Medicaid was established in 1965 by Title XIX of the Social Security Act as a joint federal–state program to finance health care for certain low- income, aged, or disabled individuals. Medicaid is an entitlement program, under which the federal government pays its share of expenditures for any necessary, covered service for eligible individuals under each state’s federally approved Medicaid plan, as described below. States pay qualified health-care providers for covered services provided to eligible beneficiaries and then seek reimbursement for the federal share of those payments. Title XIX of the Social Security Act allows flexibility in the states’ Medicaid plans. Although the federal government establishes broad federal requirements for the Medicaid program, states can elect to cover a range of optional populations and benefits. Guidelines established by federal statutes, regulations, and policies allow each state some flexibility to (1) broaden eligibility standards; (2) determine the type, amount, duration, and scope of services; (3) set the rate of payment for services; and (4) administer its own program, including processing and monitoring of medical claims and payment of claims. Differences in program design can lead to differences in state programs’ vulnerabilities to improper payments and state approaches to protecting the program. States are required to submit plans to CMS to outline their plans to verify Medicaid eligibility factors, including income, residency, age, Social Security numbers (SSN), citizenship, and household composition. With more than 50 distinct state- based programs that are partially federally financed, overseeing Medicaid is a complex challenge for CMS and states. In order to participate in Medicaid, federal law requires states to cover certain population groups (mandatory-eligibility groups) and gives the states the flexibility to cover other population groups (optional-eligibility groups). States set individual eligibility criteria within federal minimum standards. There are other nonfinancial eligibility criteria that are used in determining Medicaid eligibility. In order to be eligible for Medicaid, individuals need to satisfy federal and state requirements regarding residency, immigration status, and documentation of U.S. citizenship. Beginning in October 2013, states were required to use available electronic data sources to confirm information included on the application, while minimizing the amount of paper documentation that consumers need to provide. As of March 25, 2011, federal regulations require that certain ordering and referring physicians or other professionals providing services under the state plan or under a waiver of the plan must be enrolled as participating providers, which includes screening the providers upon initial enrollment and when follow-up verification occurs (at least every 5 years). The follow-up verification is referred to as revalidation or reenrollment. As part of the enrollment process, and depending on the provider’s risk level, states may be required to collect certain information about the providers’ ownership interests and criminal background, search exclusion and debarment lists, and take action to exclude those providers who appear on those lists. When state officials discover potentially fraudulent activity in the enrollment process, states must refer that activity or providers to law-enforcement entities for investigation and possible prosecution. In May 2014 we reported that states have historically provided Medicaid benefits using a fee-for-service system, in which health-care providers are paid for each service. However, according to CMS, in the past 15 years, states have more frequently implemented a managed-care delivery system for Medicaid benefits. In a managed-care delivery system, beneficiaries obtain some portion of their Medicaid services from an organization under contract with the state, and payments to MCOs are typically made on a predetermined, per person, per month basis. Currently, two-thirds of Medicaid beneficiaries receive some of their services from MCOs, and many states are expanding their use of managed care to additional geographic areas and Medicaid populations.According to HHS, approximately 27 percent, or $74.7 billion, of nationwide federal Medicaid expenditures in fiscal year 2011 (the fiscal year our review focused on) were attributable to Medicaid managed care. States oversee MCOs that provide care to Medicaid beneficiaries through contracts and reporting requirements, which may include identifying improper payments to providers within their plans. Pub. L. No. 109-171, § 6034, 120 Stat. 4, 74 (2006) (codified at 42 U.S.C. § 1396u-6). In September 2014, the Center for Program Integrity was reorganized to integrate the Medicare and Medicaid program-integrity functions across the Center for Program Integrity, so that all Center for Program Integrity units are focused on both programs. To achieve Medicare–Medicaid integration, the Medicaid Integrity Group was also reorganized and integrated with Medicare staff so that the Medicaid Integrity Group no longer exists as a separate identifiable unit. states through the Medicaid Integrity Institute in April 2014. HHS OIG oversees Medicaid program integrity through its audits, investigations, and program evaluations. It is also responsible for enforcing certain civil and administrative health-care fraud laws. States have primary responsibility for reducing, identifying, and recovering improper payments. Of the approximately 9.2 million beneficiaries in the four states that we examined, thousands of cases from the fiscal year 2011 data analyzed showed indications of potentially improper payments, including fraud, to Medicaid beneficiaries and providers. The numbers on beneficiaries and providers may not reflect the total incidence of potentially improper payments, including fraud, because it was not possible to fully investigate claims that did not have a valid SSN. For example, we were unable to match beneficiaries and providers without valid SSNs to the full DMF, making it difficult to fully investigate such cases for other indicators of improper payments or fraud. In addition to beneficiaries, we found hundreds of Medicaid providers who were potentially improperly receiving Medicaid payments. As described below, these cases show indications of certain types of fraud or improper benefits. Providers with suspended or revoked medical licenses. All physicians applying to participate in state Medicaid programs must hold a current, active license in each state in which they practice. During enrollment, states are required to screen out-of-state licenses to confirm the license has not expired and that there are no current limitations on the license. Additionally, states are required to provide CMS with information and access to certain information respecting sanctions taken against health-care practitioners and providers by their own licensing authorities. Using data from the Federation of State Medical Boards (FSMB), we found that approximately 90 medical providers in the four selected states had their medical licenses revoked or suspended in the state in which they received payment from Medicaid during fiscal year 2011. Medicaid approved the associated claims of these cases at a cost of at least $2.8 million. Invalid addresses for providers. A drop-box or mailbox scheme is a common fraud scheme in which a fraud perpetrator will set up a medical-oriented business and will use a CMRA as his or her official address. The four states we examined for our review required providers to provide the physical service location of their business when they apply to provide Medicaid services. Our analysis matching Medicaid data to USPS address-management tool data found that at least 220 providers may have inappropriately used a virtual address as their physical service location. Specifically, these providers used a CMRA address as their physical service location. For these providers, Medicaid approved claims of at least $318,000. Additionally, our analysis found nearly 26,600 providers with addresses that did not match any USPS records. These unknown addresses may have errors due to inaccurate data entry or differences in the ages of MMIS and USPS address-management tool data, making it difficult to determine whether these cases involve fraud through data matching alone. Our analysis also identified 47 providers with foreign addresses as their location of business. These providers had addresses in Canada, China, India, and Saudi Arabia. Our analysis found that 8 of the 47 providers with foreign addresses had been paid over $90,000 in Medicaid claims during fiscal year 2011. In December 2010, CMS released guidance on implementing the Patient Protection and Affordable Care Act (PPACA) provisions prohibiting payments to institutions or entities located outside of the United States. CMS’s guidance went into effect on June 1, 2011. Approximately 28 percent of the claims we identified occurred after CMS’s guidance went into effect. Deceased providers. We identified over 50 deceased providers in the four states we examined whose identities received Medicaid payments. Our analysis matching Medicaid eligibility and claims data to SSA’s full DMF found these individuals were deceased before the Medicaid service was provided. The Medicaid benefits involved with these deceased providers totaled at least $240,000 for fiscal year 2011. These benefits are an indication of improper or potentially fraudulent payments. Excluded providers. We found that about 50 providers in the four states we examined had been excluded from federal health-care programs, including Medicaid; these providers were excluded from these programs when they billed for Medicaid services during fiscal year 2011. The selected states paid the claims at a cost of about $60,000. The federal government can exclude health-care providers from participating in the Medicaid program for several reasons. Excluded providers can be placed on one or both of the following exclusion lists, which state Medicaid officials must check no less frequently than monthly: the List of Excluded Individuals and Entities (LEIE), managed by HHS, and the System for Award Management (SAM), managed by GSA. The LEIE provides information on health- care providers that are excluded from participation in Medicare, Medicaid, and other federal health-care programs because of criminal convictions related to Medicare or state health programs or other major problems related to health care (e.g., patient abuse or neglect). SAM provides information on individuals or entities that are excluded from participating in any other federal procurement or nonprocurement activity. Federal agencies can place individuals or entities on SAM for a variety of reasons, including fraud, theft, bribery, and tax evasion. On the basis of our matching of state prison data to Medicaid claims data, we found that 16 providers in the selected states were incarcerated in state prisons at some point in fiscal year 2011. The offenses that led to incarceration included drug possession, drug trafficking, money laundering, racketeering, and murder. We did not identify any Medicaid claims associated with these providers while they were incarcerated. Through regulation, CMS has taken steps since 2011 to make the Medicaid enrollment-verification process more data-driven. The steps may address many of the improper-payment indicators that were found in our 2011 analysis of Medicaid claims; specifically, CMS took regulatory action to enhance beneficiary-screening procedures in 2013 and provider- screening procedures in 2011. However, gaps in guidance and data sharing continue to exist, and additional opportunities for improvements are available for screening beneficiaries and providers. In response to PPACA, which was enacted in 2010, CMS issued federal regulations in 2013 to establish a more-rigorous approach to verify financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. Specifically, under these regulations, states are required to use electronic data maintained by the federal government to the extent that such information may be useful in verifying eligibility. CMS created a tool called the Data Services Hub (hub) that was implemented in fiscal year 2014 to help verify beneficiary applicant information used to determine eligibility for enrollment in qualified health plans and insurance- affordability programs, including Medicaid. The hub routes to and verifies application information in various external data sources, such as SSA and the Department of Homeland Security. According to CMS, the hub can verify key application information, including household income and size, citizenship, state residency, incarceration status, and immigration status. If properly implemented by CMS, the hub can help mitigate some of the potential improper-payment issues that we identified earlier in our analysis of fiscal year 2011 Medicaid claims including state residencies, deceased beneficiaries, and incarcerated beneficiaries. Figure 1 shows beneficiary enrollment procedures that states are required to follow beginning in October 2013. Under CMS’s regulations, when states receive an application they are to use the hub to verify an individual’s eligibility. available in the hub, or if there is missing information on the application, the state must use other data sources to determine an individual’s eligibility.all available electronic data resources before contacting an applicant directly. Under 42 C.F.R. § 435.945(k), subject to approval by the Secretary, states may request and use information from alternate sources, provided that such alternative source or mechanism will reduce the administrative costs and burdens on individuals and states while maximizing accuracy, minimizing delay, meeting applicable requirements relating to the confidentiality, disclosure, maintenance, or use of information, and promoting coordination with other insurance-affordability programs. The data used for our study are from fiscal year 2011, approximately 3 years prior to implementation of the CMS hub requirement. Medicaid services to individuals are to cease once a beneficiary dies. Under CMS regulations, states are to screen beneficiaries through the hub, which includes a check using the full DMF to determine whether they are deceased, at the time of initial enrollment as well as on at least an annual basis thereafter. Hence, the extent to which the hub identifies deceased individuals in Medicaid is generally limited to about once every year. To supplement the death verification check from the hub, states may use other electronic resources they have available, such as state vital records, to identify deceased beneficiaries. While officials at the four states we examined said that they periodically check the state vital records to determine whether a potential Medicaid beneficiary has died, the four states did not use the more-comprehensive full DMF to perform this check outside of the initial enrollment or annual revalidation period. As discussed earlier, and highlighted in table 1, we used the full DMF to identify approximately 200 incidents of potential fraud in these four states in fiscal year 2011. Without using information from the full DMF, states can generally only detect deaths within the state’s borders and not prevent or detect benefit payments made for individuals who had their deaths recorded in other states’ vital records. Additionally, we previously reported the full DMF contained approximately 40 percent more records than the public DMF for deaths reported in 2012 alone. Moreover, in March 2015, we reported that while verifying eligibility using SSA’s death data can be an effective tool to help prevent improper payments to deceased individuals or those that use their identities, agencies may not be obtaining accurate data because of weaknesses in how these data are received and managed by SSA. According to CMS officials, many state Medicaid agencies have long- standing policies of using data matches against both SSA and state vital statistics to identify deceased individuals. SSA has made the full DMF available through the hub for the states’ annual redetermination and also has agreements in place to provide death indicators based on the full DMF to states. In commenting on the draft of this report, SSA officials stated that the agency also provides the full DMF to CMS. Thus, states should be able to access this death information directly from CMS, according to SSA. While the federal regulation requires states to check the hub for such items as citizenship and incarceration, CMS officials noted that the federal regulation does not specify how deceased individuals should be identified nor has CMS explored the feasibility of states using the full DMF in the periodic screening for deceased individuals, outside of the initial enrollment or the annual revalidation period. As a result, states may not be able to detect individuals who have moved to and died in other states and prevent payment of potentially fraudulent benefits. PPACA authorized CMS to implement several actions to strengthen provider-enrollment screening. CMS and HHS OIG issued a final rule in February 2011, effective March 2011, to implement many of the new screening procedures. This final rule, if properly implemented, will address some of the issues that we found in our analysis of fiscal year 2011 data, such as screening of excluded providers. As shown in figure 2, to enroll in Medicaid directly with the state, providers must apply to the state Medicaid office. While PPACA requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures. As part of the February 2011 regulation, CMS determined that states must continue to verify providers and suppliers using various data sources, such as the full DMF, National Plan and Provider Enumeration System, LEIE, and SAM. According to CMS’s risk-based screening, moderate- and high-risk providers and suppliers additionally must undergo unscheduled or unannounced site visits, while high-risk providers and suppliers also will be subject to fingerprint-based criminal- background checks. This requirement may address some of the potentially fraudulent or improper payments highlighted in table 2, including approximately 200 providers with a CMRA or foreign address. Additionally, the regulations require the state Medicaid agency to revalidate providers at least every 5 years. Because the regulation was effective in March 2011, the states are required to complete revalidation for Medicaid providers in their states by March 2016. We found that the states in our review had different methods for identifying deceased providers. Specifically, according to officials in one state we examined, Arizona, the state uses the public DMF to periodically screen providers. Michigan uses a private-company dataset in monitoring providers for, among other things, deaths; however, the dataset used is not the full DMF but the public DMF, which excludes state-reported death data. New Jersey officials stated that they use a different source of death data—an Internet genealogy website—to check for deceased providers during the application process. According to the genealogy website, it includes deaths from SSA through 2011 and contains updated obituaries from newspapers. In addition, according to HHS, providers must hold a valid professional license before enrolling in Medicaid. CMS regulations require states to verify licenses in states in which the provider is enrolling and in each of the other states in which the provider purports to be licensed, as well. Two states we examined, Arizona and Michigan, review licenses throughout the country. Arizona uses the National Practitioner Data Bank for license verification. The National Practitioner Data Bank is an HHS nationwide system that is primarily an alert or flagging system intended to facilitate a comprehensive review of the professional credentials of health-care practitioners, health-care entities, providers, and suppliers. The National Practitioner Data Bank contains adverse actions including certain licensure, clinical privileges, and professional-society membership actions, as well as Drug Enforcement Administration controlled-substance registration actions, and exclusions from participation in Medicare, Medicaid, and other federal health-care programs. Michigan, on the other hand, uses a private-company dataset that periodically monitors providers for licenses and licensure actions. New Jersey and Florida both screen the providers within their states, as required. However, neither state uses a nationwide system, such as FSMB or the National Practitioner Data Bank, to validate licenses or determine whether the provider has been sanctioned.verification, which is allowable under Medicaid, all four states periodically reviewed licenses to ensure that providers are licensed to practice medicine in their states to meet the CMS requirement. According to CMS’s February 2011 regulation, ordering and referring providers participating in Medicaid in a risk-based managed-care environment are not required to enroll in Medicaid, and therefore are not subject to screening provisions discussed previously. As explained in its final rule, HHS did not require Medicaid managed-care providers to enroll with Medicaid programs because doing so would have resulted in unequal treatment of managed-care providers under the Medicare program, which does not require managed-care providers to enroll. Although not required, HHS officials stated that they do encourage states to screen managed-care network providers. In this regard, in May 2014, we reported that neither state nor federal entities are well positioned to identify improper payments made to MCOs, nor are they able to ensure that MCOs are taking appropriate actions to identify, prevent, or discourage improper payments.improving federal and state efforts to strengthen Medicaid managed-care program integrity takes on greater urgency as states that choose to expand their Medicaid programs under PPACA are likely to do so with managed-care arrangements, and will receive a 100 percent federal match for newly eligible individuals from 2014 through 2016. As we reported in May 2014, unless CMS takes a larger role in holding states accountable, and provides guidance and support to states to ensure adequate program-integrity efforts in Medicaid managed care, the gap between state and federal efforts to monitor managed-care program integrity will leave a growing portion of federal Medicaid dollars vulnerable to improper payments. In the May 2014 report, we recommended that CMS increase its oversight of program-integrity efforts by requiring, in part, that CMS update its guidance on Medicaid managed-care program We stated that integrity. In May 2014, HHS agreed with our recommendation, but as of February 2015 had not issued new guidance. Officials in Arizona, Florida, and Michigan said that their respective states require that all managed-care network providers enroll or register with the state Medicaid agency. We believe this standardization potentially eliminates discrepancies found in states when the credentialing standards for the managed-care network may differ from the state’s enrollment processes, and the state relies on contracted MCOs to collect network- provider disclosures, check providers and affiliated parties for exclusions, and oversee other aspects of the provider-enrollment process. Thus, by requiring that all MCO providers be enrolled directly with the states, those three states maintain centralized control over the screening and registration process and may be better positioned to ensure the integrity of their Medicaid programs. We have found that fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse rather than trying to recover payments once they are made. Thus, controls that prevent potentially fraudulent health-care providers from entering the Medicaid program or submitting claims are the most-important element in an effective fraud- prevention program. Effective fraud-prevention controls require that, where appropriate, organizations enter into data-sharing arrangements with each other to perform validation. System edit checks (i.e., built-in electronic controls) are also crucial in identifying and rejecting potentially fraudulent enrollment applications. Although CMS has taken steps through its program regulations in providing guidance to states for screening providers, the states we examined reported difficulties in implementing the regulations. One provision in the 2011 HHS regulation allowed states to rely on the results of provider screening by Medicare contractors to determine provider eligibility for Medicaid. According to HHS, this provision would eliminate additional screening and enrollment requirements for Medicaid providers, and also eliminate additional costs and burdens for separate screening for state Medicaid programs. To administer the provider screening, application fee, and revalidation requirements successfully, as specified in federal regulations, CMS determined that states must have access to Medicare enrollment data to determine whether a provider is currently enrolled in the Medicare program, has been denied enrollment, or is currently enrolling. According to CMS, in April 2012, CMS established a process by which states would have direct access to Medicare’s enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS). Each state is given “read only,” manual access to PECOS. CMS provided the states access to PECOS in hopes that the states will be able to use these data in minimizing the amount of screening and costs that are associated with providers that are already enrolled in Medicare. However, according to our discussions with officials in the four selected states, the states are using PECOS to screen a segment of their provider population but none currently utilize PECOS for their entire provider population. Arizona officials stated that they use PECOS in the screening of out-of-state providers. Michigan officials stated that they use PECOS on medium- or high-risk providers to determine whether a site visit is warranted. New Jersey officials stated they use PECOS to confirm an out-of-state provider’s Medicare provider status and view the results of the most-recent site-visit inspection. Florida officials said that they do not screen all providers using PECOS. With regard to using PECOS for all Medicaid providers in their screening processes, we determined the following: State officials told us that PECOS required manual lookups of individual providers, a task that one state characterized as inefficient and administratively burdensome. According to CMS officials, as of October 2013, CMS began providing all interested states access to a monthly PECOS data-extract file that contains basic Medicare enrollment information; the state officials we interviewed were unaware that they could obtain automated data extracts from PECOS. Additionally, state officials from Florida, Michigan, and New Jersey said that they use a limited amount of pertinent information, specifically site-visit information, from PECOS to perform the necessary provider screening. However, there is additional information in PECOS, such as ownership information, that is necessary for state Medicaid agencies to screen providers properly and that is not included in the information that they use. Only Arizona officials stated they are able to utilize PECOS ownership information for providers. According to CMS officials, ownership information on providers can be obtained through a detailed-level view of PECOS. However, CMS has not made ownership information available to the states through the monthly PECOS data-extract file. Some state officials noted that full electronic access to all information in the PECOS system would streamline provider-screening efforts, resulting in a more-efficient and more-effective process. Additional CMS guidance to the states on requesting automated information through PECOS and ensuring that such information includes key ownership information could help states improve efficiency of provider screening. The Medicaid program is a significant expenditure for the federal government and the states, representing over $310 billion in federal outlays in fiscal year 2014. Because of the size and continued expansion of the Medicaid program, it is important that the federal government and the states continue to find ways to prevent and reduce improper payments, including fraud, in the program. Since 2011, CMS has taken steps to strengthen Medicaid beneficiary and provider enrollment- screening controls. As part of this ongoing endeavor, increasing information and data-sharing efforts between the federal government and state Medicaid programs could help enhance efforts to identify improper payments and potentially fraudulent activities. As the federal overseer of the Medicaid program, CMS is well positioned to provide additional guidance on accessing information in federal databases, such as SSA information about deceased individuals and automated information on providers through Medicare’s enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS)—that would help identify and prevent benefits and payments to those individuals and providers who are ineligible to participate in Medicaid. To further improve efforts to limit improper payments, including fraud, in the Medicaid program, we recommend that the Acting Administrator of CMS take the following two actions: issue guidance to states to better identify beneficiaries who are deceased; and provide guidance to states on the availability of automated information through Medicare’s enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS)—and full access to all pertinent PECOS information, such as ownership information, to help screen Medicaid providers more efficiently and effectively. We provided a draft copy of this report to HHS, SSA, and state Medicaid program offices for Arizona, Florida, Michigan, and New Jersey. Written comments from HHS, SSA, the Arizona Health Care Cost Containment System (AHCCCS), the Florida Agency for Healthcare Administration, and the Michigan Department of Community Health are summarized below and reprinted in appendixes II–VI. HHS concurred with our recommendations. SSA did not comment on the findings and recommendations but provided clarifying comments on the full DMF. AHCCCS disagreed with out methodology and provided detailed comments on our findings, as described below. The Florida Agency for Healthcare Administration said it supports our efforts to identify provider and beneficiary fraud. The Michigan Department of Community Health agreed with our findings and supports our recommendations. In an e-mail received on March 24, 2015, the Chief of Investigations of the New Jersey Office of the State Comptroller, Medicaid Fraud Division, did not provide comments on the findings but provided a technical comment, which we incorporated as appropriate. The Florida Department of Children and Families also provided technical comments, which we incorporated as appropriate. HHS concurred with both of our recommendations. Regarding our first recommendation, to issue guidance to states to better identify beneficiaries who are deceased, HHS stated that it will work with states to determine additional approaches to better identify deceased beneficiaries and continue to provide state-specific technical assistance as needed. In response to our second recommendation, HHS indicated that it will continue to educate states about the availability of PECOS information and how to use that information to help screen Medicaid providers more effectively and efficiently. HHS also outlined steps the agency has taken to address beneficiary and provider eligibility fraud since fiscal year 2011—the time frame for the data used in our study—many of which were mentioned in our report. As described in our report, we used fiscal year 2011 data because it was the most-recent consistently comparable data available. In its written comments, SSA did not comment on the report’s findings and recommendations but provided clarifying information regarding access to the full Death Master File (DMF), which we incorporated as appropriate. Additionally, SSA stated that CMS already has access to the full DMF and can share that information with states to ensure proper payment of Medicaid benefits. We believe that such action by CMS could address our first recommendation. In its written comments, AHCCCS said that it takes exception to being included in a series of findings that are global in nature and offer no state- specific detail. As we noted in our meetings with all state agencies included in our study, we did not provide state-level detail for two primary reasons. First, because CMS was the audited agency for our work, conducting analysis at the state-level would be outside the scope of our work and would put the focus on a comparison between the states, rather than on CMS oversight. In addition, due to the age and limitations of the data, as noted in the report, we would not be referring specific cases for follow-up. AHCCCS further stated that our report contained misstatements that cannot be attributed to either state. Because AHCCCS did not provide any examples, we cannot address this assertion but stand by the findings and recommendations in our report. AHCCCS also stated that most of the findings on our report are derived from data sources that are considered unreliable. In our report, we outline the steps we took to assess the reliability of our data and determine that they were sufficiently reliable for performing our work. Additionally, we note the key limitations of the data sources we use for our report and provide the appropriate caveats, as applicable, for the findings from our data analysis. Further, AHCCCS uses several of the same data sources for its eligibility screening as we used in our report. For example, AHCCCS notes that Arizona has found that the SSA death file is unreliable. It further notes that it uses SSA’s real-time State Online Query system to obtain date of death information. According to SSA in its written response to the draft report, the source for the State Online Query system data used by Arizona is the SSA DMF. AHCCCS also states that the findings of our report do not reflect the current eligibility-screening process in Arizona. We acknowledge the limitations stemming from the age of the MSIS data (fiscal year 2011) and the passage of PPACA in 2011. Furthermore, we directly address this limitation in the report where we discuss actions CMS has taken to strengthen certain Medicaid enrollment-screening controls. Specifically, we state that CMS has taken regulatory action since 2011 to enhance beneficiary-screening procedures and provider-screening procedures that may address the improper-payment indicators found in our report. We then discuss the current eligibility-screening process at the federal and state level. We did not make any changes to the report based on these AHCCCS comments, because we believe the essence of the comments was already acknowledged within the report. AHCCCS also provided comments on specific sections of our analysis, beginning with incarcerated beneficiaries. First, AHCCCS identified reliability and timeliness issues with the SSA incarceration file. This comment is not pertinent to our work, as this file was not a data source used in our analysis. As we note in appendix I, we used each state’s department of corrections prisoner database for individuals incarcerated for any period during fiscal year 2011. Second, AHCCCS states that we failed to distinguish whether incarcerated individuals were hospitalized. To the contrary, we note that we reviewed these claims’ type of service to determine that none qualified for federal matching funds. Accordingly, this would exclude individuals that were hospitalized. Regarding our analysis using the USPS address-management tool, AHCCCS incorrectly states that our report assumes that all physical addresses are known to USPS. We do not state this in our report. Specifically, the report notes that federal law requires states to make Medicaid available to eligible individuals who do not reside in a permanent dwelling or do not have a fixed home or mailing address. Therefore, there are no requirements related to listing actual physical addresses for beneficiary enrollment and eligibility determinations. Further, the focus of our analysis was CMRAs used as the residential address, not the validity of all addresses listed on beneficiary applications. As such, the comment from AHCCCS is not supported by the actual content and analyses in our report. AHCCCS notes that our analysis of provider controls is an extrapolation from the combined set of states’ data. This is incorrect. Our report does not extrapolate, or make any population estimates, of provider eligibility fraud. We provided a descriptive analysis of potential improper payments and provider-eligibility fraud based on the data from fiscal year 2011. As stated earlier, we listed the appropriate caveats to our findings to ensure that the results of our analysis were not taken in an inappropriate context, as implied by AHCCCS. Finally, AHCCCS identified three recommendations that it believes would improve Medicaid program-integrity issues. Specifically AHCCCS stated CMS should allow states to use disclosures conducted by Medicare or another state Medicaid program in the enrollment of Medicaid providers, allow states to access the federal criminal database to conduct initial and periodic background checks on providers, and promote other national initiatives for data sharing on Medicare and provider license verifications. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Commissioner of Social Security, relevant state agencies, and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII. In this report, we (1) identify and analyze indicators of improper or potentially fraudulent payments to Medicaid beneficiaries and providers and (2) examine the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect fraud and abuse in determining eligibility for Medicaid beneficiaries and enrolling providers. To identify indicators of improper or potentially fraudulent payments to Medicaid beneficiaries and providers, we obtained and analyzed Medicaid claims paid in fiscal year 2011, the most-recent consistently comparable data, for four states: Arizona, Florida, Michigan, and New Jersey. Medicaid payments to these states constituted about 13 percent of all Medicaid payments made during fiscal year 2011. These four states were selected primarily because they had reliable data and were among states with the highest Medicaid enrollment. The results of our analysis of these states cannot be generalized to other states. We obtained Centers for Medicare & Medicaid Services (CMS) Medicaid Statistical Information System (MSIS) beneficiary, provider, and other services claims data, as well as state Medicaid Management Information System (MMIS) claims identification data to perform our work. Managed-care organizations As a result, the Medicaid (MCO) receive a monthly capitated payment.paid amounts associated with managed care may not be reflected in the state claims that were submitted to CMS for medical services, and hence our estimate is likely understated. All of the states included in our review—Arizona, Florida, Michigan, and New Jersey—had MCO arrangements in place. To identify beneficiaries that submitted applications with identification information (name, date of birth, and Social Security number ) that did not match with Social Security Administration (SSA) records, we used the SSA Enumeration Verification System. Specifically, we processed unique beneficiary identification information from the MSIS and MMIS files through the SSA Enumeration Verification System to determine the extent to which SSN information in the MSIS files was accurate. We analyzed the output codes from the SSA Enumeration Verification System to identify unique individuals who had Medicaid application identification information that did not match SSA records. Applications may have inaccuracies due to simple errors such as inaccurate data entry or incomplete sections, making it difficult to determine whether these cases involve fraud through data matching alone. In addition, there may be situations where an individual does not have an SSN (for example, a newborn child). Nonetheless, these applications pose a higher risk of fraud because there is no complete electronic record of beneficiaries’ identities. To identify providers and beneficiaries with identities associated with deceased individuals at the time of their Medicaid services, we matched Medicaid data—MMIS and MSIS—to the SSA complete file of death information from October 2012. We matched records using the SSN and full name of the individual. We then identified unique individuals who had Medicaid claims processed where the date of death in the SSA file occurred before the beginning service date in the Medicaid claims file. To identify providers and beneficiaries with identities associated with incarcerated individuals at the time of their Medicaid services, we matched our selected states’ MMIS data to the states’ departments of corrections prisoner databases. Prisoner data included individuals incarcerated for any period during fiscal year 2011. For Arizona, Florida, and New Jersey, we identified provider and beneficiary records for which the Medicaid SSN and names matched that of a person who was incarcerated in fiscal year 2011 in any of the four states. Michigan did not provide SSNs in its incarceration data. For Michigan, we identified provider and beneficiary records for which the Medicaid name and birth day exactly matched that of a person who was incarcerated in fiscal year 2011 in any of the four states. We then identified Medicaid claims associated with the identified individuals by matching to the MSIS data. We compared the beginning service date of the claims to the individual’s admittance and release date to identify all claims that occurred while the associated beneficiary or provider identity was incarcerated. Additionally, we reviewed these claims’ type of service to determine that none qualified for federal matching funds. It is not possible to determine from data matching alone whether these matches definitively identify recipients who were deceased or incarcerated without reviewing the facts and circumstances of each case. For example, it is possible that individuals can be erroneously listed in the full Death Master File (DMF). Similarly, a provider or beneficiary may have an SSN, name, and date of birth similar to an individual in state prison records. Alternatively, our matches may also understate the number of deceased or incarcerated individuals receiving assistance because matching would not detect applicants whose identifying information in the Medicaid data differed slightly from their identifying information in other databases. To identify claims that are associated with missing or invalid addresses, we used the United States Postal Service (USPS) Address Matching System Application Programming Interface (USPS address-management tool). To identify providers and beneficiaries with invalid addresses, we submitted all MMIS data through that USPS address-management tool for fiscal year 2014. The USPS address-management tool provides information such as whether an address is undeliverable, unknown, a Commercial Mail Receiving Agency (CMRA), or contains an invalid city, state, or ZIP code. Additionally, the address-management tool standardized and corrected addresses based on the information submitted. We considered invalid addresses to be unknown/blank, CMRAs, or foreign addresses. To identify providers with CMRAs, we identified all records where the address-management tool identified and confirmed the address with private-mailbox-number information. We conducted further analysis to remove any provider records that were not for the physical service location of their business, such as a billing or correspondence address for a provider. To identify beneficiaries with commercial addresses, we identified all records where the address- management tool identified the residential address as a commercial address with or without private-mailbox-number information. To identify providers and beneficiaries with unknown addresses, we identified all records where the USPS address-management tool identified the address as not found or blank. To identify providers and beneficiaries with foreign addresses, we identified and reviewed all records where the USPS address-management tool identified the address as having an invalid city or state. We removed records that had been corrected by the USPS address-management tool as well as military bases. We then conducted additional analysis to identify MSIS claims associated with both the providers and beneficiaries with invalid addresses. It is not possible to determine through data matching alone whether the identified claims were definitely associated with invalid addresses without reviewing additional information for each claim due to the difference in MMIS and address-management tool data age. For example, it is possible that an address was valid in fiscal year 2011 and was no longer recognized in fiscal year 2014. To identify Medicaid beneficiaries who received benefits in two or more states concurrently, we identified all beneficiary SSNs that appeared in two or more states’ MMIS data in fiscal year 2011. We then found all claims associated with the beneficiary identities. We conducted further analysis to determine the states in which each beneficiary identity appears and the service ranges—first and last date of service—for those states. We defined a concurrent claim as a claim that occurred within the service range of a second state for the same beneficiary identity. For each claim, we compared its date of service to the service ranges for the beneficiary identity to determine whether it was a concurrent claim. It is not possible to definitely say through data matching alone that a beneficiary was improperly receiving Medicaid benefits in two or more states concurrently without looking into further information for each claim and beneficiary. For example, a beneficiary could have been a resident in one state and received services, then changed residency to a second state and received benefits for a brief period, before finally relocating again back to the original state and receiving additional services. In this case, the claims could have been identified as a concurrent claim even if the beneficiary did not receive any services from the original state during his or her relocation period in the second state. To identify claims that might have been improperly processed and paid by the Medicaid program because the federal government had excluded these providers from providing services to Medicaid beneficiaries, we compared the Medicaid claims to the exclusion and debarment files from the Department of Health and Human Services’ (HHS) Office of Inspector General (OIG) and the General Services Administration (GSA). Specifically, we used the HHS List of Excluded Individuals and Entities (LEIE) file from September 2012 and the GSA Excluded Parties List System (EPLS) database extract from October 2011 to perform our match. We matched MMIS and MSIS Medicaid data using SSN and individual name with both the LEIE and the EPLS data extracts. We then identified unique individuals who had Medicaid claims processed where the date of exclusion occurred before the beginning service date in the Medicaid claims file. To identify claims that might be improperly processed and paid by the Medicaid program because the provider had a revoked or suspended license, we compared Medicaid claims data to the Federation of State Medical Boards (FSMB) Physician Data Center database extract from calendar year 2014. We identified providers with actions that, in some cases, may be prohibited under federal Medicaid regulations that resulted in a suspended or revoked license. We matched these providers with our Medicaid claims data by SSN and provider name. We identified unique individuals who had Medicaid claims processed where the date of license action occurred before the beginning service date in the Medicaid claims file. To identify federal and state oversight policies, controls, and processes in place to prevent and detect fraud and abuse in determining eligibility for Medicaid beneficiaries and enrolling providers, we reviewed federal statutes, CMS regulations, and state Medicaid policies pertinent to program-integrity structures, met with agency officials, and visited state Medicaid offices that perform oversight functions. We used federal standards for internal control, GAO’s Fraud Prevention Framework,federal statutes, and Medicaid eligibility regulations to evaluate these functions. To determine the reliability of the data used in our analysis, we performed electronic testing to determine the validity of specific data elements in the federal and selected states’ databases that we used to perform our work. We also interviewed officials responsible for their respective databases, and reviewed documentation related to the databases and literature related to the quality of the data. On the basis of our discussions with agency officials and our own testing, we concluded that the data elements used for this report were sufficiently reliable for our purposes. We identified criteria for Medicaid fraud controls by examining federal and state policies, laws, and guidance, including policy memos and manuals. We interviewed officials from CMS and the state governments of Arizona, Florida, Michigan, and New Jersey involved in Medicaid program administration and Medicaid fraud response. We conducted this performance audit from March 2014 to May 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our audit findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Matthew Valenta (Assistant Director), John Ahern, Mariana Calderón, Melinda Cordero, Julia DiPonio, Lorraine Ettaro, Colin Fallon, Barbara Lewis, Maria McMullen, Kevin Metcalfe, Rubén Montes de Oca, James Murphy, Christine San, Paola Tena, and Carolyn Yocom made key contributions to this report.

Summary: Medicaid is a significant expenditure for the federal government and the states, with total federal outlays of $310 billion in fiscal year 2014. CMS reported an estimated $17.5 billion in potentially improper payments for the Medicaid program in 2014. GAO was asked to review beneficiary and provider enrollment-integrity efforts at selected states. This report (1) identifies and analyzes indicators of improper or potentially fraudulent payments in fiscal year 2011, and (2) examines the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect fraud and abuse in determining eligibility. GAO analyzed Medicaid claims paid in fiscal year 2011, the most-recent reliable data available, for four states: Arizona, Florida, Michigan, and New Jersey. These states were chosen because they were among those with the highest Medicaid enrollment; the results are not generalizable to all states. GAO performed data matching with various databases to identify indicators of potential fraud, reviewed CMS and state Medicaid program-integrity policies, and interviewed CMS and state officials performing oversight functions. GAO found thousands of Medicaid beneficiaries and hundreds of providers involved in potential improper or fraudulent payments during fiscal year 2011—the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states had about 9.2 million beneficiaries and accounted for 13 percent of all fiscal year 2011 Medicaid payments. Specifically: About 8,600 beneficiaries had payments made on their behalf concurrently by two or more of GAO's selected states totaling at least $18.3 million. The identities of about 200 deceased beneficiaries received about $9.6 million in Medicaid benefits subsequent to the beneficiary's death. About 50 providers were excluded from federal health-care programs, including Medicaid, for a variety of reasons that include patient abuse or neglect, fraud, theft, bribery, or tax evasion. Since 2011, the Centers for Medicare & Medicaid Services (CMS) has taken regulatory steps to make the Medicaid enrollment process more rigorous and data-driven; however, gaps in beneficiary-eligibility verification guidance and data sharing continue to exist. These gaps include the following: In October 2013, CMS required states to use electronic data maintained by the federal government in its Data Services Hub (hub) to verify beneficiary eligibility. According to CMS, the hub can verify key application information, including state residency, incarceration status, and immigration status. However, additional guidance from CMS to states might further enhance program-integrity efforts beyond using the hub. Specifically, CMS regulations do not require states to periodically review Medicaid beneficiary files for deceased individuals more frequently than annually, nor specify whether states should consider using the more-comprehensive Social Security Administration Death Master File in conjunction with state-reported death data when doing so. As a result, states may not be able to detect individuals that have moved to and died in other states, or prevent the payment of potentially fraudulent benefits to individuals using these identities. In 2011, CMS issued regulations to strengthen Medicaid provider-enrollment screening. For example, CMS now requires states to screen providers and suppliers to ensure they have active licenses in the state where they provide Medicaid services. CMS's regulations also allow states to use Medicare's enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS)—to screen Medicaid providers so that duplication of effort is reduced. In April 2012, CMS gave each state manual access to certain information in PECOS. However, none of the four states GAO interviewed used PECOS to screen all Medicaid providers because of the manual process. In October 2013, CMS began providing interested states access to a monthly file containing basic enrollment information that could be used for automated screening, but CMS has not provided full access to all PECOS information, such as ownership information, that states report are needed to effectively and efficiently process Medicaid provider applications. GAO recommends that CMS issue guidance for screening deceased beneficiaries and supply more-complete data for screening Medicaid providers. The agency concurred with both of the recommendations and stated it would provide state-specific guidance to address them.