The size and complexity of states’ Medicaid programs have implications for program administration and oversight, including provider screening and enrollment. States have flexibility, within broad federal guidelines, in how they design, administer, and oversee their Medicaid programs. For example, states have the option to pay for care through fee-for-service (FFS) payments to participating providers, contract with managed care organizations (MCO) to deliver services based on a fixed amount per beneficiary, or a combination of both. In fiscal year 2018, total Medicaid spending was $629 billion, about half of which was estimated to be spent for services delivered under managed care. CMS and states each have a role to play in protecting the integrity of the Medicaid program and preventing fraud, waste, and abuse. States administer their Medicaid programs, including implementing federal requirements for screening and enrolling Medicaid providers. CMS has a role overseeing states’ compliance with federal requirements. CMS’s oversight activities include measuring improper payments in the Medicaid program, and conducting focused program integrity and desk reviews. Other federal and state entities also have a role in oversight of the Medicaid program. For example, state auditors—state agencies that typically conduct the annual single state audit of federal programs—may also conduct program integrity reviews and identify Medicaid improper payments. We have previously testified that state auditors are uniquely qualified to partner with CMS in its oversight of Medicaid. In our testimony, we noted that CMS could help improve program integrity by providing state auditors with a substantive and ongoing role in auditing state Medicaid programs. To limit payments to ineligible providers—such as those convicted of program-related fraud and abuse, or with a suspended or revoked medical license for reasons of bearing on professional competence or performance—federal regulations require states to screen and enroll all providers, whether the provider furnished, ordered, or referred services to an eligible beneficiary or whether the service was paid for under FFS or Medicaid managed care contracts. Providers subject to these requirements include individual practitioners—such as physicians, nurse practitioners, and physical therapists—as well as any physicians and other professionals who may only order or refer beneficiaries to services, but do not render services; for example, providers who only prescribe medications or order imaging services, such as an x-ray. Providers also include provider organizations—such as hospitals, group practices, and skilled nursing facilities—and providers and suppliers of medical equipment or goods. All providers must be screened when they (1) initially apply for and submit an application, and (2) upon reenrollment in a state’s Medicaid program. Further, states must screen all providers at least once every 5 years to revalidate their enrollment. States may rely on the results of providers’ screenings performed by the Medicare program or another state’s Medicaid program. States may also choose to delegate screening activities to vendors that screen providers on the states’ behalf or MCOs. If a state chooses to delegate screening activities, it must ensure that the screenings are conducted in accordance with the Medicaid program requirements. States must also collect certain information from providers to enroll them into their Medicaid programs, such as their Social Security numbers, dates of birth, and National Provider Identifiers, if applicable. States must also collect disclosure information for owners, managing employees, and others with controlling interests in provider organizations meeting certain criteria. For example, states must collect disclosure information for those with direct or indirect ownership totaling 5 percent or more, or who are agents or managing employees of a provider organization. These owners and others with controlling interests who are subject to disclosure requirements must undergo certain required screening activities, such as federal database checks, and states must perform these screening activities to enroll the provider organization. Federal regulations require states to perform several screening activities prior to enrolling providers. The provider’s categorical risk level for fraud, waste, and abuse determine the required screening activities. The screening activities may include conducting checks in federal databases; verifying licensure; and performing site visits and fingerprint-based background checks. In addition to required activities, states may also choose to conduct other screening activities in order to identify providers ineligible for participating in Medicaid. See figure 1 for an overview of Medicaid provider screening activities and appendix II for a full list of provider screening requirements. Risk-based screening. States must screen providers according to the provider’s categorical risk level for fraud, waste, and abuse. The regulations establish screening requirements for three risk levels—limited, moderate, and high risk—and each risk level includes a range of provider types. (See table 1.) In addition, providers’ risk levels can change. For example, limited- or moderate-risk providers may be categorized as high risk if the state Medicaid agency imposes a payment suspension based on a credible allegation of fraud, waste, or abuse. Federal database checks. States must confirm the identity of prospective providers, providers seeking revalidation, and individuals subject to disclosure requirements to determine if they have been excluded from participating in Medicaid by checking four federal databases: 1. the Social Security Administrations’ Death Master File (DMF); 2. the National Plan and Provider Enumeration System (NPPES); 3. the List of Excluded Individuals/Entities (LEIE); and 4. the General Services Administration’s System for Award Management (SAM). In addition, states must conduct at least monthly checks in the LEIE and SAM. States may also check other federal and state databases. For example, states may check CMS’s database containing Medicare provider enrollment data—the Provider Enrollment, Chain and Ownership System (PECOS)—prior to conducting their own database checks to determine if a provider is enrolled in Medicare and was previously screened. For providers enrolled in Medicare, states may choose to rely on the results of the screening conducted for the Medicare program and enroll the provider without conducting any further screening activities. For providers not enrolled in Medicare, states must screen the provider prior to enrolling them. (See table 2.) Licensure verification. States must verify that providers have a current, valid medical license in the states in which they are licensed. Further, states must confirm that the providers’ license does not have any limitations, such as a suspension or probation. Site visits and fingerprint-based criminal background checks. States must conduct on-site visits for moderate- and high-risk providers to verify that the information submitted is accurate and to determine providers’ compliance with federal and state enrollment requirements. Further, states must collect fingerprints from high-risk providers, and these providers must consent to a criminal background check. CMS developed the PERM to estimate the national Medicaid improper payment rate, including improper payments due to states’ non- compliance with provider screening and enrollment requirements. CMS computes the national improper payment rate as the weighted average of states’ improper payment rate estimates from the PERM using three key components of the Medicaid program: FFS, managed care, and beneficiary eligibility determinations. Each component of the PERM is estimated differently, and only the FFS component is used to oversee states’ compliance with provider screening and enrollment requirements. When calculating the FFS component, CMS measures improper payments in a sample of FFS claims, which record services provided. Specifically, CMS reviews the sample of FFS claims and examines related state documents to identify any errors resulting from a failure to meet federal and state policies, including provider screening and enrollment requirements. For example, CMS verifies the provider was eligible to render and bill for the services by reviewing provider information, including the provider’s name and license, and whether the provider was screened in accordance with risk-based screening requirements. Any FFS claims paid for services furnished, ordered, referred, or prescribed by a provider who was not screened in compliance with requirements or not enrolled with the state is considered an improper payment. The managed care component of the PERM measures any improper payments in the capitated payments that state Medicaid agencies make to MCOs on behalf of enrollees. It does not examine whether providers in managed care were appropriately screened and enrolled within a state. The eligibility component focuses solely on measuring improper payments related to state determinations of whether Medicaid enrollees meet categorical and financial criteria for Medicaid benefits. CMS conducts the PERM across all states on a 17-state, 3-year rotation cycle and computes an annual rolling average of improper payment rates from the 3 years of data. At the conclusion of each PERM cycle, CMS develops reports for each state, which include any findings related to provider screening and enrollment. Following each PERM cycle, states must prepare a corrective action plan to address errors found. CMS also conducts other oversight activities to protect the integrity of the Medicaid program and assess states’ compliance with Medicaid provider screening and enrollment requirements. These activities include the following: Focused program integrity reviews. CMS conducts these reviews to examine specific areas of Medicaid, including provider screening and enrollment and managed care. These reviews may include a full or partial review of states’ compliance with provider screening and enrollment requirements. Desk reviews. CMS conducts these off-site reviews on specific aspects of states’ program integrity activities, such as a state’s progress toward implementing corrective action plans in response to PERM findings and payments made to providers terminated from Medicaid. Officials from all seven selected states told us they faced challenges building the capacity and establishing the administrative processes needed to implement the new and expanded provider screening and enrollment requirements under PPACA and the 21st Century Cures Act. These challenges included establishing procedures for risk-based screenings, using federal databases and collecting information from providers, and screening and enrolling an increased volume of providers. Due, in part, to these challenges, officials from five selected states told us they have not yet implemented some of the requirements. Officials from all seven selected states described challenges building their capacity to conduct risk-based provider screenings prior to enrollment into their Medicaid programs. To incorporate database checks, site visits, fingerprint-based background checks, and other risk-based screening activities into state screening procedures; state Medicaid officials said they needed financial resources, leadership support, and time. Specifically, officials from the selected states told us they used one of the following three approaches to build capacity to implement the screening and enrollment requirements. 1. Developing new information technology systems. Officials from two of the seven selected states told us they developed new state information technology systems that automated screening and enrollment activities. For example, officials from one state told us they spent $5.9 million from 2015 through 2018 to develop a new provider screening and enrollment system that included an online provider application portal and automated screening activities, such as conducting database checks and flagging high-risk providers for site visits and fingerprint-based background checks. According to state officials, this new system helped the state implement provider screening and enrollment requirements, yielding efficiencies by allowing staff to focus on analyzing provider screening results rather than clarifying data entry errors and manually checking each database. (See fig. 2.) 2. Contracting with vendors. Officials from four other selected states told us they initiated or modified existing contracts with vendors to screen new provider applications and conduct revalidations on their behalf. For example, officials from one state told us their contract with a vendor resulted in screening and enrolling about 10,000 providers in 2018, more than five times the number the state had processed in the previous year. Another state used a vendor to revalidate more than 9,000 providers in 2016; about 12 percent of the state’s enrolled provider population. 3. Modifying existing procedures. Officials from our seventh selected state told us that they modified their existing state information technology system and procedures to manually screen and enroll providers. However, according to state officials, this approach has put pressure on their resources. Officials said that they were working to automate some database checks as much as possible without requiring services from a contractor. Officials from six of the seven selected states told us they experienced challenges using federal databases, and all seven of the states described challenges collecting required information for screening and enrollment. To mitigate challenges using federal databases, the state Medicaid agencies took actions including accessing data from alternate sources, manually verifying information, and collecting information from providers. (See table 3.) Recent CMS actions could also improve states’ ability to search databases. In April 2019, CMS officials told us they have partnered with the Treasury Department, which is conducting a pilot that will offer states access to its Do Not Pay Business Center services. Do Not Pay is a resource developed by the Treasury Department to detect and prevent improper payments. This resource allows federal agencies to automate screenings by searching for excluded parties using common identification numbers, such as Social Security numbers. Do Not Pay also allows users to search DMF, LEIE, and SAM from a single portal. CMS referred seven states, including two of our selected states, to take part in Treasury’s pilot. Officials from all seven selected states told us that they faced challenges collecting required information from providers for screening and enrollment, such as Social Security numbers or fingerprints. These states took steps—such as educating providers and developing or updating forms, procedures, and statutory provisions—to address some of the challenges associated with collecting the information necessary to screen and enroll providers. For example, one state told us that some providers have been hesitant to disclose Social Security numbers and their date of birth on applications, as well as other information that states are required to collect for enrollment. In response, the state has offered provider education on the requirements to facilitate collecting this information. State Medicaid officials also noted that their agencies worked with CMS, state legislatures, and state law enforcement agencies to implement fingerprint-based background check requirements to, for example, collect fingerprints and check them against Federal Bureau of Investigation records. Officials from two selected states told us their agencies did not have the authority under state law to collect fingerprints from providers or submit them to the Federal Bureau of Investigation prior to PPACA, and officials from one of these states told us changes to state statute were needed before they could implement this requirement. Officials from five of the seven selected states described challenges having sufficient capacity to screen an increased volume of providers and enroll certain provider types. Officials from one state told us that the new requirement to screen managed care providers more than doubled the number of providers the state needed to screen and enroll. Further, officials from three states told us about challenges obtaining information needed to conduct screenings from prescribers and other professionals who only order and refer services. Previously, such providers were not required to enroll in Medicaid and some were not responsive to the state Medicaid agency’s requests for information. Officials from the five selected states that faced these challenges told us they had taken steps to address these challenges. Yet, four of the five selected states that faced these challenges continued to make payments to these types of providers even though they were not enrolled in their Medicaid programs, because they wanted to maintain beneficiary access to the services. Managed care providers. Officials from three of the selected states told us they faced challenges enrolling managed care providers. For example, officials from one state told us that they could not process the large number of applications they needed to screen before enrolling these providers, and attempted to delegate some required database checks for managed care providers to its MCOs. However, officials told us these MCOs do not have state-level access to all required databases; therefore, the managed care providers have not been screened as required and are not all enrolled with the state. The officials told us the state has about 80,000 managed care providers to screen and enroll as part of implementing the 21st Century Cures Act requirements. However, officials said they have chosen to wait until the state launches a new information technology system that automates screenings before screening and enrolling these providers. Prescribers and other professionals who may only order and refer services to beneficiaries. Officials from three selected states told us they had not enrolled all prescribers and other professionals who may only order and refer services, but do not render them. These states have taken steps to address this challenge. Officials from one state told us they took steps to screen and enroll medical residents— hospital providers who are not providing services to Medicaid beneficiaries, but may prescribe medication during a beneficiary’s hospital stay. These officials told us they did not screen and enroll medical residents prior to PPACA, because of differences in licensure. Officials from all three states said they continue to pay for prescriptions written by these providers who are not enrolled in their Medicaid programs. CMS offers optional consultations that are tailored to support states’ implementation of the Medicaid provider screening and enrollment requirements. However, these consultations are optional, regardless of whether states have implemented the federal requirements. CMS also conducts several oversight activities—the PERM, focused program integrity reviews, and other activities—to oversee states’ compliance with provider screening and enrollment requirements. Collectively, these activities do not ensure CMS has comprehensive and timely information on the extent of states’ compliance with the requirements. In 2016, CMS began offering optional consultations tailored to support states’ implementation of Medicaid screening and enrollment requirements. Optional consultations include CMS contractor site visits to states that examine the extent to which states have implemented the requirements, and the data compare service to assist states with screening providers. While most states (38) have used one or more of these consultations, 13 states have not used any. Because some states do not avail themselves of the optional consultations, these consultations do not provide CMS with information on all states’ progress in implementing the requirements. Officials from some of the seven selected states reported limitations affecting their use of the consultations. CMS contractor site visits. One-third of states (17), including three of the seven selected states, participated in at least one multi-day CMS contractor site visit, as of June 2019. Officials from CMS and its contractor told us that during the site visit, the state completes a self- assessment, followed by the contractor’s assessment on the implementation status of all provider screening and enrollment requirements to identify requirements that have not been implemented and opportunities for improving the states’ screening and enrollment procedures. (See fig. 3 for a map of states that participated in the CMS contractor site visit.) After the visit, the contractor provided a report that summarizes the state’s status toward implementing each requirement, such as full, partial, nearly complete, and not started. (See fig. 4.) CMS officials consider any requirements that are not fully implemented as “opportunities for improvement.” CMS contractor site visits are not required and are not considered audits; the agency does not track states’ progress on implementing requirements and opportunities for improvement unless the state engages CMS in follow-up. At the time of their contractor site visit, 16 of the 17 states that opted for this service had not fully implemented all provider screening and enrollment requirements. Officials from the three selected states that received a CMS contractor site visit told us that the visit helped (1) accurately identify requirements that their state had not fully implemented, or (2) establish priorities for making changes. Two of these states found it helpful to learn from the contractor about other states’ best practices and requested a return visit. Officials from another state told us they were able to make positive changes to their screening and enrollment procedures immediately after the visit, such as improving documentation of database checks through the use of screenshots to record search results. Data compare service. About half of all states (25), including four of the seven selected states, used the data compare service as of June 2019— a process by which states submit a list of all their active providers, and CMS provides a full report of the state’s providers who were previously screened by Medicare, as well as identify providers the state may need to take action on, because, among other reasons, they were terminated from Medicaid. For the states that have used the data compare service, CMS officials reported being able to screen between 40 to 80 percent of their providers. Officials from the four selected states said it was also useful for testing their provider screening and enrollment procedures to see whether the service would identify any providers they should have excluded in their screening, and three of these states said it was useful for streamlining their provider revalidations. Additionally, officials from one state that had not yet used the service told us they would consider using it in the future for both of these purposes. For example, officials from one state reported that CMS’s data compare service screened half of the approximately 80,000 providers they needed to revalidate. (See fig. 5 for a map of states that opted for the data compare service.) However, officials from all seven selected states identified limitations of the data compare service that led some states to use the service less frequently and three states to not use the service at all. CMS officials acknowledged the three limitations reported by state officials: 1. Time for receiving results. The results from the data compare service were not timely enough to help states with screening newly enrolling providers. Officials from one state explained that some provider information may become outdated by the time the results are received 6 to 8 weeks later, which makes the service less useful than it could be. 2. Different Medicare and Medicaid address entries. The data compare service’s addresses reflected Medicare practice or billing locations that may be different from providers’ Medicaid addresses. Because these addresses do not match, they could not be relied upon for updating the state’s provider records or to help states conduct site visits required for screening and enrolling moderate- and high-risk providers. 3. Additional burden for manual enrollment systems. Officials from two selected states told us that manually extracting provider data from their system—including names, addresses, Social Security numbers, and National Provider Identifiers—and manually re-entering the results from CMS for each provider into their system was burdensome and resource-intensive, leading one of these states to stop using the service. CMS offers guidance and other supports to states on a regular and periodic basis, including monthly calls with states, and assigning states to a CMS contact (see sidebar). These services also assist states with implementing the Medicaid provider screening and enrollment requirements. Officials from all of our selected states told us the guidance and other supports were helpful. According to CMS officials, the extent to which states participate in these other supports varies, because the level of participation is optional. CMS officials also told us that they use these other supports, including monthly calls and ad hoc emails, to discuss progress and keep a record of information provided; however, the agency does not revisit or require corrective actions unless the state initiates it. The PERM and other methods CMS uses to oversee states’ efforts to screen and enroll Medicaid providers do not provide CMS with comprehensive and timely information on states’ compliance with the requirements. Some methods do not fully track whether states have enrolled all types of providers and are in compliance with all the requirements; other program integrity oversight methods have not been conducted on all states. Further, these methods do not ensure timely follow-up to address identified concerns. The PERM’s components—FFS, managed care, and beneficiary eligibility determinations—measure improper payments across all states; as previously noted, the FFS component is the only component CMS uses to assess states’ compliance with provider screening and enrollment requirements. However, using the PERM to oversee states’ compliance with the requirements has limitations, including the following: The PERM does not examine whether providers under contract with MCOs are appropriately screened and enrolled. The PERM assesses states’ compliance with the provider screening and enrollment requirements by reviewing provider information for claims paid under FFS; it does not review such information for services financed under managed care. Currently, the PERM does not examine ownership disclosure and certain other provider screening and enrollment requirements. CMS officials told us the agency plans to assess the feasibility of including ownership disclosure requirements in the PERM over the next 3 years. The PERM does not ensure that CMS identifies areas of non- compliance in a timely manner. CMS conducts the PERM in each state every 3 years, and states develop corrective action plans in response to findings from the PERM; thus, it may be years before CMS identifies—and states resolve—areas of non-compliance with the provider screening and enrollment requirements. (See fig. 6.) Although CMS follows up annually with states regarding their corrective action plans, it does not fully assess states’ progress toward implementing their plans until the next PERM cycle, which is 3 years later. Further, while four of our selected states had implemented all their corrective action plans regarding provider screening and enrollment requirements within 1 year of PERM findings, the other three states had not fully implemented their plans about 2 years after PERM findings. CMS officials emphasized that developing and tracking corrective action plans was a collaborative process and that states may change corrective action plans in response to competing priorities. CMS uses other methods to oversee states’ compliance with the provider screening and enrollment requirements—focused program integrity reviews and desk reviews—that are not optional and have resulted in findings. However, these methods do not provide the agency with comprehensive and timely information on states’ compliance with the requirements. Specifically, these methods have not been conducted in all states, performed in a timely manner, or included a systematic review of states’ compliance with all the provider screening and enrollment requirements. For example: Focused program integrity reviews. CMS has not conducted focused program integrity reviews examining specific areas in Medicaid for all states. Most of the reviews performed did not include a comprehensive or timely examination of states’ compliance with provider screening and enrollment requirements. Overall, CMS has conducted 42 focused program integrity reviews in fiscal years 2014 through 2018 in 39 states. Among these reviews, nine of the 42 focused program integrity reviews examined states’ compliance with provider screening and enrollment requirements, the last of which was completed in fiscal year 2015. CMS also conducted focused program integrity reviews on managed care for 34 of the 41 states with managed care expenditures in fiscal year 2017. However, nearly all of these reviews (33) were conducted prior to January 2018 when states were required to screen and enroll all managed care providers, as required by the 21st Century Cures Act. CMS also conducted seven focused reviews examining personal care services in seven states— which include examining screening and enrollment requirements for providers of these services. Desk reviews. Off-site desk reviews that examine specific aspects of states’ program integrity activities do not include a comprehensive or timely examination of states’ compliance with the provider screening and enrollment requirements. CMS has conducted desk reviews examining activities related to provider screening and enrollment, such as corrective actions states have taken in response to PERM findings. However, desk reviews on corrective action plans are limited to examining findings on provider screening and enrollment identified during the PERM and are not conducted until 3 years after the PERM has occurred. For example, CMS told us that in 2018 the agency conducted desk reviews on the 17 states that underwent the PERM in fiscal year 2015. CMS also conducted 35 desk reviews on potential payments to terminated providers since fiscal year 2014. The PERM and CMS’s other oversight methods do not provide CMS with sufficient or timely information about states’ screening and enrollment procedures for all Medicaid provider types, and most states with managed care expenditures have not undergone a managed care-focused program integrity review since the 21st Century Cures Act screening and enrollment provisions went into effect. The lack of complete information on whether states are screening and enrolling all providers according to requirements is inconsistent with federal internal controls on assessing risk, which note that management should consider the potential for fraud when identifying, analyzing, and responding to risks. Without complete information, CMS cannot ensure that only eligible providers are participating in the Medicaid program, leaving the program vulnerable to improper payments. Further, CMS does not obtain timely information on all states’ actions to address areas of non-compliance or track progress toward addressing these areas. The length of the PERM cycle—3 years—and time for performing corrective actions to address PERM findings, limits CMS’s awareness of states’ progress, or lack thereof, toward implementing requirements. As a result, CMS lacks assurance that states are addressing areas of non-compliance or if such actions are being taken in a timely manner. This is inconsistent with federal internal controls on monitoring, which note that management should remediate deficiencies in the internal control system on a timely basis. CMS has a range of activities that provide the agency with some knowledge of states’ implementation of required provider screening and enrollment under PPACA and the 21st Century Cures Act; however, the agency’s oversight activities are not designed to systematically examine compliance with all the requirements for all providers in a timely manner. Notably, the PERM does not examine managed care providers, and CMS’s assessment of compliance and monitoring of corrective actions are not timely, because they are based on the 3-year PERM cycle. Also, focused program integrity reviews—which may examine states’ oversight of MCOs and their compliance with provider screening and enrollment requirements for providers participating in managed care—have not been conducted on all states. The one activity that can provide CMS and states with a complete and timely assessment of states’ implementation with provider screening and enrollment requirements is optional. While CMS does some tracking of state-reported information on the status of states’ implementation of the requirements, this oversight does not include states that have not availed themselves of the support CMS provides. Since states are not required to participate in these optional consultations, the states that may face the greatest challenges with implementing the provider screening and enrollment requirements might not volunteer to participate in the consultations. Without a thorough review of states’ implementation of the provider screening and enrollment requirements, as well as processes to monitor states to ensure timely remediation of deficiencies, the agency lacks assurance that only eligible providers are participating in the Medicaid program, leaving the program at risk for improper payments. We are making the following two recommendations to CMS: The Administrator of CMS should expand its review of states’ implementation of the provider screening and enrollment requirements to include states that have not made use of CMS’s optional consultations. Similar to CMS’s contractor site visits, such reviews should include any necessary steps to address areas of noncompliance for all types of enrolled providers, including those under contract with MCOs. (Recommendation 1) The Administrator of CMS should annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements for any state with one or more corrective action plans. (Recommendation 2) We provided a draft of this report to HHS for review and comment. In its written comments, HHS concurred with our recommendations; the full text of which are reproduced in appendix I. Regarding our first recommendation, HHS stated that it will reach out to states that have not yet participated in optional consultations to discuss their progress and outline steps that the states should take to come into full compliance with the provider screening and enrollment requirements. Regarding our second recommendation, HHS stated that it is in the process of instituting more frequent reviews of corrective action plans resulting from one of CMS’s oversight activities—the PERM—stating that such reviews will now be performed quarterly. However, HHS’s comments did not discuss monitoring areas of noncompliance that are identified through other oversight activities, such as focused program integrity reviews, which include reviews of states’ screening and enrollment of providers who are under contract with MCOs. We recommend that CMS annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements, which would include areas of noncompliance identified through the PERM, optional consultations, and other oversight activities. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. Appendix II: Summary of Medicaid Provider Screening and Enrollment Requirements Description The state Medicaid agency must require all enrolled providers to be screened in accordance with applicable requirements. The state Medicaid agency must have a method for verifying that a provider is licensed without restrictions in accordance with the laws of that state. The state Medicaid agency must complete revalidation of enrollment for all providers, regardless of provider type, at least every 5 years. The state Medicaid agency must deny enrollment to any provider and disclosing entity that does not successfully pass or comply with the screening process, and the agency must terminate providers who no longer meet the requirements for enrollment. The state Medicaid agency must rescreen a provider who has been deactivated for any reason prior to the provider’s reactivation. The state Medicaid agency must share with providers who are terminated or denied enrollment the process for appealing the decision. The state Medicaid agency must conduct site visits for providers who are designated as moderate or high-risk levels. Fingerprint criminal background checks The state Medicaid agency must complete fingerprint-based criminal background checks for providers and disclosing entities in the high-risk category. The state Medicaid agency must confirm the identity and determine the exclusion status of providers, any person with an ownership or control interest, and any agent or managing employee of the provider. The state Medicaid agency must require all claims for payment for items and services that were ordered or referred to contain the National Provider Identifier of the physician or other professional who ordered or referred such items or services. Screening levels for Medicaid providers The state Medicaid agency must screen all initial applications based on a categorical risk level of “limited,” “moderate,” or “high.” The state Medicaid agency must collect an application fee from institutional providers during a new enrollment or revalidation, unless Medicare or another Medicaid agency has already collected an application fee. Allows CMS and states to implement temporary moratoria pausing the enrollment of new provider types in a given location. In addition to the contact named above, Leslie V. Gordon (Assistant Director), Kristin Ekelund (Analyst-in-Charge), Manuel Buentello, Drew Long, Giao N. Nguyen, and Chris Zakroff made key contributions to this report. Also contributing were Marissa Coloske, Vikki Porter, and Jennifer Whitworth.

Summary: A crucial component of protecting the integrity of the Medicaid program is ensuring that only eligible providers participate in Medicaid. States' non-compliance with provider screening and enrollment requirements contributed to over a third of the $36.3 billion estimated improper payments in Medicaid in 2018. To improve the integrity of the Medicaid program, PPACA and the 21st Century Cures Act established new requirements for screening and enrolling providers and expanded enrollment to include additional provider types. In this report, GAO (1) describes challenges states faced implementing provider screening and enrollment requirements; and (2) examines CMS support for and oversight of states' implementation of these requirements. GAO reviewed federal laws and CMS guidance. GAO also reviewed CMS documents, including reports resulting from CMS oversight activities published from 2014 through 2018 for seven states. These states were selected based on their use of CMS's contractor site visits, among other things. GAO also interviewed officials from CMS and the seven selected states. Officials from seven selected states that GAO interviewed described challenges they faced implementing new Medicaid provider screening and enrollment requirements, established by the Patient Protection and Affordable Care Act (PPACA) in 2010 and the 21st Century Cures Act in 2016. These challenges included establishing procedures for risk-based screenings, using federal databases and collecting required information, and screening an increased volume of providers. Due in part to these challenges, officials from five of the seven selected states told GAO they had not implemented certain requirements. For example, one state plans to launch its new information technology system, which automates screenings, before it will enroll providers under contract with managed care organizations, as required under these laws. The Centers for Medicare & Medicaid Services (CMS)—the federal agency that oversees Medicaid—supports states' implementation of new requirements with tailored optional consultations, such as CMS contractor site visits that examine the extent of states' implementation. Yet, because these are optional, states that need support might not participate, and CMS would not have information on those states. CMS uses other methods to oversee states' compliance, such as, the Payment Error Rate Measurement (PERM) process for estimating improper payments, and focused program integrity reviews. PERM. This process assesses states' compliance with provider screening and enrollment requirements, but does not assess compliance for all providers and all requirements, and occurs once every 3 years. Focused program integrity reviews. These reviews examine specific areas in Medicaid, like state compliance with provider screening and enrollment requirements, but have not been done in all states. CMS conducted reviews in 39 states in fiscal years 2014 through 2018. Collectively, CMS's oversight methods do not provide it with comprehensive and timely reviews of states' implementation of the provider screening and enrollment requirements or the remediation of deficiences. As a result, CMS lacks assurance that only eligible providers are participating in the Medicaid program. GAO recommends that CMS (1) expand its review of states' implementation of provider screening and enrollment requirements to include states that have not participated in optional consultations; and (2) for states not fully compliant with the requirements, annually monitor the progress of those states' implementation. The Department of Health and Human Services, the department that houses CMS, concurred with both recommendations.