Under PPACA, health-insurance marketplaces were intended to provide a single point of access for individuals to enroll in participating private health plans, apply for income-based subsidies to offset the cost of these plans, and, as applicable, obtain an eligibility determination or assessment of eligibility for other health-coverage programs, such as Medicaid or the Children’s Health Insurance Program. To be eligible to enroll in a “qualified health plan” offered through a marketplace—that is, one providing essential health benefits and meeting other requirements under PPACA—an individual must be a U.S. citizen or national, or otherwise lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). To be eligible for Medicaid, individuals must meet federal requirements regarding residency, U.S. citizenship or immigration status, and income limits, as well as any additional state-specific criteria that may apply. Under the Medicaid expansion, states may choose to provide Medicaid coverage to nonelderly adults who meet income limits and other criteria. Under PPACA, the federal government is to fully reimburse states through fiscal year 2016 for the Medicaid expenditures of “newly eligible” individuals who gained Medicaid eligibility through the expansion. According to the CMS Office of the Actuary, federal expenditures for the Medicaid expansion are estimated at $430 billion from 2014 through 2023. PPACA requires marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant’s Social Security number, if one is provided; verifying citizenship, status as a U.S. national, or lawful presence by comparison with Social Security Administration (SSA) or Department of Homeland Security records; and verifying household income by comparison with tax-return data from the Internal Revenue Service (IRS), data on Social Security benefits from SSA, and other available current income sources. In particular, PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another method approved by HHS. To implement this verification process, CMS developed the data services hub (data hub), which acts as a portal for exchanging information between the federal Marketplace, state-based marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other federal agencies. The Marketplace uses the data hub in an attempt to verify that applicant information necessary to support an eligibility determination is consistent with external data sources. For qualifying applicants, the act provides two possible forms of subsidies for consumers enrolling in individual health plans, both of which are generally paid directly to insurers on consumers’ behalf. One is a federal income-tax credit, which enrollees may elect to receive in advance, and which reduces a consumer’s monthly premium payment. When taken in advance, this benefit is known as the advance premium tax credit (APTC). The other, known as cost-sharing reduction (CSR), is a discount that lowers the amount consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. Under PPACA, an applicant’s filing of a federal income-tax return, including a required additional form, is a significant eligibility requirement for continued receipt of federal subsidies. When applicants apply for coverage, they report family size and the amount of projected income. On the basis, in part, of that information, the Marketplace will calculate the maximum allowable amount of APTC. An applicant can then decide whether he or she wants all, some, or none of the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment. If an applicant chooses to have all or some of his or her credit paid in advance, the applicant is required to “reconcile” on his or her federal income-tax return the amount of advance payments the government sent to the applicant’s insurer on the applicant’s behalf with the tax credit for which the applicant qualifies based on actual reported income and family size. Reconciliation is accomplished using IRS Form 8692, Premium Tax Credit (PTC). To receive advance payment of the tax credit at time of application, applicants must attest they will file a tax return for the year for which they receive APTC. CMS announced that, beginning with the open- enrollment period for 2016 coverage, APTC and CSR subsidies will be discontinued for 2016 coverage for enrollees who received APTC in 2014, but did not comply with the requirement to file a federal income-tax return and reconcile receipt of their APTC subsidy. Under PPACA’s application process, “inconsistencies” are generated when individual applicant information does not match information from federal data sources—either because information an applicant provided does not match information contained in data sources that a marketplace uses for eligibility verification at the time of application, or because such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved. Under the marketplace process, applicants will be asked to provide additional information or documentation for the marketplaces to review to resolve the inconsistency. Our undercover testing for the 2016 coverage year found that the eligibility determination and enrollment processes of the federal and state marketplaces we reviewed remain vulnerable to fraud, as we previously reported for the 2014 and 2015 coverage years. For each of our 15 fictitious applications, the marketplaces approved coverage, including for 6 fictitious applicants who had previously obtained subsidized coverage but did not file the required federal income-tax returns. Although IRS provides information to marketplaces on whether health-care applicants have filed required returns, the federal Marketplace and our selected state marketplace allowed applicants to instead attest that they had filed returns, saying the IRS information was not sufficiently current. The marketplaces we reviewed also relaxed documentation standards or extended deadlines for filing required documentation. After initial approval, all but one of our fictitious enrollees maintained subsidized coverage, even though we sent fictitious documents, or no documents, to resolve application inconsistencies. Marketplace officials told us that without specific identities of our fictitious applicants—which we declined to provide, to protect the identities—they could not comment on individual outcomes. In general, however, they told us our results indicate their marketplace processes worked as designed. For each of our 15 fictitious applications, the federal or state-based marketplaces approved coverage at time of application—specifically, 14 applications for qualified health plans, and 1 application for Medicaid. Each of the 14 applications for qualified health plans was also approved for APTC subsidies. These subsidies totaled about $5,000 on a monthly basis, or about $60,000 annually. These 14 qualified-health-plan applications also each obtained CSR subsidies, putting the applicants in a position to further benefit if they used medical services. However, our successful applicants did not seek medical services. These subsidies are not paid directly to enrolled consumers; instead, the federal government pays them to health-plan issuers on consumers’ behalf. For the first time in our three rounds of undercover application testing since the 2014 coverage year, we successfully cleared an online identity- checking step for one fictitious applicant. Known as “identity proofing,” the process uses personal and financial history on file with a credit-reporting agency. The marketplace generates questions that only the applicant is believed likely to know. According to CMS, the purpose of identity proofing is to prevent someone from creating an account and applying for health coverage based on someone else’s identity and without the other person’s knowledge. Although intended to counter such identity theft involving others, identity proofing also serves as an enrollment control for those applying online. For our 2014 and 2015 undercover testing, we failed to clear identity proofing in each online application we made. In this latest round of testing, we cleared identity proofing in one online application by successfully answering the identity questions presented: (1) name the county for the applicant address provided, (2) identify the high school from which the applicant graduated, and (3) identify the last four digits of a cellular phone number. Although our applicant’s identity was fictitious, the eligibility system may still have been able to generate questions based on a “likely” match, CMS officials told us. For our state marketplace applications, in four of five cases, marketplace representatives were unable to verify our applicants’ identities and, as a result, suggested that we visit enrollment counselors to present identification in person. As a representative said to one of our applicants, “I can’t look at your picture ID” and, “I have to be able to confirm that you are who you say you are … in case you were an impostor calling us.” We avoided such in-person visits, however, by filing paper applications (which under PPACA must be an option available to applicants). In such cases, an applicant signature is provided under penalty of perjury and threat of civil or criminal penalty. In our paper applications, we provided signatures for our fictitious identities and filed the forms. In another of the state marketplace cases, we were able to complete the application over the phone, without being asked identity-proofing questions. Our federal Marketplace applicants received no similar instructions on visiting enrollment counselors or submitting paper applications. For the 14 qualified-health-plan applications, we attempted to pay the required premiums to put policies into force, as we did in both of our previous rounds of testing. For 11 applicants, we successfully made premium payments. However, for three applicants, our initial premium payments—made to insurers we selected—were unsuccessful, and we were unable to resolve the issue. While we believed we had received confirmation of premium payments, insurers said payments were not received on a timely basis. As a result, our coverage was not put into effect in these three cases. At that point, because these cases had experienced different treatment than our other applications and no longer matched our original testing profile, we elected to discontinue them from further testing. Thus, the remainder of our discussion centers on the 12 cases for which we did not encounter payment issues—11 applications for qualified health plans, and 1 for Medicaid. As discussed in following sections, we divided the remaining 12 cases into those involving reconciliation of APTC subsidies and those involving other issues. Figure 1 shows a breakdown of our applications, from the original group of 15 down to the division into the tax-filing and other-issue groups. CMS announced that beginning with the open-enrollment period for 2016 coverage, APTC and CSR subsidies would be discontinued for 2016 coverage for enrollees who received APTC in 2014 but did not comply with the requirement to file a 2014 federal income-tax return and reconcile APTC received. Figure 2 illustrates how the reconciliation process is designed to work, and how failing to reconcile is to affect the ability to retain subsidized coverage. As discussed later, IRS tax-return processing time, and taxpayer-requested extension of the filing deadline, can affect the timeliness of tax-filing data that IRS reports to marketplaces. Because reconciliation is a key requirement for receipt of subsidies, and CMS announced that loss of subsidy would be enforced for the first time in 2016, we focused a number of our undercover applicant scenarios on this process. At the outset of our testing, we made 6 of our 15 applications using identities from our 2014 testing, when we obtained subsidized coverage for them. After the payment-processing issue noted earlier, four of these six identities remained in active testing. In addition to obtaining coverage, each of the four remaining fictitious applicants was also approved for APTC subsidies. For these four applicants, these subsidies totaled about $1,100 on a monthly basis, or about $13,000 annually. They also obtained CSR subsidies. Figure 3 summarizes results by scenario. In two of the four cases, Marketplace representatives asked our applicants if they had filed the requisite income-tax return, to which they replied falsely that they had done so. For one of these applicants, a federal Marketplace representative initially told us that we were not approved for subsidies, for tax-related reasons. However, when we provided the representative with verbal assurances that we had filed the necessary tax return, the representative dropped the matter, and we were approved for subsidized coverage. In May 2016, we received a Marketplace notice stating that if we do not file a 2014 tax return and reconcile APTC, our subsidies would end. As of August 2016, our subsidized coverage remained in force. In the two other of the four cases, our fictitious state marketplace applicants were not asked whether they received APTC subsidies in 2014 or whether they filed income-tax returns. As noted earlier, for our state marketplace applicants, we filed some applications by paper form. The state marketplace’s paper application form, however, did not ask whether we had filed a 2014 tax return, or otherwise require us to demonstrate that we had filed the return. To support the tax-reconciliation requirement, IRS began reporting to federal and state-based marketplaces, in response to 2016 queries made to the data hub, cases in which an applicant or a member of the applicant’s tax household received APTC subsidies for 2014 but had not filed a 2014 income-tax return. IRS reports subsidy-recipient tax-return filing status based on information received from marketplaces on who received APTC subsidies. It matches the marketplace-provided information against records of who has filed tax returns, to identify those reported as receiving subsidies but who did not file a return. As shown in table 1, about one-quarter of 2014 APTC—totaling about $4 billion— had not been reconciled as of December 2015, according to summary information provided by IRS. As table 1 indicates, the largest category for unreconciled APTC, both in number of filers and value of APTC, is those who filed tax returns, but did not, as part of their filing, complete the necessary form for reconciliation. Although IRS reports to marketplaces whether an applicant has filed a tax return, it does not make eligibility determinations for APTC on applications for coverage. Instead, it passes the filing information to marketplaces, which then make the determinations. As IRS officials noted to us, reporting that an applicant has not filed a required tax return ends IRS’s role. In the case of the federal Marketplace, CMS generally elected not to rely on the IRS data identifying 2014 subsidy recipients who failed to file income-tax returns when making federal Marketplace eligibility determinations for 2016. Instead, if IRS reported that applicants had not filed a tax return, CMS chose to offer applicants the opportunity to attest they had made the proper tax filing, to be followed by CMS postapproval checks of IRS data. CMS officials told us they chose to allow applicant attestations of tax filing, rather than rely solely on IRS failure-to-file data, for two reasons: Time lag between when tax returns are filed and when filings are reflected in information IRS provides to marketplaces. This is due to: normal IRS processing time; additional time required to update tax- return-filing status in information provided to marketplaces; and because taxpayers can request a tax-filing deadline extension, to October 15, beyond the normal filing date of April 15. IRS officials told us that assuming a return is complete, normal processing time is typically 3 to 12 weeks. They also confirmed that the IRS status updates, which occur monthly, can add additional time. Enrollees receiving the APTC subsidy had not previously been required to reconcile the credit as part of their taxes and were unfamiliar with the reconciliation process. CMS officials told us that in May 2016, seeking to check individuals who received APTC after attesting to filing a 2014 tax return, the agency began a postapplication approval process for tax-filing verification. Under this process, the officials said, the federal Marketplace would first check IRS tax-filing-requirement data for applicants who attested on their applications that they had filed a tax return; next, would notify remaining APTC recipients who have not filed of the obligation to do so; and then would conduct a final IRS check of tax-filing status for those who had received warning notices. After that, nonfilers will lose APTC and income- based CSR subsidies. According to the officials, this process will be complete, with subsidies terminated, by October 2016. If such a determination is made to end subsidies, on the schedule CMS identified, those losing financial assistance for failure to file may have received subsidized coverage for January to September, or 9 months of the 2016 coverage year, according to CMS officials. IRS officials said subsidy recipients would still be responsible for reconciling APTC provided. As noted, that could increase or decrease tax liability depending on the individual situation. According to CMS officials, the tax-filing recheck process—done following applicant attestations on tax-filing earlier—began in May 2016, 4 months after the close of 2016 open enrollment. The CMS officials told us this timing was chiefly because the federal Marketplace did not have the system capability earlier to both first determine on a large-scale basis whether applicants had made required tax filings, and then also to subsequently end subsidies for those who had not done so. The process of both comprehensively checking tax-return-filing status and also taking action against those not making the required filings is a difficult, complex task, CMS officials told us, due to coordination required with IRS and restrictions on disclosure of protected federal taxpayer information. Although building a system to do so has been a priority, they said, competing priorities, coupled with complexity of building a new system, meant system capability to remove APTC on a large-scale basis following a recheck process would not be available until August or September 2016 at the earliest. CMS officials said that among enrollees in Marketplace coverage with APTC subsidies who had attested to filing a 2014 tax return, there were about 19,000 applications for which IRS indicated no 2014 return had been processed at the start of the recheck process in May 2016. CMS officials said they do not have information on the value of APTC and CSR subsidies associated with this coverage. Although the recheck process began 4 months after the end of 2016 open enrollment, the Marketplace hopes to begin the tax-filing check-and-termination process earlier for the upcoming 2017 coverage year, because the system will already be in place, the officials said. But a timetable has not been set, they said. For our 2016 fictitious applicants, because they did not file a tax return and reconcile APTC subsidies they received, IRS could have reported the failure to file in response to marketplace queries if the applicant had a valid Social Security number, CMS officials told us. Since the federal Marketplace process allowed applicant attestation instead, that is likely what accounted for our fictitious applicants successfully gaining coverage despite not having filed tax returns, according to the officials. IRS officials told us they expressed concerns to CMS about CMS’s attestation approach. Allowing applicants to attest to tax filing, without making some validation attempt at the time of application, raises the possibility that improper APTC payments would be made, in the case that it is determined later that an applicant in fact did not make the required filing. The issue arises because the APTC is paid before reconciliation status is ultimately known, the officials told us. From IRS’s perspective, if someone has not reconciled, the person has not met the obligation necessary to continue to receive APTC, they said. IRS officials said they have had ongoing discussions with CMS about this issue, but noted that CMS has the decision-making authority in the matter. In the case of the state marketplace we tested, Covered California similarly opted for applicant attestation rather than relying on IRS tax-filing data, marketplace officials told us. State officials told us that for 2016 enrollment, the marketplace added an attestation form to its online application system for those who had received subsidized coverage for 2014 and were renewing their coverage. In November 2015, the marketplace conducted an outreach campaign, sending notices to consumers who were reported by IRS as not having filed, warning that they were at risk of losing subsidies if they did not file tax returns. Covered California followed up with a reminder notice in January 2016, the officials said. Then, in May 2016, the marketplace rechecked IRS tax- filing data, officials told us, for those reported by IRS as not having filed, plus those who had not attested earlier that they had filed tax returns. On the basis of that check, the marketplace then ended subsidized coverage for those still showing as not having filed, officials told us. Covered California also allowed an opportunity to regain subsidized coverage, however. The state marketplace sent a notice of loss of subsidy, explaining that the change was based on failure to file. But the marketplace also told those losing subsidized coverage that if they believed the determination was wrong, they could attest to having filed. If consumers made that attestation, subsidized coverage would be restored, officials told us. Thus, a consumer could have attested (at renewal, when submitting a new application, or while reporting a change) that he or she had filed, or would file; next, have had subsidized coverage end when IRS data did not support the attestation; but then have the subsidized coverage reestablished through another attestation. The reason for this ultimate reliance on attestation is that officials were “very mindful” that IRS data being reported to marketplaces may not be current. While relying on attestation, the marketplace does not have information on the extent to which people who attested to filing have actually done so, the officials said. The officials also could not provide information on the number of applications where the IRS non-filing code was received, but the marketplace relied on attestation. As of May 2016, among 14,000 consumers that had not attested, 5,000 lost APTC during the redetermination process, Covered California officials told us. After subsidized coverage is restored following a postcutoff attestation, there are no further checks of IRS data for the coverage year, officials told us. This practice is because they deemed a new round of checks for the 2017 coverage year, beginning in about October 2016, as an opportune time to make the next check. However, the officials said the October check would not distinguish between failure to file for the first year subject to the reconciliation requirement—2014—or instead for the second year for which the requirement was in effect, 2015. Nevertheless, if a consumer has the IRS nonfiling code at that time, her or she will not be renewed with a subsidy, the officials said. In general, Covered California only takes action on the most recent tax-filing status code returned from the data hub, the officials said, which currently does not distinguish between years. In our California work we also identified that the state marketplace used a paper application that did not include a tax-filing query, which means that applicants filing by paper would not have to attest to tax-filing status. As a result, two of our fictitious applicants that submitted paper applications were not asked whether they filed taxes (as noted in fig. 3). Covered California officials confirmed the form has been in use since the first PPACA open-enrollment period began in 2013. The state marketplace is seeking to revise its paper application, with CMS to review the changes, Covered California officials told us. The state marketplace has limited ability to know whether applicants received subsidies in prior years, the Covered California officials told us, and thus are subject to the reconciliation requirement. Those who obtained previous coverage through Covered California can readily be identified, they said. But the state marketplace generally does not receive information on whether its applicants have ever had previous coverage elsewhere. An exception is for applicants flagged by IRS for failure to file. For non–Covered California enrollees, that flag indicates previous coverage elsewhere, the officials said. Otherwise, the state marketplace has no way to determine such previous coverage. At the outset of our testing, we made 9 of our 15 applications using new fictitious identities to test scenarios similar to those tested in our previous undercover testing—citizenship / lawful presence, Social Security identity, and duplicate enrollment in more than one state. After the payment- processing issue noted earlier, eight of these nine applications remained in active testing—seven for qualified-health-plan coverage and one for Medicaid. For all seven of the qualified-health-plan coverage cases that remained active, our fictitious applicants were approved for coverage with APTC and CSR subsidies. However, as discussed later, one fictitious applicant did not maintain subsidized coverage. For these seven successful applicants, we obtained APTC subsidies totaling about $2,700 on a monthly basis, or about $33,000 annually. In the eighth case, our applicant was approved for Medicaid coverage. Figure 4 summarizes our testing results by scenario. As previously noted, citizenship/lawful presence is an explicit eligibility criterion under PPACA. In the case of Social Security identity, the information our applicants submitted did not match information on file with SSA. In the case of duplicate enrollment, we used a single identity to apply for coverage in each of the three states—a situation consistent with identity theft. CMS officials told us that for the federal Marketplace there generally appeared to be reasons to explain the outcomes our fictitious applicants experienced. For example, in the case of the applicant who passed online identity proofing (described earlier), the eligibility system may still have been able to generate identity-proofing security questions even if our applicant’s identity was fictitious, the officials told us. This could be possible through use of probable or likely matching criteria, rather than exact matching of the phony applicant information, officials explained. That is, the system that seeks to identify a person and then generate corresponding security questions may have made a match based on some applicant information, rather than on a one-for-one match with information the applicant provided. The federal Marketplace uses a risk- based system for applicant identification, CMS officials told us, based on the preponderance of data available, as opposed to a single identity element. Because there is no universal source for applicant information, the risk-based approach is best, they said. Meanwhile, the identity- proofing process used in online applications is not used in the telephone application process, the officials said. This is due in part to resource limits, CMS officials told us, but is chiefly attributable to a policy decision that call center representatives not have access to applicants’ credit histories, in order to protect personally identifiable information. Likewise, according to CMS officials, some of our applicants’ treatment could likely be explained by an extension of document-submission deadlines granted by the Marketplace. CMS regulations authorize the Marketplace to extend the standard 90-day inconsistency resolution period if the applicant demonstrates a good-faith effort to obtain the required documentation during the period. In 2014, the Marketplace had statutory authority to extend for any reason the period to resolve inconsistencies unrelated to citizenship or lawful presence, as well as the good-faith-effort regulatory authority to extend the submission period for resolving any type of inconsistency. Using its authority, the Marketplace effectively waived document-submission requirements for many applicants. For 2015 and 2016, however, the statutory authority had expired, and the Marketplace took a different approach in implementing its good-faith-effort regulatory authority. CMS told us as part of our 2014 testing work that use of the good-faith-effort authority would be limited to a case-by-case basis after 2014. Under good-faith-effort extensions for 2016, documentation requirements are not waived, but applicants are provided additional time to submit documents, CMS officials said. According to CMS officials, a good-faith-effort extension can be triggered for these reasons: 1. An applicant has not received standard reminder notices warning of an unresolved inconsistency and the deadline for submitting documentation. In such cases, a 90-day extension is provided. 2. The Marketplace has not called the applicant to warn that he or she needs to submit documents by the deadline. A 30-day extension is provided. 3. The consumer requests an extension. A 60-day extension is provided. Each extension based on these factors is onetime only, the CMS officials told us. Other than granting these extensions, the Marketplace did not apply good-faith-effort authority in any other way for 2016 enrollment, officials told us. CMS also did not otherwise waive, amend, or extend verification or eligibility controls in 2016, officials told us. We asked CMS officials for details on the number of applications that benefited from good-faith-effort extensions for 2016, including the reason for granting the extensions and types of inconsistencies at issue, and as of August 2016 officials had yet to respond. In the case of duplicate enrollments, our fictitious applicant was first approved for subsidized coverage in the California marketplace and then—using the same identity—applied and was approved for a qualified health plan in Virginia and for Medicaid in West Virginia. When our applicant made the Medicaid application, a federal Marketplace representative flagged the applicant as potentially fraudulent. Nonetheless, the applicant was told that he was eligible for coverage. CMS officials told us they consider it highly unlikely, and thus low risk, that individuals would apply for multiple plans for themselves, given the cost of paying premiums on more than one plan. But they also acknowledged they are interested in the possibility that multiple enrollments could represent identity theft, and said they are working on approaches to identify such situations. As CMS has reported to us previously, officials during this review also said the agency is unaware of any fraud in individual consumer applications for federal Marketplace coverage. Apart from individual- consumer-level fraud, instances have occurred in which agents or brokers have submitted applications for people without their knowledge, for financial gain, such as if the agent/broker is working for an organization and is paid on commission based on the number of people enrolled, CMS officials told us. The officials said some consumers have reported to the agency that they have been enrolled without their knowledge. CMS officials declined to provide other details, saying work in this area is law- enforcement sensitive. In responding to consumer complaints, CMS has recently developed a capability for service-center representatives to direct complaint information to a program-integrity office for investigation into waste, fraud, or abuse, CMS officials told us. They likewise said further details were unavailable. Overall, according to CMS officials, the federal Marketplace has made a number of improvements to the eligibility and enrollment process, as well as the process for resolving application inconsistencies. In particular, CMS officials said the agency has focused on providing applicants with specific details of what documentation is required, and that notices sent to consumers have been improved. As a result, more consumers are sending proper documentation with appropriate information in response to Marketplace requests, and applicant inconsistencies are down. As an illustration of improvements in document filing, CMS officials cited a 40 percent increase in the number of documents consumers have submitted to resolve inconsistencies. According to CMS officials, the Marketplace has also relaxed the income- inconsistency resolution-threshold standard beginning with applications for 2016 coverage. Under this change, the acceptable variance for applicants submitting documentation to resolve income inconsistences has increased, and the inconsistency can be resolved if the new income information meets one of two standards. First, there can now be up to a 25 percent difference, up from 20 percent, between what an applicant initially reported in income and the amount submitted later when providing income documentation to resolve an income inconsistency, for that inconsistency to be officially resolved. Or second, he or she can resolve the inconsistency if the income difference is within $6,000. CMS officials said the federal Marketplace made the change in recognition that many applicants experience variations in earnings, making it hard to project income. They said that for lower-income households a small difference in income, measured in dollars, can result in a large percentage change. In the case of our Medicaid application, as noted, we applied through the federal Marketplace and were told our applicant may be eligible for Medicaid and that the West Virginia state Medicaid agency would contact us with a final determination. When we later called the West Virginia state Medicaid agency, we were told our applicant was approved for Medicaid. When we shared the results of our testing with West Virginia Medicaid officials, they told us that without a specific identity for our fictitious applicant, they could not comment authoritatively on the outcome. However, the officials said that because our applicant was not directed to produce any documentation, it is likely that the federal Marketplace did not pass along any application inconsistencies, assuming the application was processed properly. As noted, for this fictitious applicant a federal Marketplace representative said the case would be flagged as a “fraud issue,” because applicant identifying information was already present in the Marketplace system. However, West Virginia officials said the Marketplace does not pass along to the state any information suggesting fraud. The West Virginia officials told us that this experience illustrates why the federal Marketplace should make a greater effort to verify identity before sending Medicaid applicant information to the state. West Virginia is a “determination state,” meaning it delegates eligibility determinations to the federal Marketplace. That underscores the importance of the federal Marketplace making accurate determinations, the officials said. The officials told us West Virginia’s experience with Medicaid applicant data from the federal Marketplace has been that for 2014, the first coverage year for the program, data quality was not good overall. For example, the state would receive applicant information showing income exceeding Medicaid limits; or, the state would not receive Medicaid application information that should have passed from the federal Marketplace to the state. But since the first year, data quality has improved significantly, the officials said, although quality issues such as blank data fields or incorrect Social Security numbers remain. Data quality is important because if applicant information cannot be verified electronically, a Medicaid case worker must review it manually, the officials said. Had our West Virginia Medicaid applicant been directed to send documentation, a case worker would have examined it with the level of scrutiny applied varying according to the particular situation, the officials told us. Although Covered California officials also told us that without specific identities they could not comment on individual outcomes, in general they said the results of our undercover testing indicate their marketplace processes worked as designed. For example, they said, when our applicants could not clear online identity proofing and contacted Covered California representatives by phone, the representatives were correct in first seeking to direct the applicants to visit enrollment counselors, so they could verify identities in person. While in-person presentation of identity documentation is never required, the officials said, an in-person visit provides an opportunity to examine identity documents. When our applicants indicated they would have difficulty in doing so, the representatives were also correct in offering the opportunity to file a paper application, the officials said. Likewise, applicants were treated correctly in being granted eligibility with the directive to provide supporting documentation. The state officials noted that under PPACA the marketplace is required to accept paper applications. While our applicants could not establish their identity through the standard online process, the officials said, they could file a paper application in which the signature on the paper application is done under penalty of perjury. The same paper process is available for those originally applying by telephone, they said. Obtaining an eligibility determination then becomes possible—an option precluded by failure to confirm an identity in the online process, the officials said. The state marketplace does not have any information on the extent to which the threat of a penalty for perjury actually compels applicants to provide truthful answers. Like the federal Marketplace, Covered California made use of a good- faith-effort extension policy for applicant documentation. According to state officials, consumers must affirmatively request such an extension by contacting the state marketplace. They can be granted a maximum of 60 additional days to file required documentation, beyond the 90-day period initially provided. According to the officials, there has been a low volume of such requests—about 10 percent to 15 percent of consumers required to submit documentation to retain coverage. Covered California officials also told us they have eased documentation requirements in several other ways: Income: Covered California is not taking steps to resolve income inconsistencies. Even though it requested applicants to submit income documentation, it is not taking action in cases in which they do not. The reason is a policy decision that the issue of whether amount of subsidies received was proper will be addressed through the tax reconciliation process. The marketplace provides consumers with multiple notices, alerting them to possible tax consequences of income inconsistencies, officials said. In addition, Covered California decided to give higher priority to other inconsistencies that can lead to termination of coverage, such as citizenship / lawful presence, rather than adjustment of subsidies, they said. We note that under PPACA, even if reconciliation is made, the amount of excess APTC that can be recovered can be limited, based on household income and tax-filing status. CSR subsidies, however, are not subject to reconciliation. Minimum essential coverage: The marketplace is not taking action to verify applicants’ claims that they do not have access to “minimum essential coverage” and hence can apply for subsidized coverage through the marketplace. While important, such cases account for a very low percentage of all applications, the officials said. Incarceration: Rather than rely on documentation, the marketplace accepts applicant attestation on incarceration status. Under PPACA, those who are incarcerated are not eligible for coverage, unless they are incarcerated awaiting disposition of charges. The officials said they did not have information on the number of such attestations provided. Otherwise, Covered California officials told us the state marketplace has made a number of improvements. In May 2016, it implemented a system check to guard against use of impossible Social Security numbers; we used such numbers in our 2015 undercover testing, which included California. The marketplace is more consistently reminding people when documents are due and warning of loss of coverage if the material is not provided, they said. Consumer notices overall are more readable, following work with focus groups, according to the officials, and efforts are under way to address cases in which applicant-supplied Social Security numbers cannot be verified through the data hub. Such applicants, too, are being warned about loss of subsidy or coverage. On the issue of identity theft and duplicate enrollment, Covered California officials said that while it can check the state marketplace’s own records it would be helpful if CMS could supply data on those obtaining plans through the federal Marketplace. That way the state marketplace could check those obtaining coverage against coverage obtained elsewhere. We retained subsidized coverage for 10 of the 11 qualified-health-plan applicants through August 2016, even though supporting documentation we submitted was fictitious, and in some cases we submitted none or only some of the documentation we were directed to send. As noted, we focused our testing on 12 fictitious applicants. For all 11 of our applicants approved for qualified-health-plan coverage with subsidies, we were directed to provide supporting documentation. Our applicant approved for Medicaid received no direction to provide supporting documentation. In response to the marketplace directives to the 11 subsidized qualified- health-plan applicants, we provided follow-up documentation, albeit fictitious. Overall, we varied what we submitted by application— providing all, none, or only some of the material we were told to send—to test controls and note any differences in outcomes. Among the 11 applications for which we were directed to send documentation, we submitted all requested documentation for five applications, partial documentation for three applications, and no documentation for the remaining three applications. Figure 5 summarizes document submissions and outcomes for the 11 qualified-health-plan applicants, plus the Medicaid application for which, as noted, we were not directed to send documentation. In two of the cases, in which we provided only partial documentation, our applicants were nevertheless able to clear inconsistencies through conversations with marketplace phone representatives. For example, in one case we called the federal Marketplace to discuss notices received about application inconsistencies. A representative told our applicant that the applicant needed to submit documentation on citizenship status and Social Security number. However, our applicant told the representative that the applicant had a name change, and provided the former name. The representative appeared to enter this information into the Marketplace system before saying the documentation issues had been cleared, and no other information was required. The information our applicant provided over the phone, however, did not match documentation our applicant had filed previously. Without a specific identity, CMS officials could not say conclusively what happened with our application. Generally, however, they told us that under certain circumstances, such as an applicant providing new information, a previously recorded inconsistency may become inactive. In one of the 11 qualified-health-plan cases, as shown in figure 5, our fictitious applicant’s coverage was terminated after the document- submission period, after we failed—by design—to provide any documentation to clear an inconsistency, in this case regarding immigration status. We also noted other issues with marketplace-requested documentation: In one case involving Social Security identity, one of our applicants was directed to supply proof of a valid Social Security number at the time of initial eligibility determination. A subsequent Marketplace notice in early 2016, however, omitted that directive. We believe this could be confusing to an applicant. Further, to the extent it might cause an applicant to not submit necessary documentation, the discrepancy could lead to loss of coverage. CMS officials told us that the Marketplace initially requests a Social Security number, because having a Social Security number can help to clear other inconsistencies. The Marketplace does not, however, make it a practice to resolve Social Security inconsistencies alone. In another of our applications involving Social Security identity, a Marketplace representative noted a discrepancy with our applicant’s Social Security number, and inquired about the possibility of identity theft. Based on our applicant’s assurances, however, the representative cleared the discrepancy and made no request for the applicant’s Social Security card. In some cases, our applicants presented identical information, but marketplace handling of their applications was different. For example, in each of two federal Marketplace applicant scenarios, we claimed to be lawfully present and with income at a level qualifying for a subsidy. In each case, we were directed to provide proof of immigration status and income, and in both cases, we did not provide any documentation. In one case we lost coverage, while in the other we retained it. As noted, we elected not to continue testing with three scenarios after encountering premium-payment issues. Even though our coverage was canceled in these cases, we continued to receive marketplace notices directing us to provide supporting documentation or risk losing coverage. Such a situation could cause consumer confusion. CMS officials told us this practice is by design, because if consumers reapply later, they would still need to resolve inconsistencies previously identified. As noted in the case of our one successful Medicaid application, we were not directed to submit any supporting documentation. In discussing these outcomes for our fictitious applicants, federal and state marketplace officials reaffirmed, as we have reported previously, that the marketplaces do not seek to identify fraudulent document submissions. Federal Marketplace officials said document-review standards—in which CMS’s documents-processing contractor is not required to examine documents for fraud—remain unchanged. Unless documents show signs of being visibly altered, they are accepted as authentic. Covered California officials likewise told us marketplace service-center representatives do not authenticate documents. As with the federal Marketplace, the standard for review is visible alteration and whether a document presented appears as it should be; that is, for example, that a permanent-resident card submitted conforms to established design of such a card. If documents do look suspicious, they can be referred to a consumer-protection office for investigation, the officials said. Thus far, the office has not received any such referrals, they said. In addition, as noted earlier, federal officials cited good-faith-effort extensions as possibly contributing to our outcomes. California officials said the state marketplace does not take action in cases when applicants fail to submit requested income documentation, thereby leaving income inconsistencies unresolved, which could account for our results. For overall handling of inconsistency resolution, we asked CMS about the number of unresolved inconsistencies and the value of associated APTC and CSR subsidies. As of August 2016, the agency had yet to respond. Covered California officials provided some information on the state marketplace’s experience with inconsistency resolution. Since January 1, 2016, the marketplace eliminated APTC for failure to resolve citizenship / lawful-presence inconsistencies in 10,043 cases; and likewise for 875 cases with unresolved incarceration inconsistencies. Covered California did not have information on value of subsidies for these groups. As of June 2016, Covered California’s largest categories of unresolved inconsistencies were income (190,693 cases), Social Security number (9,247 cases), and citizenship / lawful presence (7,717 cases). Values of associated subsidies were likewise unavailable, officials told us. We provided a draft of this report to HHS, IRS, Covered California, and the West Virginia state Medicaid agency for their review and comment. HHS, IRS, and Covered California provided technical comments, which we incorporated as appropriate. HHS provided us with written comments, which are reprinted in appendix II. Covered California’s comments, along with our responses, are reprinted in appendix III. The West Virginia Medicaid agency did not provide comments. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Health and Human Services, the Acting Administrator of CMS, the Commissioner of Internal Revenue, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The objective of this report is to describe, by means of undercover testing and related work, potential vulnerabilities to fraud in the application, enrollment, and eligibility-verification controls of the federal Health Insurance Marketplace (Marketplace) and a selected state marketplace, for the third open-enrollment period under the Patient Protection and Affordable Care Act, for 2016 coverage. Our testing covered both individual health-care plans and Medicaid, with a portion focusing on a requirement that applicants who previously received advance payment of tax credits to subsidize their monthly premium payments must file federal income-tax returns and account for those credits, in order to continue receiving subsidies in future years. To perform our undercover testing of the application, enrollment, and eligibility-verification process for the 2016 open enrollment season— which ran from November 1, 2015, to January 31, 2016—we used fictitious identities for the purpose of making 15 applications. Specifically, we made 14 applications for individual plans, and 1 application for Medicaid. In these 15 applicant scenarios, we chose to test controls for verifications related to the following: 1. Whether applicants had made required income-tax filings. We made six such fictitious applications. For qualifying applicants, the act provides two possible forms of subsidies for consumers enrolling in individual health plans, both of which are generally paid directly to insurers on consumers’ behalf. One is a federal income-tax credit, which enrollees may elect to receive in advance, which reduces a consumer’s monthly premium payment. This is known as the advance premium tax credit. If an applicant chooses to have all or some of his or her credit paid in advance, the applicant is required to “reconcile” on his or her federal income-tax return the amount of advance payments the government sent to the applicant’s insurer on the applicant’s behalf with the tax credit for which the applicant qualifies based on actual reported income and family size. Our group of six fictitious applicants tested this reconciliation requirement. 2. The identity or citizenship/immigration status of the applicant, or whether the applicant had sought enrollment in multiple plans. We made nine such fictitious applications. In general, our testing approach allowed us to test similar scenarios across different states. We made 10 of our applications online initially, and 5 by phone. In some cases, we filed paper applications, as is permissible, after speaking with marketplace representatives. We set our applicants’ income levels at amounts eligible for subsidies provided under the act, or to meet Medicaid eligibility requirements, as appropriate. Because the federal government, at the time of our review, operated a marketplace on behalf of the state in about three-quarters of the states, we focused our work on those states. Specifically, we selected two states—Virginia and West Virginia—that elected to use the federal Marketplace rather than operate a marketplace of their own. We selected one additional state—California—that operates its own marketplace. The results obtained using our limited number of fictional applicants are illustrative and represent our experience with applications in the three states we selected. The results cannot, however, be generalized to the overall population of applicants or enrollees. For all 15 fictitious applications, we used publicly available information to construct our scenarios. We also used publicly available hardware, software, and materials to produce counterfeit or fictitious documents, which we submitted as appropriate for our testing. In responding to marketplace directives to submit documentation, we adopted an approach of submitting all requested documentation in some cases, partial documentation in other cases, or no documentation in the remaining cases, in order to note any differences in outcomes. We observed any approvals received, and responded as appropriate for our testing to any directions to provide additional supporting documentation. Fourteen of our 15 applicant scenarios involved qualified individual health plans. For these 14 plans, we attempted to pay the required premiums to put policies into force. For 11 of these 14 applicants, we successfully made premium payments. However, for three applicants, our initial premium payments—made to insurers we selected—were unsuccessful, and we were unable to resolve the issue. While we believed we had received confirmation of premium payments, insurers said payments were not received on a timely basis. As a result, our coverage was not put into effect in these three cases. At that point, because these cases had experienced different treatment than our other applications and no longer matched our original testing profile, we elected to discontinue them from further testing. To protect our undercover identities, we did not provide the marketplaces with specific applicant identity information. Centers for Medicare and Medicaid Services (CMS) and state officials generally told us that without such information they could not fully research handling of our applicants. We also reviewed statutes, regulations, and other policy and related information. Overall, our review covered the act’s third open-enrollment period, for 2016 coverage, as well as follow-on work after close of the open-enrollment period. After conducting our undercover testing, we briefed officials from CMS, the Internal Revenue Service, the California marketplace, and the West Virginia state Medicaid agency on our results and sought their views on the outcomes. We conducted this performance audit from November 2015 to September 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We conducted our related investigative work in accordance with investigative standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. 1. For the two California applications that were submitted to test income- tax filing and reconciliation requirements, we did provide a valid Social Security number. This means that our applicants could have been flagged by the Internal Revenue Service for failure to file tax returns. As Covered California noted, if the Social Security number is invalid or is not provided, the Internal Revenue Service does not return a failure-to-file code to the marketplace. In addition to the contact named above, Philip Reiff, Gary Bianchi, and Helina Wong, Assistant Directors; Evelyn Calderón; Paul Desaulniers; Ranya Elias; Robert Graves; Olivia Lopez; Maria McMullen; James Murphy; George Ogilvie; Ramon Rodriguez; Christopher H. Schmitt; Julie Spetz; and Elizabeth Wood made key contributions to this report.

Summary: PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans. States may operate their own health-care marketplace or rely on the federal Health Insurance Marketplace (Marketplace). The Congressional Budget Office estimates subsidies and related spending under PPACA at $56 billion for fiscal year 2017. GAO was asked to review marketplace enrollment and verification controls for the act's third open-enrollment period ending in January 2016.This report provides results of GAO undercover testing of potential vulnerabilities to fraud in the application, enrollment, and eligibility-verification of the federal Marketplace and one selected state marketplace. GAO submitted 15 fictitious applications for subsidized coverage through the federal Marketplace in Virginia and West Virginia and through the state marketplace in California. GAO's applications tested verifications related to (1) applicants' making required income-tax filings, and (2) applicants' identity or citizenship/immigration status. The results, while illustrative, cannot be generalized to the full population of enrollees. GAO discussed results with CMS, IRS, and state officials. Written comments from HHS and California are included in the report. GAO currently has eight recommendations to CMS to strengthen its oversight of the federal Marketplace (see GAO-16-29 ). CMS concurred with the recommendations and implementation is pending. The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies. Verification steps include validating the applicant's Social Security number, if one is provided; citizenship or immigration status; and household income. PPACA requires the marketplaces to grant eligibility while identified inconsistencies between the information provided by the applicant and by government sources are being resolved. The 2016 coverage year was the first year in which a key eligibility requirement—verification of whether applicants who previously received one type of federal subsidy under the act filed federal tax returns, as a requirement to retain that benefit—went into effect. As previously reported for the 2014 and 2015 coverage years, GAO's undercover testing for the 2016 coverage year found that the health-care marketplaces' eligibility determination and enrollment processes remain vulnerable to fraud. The marketplaces initially approved coverage and subsidies for GAO's 15 fictitious applications. However, three applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications. For four applications, to obtain 2016 subsidized coverage, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. Although none of the fictitious applicants filed a 2014 tax return, all were approved for 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is a time lag between when tax returns are filed and when they are reflected in IRS's systems. CMS officials said they are rechecking 2014 tax-filing status. For eight applications, GAO used new fictitious identities to test verifications related to identity or citizenship/immigration status and, in each case, successfully obtained subsidized coverage. When marketplaces directed 11 of the 12 applicants to provide supporting documents, GAO submitted fictitious documents as follows: For five applications, GAO provided all documentation requested and the applicants were able to retain coverage. For three applications, GAO provided only partial documentation and the applicants were able to retain coverage. Two of these applicants were able to clear inconsistencies through conversations with marketplace phone representatives even though the information provided over the phone did not match the fictitious documentation that GAO previously provided. For three applications, GAO did not provide any of the requested documents, and the marketplaces terminated coverage for one applicant but did not terminate coverage for the other two applicants. According to officials from the Department of Health and Human Services' (HHS) Centers for Medicaid & Medicare Services (CMS), some of GAO's application outcomes could be explained by decisions to extend document filing deadlines.