CMS is responsible for overseeing Medicaid and state Medicaid agencies are responsible for administering the program. Although each state is subject to federal requirements, it develops its own Medicaid administrative structure for carrying out the program including its approach to program integrity. Within broad federal guidelines, each state establishes eligibility standards and enrolls eligible individuals; determines the type, amount, duration, and scope of covered services; sets payment rates for covered services; establishes standards for providers and managed care plans; and ensures that state and federal funds are not spent improperly or diverted by fraudulent providers. However, state Medicaid programs do not work in isolation on program integrity; instead, there are a large number of federal agencies, other state entities, and contractors with which states must coordinate. Generally, each state’s Medicaid program integrity unit uses its own data models, data warehouses, and approach to analysis. States often augment their in-house capabilities by contracting with companies that specialize in Medicaid claims and utilization reviews. However, as program administrators, states have primary responsibility for conducting program integrity activities that address provider enrollment, claims review, and case referrals. Specifically, CMS expects states to collect and verify basic information on providers, including whether the providers meet state licensure requirements and are not prohibited from participating in federal health care programs  maintain a mechanized claims processing and information system known as the Medicaid Management Information System (MMIS). MMIS can be used to make payments and to verify the accuracy of claims, the correct use of payment codes, and a beneficiary’s Medicaid eligibility.  operate a Surveillance and Utilization Review Subsystem (SURS) in conjunction with the MMIS that is intended to develop statistical profiles on services, providers, and beneficiaries in order to identify potential improper payments. For example, SURS may apply automatic post-payment screens to Medicaid claims in order to identify aberrant billing patterns. submit all processed Medicaid claims electronically to CMS’s Medical Statistical Information System (MSIS). MSIS does not contain billing information, such as the referring provider’s identification number or beneficiary’s name, because it is a subset of the claims data submitted by states. States provide data on a quarterly basis and CMS uses the data to (1) analyze Medicaid program characteristics and utilization for services covered by state Medicaid programs, and (2) generate various public use reports on national Medicaid populations and expenditures. refer suspected overpayments or overutilization cases to other units in the Medicaid agency for corrective action and refer potential fraud cases to other appropriate entities for investigation and prosecution. Our reports and testimonies from 2001 through 2006 identified gaps in state program integrity activities and noted that the support provided by CMS to states was hampered by resource constraints. For example, in 2004, we reported that 15 of 47 states responding to our questionnaire did not affirm that they conducted data mining, defined as analysis of large data sets to identify unusual utilization patterns, which might indicate provider abuse. The DRA established the Medicaid Integrity Program to provide effective federal support and assistance to states to combat fraud, waste, and abuse. To implement the Medicaid Integrity Program, CMS created the Medicaid Integrity Group (MIG), which is now located within the agency’s Center for Program Integrity. The DRA also required CMS to hire contractors to review and audit provider claims and to educate providers on issues such as appropriate billing practices. The Medicaid Recovery Audit Contractor (RAC) program was established by PPACA. Each state must contract with a RAC, which is tasked with identifying and recovering Medicaid overpayments and identifying underpayments. Each state’s RAC is required to be operational by January 1, 2012. Medicaid RACs will be paid on a contingency fee basis—up to 12.5 percent—of any recovered overpayments and states are required to establish incentive payments for the detection of underpayments. Figure 1 identifies the key federal and state entities responsible for Medicaid program integrity. Fraud detection and investigations often require more specialized skills than are required for the identification of improper payments because investigators must establish that an individual or entity intended to falsify a claim to achieve some gain. As a result, fraud is more difficult to prove than improper payments and requires the involvement of entities that can investigate and prosecute fraud cases. In 1977, Congress authorized federal matching funds for the establishment of independent state Medicaid Fraud Control Units (MFCU). MFCUs are responsible for investigating and prosecuting Medicaid fraud. In general, they are located in State Attorneys Generals’ offices. MFCUs can, in turn, refer some cases to federal agencies that have longstanding responsibility for combating fraud, waste, and abuse in Medicare and Medicaid—the HHS’s Office of Inspector General (HHS-OIG), the Federal Bureau of Investigation (FBI), and the Department of Justice. A key challenge CMS faces in implementing the statutorily required federal Medicaid Integrity Program is ensuring effective coordination to avoid duplicating state program integrity efforts. CMS established the MIG in 2006 and it gradually hired staff and contractors to implement a set of core activities, including the (1) review and audit of Medicaid provider claims; (2) education of state program integrity officials and Medicaid providers; and (3) oversight of state program integrity activities and provision of assistance. Because states also routinely review and audit provider claims, the MIG recognized that coordination was key to avoiding duplication of effort. In 2011, the MIG reported that it was redesigning its national provider audit program to allow for greater coordination with states on data, policies, and audit measures. According to MIG data, overpayments identified by its review and audit contractors over the first 3 years of the national audit program were not commensurate with the contractors’ costs. The DRA provided CMS with the resources to hire staff whose sole duties are to assist states in protecting the integrity of the Medicaid program. The MIG’s core activities were implemented gradually from fiscal year 2006 to 2009. The DRA provided start up funding of $5 million for fiscal year 2006, increasing to $50 million for each of the subsequent 2 fiscal years, and $75 million per year for fiscal year 2009 and beyond. One of the first activities initiated by the MIG in fiscal year 2007 was comprehensive program integrity reviews to assess the effectiveness of states’ activities, which involved eight, week-long onsite visits that year. One of the last activities to be implemented was the statutorily required National Provider Audit Program where MIG contractors review and audit Medicaid provider claims. In fiscal year 2005, we reported that CMS devoted 8.1 full time equivalent staff years to support and oversee states’ anti-fraud-and-abuse operations, which, in 2010, had grown to 83 out of the 100 DRA authorized full time equivalent staff years. Table 1 describes six core MIG activities and the fiscal year in which those activities began. Figure 2 shows MIG expenditures by program category for fiscal year 2010. The Medicaid Integrity Institute accounted for about 2 percent of the MIG’s fiscal year 2010 expenditures, while the National Provider Audit Program accounted for about half of expenditures. At the outset, the MIG recognized that effective coordination with internal and external stakeholders was essential to the success of the Medicaid Integrity Program. In a report issued prior to establishment of the program, we found that CMS had a disjointed organizational structure and lacked the strategic planning necessary to face the risks involved with the Medicaid program. We identified the need for CMS to develop a strategic plan in order to provide direction to the agency, its contractors, states, and its law enforcement partners. In designing and implementing the program, the MIG convened an advisory committee consisting of (1) state program integrity, Medicaid, and MFCU directors from 16 states; and (2) representatives of the FBI, HHS-OIG, and CMS regional offices. This committee provided planning input and strategic advice and identified key issues that the MIG needed to address, including  The MIG’s efforts should support and complement states’ Medicaid integrity efforts, not be redundant of existing auditing efforts.  Program integrity activities of the MIG and other federal entities require coordination with states regarding auditing and data requests.  The focus of state activities should be shifted from postpayment audits to prepayment prevention activities. The advisory committee also highlighted the lack of state resources for staffing, technology, and training. CMS’s July 2009 Comprehensive Medicaid Integrity Plan, the fourth such plan since 2006, stated that fostering collaboration with internal and external stakeholders of the Medicaid Integrity Program was a primary goal of the MIG. In implementing more recent statutory requirements, CMS again stressed the need for effective coordination and collaboration. CMS’s commentary accompanying the final rule on the implementation of Medicaid RACs acknowledged the potential for duplication with states’ ongoing efforts to identify Medicaid overpayments. States have been responsible for the recovery of all identified overpayments, including those identified since fiscal year 2009 by the MIG’s audit contractors. The new requirement for states to contract with an independent Medicaid RAC introduces another auditor to identify and collect Medicaid overpayments. The Medicaid RAC program was modeled after a similar Medicare program, which was implemented in March 2009 after a 3-year demonstration. Because Medicare RACs are paid a fixed percentage of the dollar value of any improper payments identified, they generally focused on costly services such as inpatient hospital stays. Our prior work on Medicare RACs noted that the postpayment review activities of CMS’s other contractors would overlap less with the RACs’ audits if those activities focused on different Medicare services where improper payments were known to be high, such as home health. Because Medicaid RACs are not required to be operational until January 1, 2012, the extent to which states will structure their RAC programs to avoid duplication and complement their own provider review and audit activities remains to be seen. In its most recent annual report to the Congress, the MIG indicated that it was redesigning the National Provider Audit Program. According to the MIG, the National Provider Audit Program has not identified overpayments in the Medicaid program commensurate with the related contractor costs. About 50 percent of the MIG’s $75 million annual budget supports the activities of its review and audit contractors. From fiscal years 2009 through 2011, the MIG authorized 1,663 provider audits in 44 states. However, the MIG’s reported return on investment from these audits was negative. While its contractors identified $15.2 million in overpayments, the combined cost of the National Provider Audit Program was about $36 million in fiscal year 2010. The actual amount of overpayments recovered is not known because states are responsible for recovering overpayments and the MIG is not the CMS entity that tracks recoveries. Actual recoveries may be less than the identified overpayments. The National Provider Audit Program has generally relied on MSIS, which is summary data submitted by states on a quarterly basis that may not reflect voided or adjusted claims payments. As a result, the MIG’s audit contractors may identify two MSIS claims as duplicates when the state has already voided or denied payment on one of these claims. For their program integrity efforts, states use their own MMIS data systems, which generally reflect real-time payments and adjustments of detailed claims for each health care service. States are required to have a SURS component that performs data mining as a part of their program integrity efforts. The MIG’s review contractors use data mining techniques that may be similar to those employed by states, and they may not identify any additional improper claims. Moreover, MIG officials told us that the National Provider Audit Program did not prioritize the activities according to the dollar amount of the claim, that is, it did not concentrate its efforts on audits with the greatest potential for significant recoveries. Although the amount of overpayment identified from any given audit can vary by thousands or millions of dollars, the MIG’s comprehensive reviews of several states’ Medicaid integrity programs show that these states identified significantly higher levels of overpayments in 1 year than the National Provider Audit Program identified over 3 years. For example, the number of national provider audits (1,663) over three fiscal years was similar to the number that New York conducted in fiscal year 2008 (1,352), yet CMS reported that New York had identified more than $372 million in overpayments— considerably more than the $15.2 million identified through national provider audits. The MIG’s proposed redesign of the National Provider Audit Program appears to allow for greater coordination between its contractors and states on a variety of factors, including the data to be used. In fiscal year 2010, the MIG launched collaborative audits in 13 states. For these audits, the states and the MIG agreed on the audit issues to review and, in some cases, states provided the MIG’s audit contractors with more timely and complete claims data. These collaborative projects (1) allowed states to augment their own audit resources, (2) addressed audit targets that states may not have been able to initiate because of a lack of staff, and (3) provided data analytic support for states that lacked that capability. Although these activities are ongoing and the results have not yet been finalized, such collaborative projects appear to be a promising approach to audits that avoids a duplication of federal and state efforts. It remains to be seen, however, whether these changes will result in an increase in identified overpayments. While the MIG’s audit program is challenged to avoid duplicating states’ own audit activities, its other core functions present an opportunity to enhance states’ efforts. The MIG’s state oversight activities are extensive and labor intensive. Although the data collected during reviews and assessments are not always consistent with each other, these oversight activities have a strong potential to inform the MIG’s technical assistance and help identify training opportunities. The Medicaid Integrity Institute appears to address an important state training need. The MIG’s core oversight activities—triennial comprehensive state program integrity reviews and annual assessments—are broad in scope and provide a basis for the development of appropriate technical assistance. However, we found that the information collected during reviews and the information collected from assessments was sometimes inconsistent with each other. As of November 2011, the MIG had completed the first round of reviews for 50 states and had initiated a second round of reviews in 10 states. The reviews cover the entirety of a state’s program integrity activities and assess compliance with federal regulations. In advance of the MIG’s week-long onsite visit, state program integrity officials are asked to respond to a 71-page protocol containing 195 questions and to provide considerable documentation. Table 2 summarizes the topics covered in the protocol. Typical compliance issues and vulnerabilities identified during the reviews include provider enrollment weaknesses, inadequate oversight of providers in Medicaid managed care, and ineffective fraud referrals to state MFCUs. Much of the information collected during the assessments—Medicaid program integrity characteristics, program integrity planning, prevention, detection, investigation and recoveries—is also collected during the triennial comprehensive reviews. In addition, we found inconsistencies between the information reported in the comprehensive reviews and in the assessments for several states that were conducted at about the same time. For example, there was a significant discrepancy for one state in the number of staff it reported as being dedicated to program integrity activities. According to the MIG, knowing the size of state program integrity staff helps it to more appropriately tailor content during training events. Improved consistency will help the MIG ensure that it is targeting its training and technical assistance resources appropriately. Despite the frequency of the annual assessments, the most current data cover fiscal year 2008, which the MIG began collecting in fiscal year 2010. Although the MIG provides states with a glossary explaining each of the requested data elements, it is not clear that the information submitted is reliable or comparable across states. Our review of a sample of assessments revealed missing data and a few implausible measures, such as one state reporting over 38 million managed care enrollees. In other states, there were dramatic changes in the data reported from 2007 to 2008, which either raises a question about the reliability of the data or suggests that states be allowed to explain significant changes from year to year. For example, the number of audits in one state declined from 203 to 35. According to MIG officials, the comprehensive reviews and the assessments inform the MIG’s technical assistance activities with the states. For example, we found that the MIG published best practices guidance in 2008 after finding weaknesses in coordination between state program integrity officials and their respective MFCU’s in a number of states. In its report to Congress on fiscal year 2010 activities, the MIG indicated it completed 420 requests for technical assistance from 43 states, providers, and others. The most common topics included the National Provider Audit Program, policy and regulatory requirements on disclosures, provider exclusions and enrollment, and requests for statistical assistance related to criminal and civil court actions. Examples of assistance provided to the states by the MIG included (1) hosting regional state program integrity director conference calls to discuss program integrity issues and best practices; and (2) helping develop a State Medicaid Director Letter (issued in July 2010) on the return of federal share of overpayments under PPACA. The federally sponsored Medicaid Integrity Institute not only offers state officials free training but also provides opportunities to develop relationships with program integrity staff from other states. The institute addresses our prior finding that CMS did not sponsor any fraud and abuse workshops or training from 2000 through 2005. From fiscal years 2008 through 2012, the institute will have trained over 2,265 state employees at no cost to states. Given the financial challenges states currently face, it is likely that expenditures for training and travel are limited. Expenditures on the institute accounted for about $1.3 million of the MIG’s $75 million annual budget. MIG officials told us that states uniformly praised the opportunity to network and learn about best practices from other states. A special June 2011 session at the institute brought together Medicaid program integrity officials and representatives of MFCUs from 39 states in an effort to improve the working relations between these important program integrity partners. In addition to the institute, the MIG has a contractor that provides (1) education to broad groups of providers and beneficiaries, and (2) targeted education to specific providers on certain topics. For example, the education contractor has provided outreach through its attendance at 17 conferences with about 36,000 attendees. These conferences were sponsored by organizations devoted to combating health care fraud such as the National Association of Medicaid Program Integrity and National Health Care Anti-Fraud Association, as well as meetings of national and regional provider organizations (hospital, home care and hospice and pharmacy). An example of a more targeted activity is one focused on pharmacy providers. The MIG’s education contractor is tasked with developing provider education materials to promote best prescribing practices for certain therapeutic drug classes and remind providers of the appropriate prescribing guidelines based on FDA approved labeling. The education program includes some face-to-face conversations, mailings to providers, and distribution of materials on a website and at conferences and meetings. These activities are collaborative efforts with the states so that states are: aware of the aberrant providers, participate in the education program, and can implement policy changes to address these issues, as appropriate. We discussed the facts in this statement with CMS officials. Chairmen Pratts and Gowdy, this concludes my prepared remarks. I would be happy to answer any questions that you or other Members may have. For further information about this statement, please contact Carolyn L. Yocom at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relation and Public Affairs may be found on the last page of this statement. Walter Ochinko, Assistant Director; Sean DeBlieck; Iola D’Souza; Leslie V. Gordon; Drew Long; Jessica Smith; and Jennifer Whitworth were key contributors to this statement. Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Status of Fiscal Year 2010 Federal Improper Payments Reporting. GAO-11-443R. Washington, D.C.: March 25, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Medicare: Program Remains at High Risk Because of Continuing Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 2011. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-1004T. Washington, D.C.: September 30, 2009. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009. Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009. Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax System. GAO-08-239T. Washington, D.C.: November 14, 2007. Medicaid: Thousands of Medicaid Providers Abuse the Federal Tax System. GAO-08-17. Washington, D.C.: November 14, 2007. Medicaid Financial Management: Steps Taken to Improve Federal Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705. Washington, D.C.: June 22, 2006. Medicaid Integrity: Implementation of New Program Provides Opportunities for Federal Leadership to Combat Fraud, Waste, and Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006. Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: June 28, 2005. Medicaid Program Integrity: State and Federal Efforts to Prevent and Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004. Medicaid: State Efforts to Control Improper Payments. GAO-01-662. Washington, D.C.: June 7, 2001. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Centers for Medicare & Medicaid Services (CMS), the federal agency that oversees Medicaid, estimated that improper payments in the federal-state Medicaid program were $21.9 billion in fiscal year 2011. The Deficit Reduction Act of 2005 established the Medicaid Integrity Program and gave CMS an expanded role in assisting and improving the effectiveness of state activities to ensure proper payments. Making effective use of this expanded role, however, requires that federal resources are targeted appropriately and do not duplicate state activities. GAO was asked to testify on Medicaid program integrity. GAO's statement focuses on how CMS's expanded role in ensuring Medicaid program integrity (1) poses a challenge because of overlapping state and federal activities regarding provider audits and (2) presents opportunities through oversight to enhance state program integrity efforts. To do this work, GAO reviewed CMS reports and documents on Medicaid program integrity as well as its own and others' reports on this topic. In particular, GAO reviewed CMS reports that documented the results of its state oversight and monitoring activities. GAO also interviewed CMS officials in the agency's Medicaid Integrity Group (MIG), which was established to implement the Medicaid Integrity Program. This work was conducted in November and December 2011. GAO discussed the facts in this statement with CMS officials. The key challenge faced by the Medicaid Integrity Group (MIG) is the need to avoid duplication of federal and state program integrity efforts, particularly in the area of auditing provider claims. In 2011, the MIG reported that it was redesigning its national provider audit program. Previously, its audit contractors were using incomplete claims data to identify overpayments. According to MIG data, overpayments identified by its audit contractors since fiscal year 2009 were not commensurate with its contractors' costs. The MIG's redesign will result in greater coordination with states on a variety of factors, including the data to be used. It remains to be seen, however, whether these changes will result in an increase in identified overpayments. The table below highlights the MIG's core oversight activities, which were implemented from fiscal years 2007 through 2009. The MIG's core oversight activities present an opportunity to enhance state efforts through the provision of technical assistance and the identification of training opportunities. The MIG's assessment of state program integrity efforts during triennial onsite reviews and annual assessments will need to address data inconsistencies identified during these two activities. Improved consistency will help ensure that the MIG is appropriately targeting its resources. The Medicaid Integrity Institute appears to address a state training need and create networking opportunities for program integrity staff.