States have flexibility within broad federal requirements to design and implement their Medicaid programs. For example, while states must cover certain mandatory groups and benefits, they have the option to cover certain other groups of individuals and benefits. States’ Medicaid plans outline the services provided, the populations covered by their programs, and how they implement and comply with other federal requirements. States share responsibility for oversight of Medicaid eligibility with CMS. States are primarily responsible for assessing applicants’ eligibility for, and enrolling eligible individuals into, Medicaid. These responsibilities include verifying individuals’ eligibility at the time of application, performing redeterminations of eligibility, and promptly disenrolling individuals who are no longer eligible. In verifying individuals’ eligibility, states must assess specified financial and nonfinancial information. Financial: Individuals applying for Medicaid generally must have an income below a certain limit. PPACA requires states to calculate the income for most nondisabled, nonelderly applicants using a uniform method based on modified adjusted gross income (MAGI), which is derived from a federal tax-based definition of income. States have more flexibility in determining how to calculate incomes for individuals whose eligibility is determined on the basis of age or disability, because their income is not calculated using MAGI-based methods. For example, states may disregard certain types or amounts of income for these MAGI-exempt populations. Additionally, individuals eligible on the basis of age or disability generally must also have assets—cash or real or personal property that are owned and can be converted to cash—below specified standards that vary by state. Nonfinancial: Individuals applying for Medicaid must also satisfy certain nonfinancial criteria. For example, to be eligible for Medicaid individuals generally must be residents of the state in which they are applying and must be either citizens of the United States or certain noncitizens, such as lawful permanent residents. States generally have flexibility in the sources of information they use to verify applicants’ financial eligibility and citizenship or immigration status. However, to the extent practicable, states must use third party sources of data for these verifications prior to requesting documentation from the applicant. When data from reliable third party sources are inconsistent with information from an application, the state must have processes in place to resolve these inconsistencies, such as through requesting additional documentation or accepting the applicant’s attestation. Additionally, states may accept self-attestation for some eligibility criteria, such as residency in the state and household composition (which is used in determining if applicants’ income is below the limit). Once a state determines that an individual meets relevant financial and nonfinancial eligibility criteria, the state enrolls the individual into Medicaid under one basis of eligibility. Examples of bases of eligibility include those applicable to children, pregnant women, individuals eligible for Supplemental Security Income (SSI)—a program that provides cash assistance to low-income adults and children with disabilities—and other low-income adults under age 65 in states that expanded their Medicaid populations under PPACA. (See table 1.) Since individuals may meet the criteria for more than one category and eligibility group, they could have more than one basis of eligibility. For example, a child who is pregnant could meet the criteria applicable to children and those applicable to pregnant women. However, a state would enroll each individual under one basis of eligibility. CMS regulations specify that when states determine applicants eligible based on MAGI criteria, they must notify these individuals of the benefits and services available through any MAGI-exempt bases of eligibility for which they may qualify, in order to provide the individual information about whether to request a MAGI-exempt eligibility determination. However, CMS officials explained that they advise states that they do not need to inform applicants of benefits and services under other eligibility groups if there is no meaningful difference in the benefits or cost-sharing that the individual would receive under one basis compared to another. CMS officials also noted that they have provided further guidance to states on assigning bases of eligibility, including that if an individual meets the criteria for more than one basis, the state should enroll the person into the most beneficial coverage in terms of factors such as the benefit package and out-of-pocket costs. In 2014, CMS issued a framework based on federal rules for states to use in developing their systems to assess individuals’ bases of eligibility. The framework describes a hierarchy for states to use in developing their eligibility systems that begins with bases related to receipt of other federal benefits, such as SSI and federally funded foster care and adoption assistance, which often result in automatic eligibility for Medicaid. Following these bases of eligibility, states are to assess eligibility for bases subject to MAGI-based income rules, and should first evaluate for mandatory coverage before evaluating for optional coverage. Federal rules allow for some exceptions to this sequence, such as when an individual who may be eligible for bases subject to MAGI-based income rules requests consideration under a MAGI-exempt basis to access certain additional benefits, such as long-term services and supports. CMS has historically operated two distinct, but complementary programs to oversee states’ eligibility determinations in the Medicaid program. The Medicaid Eligibility Quality Control (MEQC) program, which is implemented by states and overseen by CMS, was created in 1978 to monitor the accuracy and timeliness of Medicaid eligibility determinations in order to avoid inappropriate payments and eligibility decision delays. MEQC was also designed to identify methods to reduce and prevent errors related to incorrect eligibility determinations by having states review sample cases to independently verify eligibility criteria and then report the results to CMS. The Payment Error Rate Measurement (PERM) program is CMS’s process to estimate the national Medicaid improper payment rate in accordance with the Improper Payments Information Act of 2002, as amended, and Office of Management and Budget guidance. To calculate the Medicaid improper payment rate through PERM, CMS computes an annual rolling average of improper payment rates across all states based on a 3-year rotation cycle of 17 states each year. PERM is comprised of three components, including one that measures errors in state determinations of Medicaid eligibility. For fiscal years 2015 through 2018, CMS suspended MEQC and the eligibility component of PERM to provide states with time to adjust to eligibility process changes in PPACA; in its place, CMS required states to implement pilots to assess the accuracy of their eligibility determinations. As a result, CMS did not publish an updated national estimate of improper payments due to Medicaid eligibility errors for fiscal years 2015 through 2018. Eligibility reviews under PERM, which are conducted by a federal contractor, resumed in July 2017 for fiscal year 2019. In November 2019, CMS released an updated national estimate of Medicaid eligibility errors, which reflected results of the first 17 states reviewed under the new PERM process. Going forward, states are to resume MEQC reviews in the 2 years between their PERM reviews. The MEQC reviews will focus, in part, on specific areas of improvement for each state. For example, states might choose to focus on specific populations, such as whether pregnant women were assigned to the appropriate eligibility group, or specific processes, such as asset verification. The Medicaid statute includes a provision for CMS to recoup, or disallow, federal funds related to erroneous payments for ineligible individuals and overpayments for eligible individuals. The provision generally requires CMS to recoup funds from states for eligibility-related improper payments if the state’s eligibility error rate exceeds 3 percent. CMS has general authority to recoup funds from states when it determines that an expenditure of federal funding is not an allowable expense; according to CMS, however, this general authority does not apply to eligibility-related errors, given the separate specific statutory authority. Therefore, it is the view of the agency that CMS cannot recoup funds from states whose eligibility-related improper payment rate is below the 3 percent threshold. In addition to the PERM and MEQC oversight, state auditors review Medicaid eligibility determinations, including through audits conducted at the auditors’ initiative and as part of audits required by provisions of the Single Audit Act of 1984. To guide auditors in performing reviews under the Single Audit Act, the Office of Management and Budget issues a document referred to as the Compliance Supplement, which identifies important compliance requirements that the federal government expects to be considered as part of such an audit. Beginning in fiscal year 2014, the Compliance Supplement directed auditors to forgo review of eligibility determinations for individuals whose income is calculated based on MAGI. The supplement noted that testing was being performed under Medicaid eligibility review pilots, which would serve as CMS’s oversight during the initial years of PPACA implementation when the MEQC and the eligibility component of PERM were suspended. In June 2019, the Office of Management and Budget issued the 2019 Compliance Supplement that included changes to permit state auditors to test eligibility determinations of both MAGI and MAGI-exempt populations to ensure enrollees qualify for the Medicaid program and are in the appropriate enrollment category. The five selected states in our review considered similar factors when ranking the bases of eligibility to which individuals are assigned—such as bases related to children, pregnant women, or disabled individuals—but the resulting basis of eligibility in which individuals were placed could vary. Each of the five states ranked bases of eligibility by comparing how beneficial they were for enrollees across several key factors, and ordered the bases into a hierarchy starting with the most beneficial, according to officials. The states’ eligibility systems were programmed to apply these hierarchies in deciding each individual’s basis of eligibility; when an individual was potentially eligible for more than one basis of eligibility, the system would assign them to the basis highest in the ranking. The key factors the selected states considered in ranking the bases of eligibility, according to state officials, included (1) whether eligibility was related to the receipt of benefits from other programs, (2) the services provided through the benefit package, and (3) the financial implications for the individual. Eligibility related to other programs. The selected states ranked bases of eligibility associated with enrollment in other federal and state assistance programs at or near the top of their hierarchies. For instance, eligibility associated with receipt of SSI was generally at the top of the states’ hierarchies, and eligibility associated with receipt of federal foster care and adoption assistance benefits was ranked above other bases for which a child might be eligible. Services included in the benefit package. Bases of eligibility that conveyed additional benefits, such as long-term services and supports, were ranked higher. Similarly, bases that offered limited benefits, such as only covering family planning services or assistance with cost-sharing for Medicare beneficiaries (i.e., the Medicare Savings Program) were ranked lower in the selected states’ hierarchies. Financial impact. The selected states ranked bases of eligibility lower if they were associated with additional financial requirements for the individual, such as asset tests as a condition of eligibility, or out- of-pocket costs once enrolled. For example, bases of eligibility that required applicants to make copayments to receive certain services, or to pay a monthly premium, were ranked lower than those without such costs. Although the selected states considered similar factors when deciding an individual’s basis of eligibility for Medicaid, a similarly situated individual could be enrolled under a different basis of eligibility in one state versus another state. Decisions varied across states, in part, because of differences in (1) how states factored in the length of the enrollment period; and (2) the degree to which states’ eligibility systems and processes were integrated. Length of the enrollment period. Officials in selected states considered the length of the enrollment period when deciding bases of eligibility for certain populations, such as pregnant mothers (pregnant women who were also eligible as caretakers of dependent children). Pregnant women who are eligible for Medicaid have continuous eligibility, which guarantees enrollment through at least 60 days postpartum regardless of income changes. For this reason, Oklahoma enrolled pregnant mothers under a basis of eligibility applicable to pregnant women. In contrast, Virginia enrolled pregnant mothers under a basis of eligibility applicable to caretakers, because it has a 12-month enrollment period. However, pregnant women have continuous eligibility through at least 60 days postpartum regardless of income changes or whether they are enrolled as caretakers or on some other basis. As such, if a pregnant woman enrolled as a caretaker no longer met the income standard for a caretaker, for example, she could still remain eligible through her postpartum period. Alternatively, a woman enrolled under a pregnancy-related basis of eligibility would be redetermined for eligibility at the end of her postpartum period and could continue enrollment as a caretaker if she continued to meet the financial and other eligibility criteria. CMS noted that such variations in eligibility policies are allowable and expected among state Medicaid programs. Eligibility system integration. Differences in the degree to which selected states integrated their eligibility systems affected how individuals were assessed for potential bases of eligibility and potentially resulted in different eligibility determinations. Officials in four of our five selected states—New Mexico, Oklahoma, Tennessee, and Virginia—reported operating unified or integrated eligibility systems through which individuals could be considered for both MAGI and MAGI-exempt bases of eligibility. The fifth state, Maryland, had separate eligibility systems for MAGI and MAGI-exempt bases of eligibility, so an individual would need to apply through both systems to have all potential bases of eligibility considered. As such, an individual who is over age 65 and a caretaker of a dependent child would have to submit two separate applications to be assessed for all potential bases of eligibility in Maryland. Depending on the system to which he or she applied, that individual could be enrolled in a less beneficial basis of eligibility or denied eligibility for Medicaid. For example, the individual might be determined ineligible for full Medicaid benefits and enrolled in a Medicare Savings Program, in which Medicaid covers out-of-pocket costs related to Medicare benefits. (See fig. 1.) Our review of 47 state and federal audits across 21 states identified multiple issues affecting the accuracy of states’ Medicaid eligibility determinations. The accuracy issues identified in the audits we reviewed generally fell into nine broad categories, such as eligibility determinations made with incorrect or incomplete income or asset information, unresolved discrepancies between what applicants reported as their income and electronic data sources, and unidentified or unaddressed changes in circumstances, such as changes in household income or size. (See table 2.) Within these nine broad categories, the audits identified several specific accuracy issues, including states that were not conducting income checks for individuals reporting no income; not terminating the enrollment of individuals who had moved out of enrolling individuals who did not provide required information (such as proof of citizenship) on a timely basis; months or years behind schedule in conducting required eligibility not acting on—or not having adequate systems in place to detect— changes in enrollees’ circumstances that could affect eligibility, such as changes in income or household composition. See table 3 for examples of audit findings related to each of the accuracy issue categories, and appendix I for an overview of the key findings for each audit we reviewed. In some cases, the accuracy issues identified by auditors resulted in errors in eligibility determinations, such as instances when applicants were determined eligible even though their incomes were above the applicable limit, or instances in which the state did not enroll eligible individuals. However, in other instances, the accuracy issues identified by auditors did not result in erroneous eligibility determinations. For example, in some cases the audit found that a state determined that an applicant was eligible based on incorrect or incomplete financial information; however, auditors found that the applicant would have still been eligible for Medicaid even after reviewing additional financial information. In other cases, auditors found that eligibility determinations complied with state policies and federal requirements, but that changes in state policies— such as using additional data sources or checking sources more frequently—could provide more information that could be used to improve eligibility determinations. For example, audits in three states found that the quarterly wage data the states used to verify income did not detect certain nonwage income; that income could have been identified had the states chosen to use state or federal tax data as a verification source. Auditors in one of these states (Louisiana) also found that checking income data during individuals’ coverage period, such as on a quarterly basis, could have saved the state tens of millions of dollars in managed care fees for individuals whose incomes exceeded eligibility thresholds during their enrollment period. The selected states we reviewed reported having processes in place that were designed to avoid or address many, but not all, of the accuracy issues identified. The following are examples of the states’ processes related to specific accuracy issues. Incorrect or incomplete income or asset information. All five selected states we reviewed reported checking electronic data sources to verify income, including for individuals who report $0 in income. Officials from some states noted, however, that the electronic sources they have chosen to use do not include all relevant types of income, such as self- employment income. The five states also reported having electronic asset verification systems to verify financial assets, such as bank and retirement accounts for applicants subject to asset limits. One state (New Mexico) reported that it recently implemented an asset verification system that includes information from financial institutions, property ownership records, and vehicle licensing. Eligibility redeterminations not made in a timely manner. To help ensure that redeterminations are made in a timely manner, all five selected states reported conducting automatic redeterminations for at least some MAGI enrollees using electronic data sources to confirm continued eligibility. The proportion of MAGI enrollees whose eligibility was automatically redetermined ranged from about 10 to 80 percent. Officials from Virginia, which was cited by auditors in 2015 as having significant delays in conducting redeterminations, reported that automatic redeterminations have helped improve timeliness. Where automatic eligibility redeterminations are not conducted—such as for enrollees whose incomes could not be confirmed through electronic sources or who are eligible on a MAGI-exempt basis—the five selected states reported having systems in place to generate a redetermination packet or notice to be sent to enrollees prior to the end of their eligibility period. Officials reported that enrollees who do not complete their redetermination would be disenrolled, with states varying in how quickly they would take such action. For example, Oklahoma officials reported that the state automatically terminates enrollment for individuals who do not reply with the required information by the end of their coverage period. In contrast, Virginia officials reported that redeterminations for which no response was provided are kept open, pending eligibility worker action; the state’s systems do not automatically terminate enrollment. Unresolved income discrepancies. Officials in the five selected states reported that their eligibility systems automatically identify income discrepancies. For example, Oklahoma officials indicated that if there is more than a 5 percent difference in the income reported on the application and the income from electronic data sources, their system either alerts eligibility workers or automatically sends a request for additional information to the enrollee. Individuals enrolled in incorrect basis of eligibility. According to state officials, their eligibility systems have automated checks to reassess the eligibility for individuals reaching certain milestones, such as the maximum age for their basis of eligibility (i.e., children reaching adulthood and adults reaching age 65) and pregnant women who are approaching the end of their 60-day postpartum period. For example, to help ensure individuals are correctly assigned to the appropriate basis of eligibility, officials in Maryland noted that they apply system edits that preclude individuals who are pregnant, age 65 or older, or enrolled in Medicare from being incorrectly assigned to the new adult group. Unidentified or unaddressed changes in circumstances. Officials from the five selected states indicated that they generally had systems in place to identify if an enrollee had died or moved out of state. For example, officials from the five selected states reported conducting periodic checks of residency through the Public Assistance Reporting Information System—a federal data source that identifies individuals receiving benefits in other states—and following up with identified enrollees to see if they still reside in the state. None of the selected states conducted regular reviews to identify changes in MAGI enrollees’ incomes during the enrollment period, although one state—Oklahoma— planned to implement interim checks of income in response to a recent change in state law. Oklahoma also reported that it conducted quarterly checks of wage data for MAGI-exempt enrollees. Use of incomplete or incorrect information on household composition. The selected states generally did not have processes in place to detect accuracy issues related to household composition, although officials in four of the five states—Maryland, New Mexico, Oklahoma, and Virginia—noted that eligibility information from other benefit programs may be compared with Medicaid files to detect changes or discrepancies in household membership. In 1983, CMS implemented its statutory requirement to recoup funds associated with Medicaid eligibility-related improper payments for states with an eligibility error rate above 3 percent through its MEQC program. The MEQC program required states to randomly sample Medicaid enrollees to verify eligibility. Claims related to enrollees determined ineligible were tallied and compared with total claims for the sample universe to calculate an error rate. Following federal validation, states were subject to recoupment of all or part of the federal funds expended related to erroneous state payments over the 3 percent error rate threshold. However, in 1992, HHS’s Departmental Appeals Board—the department’s final level of administrative review—concluded that the MEQC error rate was not sufficiently accurate to provide reliable evidence to support recoupment of funds due to the small sample size from which the error rate was calculated. Consequently, the appeals board stated that it was “impossible to conclude with a reasonable certainty that the States failed to meet their target rates….” As a result of this opinion, CMS provided states the option, beginning in 1994, to either continue operating a traditional MEQC program or to conduct what CMS referred to as “MEQC pilots,” which focused on prospective improvements in eligibility determinations, rather than calculation of error rates. Since the “MEQC pilots” did not produce an error rate, CMS could not recoup federal funds expended due to erroneous eligibility determinations for states participating in the pilots. Between 2012, the earliest year for which CMS has maintained records, and 2014 when CMS suspended the MEQC program, 39 states participated in these “MEQC pilots” exempting them from possible recoupment of funds due to eligibility errors. While the other 12 states that continued to operate traditional MEQC programs could still be subject to recoupment of funds, CMS officials reported that no recoupments related to eligibility errors had occurred since the 1992 appeals board ruling, because none of these states had an error rate exceeding the 3 percent threshold. Thus, CMS has not recouped federal funds due to eligibility errors in decades. However, the agency has introduced new procedures through which it can, under certain circumstances, begin to recoup funds based on eligibility errors in fiscal year 2022. Specifically, in July 2017, CMS issued new regulations that included changes to its PERM process to satisfy the statutory requirements for recouping funds that MEQC was previously designed to operationalize. Under the revised PERM rules, CMS calculated an eligibility error improper payment rate beginning with the cohort of states under review for the fiscal year 2019 reporting period. However, it will not recoup funding from states with error rates exceeding the 3 percent threshold until states have a second review under the revised PERM rules, which will occur for the first cohort of states in fiscal year 2022. This allows each state the opportunity to implement improvements based on its initial PERM review and the MEQC review it will conduct in the off-cycle years to reduce the error rate or demonstrate a “good faith effort” to do so. CMS officials recognize the benefits of using state and federal audits, such as audits we reviewed for this report, as part of a broader strategy to improve program integrity and oversee states’ eligibility determination processes. However, CMS officials told us they do not have the authority to recoup federal funds related to eligibility errors identified outside of the PERM process, such as through state single audits. According to CMS officials, this is because of the specific statutory instruction limiting recoupments to instances when eligibility-related errors exceed the 3 percent error rate threshold, and because PERM is the process that CMS uses to calculate that error rate. The President’s fiscal year 2020 budget request included a legislative proposal to expand HHS’s authority to issue disallowances for eligibility errors. Specifically, the proposal requests legislative authority to permit HHS to issue disallowances outside of PERM and allow HHS, including the HHS-OIG, to extrapolate findings on beneficiary eligibility to ensure federal recovery of incorrect eligibility determinations; and eliminate the current 3 percent threshold for states’ eligibility-related improper payments. In place of the current 3 percent disregard, HHS would issue rulemaking specifying criteria for the recoupment of funds, including limiting them to instances of monetary loss, such as cases in which ineligible individuals received benefits. Determining whether individuals are eligible for Medicaid is a complex process that is vulnerable to error. The processes used to measure the extent of eligibility errors have been, and will continue to be, in a state of transition over the next several years as CMS implements its new PERM procedures and states implement improvements after their initial PERM reviews under these new procedures. Because CMS has not had a complete national estimate of improper payments due to eligibility errors since 2014, policymakers and other stakeholders have had an incomplete picture of the extent of eligibility errors in the Medicaid program nationally. This state of flux will make the findings from federal and state audits an even more important source of information on the accuracy of states’ eligibility determinations. As we have previously reported, oversight of the Medicaid program could be further improved through leveraging and coordinating program integrity efforts with state auditors to further improve the integrity of the Medicaid program. We provided a draft of this report to HHS for review and comment. HHS provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Administrator of the CMS, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Table 4 provides a summary of key findings from the 47 federal and state audits that discussed the accuracy of states’ Medicaid eligibility determinations, published from 2014 through 2018, which we identified and reviewed. In addition to the contact named above, Michelle Rosenberg (Assistant Director), Perry Parsons (Analyst-in-Charge), and Heather Tompkins made key contributions to this report. Also contributing were Drew Long, Vikki Porter, and Jenny Rudisill.

Summary: In fiscal year 2018, Medicaid covered approximately 75 million individuals at an estimated cost of $629 billion, $393 billion of which were federal funds. Medicaid eligibility is governed by a network of federal and state laws and regulations. In assessing eligibility for Medicaid, states must determine whether applicants meet eligibility criteria, such as financial and citizenship requirements. The accuracy of eligibility decisions has implications for federal and state spending. The Patient Protection and Affordable Care Act made significant changes to Medicaid eligibility rules beginning in 2014, including new ways of calculating income and new requirements related to electronically verifying applicants' information. Yet, little is known about the accuracy of states' Medicaid eligibility determinations since these changes were implemented. GAO was asked to review Medicaid eligibility determinations. This report describes, among other things, what is known about the accuracy of Medicaid eligibility determinations, and CMS's efforts to recoup funds related to eligibility errors. GAO reviewed 47 state and federal audits of Medicaid eligibility determinations across 21 states published between 2014 and 2018. GAO also reviewed relevant federal laws and regulations, and interviewed CMS officials. The Department of Health and Human Services provided technical comments on a draft of this report, which GAO incorporated as appropriate. States are responsible for determining applicants' eligibility for Medicaid, including verifying eligibility at application, redetermining eligibility, and disenrolling individuals who are no longer eligible. The Centers for Medicare & Medicaid Services (CMS) oversees states' Medicaid eligibility determinations. CMS did not publish an updated national Medicaid eligibility improper payment rate from 2015 through 2018 as states implemented the Patient Protection and Affordable Care Act. CMS released an updated rate in November 2019 that reflected new information on eligibility errors from 17 states. In lieu of complete and updated data, GAO reviewed 47 state and federal audits published between 2014 and 2018 related to 21 states' eligibility determinations. The identified accuracy issues did not always result in erroneous eligibility determinations. For example, some audits found applicants were determined eligible based on incomplete financial information, but when the audits reviewed additional information they found that the applicants still would have been eligible for Medicaid; and eligibility determinations complied with state policies and federal requirements, but noted that changes in state practices—such as using additional data sources to verify applicant information or checking sources more frequently—could improve eligibility determinations. While CMS is generally required to disallow, or recoup, federal funds from states for eligibility-related improper payments if the state's eligibility error rate exceeds 3 percent, it has not done so for decades, because the method it used for calculating eligibility error rates was found to be insufficient for that purpose. To address this, in July 2017, CMS issued revised procedures through which it can recoup funds for eligibility errors, beginning in fiscal year 2022. In addition, the President's fiscal year 2020 budget request includes a legislative proposal to expand the agency's authority to recoup funds related to eligibility errors. During this period of transition, federal and state audits will continue to provide important information about the accuracy of states' eligibility determinations.