating information, and will continue to monitor CMS's progress in implementing them. Implementing these recommendations by actions such as performing the fraud-risk assessment could help address the control vulnerabilities GAO identified during its most recent SEP tests.