Throughout this report, we refer to program integrity activities as those activities designed to prevent fraud, waste, and abuse of government resources. Program integrity activities may encompass a broad range of activities, such as identifying improper payments or improper access to federal programs or benefits. An improper payment is defined by statute as any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. Among other things, it includes payment to an ineligible recipient, payment for an ineligible good or service, and any duplicate payment. In the context of this report, improper access to a federal program or benefit refers to access that should not have occurred under statutory, contractual, administrative, or other legally applicable requirements. Additionally, Standards for Internal Control in the Federal Government states that management should use information that is appropriate, current, complete, accurate, and provided on a timely basis to achieve an entity’s objectives. To do this, management obtains relevant data from reliable internal and external sources in a timely manner based on the identified information requirements, which may vary depending on the program’s objectives. Management uses the quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks, such as the risk of fraud, waste, and abuse. As such, information and communication are a key component of agencies’ internal control over their programs. Commercial data may or may not help agencies meet these information needs. Throughout this report, we refer to commercial data and data service providers. These include private companies and nonprofit entities that gather and maintain data as well as provide a variety of analytical and consulting support to federal agencies as part of their data services. The types of data these entities provide access to may include data from federal government entities, such as death information from the Social Security Administration (SSA); data from state and local government entities, such as real estate and personal property ownership records; and data from commercial entities, such as the name and address of a private business that the data service provider collects, maintains, and updates through its own efforts. Figure 1 shows examples of the types of data that agencies may obtain from data service providers. In addition to aggregating information from multiple data sources and providing access to various databases, commercial data service providers may provide technical and analytical support to federal agencies, such as by developing user-friendly interfaces for agency staff and producing analytical reports that agencies can use to identify potential fraud. As mentioned, agencies may pay for commercial data and data services in different ways, such as through contracts for a set amount or through rates based on usage. Additional background information on each of the five commercial data service providers we selected as part of our nonprobability sample appears later in this report. RELX Group is a public company that provides data services to private sector and government agencies. These data services include those provided through LexisNexis Risk Solutions and the Accuity Asset Verification Solution. LexisNexis Risk Solutions can provide access to public, proprietary, and third-party data—such as data on an individual’s name, current address, and criminal history information—as well as data analytics as part of a data service. The Accuity Asset Verification Solution allows federal agencies to obtain information from the U.S. banking community to verify applicants’ financial assets as part of program eligibility determinations, such as through SSA’s Access to Financial Institutions initiative. Equifax Inc. is a public company that provides data services that include consumer and commercial information as well as workforce information. For example, Equifax provides automated verification of employment and income to both the public and private sectors through its proprietary The Work Number® database. According to Equifax officials, Equifax performed 74 million employment verifications through The Work Number® in 2015. In addition to The Work Number, Equifax provides its eIDVerifier product to the Internal Revenue Service (IRS), which IRS uses to support the authentication of taxpayers in a call center environment as part of its Taxpayer Protection Program. NAPHSIS is a nonprofit membership organization representing the 57 vital records jurisdictions that collect, process, and issue vital records in the United States. Vital records jurisdictions review, edit, process, and officially register births and deaths based on information submitted to them by various parties. The jurisdictions are then responsible for maintaining registries of such vital events and for issuing certified copies of birth and death records. NAPHSIS has worked to promote the adoption of electronic death registration systems and is developing an online tool that federal agencies and others may use to verify birth and death certificate information. Thomson Reuters Corporation is a public company and a multinational media and information firm that sells data services to its customers. Among these data services is the Thomson Reuters CLEAR data product, which allows users to search both public and proprietary records as part of research or investigations. According to representatives from Thomson Reuters, the CLEAR data service is used predominately in the law enforcement and inspector general communities for investigative purposes. D&B is a public company that provides both public and commercial data and data analytics services to its customers. The federal government has contracted with D&B since 1978 to provide Data Universal Numbering System (DUNS) identification numbers for all government contractors. A DUNS number is a unique nine-digit number that is assigned to every business entity in D&B’s global business database, which according to D&B contains more than 240 million records. In addition to the right to use DUNS numbers as a unique identification number, the General Services Administration (GSA) also contracts with D&B to provide business information and related services on all existing and potential government contractors and awardees. This information is linked to the business entity through the DUNS number. The DUNS number and associated business information are owned and controlled by D&B, but licensed to the government to be used for selected federal award management purposes. Officials from SSA, the Department of Labor (DOL), the U.S. Department of Homeland Security (DHS), GSA, and IRS told us that using commercial data services can help their agencies to access proprietary private sector data that are not available from government sources and improve the efficiency of program integrity activities. Commercial bank account information from private financial institutions may not be available from government sources, and this proprietary private sector information may help a federal agency to identify improper payments. For example, as part of SSA’s Access to Financial Institutions initiative, SSA contracts with Accuity to use its Asset Verification Solution to electronically search for account ownership and balances at financial institutions, such as commercial bank accounts where Supplemental Security Income (SSI) program recipients have a direct deposit account. These searches can provide SSA with independent data on a recipient’s financial institution accounts when a new SSI claim is filed or when the agency periodically redetermines program eligibility for some SSI recipients. Similarly, in August 2012 DOL contracted with Accuity for a pilot project that explored how accessing data from commercial financial institutions, which are not available from a government source, could help detect and prevent overpayments in the Unemployment Insurance (UI) program. The pilot project tested whether obtaining financial transaction data—such as deposits that could represent wages from work—through a data match with commercial financial institutions would allow three states to more accurately determine whether UI claimants had returned to work and therefore may no longer have been eligible for UI benefits. The results of this pilot indicated a significant increase in the number of UI claimants detected with unreported income, translating into a more than $80 million increase in the amount of potential improper payments identified during the 15-month period of the pilot project. However, in January 2015, Accuity and its project partner informed DOL that it no longer wished to participate in the project, absent legislation compelling the financial institutions to do so. DOL officials we spoke with during our review indicated that they are currently exploring a new pilot to use wage data from another commercial data service provider to identify improper UI payment stemming from unreported income from work. Additionally, officials from DOL, DHS, and GSA as well as representatives of the commercial data service providers told us that, while some data sets they obtain are available from federal agencies, some federal agencies likely could not provide the level of data service they receive from commercial data service providers without making significant investments in various data service activities. These various data service activities include collecting, maintaining, and verifying data from both public and proprietary sources; providing IT infrastructure; providing data analytics services; and providing user-friendly interfaces and output, among other activities. Consequently, officials from these agencies speculated that relying on these commercial data service providers likely costs their agencies less than if they attempted to provide a similarly extensive data service using only agency resources. Using commercial data may also help realize efficiencies by freeing up agency staff to perform other mission-oriented work. For example, IRS officials told us that using commercial data service providers to provide web and phone-based services to help authenticate certain taxpayers’ identities allowed their staff to focus on other work rather than deal with large volumes of in-person requests for identity authentication. IRS’s Taxpayer Protection Program reviews suspicious returns flagged by IRS’s identity theft filters and requires taxpayers to confirm their identities before IRS issues a refund. To do this, IRS asks authentication questions about personal information that only the taxpayer should know, such as: “Who is your mortgage lender?” or “Which of the following is your previous address?” IRS’s Taxpayer Protection Program database includes data from LexisNexis and Equifax. If the individual’s identity cannot be authenticated, IRS removes the tax return from processing, an action designed to prevent the agency from issuing a fraudulent tax refund. The IRS officials we spoke with indicated that using these web and phone based services likely required fewer IRS resources than authenticating identities in person at an IRS office. Further, the IRS officials we spoke with as part of this review also stated that using commercial data services to provide web and phone-based services to authenticate taxpayers’ identities may reduce the burden on taxpayers who live far from an IRS office or are otherwise unable to visit an office in person. Factors agencies may consider in determining whether data from nongovernmental data services meet their information requirements for conducting program integrity activities include the accuracy of data; the currency and timeliness of data; the completeness of data; and technical aspects of using the data for these purposes, according to officials we spoke with. As mentioned, our work was based on a nonprobability sample of agencies and nongovernmental entities, and the information and perspectives that we obtained are not generalizable to other federal agencies and data service providers. Officials from DOL, SSA, and DHS told us that these federal agencies consider the accuracy of data and related laws and policies when determining whether commercial data meet their information requirements for conducting program integrity activities. For example, DOL officials noted that individuals who are legitimately eligible for federal programs could be unfairly denied program benefits if agencies rely on inaccurate data to make a determination about their eligibility for a program. SSA officials stated that using less accurate data in making eligibility and payment determinations could also place undue burdens on applicants and payment recipients and increase the agency’s appeals workload, which could create inefficiencies in the agency’s program integrity efforts. At the same time, representatives of some commercial data service providers we spoke with stated that they work continuously to ensure the accuracy of their data, but also acknowledged that it is unreasonable to expect all data to be perfectly accurate. As part of our review, OMB staff described provisions of the Computer Matching and Privacy Protection Act of 1988 (“Computer Matching Act”) designed to mitigate the risk of agencies using inaccurate data in conducting program integrity activities. Specifically, OMB staff noted that the Computer Matching Act generally requires that agencies independently verify information produced through data matching and provides due process rights to individuals whose benefits may be affected by the data obtained through computer matching activities. OMB staff emphasized that agencies must consider relevant provisions of the Computer Matching Act when using commercial data to conduct program integrity activities. Additionally, DHS and DOL officials cited agency policies designed to ensure that officials verify data obtained from commercial data sources before making final program determinations. For example, officials from DHS’s United States Citizenship and Immigration Services provided us with a document of their standard operating procedure that requires officers investigating immigration benefit fraud—such as fraud committed to obtain a visa—to provide adjudicators with original source documents rather than summarizing information contained in commercial databases. These DHS officials stated that they use information from commercial data sources such as LexisNexis and Thomson Reuters CLEAR as “leads” to original or primary sources rather than as the basis for making final program determinations. Similarly, DOL officials told us that they issued an advisory to the state workforce agencies that administer UI payments citing the need to independently verify information received through various analytic techniques before suspending, terminating, reducing, or making a final denial of UI benefits. Officials from DHS, DOL, and SSA told us these federal agencies consider how the currency and timeliness of data obtained through commercial data services meet their information requirements for conducting program integrity activities. For example, DHS officials told us that outdated information, such as a name or address that may have been previously, but not currently, associated with an individual, could hinder the efficiency of tracking down that individual. Similarly, representatives from some commercial data service providers we spoke with described the need for data to be up-to-date, such as by continually updating information on whether entities are still in business or have changed addresses. These representatives described steps they take to do so, such as by electronically and manually verifying information in their databases on a regular basis. Moreover, the timeliness of data can be an important factor in identifying and preventing improper payments. For example, DOL officials told us that state UI agencies could likely improve their ability to identify and prevent improper UI payments to claimants who return to work by obtaining wage data from Equifax’s Work Number system, which are generally more recent than quarterly wage data that UI agencies receive from employers. Specifically, the officials noted that state UI agencies currently rely on wage data from employers that are usually reported on a quarterly basis, while Equifax’s Work Number data can be obtained on a “real time” basis corresponding to the weekly, biweekly, or monthly pay period of the employer. Because a significant proportion of overpayments in the UI program occur because individuals return to work without notifying the state workforce agency that administers those benefits, obtaining these data may be an opportunity for UI agencies to improve their efforts to reduce UI improper payments, according to DOL officials. In April 2016, DOL officials told us that the agency is currently working with three states and Equifax to conduct a pilot project to examine the use of Equifax’s Work Number data to identify improper payments to UI recipients with disqualifying income from work. The DOL officials expect the pilot project to last for up to 4 months. Similarly, a provision of the Social Security Benefit Protection and Opportunity Enhancement Act of 2015, which goes into effect in November 2016, authorizes SSA to enter into data exchanges with payroll providers, such as Equifax’s Work Number system, to help prevent improper Disability Insurance and SSI payments to individuals with relevant work and income by helping SSA access timely information on wages and income. SSA’s preliminary cost estimates, which were prepared before the enactment of the legislation, suggest that the agency would realize savings by accessing and using wage data from commercial databases. However, the SSA officials we spoke with also stated that because the agency’s savings estimates were completed prior to actual implementation planning and before the Social Security Benefit Protection and Opportunity Enhancement Act became law, they expect the estimates to change as the agency implements provisions of the Act. Officials from SSA told us that they also consider the completeness of data from various governmental and commercial sources when determining whether data meet their information requirements for conducting program integrity activities. For example, death data can help agencies to prevent improper payments to deceased individuals, but the completeness of death data varies depending on the source. For example, SSA receives death reports from multiple sources, including state vital records agencies, family members, and other federal agencies in order to administer its programs. During our review, SSA officials told us that obtaining death data helps them to prevent around $50 million in improper payments each month. In accordance with the Social Security Act, SSA shares its full set of death data with certain agencies that pay federally funded benefits, for the purpose of ensuring the accuracy of those payments. For other users of SSA’s death data, including commercial data service providers, SSA extracts a subset of records into a file called the Death Master File (DMF), which, to comply with federal law, excludes state-reported death data. Agencies and commercial data service providers can purchase a DMF subscription through the Department of Commerce’s National Technical Information Service, which reimburses SSA for the cost of providing the file. However, the death information included in the publicly available DMF is less complete than the death information contained in SSA’s full death file because the publicly available DMF does not include state-reported death information. Further, during our review, SSA officials said they expect the percentage of state-reported deaths as a proportion of all of SSA’s death records to increase, which over time will lead to a smaller portion of all of SSA’s death records being included on the DMF. In that scenario, federal, state, or local agencies that use death data from the DMF will receive increasingly less complete and therefore less useful information than agencies that use death data from SSA’s full death file. While SSA has a role collecting and distributing death records as described above, SSA officials told us that the most important step in ensuring the quality and completeness of their death records would be for all vital records agencies to use electronic death registration systems. According to SSA officials, electronic death registration systems automate the death reporting process and allow vital records agencies to verify the name and Social Security Number of a deceased individual before they issue the death certificate or transmit a report of death to SSA. As of November 2015, 46 of 57 vital records agencies have implemented electronic death registration systems, according to NAPHSIS. NAPHSIS and SSA officials told us that they are continuing efforts to expand electronic death record reporting, and NAPHSIS officials cited the need for additional funding to facilitate the adoption and use of electronic data registration systems by all 57 jurisdictions. Additionally, NAPHSIS is developing an online tool that may provide agencies the ability to access death information maintained by vital statistics agencies, which could provide federal agencies access to a more complete set of death records than SSA’s full death file. However, at the time of this report, this tool is in a preliminary testing phase, and no federal agencies currently access the system. Officials from IRS, SSA, and GSA told us that federal agencies also consider technical aspects of commercial data services when determining whether commercial data meet their information requirements for conducting program integrity activities, such as restrictions on batch versus manual data processing. For example, IRS officials told us that large-scale, batch processing can be more efficient than manual, case- by-case processing, which would be unfeasible for analyses involving large populations or large amounts of data from various sources. The IRS officials noted that the agency determined that some potential data service providers could not meet their requirements because the potential providers’ processing capability was limited to manual or case-by-case processing. Similarly, SSA officials stated that data providers may place restrictions on whether agencies can access and process data on a manual, case-by-case basis or in batches, and these restrictions can affect the efficiency of their program integrity activities. For example, SSA officials noted that batch processing could save operational and administrative resources compared to case-by-case or manual database searches for its SSI program. The SSA officials stated that their current process involves staff requesting data on a single case basis, reviewing the response, and transcribing information into the agency’s case processing system. According to SSA officials, batch processes would afford technicians more time to focus on other critical agency workloads. Additionally, SSA officials stated that routine batch processes would potentially allow the agency to detect unreported income and resources before an improper payment is made, which could save administrative resources on the back end related to processing improper payments. Commercial data service providers may also place restrictions on how agencies can use data. For example, D&B’s DUNS—a proprietary, unique identifier for businesses—helps the federal government track entities across various data systems, but D&B has placed restrictions on how GSA can use the data. During our review, officials from GSA noted that using D&B’s proprietary DUNS number allowed the federal government to track contracts, grants, awards, and other business with that entity across various agencies and data systems, which can help identify “bad actors” that are barred from holding federal contracts. However, due to the proprietary nature of DUNS numbers, D&B has placed restrictions on how GSA can use them. These restrictions limit the purposes for which the government can use the data and hampers the ability to switch to a new numbering system. The federal government is currently exploring alternatives to the DUNS, but GSA officials noted that the costs of switching to a new unique numbering system across all government information systems were unknown. Representatives of one data service provider told us that their customers may also consider issues related to the infrastructure needed to conduct large-scale, data-intensive program integrity activities when determining whether commercial data meet its information requirements. Specifically, NAPHSIS representatives stated that, at the conclusion of their current testing phase, NAPHSIS may need to expand its infrastructure to accommodate increased data traffic for its online tool that federal agencies and others may use to verify death information. The NAPHSIS officials we spoke with stated that they were partnering with LexisNexis Risk Solutions on this project, which required significant investments from both parties. According to NAPHSIS officials, NAPHSIS is also in the process of upgrading software and hardware at some vital statistics agencies to support its online tool. As mentioned, this tool is in a preliminary testing phase and no federal agencies currently access the system. Additionally, agency officials may consider the design of software associated with a data service when determining whether commercial data meet their information requirements for conducting program integrity activities, as illustrated by an example from prior GAO work. In June 2015, we reported that we examined practice location addresses of providers and suppliers listed in Centers for Medicare & Medicaid Services (CMS) data and found that an estimated 23,400 (22 percent) of 105,234 were potentially ineligible. Potentially ineligible addresses include those that are associated with a certain type of a Commercial Mail Receiving Agency (CMRA) or vacant or invalid addresses. To do this, we used a software package that provides more detailed information on provider practice location addresses than that used by CMS. To help improve the Medicare provider and supplier enrollment-screening procedures, we recommended in June 2015 that that the Acting Administrator of CMS modify the CMS software integrated into CMS data to include specific flags to help identify potentially questionable practice location addresses, such as CMRA, vacant, and invalid addresses. In its comments on the June 2015 report, the Department of Health and Human Services (HHS) agreed with our recommendation and noted plans to configure the provider and supplier address-verification system in CMS data to flag CMRAs, vacancies, invalid addresses, and other potentially questionable practice locations. Because HHS has not yet initiated specific actions to implement our recommendations, it is too early for us to determine whether the actions the agency outlined in its official comments on a draft of that report would fully address the intent of the recommendations. However, if effectively implemented, the actions could prevent ineligible providers from enrolling into the Medicare program and obtaining Medicare funds, thus potentially reducing the amount of improper payments. We plan to continue to monitor the agency’s efforts in this area. We are not making recommendations in this report. We provided a draft of this report to OMB, GSA, DOL, IRS, SSA, DHS, and Fiscal Service for review and comment. OMB provided comments, which are reproduced in appendix I, that describe ongoing efforts to use data analytics for federal program integrity efforts. GSA and DOL provided technical comments, which we incorporated as appropriate. IRS, SSA, DHS, and Fiscal Service had no comments on this report. We are sending copies of this report to the Commissioner of the Bureau of the Fiscal Service, the Administrator of GSA, the Secretary of Homeland Security, the Commissioner of Internal Revenue, the Secretary of Labor, the Director of OMB, the Commissioner of Social Security, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6722 or larink@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above Jennifer Cook, Marcus Corbin, Gabrielle Fagan (Assistant Director), Colin Fallon, Michele Fejfar, Barbara Lewis, Maria McMullen, James Murphy, Jonathon Oldmixon, and Anna Maria Ortiz made key contributions to this report.

Summary: Federal agencies may use commercial data services in conducting program integrity activities designed to identify fraud and improper payments, which pose a significant risk to the integrity of federal programs. For example, federal agencies may obtain commercial data—subject to applicable laws and protections—that identifies individuals' deaths, income and assets, or other information that may help the agency determine whether individuals or entities are eligible for a government program or benefit. GAO was asked to review issues surrounding the use of commercial data in conducting program integrity activities. This report identifies and describes the views of selected agency officials and commercial data service providers regarding (1) reasons selected agencies have used commercial data services in conducting program integrity activities; and (2) factors agencies may consider in determining whether commercial data services meet their information requirements for conducting program integrity activities. To do this, GAO reviewed documents and conducted interviews with federal agency officials and representatives of commercial data service providers selected as part of a nonprobability sample of 12 entities selected to represent a range of program integrity activities and commercial data services. The information and perspectives that GAO obtained are not generalizable to other agencies and providers. GAO is making no recommendations in this report, which incorporates various technical comments from the agencies. Officials from selected federal agencies told GAO that using commercial data services can help their agencies improve the efficiency of program integrity activities. For example, Internal Revenue Service (IRS) officials told GAO that using commercial data service providers to provide web and phone-based services to help authenticate certain taxpayer's identities likely allowed their staff to focus on other work rather than deal with large volumes of in-person requests for identity authentication. Commercial data services can also provide federal agencies access to private sector data, such as bank deposit information, that is not available from federal government sources. This financial information may help agencies to determine whether individuals have income from work or assets that indicate they are not eligible for certain programs, such as disability programs. Applicable laws generally require that agencies independently verify instances of matching data identified by computer matching programs before taking action and provide minimum notice to affected individuals. The figure below shows examples of the types of data that agencies may obtain from data service providers. Federal agencies may consider various factors in determining whether data from commercial data services meet their information requirements for conducting program integrity activities. These factors include the accuracy of data; the currency and timeliness of data; the completeness of data; and technical aspects of using the data for these purposes, according to officials from agencies in GAO's nonprobability sample. For example, Department of Labor (DOL) officials told GAO that state Unemployment Insurance (UI) agencies could likely improve their ability to identify and prevent improper UI payments to claimants who return to work by obtaining commercially available wage data from a data service provider that are generally more recent than quarterly wage data that UI agencies receive directly from employers. DOL officials also told GAO that the agency is currently working with three states and a provider to conduct a pilot project to examine the use of the provider's payroll data to identify improper payments to UI recipients with disqualifying income from work. DOL expects the pilot to last up to 4 months.