PPACA provides for the establishment of health-insurance marketplaces to assist consumers in comparing and selecting among insurance plans offered by participating private issuers of health-insurance coverage. Under PPACA, states may elect to operate their own health-insurance marketplaces, known as state-based marketplaces, or they may rely on the federal Marketplace, known to the public as HealthCare.gov. These marketplaces were intended to provide a single point of access for individuals to enroll in private health-plans, apply for income-based subsidies to offset the cost of these plans--which, as noted, are paid directly to health-insurance issuers--and, as applicable, obtain an eligibility determination or assessment of eligibility for other health- coverage programs, such as Medicaid or the Children's Health Insurance Program. CMS, a unit of the Department of Health and Human Services (HHS), is responsible for overseeing the establishment of these online marketplaces, and the agency maintains the federal Marketplace. To be eligible to enroll in a "qualified health plan" offered through a marketplace--that is, one providing essential health benefits and meeting other requirements under PPACA--an individual must be a U.S. citizen or national, or otherwise lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). To be eligible for Medicaid, individuals must meet federal requirements regarding residency, U.S. citizenship or immigration status, and income limits, as well as any additional state-specific criteria that may apply. Marketplaces are required by PPACA to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant's Social Security number, if one is provided; verifying citizenship, status as a U.S. national, or lawful presence by comparison with Social Security Administration or Department of Homeland Security records; and verifying household income with tax-return data from the Internal Revenue Service (IRS), as well as data on Social Security benefits from the Social Security Administration. Under PPACA's eligibility verification process, "inconsistencies" are generated when individual applicant information does not match federal data sources--either because information an applicant provided does not match information contained in data sources that a marketplace uses for eligibility verification at the time of application, or because such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant's attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved. Under the marketplace process, applicants may be asked to provide additional information or documentation for the marketplaces to review to resolve the inconsistencies. In addition to the two related reports discussed in this statement, we have issued a body of work in which we examined enrollment and verification controls of the federal and state marketplaces. For example, in February 2016, we issued a report addressing CMS enrollment controls and the agency's management of enrollment fraud risk. That report included eight recommendations to CMS to strengthen its oversight of the federal Marketplace. CMS concurred with our recommendations, and implementation is pending. In terms of concentration in the private health-insurance market, in December 2014 we reported that, from 2010 through 2013, enrollment in most states was concentrated among the largest issuers in each of the three types of health-insurance markets: the large-group market (under which individuals obtain coverage through a group plan maintained by large employers), the small-group market (under which individuals obtain coverage through a group plan maintained by small employers), and the individual market (coverage sold directly to individual consumers other than in connection with a group health-plan). As mentioned above, PPACA contained provisions that could affect market concentration among health issuers. For example, the law required the establishment of individual health-insurance exchanges, as well as Small Business Health Options Programs ("SHOPs"), within each state by 2014. These exchanges are a new type of market where eligible individuals and small employers, respectively, can compare and select among qualified insurance plans offered by participating issuers. PPACA does not require issuers to offer plans through these exchanges but instead generally relies on market incentives to encourage their participation. Issuers seeking to offer a health plan in an individual exchange or SHOP must first have that plan approved by the exchange in the state. About a third of the states chose to operate their exchanges in 2014 and approved issuers for participation. In the remaining states electing not to establish and operate their own exchange, PPACA required HHS to carry out these responsibilities. As reported in August 2014, most of the largest issuers holding the majority of the market in the 2012 individual and small-group markets participated in the 2014 exchanges, although most of the numerous smaller issuers in those markets did not. Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for qualified health-plans--that is, coverage obtained from private insurers-- was vulnerable to fraud. The federal Marketplace or selected state-based marketplaces approved each of 10 fictitious applications we made for subsidized health-plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued, such as numbers starting with "000." Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage. For eight additional fictitious applications, initially made for Medicaid coverage, we were approved for subsidized health-care coverage in seven of the eight cases, through the federal Marketplace and the two selected state-based marketplaces. Three of our applications were approved for Medicaid, which was the health-care program for which we originally sought approval. In each case, we provided identity information that would not have matched Social Security Administration records. For two applications, the marketplace or state Medicaid agency directed the fictitious applicants to submit supporting documents, which we did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone. For four applications, we were unable to obtain approval for Medicaid but were subsequently able to gain approval of subsidized health-plan coverage. In one case, we falsely claimed that we were denied Medicaid and were able to obtain the subsidized health-plan when in fact no Medicaid determination had been made at that time. For one application, we were unable to enroll into Medicaid, in California, because we declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications. We submitted fictitious documentation as part of the application and enrollment process. According to officials from CMS, California, Kentucky, and North Dakota, the marketplaces or Medicaid office only inspect supporting documentation that has obviously been altered. Thus, if the documentation submitted did not show signs of alteration, it would not be questioned for authenticity. Our undercover testing for the 2016 coverage year found that the health- care marketplaces' eligibility determination and enrollment processes continued to be vulnerable to fraud. The marketplaces initially approved coverage and subsidies for our 15 fictitious applications, including 1 application for Medicaid, made through the federal Marketplace in Virginia and West Virginia and through the state marketplace in California. However, three applicants were unable to put their policies in force because their initial payments were not successfully processed. Therefore, we focused our testing on the remaining 12 applications --11 applications for qualified health-plans, and 1 for Medicaid. For four applications, to obtain 2016 subsidized coverage, we used identities from our 2014 testing that had previously obtained subsidized coverage. The 2016 coverage year was the first year in which verification was required to ensure that applicants who previously received a specific type of federal subsidy under the act had filed a federal tax return. This was a condition for these applicants to retain this benefit in 2016. None of the four fictitious applicants had filed a 2014 tax return but all were approved for the 2016 subsidies. Marketplace officials told us that they allowed applicants to attest to filing taxes if information from the IRS indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is the time lag between when tax returns are filed and when they are reflected in IRS's systems. CMS officials said they are rechecking the 2014 tax-filing status and will remove subsidies for applicants that have not filed a 2014 tax return. For eight applications, we used new fictitious identities to test verifications related to identity or citizenship/immigration status and, in each case, successfully obtained subsidized coverage. When the marketplaces directed 11 of the 12 applicants to provide supporting documents, we submitted fictitious documents as follows: For five applications, we provided all documentation requested, and the applicants were able to retain coverage. For three applications, we provided only partial documentation, and the applicants were able to retain coverage. Two of these applicants were able to clear inconsistencies through conversations with marketplace phone representatives even though the information provided over the phone did not match the fictitious documentation that we previously provided. For three applications, we did not provide any of the requested documents, and the marketplaces terminated coverage for one applicant but did not terminate coverage for the other two applicants. Marketplace officials told us that without specific identities of our fictitious applicants--which we declined to provide, to protect the identities--they could not comment on individual outcomes. In general, however, they told us our results indicate their marketplace processes worked as designed. For example, according to officials from CMS, some of our application outcomes could be explained by decisions to extend document filing deadlines. CMS regulations authorize the Marketplace to extend the standard 90-day inconsistency resolution period if the applicant demonstrates a good-faith effort to obtain the required documentation during the period. Under good-faith-effort extensions for 2016, documentation requirements are not waived, but applicants were provided additional time to submit documents. For Covered California applications, when our applicants could not clear online identity proofing and contacted representatives by phone, the representatives were correct in first seeking to direct the applicants to visit enrollment counselors, so they could verify identities in person. While in- person presentation of identity documentation is never required, the officials said, an in-person visit provides an opportunity to examine identity documents. In discussing these outcomes for our fictitious applicants, federal and state marketplace officials reaffirmed, as we have reported previously, that the marketplaces do not seek to identify fraudulent document submissions. Federal Marketplace officials said document-review standards--in which CMS's documents-processing contractor is not required to examine documents for fraud--remain unchanged. Unless documents show signs of being visibly altered, they are accepted as authentic. In response to our findings, the Department of Health and Human Services stated that it continues to strengthen marketplace controls. We found that enrollment in private health-insurance plans remained concentrated among a small number of issuers in most states in 2014, including in the newly established exchanges. On average, in each state, 11 or more issuers participated in each of three types of markets-- individual, small-group, and large-group--from 2011 through 2014. However, in most states, the 3 largest issuers in each market had at least an 80 percent share of the market during the period. Beginning in 2014, issuers in the individual and small-group markets could sell coverage through the individual and SHOP exchanges established by PPACA. Not all issuers in these overall markets participated in the exchanges, and several exchanges had fewer than 3 issuers participating. Enrollment through these exchanges was generally more concentrated among a few issuers than was true for the overall markets. We did not assess the effect of the law on concentration and participation as 2014 was the first year of implementation for certain PPACA insurance reforms. In nearly all states, we found that the number of issuers participating in individual markets decreased from 2013 to 2014, while fewer states' small-group and large-group markets had decreased participation. However, across the three types of markets, those issuers exiting each state market before 2014 generally had less than 1 percent of the market in the prior year. There were also issuers that newly entered state markets in 2014. Their market shares in 2014 varied across the three types of markets, with some entering issuers in the individual market capturing a market share of over 10 percent. Newly entering issuers generally captured a larger share of the enrollment sold through the exchanges than through the overall markets, and some captured a majority of their exchange market. Chairmen Murphy and Pitts, Ranking Members DeGette and Green, and Members of the Subcommittees, this concludes my statement. I would be happy to respond to any questions that you might have. For questions about this statement, please contact Seto Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include John Dicken, Director; Philip Reiff and William Hadley, Assistant Directors; Ariel Vega, Christopher H. Schmitt, Ranya Elias, Colin Fallon, James Murphy, Olivia Lopez, Madeline Messick, and Dee Abasute. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
PPACA provides for the establishment of health-insurance marketplaces through which private issuers can sell qualifying health-care coverage, and makes subsidies available to enrollees who meet certain income and other requirements. According to the Congressional Budget Office, the estimated cost of subsidies and related spending under the act is $56 billion for fiscal year 2017, and totaling $866 billion for fiscal years 2017-2026. GAO issued three reports in September 2016 that examined (1) enrollment controls for health-care coverage obtained through the health-insurance marketplaces, and (2) private health-insurance market concentration. This testimony summarizes those reports' findings . For its undercover testing of the 2015 coverage year, GAO submitted fictitious applications for subsidized coverage through the federal Marketplace in New Jersey and North Dakota, and through state-based marketplaces in Kentucky and California. For the 2016 coverage year, GAO submitted fictitious applications through the federal Marketplace in Virginia and West Virginia, and through the state-based marketplace in California. The results of these undercover tests, while illustrative, cannot be generalized to the full population of enrollees. To review market concentration, GAO examined data reported by issuers to CMS for fiscal years 2011 through 2014, the latest data available. In response to GAO's findings, the Department of Health and Human Services stated that it continues to strengthen marketplace controls. The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information, such as citizenship or immigration status and household income, to determine eligibility for enrollment and, if applicable, eligibility for income-based subsidies. While inconsistencies between the information provided by the applicant and by government sources are being resolved, marketplaces must determine eligibility using an applicant's attestations and ensure subsidies are provided, if the applicant is qualified to receive them. GAO's undercover testing for the 2015 and 2016 coverage years found that the federal and selected state health-care marketplace's eligibility determination and enrollment process were vulnerable to fraud. For the 2015 coverage year, for example, the federal and selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health-plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued. Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage. For the 2016 coverage year, the federal and selected state marketplaces initially approved subsidies for 15 fictitious applications. However, three fictitious applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications. For 4 of the 12 applications, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. The 2016 coverage year was the first year in which verification was required to ensure that applicants who previously received a specific type of federal subsidy under the act had filed a federal tax return. This was a condition for these applicants to retain this benefit in 2016. None of the four fictitious applicants had filed a 2014 tax return, but all for were approved for the 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is the time lag between when tax returns are filed and when they are reflected in IRS's systems. Centers for Medicare & Medicaid Services (CMS) officials said they are rechecking 2014 tax-filing status and will remove subsidies for applicants that have not filed a 2014 tax return. GAO's review of concentration in the private health-insurance market found that enrollment was concentrated among a small number of health insurance companies (issuers) in most states in 2014, including in the newly established exchanges. On average, in each state and the District of Columbia, 11 or more issuers participated in each of three types of markets--individual, small-group, and large-group--from 2011 through 2014. However, in most states, the 3 largest issuers in each market had at least an 80 percent share of the market during the period. Enrollment through the exchanges was generally more concentrated among a few issuers than was true for the overall markets.