The federal government and the states share responsibilities for financing and administering Medicaid. As a result of flexibility in the program’s design, Medicaid consists of 56 distinct state-based programs. The challenges inherent in overseeing a program of Medicaid’s size and diversity make the program vulnerable to inappropriate program spending. CMS is responsible for overseeing state Medicaid programs. For example, CMS is responsible for ensuring that states’ capitated managed care payments meet actuarial soundness requirements, that supplemental payments are appropriate, and for supporting and overseeing state program integrity activities—activities intended to address Medicaid fraud, waste, and abuse. Managed care is a significant component of the Medicaid program, with nearly half of all Medicaid enrollees—approximately 20.7 million individuals—enrolled in capitated managed care in 2008. In 2007, there was a total of over $62 billion in federal and state spending for managed care. Under managed care, states use capitation payments to prospectively pay health plans to provide or arrange for services for Medicaid enrollees. Such capitation payments are required by federal law to be actuarially sound. CMS regulations, first issued in 2002, define actuarially sound rates as those that are (1) developed in accordance with generally accepted actuarial principles and practices, (2) appropriate for the populations to be covered and the services to be furnished, and (3) certified as meeting applicable regulatory requirements by qualified actuaries. In order to receive federal funds for their managed care programs, states must submit documentation to CMS regional offices for review, including a description of their rate-setting methodology and data used to set rates. This review, completed by CMS regional office staff, is designed to ensure that a state complies with the regulatory requirements for setting actuarially sound rates. Most state Medicaid programs make supplemental payments to certain providers in addition to the standard payments states make to these providers for Medicaid services. For purposes of this testimony, we have grouped supplemental payments into two broad categories: (1) Disproportionate Share Hospital (DSH) payments, which states are required to make to hospitals that treat large numbers of low-income uninsured people and Medicaid patients; and (2) non-DSH supplemental payments, which are not required by statute or regulation. In fiscal year 2010, states made more than $31 billion in supplemental payments; the federal share was more than $19 billion. CMS is responsible for overseeing these payment arrangements to ensure the propriety of expenditures for which states seek federal reimbursement, including whether states were appropriately financing their share. Program integrity activities are designed to prevent, or detect and recover, improper payments throughout the Medicaid program. The Deficit Reduction Act of 2005 expanded CMS’s role regarding Medicaid program integrity, establishing the Medicaid Integrity Program to provide effective federal support and assistance to states to combat fraud, waste, and abuse. CMS’s core program integrity activities include: National Provider Audit Program—a program through which separate CMS contractors analyze claims data to identify aberrant claims and potential billing vulnerabilities, and conduct postpayment audits based on data analysis leads in order to identify overpayments to Medicaid providers. Comprehensive program integrity reviews—comprehensive management reviews that are conducted every 3 years to assess the effectiveness of each state’s program integrity efforts and determine whether the state’s policies and procedures comply with federal law and regulations. State program integrity assessments—annual assessments in which CMS collects data on state Medicaid integrity activities—including program integrity staffing and expenditures, audits, fraud referrals, and recoveries—for the purposes of program evaluation and technical assistance support. CMS also provides training and technical assistance to states. For example, CMS’s Medicaid Integrity Institute is the first national Medicaid integrity training program and offers state officials training and opportunities to develop relationships with program integrity staff from other states. We found that CMS had not ensured that all states were complying with the actuarial soundness requirements and did not have sufficient efforts in place to ensure that states were using reliable data to set managed care rates. Specifically, in August 2010, we reported that there were significant gaps in CMS’s oversight of 2 of the 26 states included in our review. First, CMS had not reviewed one state’s rate setting for multiple years and only determined that the state was not in compliance with the requirements through the course of our work. Second, at the time of our work, CMS had not completed a full review of a second state’s rate setting since the actuarial soundness requirements became effective in August 2002, and therefore may have provided federal funds for managed care rates that were not in compliance with all of the requirements. In addition to these gaps in oversight, we found inconsistencies in the reviews CMS completed. For example, the extent to which CMS ensured state compliance with some of the actuarial soundness requirements was unclear because CMS officials did not always document their review or cite evidence of the state’s compliance. When officials did cite evidence, the evidence did not always appear to meet the actuarial soundness requirements. Variation in practices across CMS regional offices contributed to these gaps and other inconsistencies in the agency’s oversight of states’ rate setting. For example, regional offices varied in the extent to which they tracked state compliance with the actuarial soundness requirements, their interpretations of how extensive a review of a state’s rate setting was needed, and their determinations regarding sufficient evidence for meeting the actuarial soundness requirements. We also reported in 2010 that CMS’s efforts to ensure the quality of the data used to set rates were generally limited to requiring assurances from states and health plans—efforts that did not provide the agency with enough information to ensure the quality of the data used. CMS regulations require states to describe the data used as the basis for rates and provide assurances from their actuaries that the data were appropriate for rate setting. The regulations do not include requirements for the type, amount, or age of the data used to set rates, and states are not required to report to CMS on the quality of the data. When reviewing states’ descriptions of the data used to set rates, CMS officials focused primarily on the appropriateness of the data rather than their reliability. Additionally, we found that actuarial certification does not ensure that the data used to set rates are reliable. In particular, our review of rate-setting documentation found that some actuaries’ certifications included a disclaimer that if the data used were incomplete or inaccurate then the rates would need to be revised. Furthermore, some actuaries noted that they did not audit or independently verify the data and relied on the state or health plans to ensure that the data were accurate and complete. With limited information on data quality, CMS cannot ensure that states’ managed care rates are appropriate, which places billions of federal and state dollars at risk for misspending. States and other sources have information on the quality of data used for rate setting—information that CMS could obtain. In addition, CMS could conduct or require periodic audits of data used to set rates; CMS is required to conduct such audits for the Medicare managed care program. CMS took a number of steps that may address some of the variation that contributed to inconsistent oversight, such as requiring regional office officials to use a detailed checklist when reviewing states’ rate setting; use of the checklist had previously been optional. However, we found variations in CMS oversight even when the checklist was used. Thus, to improve oversight of states’ Medicaid managed care rate setting, we recommended that CMS (1) implement a mechanism for tracking state compliance, including tracking the effective dates of approved rates; (2) clarify guidance for CMS officials on conducting rate-setting reviews, such as identifying what evidence is sufficient to demonstrate state compliance with the actuarial soundness requirements, and how officials should document their reviews; and (3) make use of information on data quality in overseeing states’ rate setting. HHS agreed with these recommendations, and as of June 2011, CMS officials indicated they were investigating ways to create an easily accessible database to help them more closely monitor the status of rate-setting approvals, reviewing and updating its guidance, and looking into incorporating information about data quality into its review and approval of Medicaid managed care rates. In our prior work, we have reported on varied financing arrangements involving supplemental payments that shifted costs from the states to the federal government. In some cases, the providers did not retain the full amount of the payments as some states required providers to return most, or all, of the supplemental payment to the state. Our work found that while a variety of federal legislative and CMS actions have helped curb inappropriate financing arrangements, gaps in oversight remain. Because such financing arrangements effectively increased the federal Medicaid share, they could compromise the fiscal integrity of Medicaid’s federal and state partnership. Our most recent reports on supplemental payments underscore these gaps in federal oversight. In May 2008, we reported that CMS had not reviewed all supplemental payment arrangements to ensure that these payments were appropriate and used for Medicaid purposes. In November 2009, we found that ongoing federal oversight of supplemental payments was warranted, in part, because two of the four states reviewed did not comply with federal requirements to account for all Medicaid payments when calculating DSH payment limits for uncompensated hospital care. Recently implemented requirements have the potential to improve oversight of some supplemental payments, but concerns about other payments remain. and accountability requirements in place for DSH payments. However, these requirements are not in place for non-DSH supplemental payments, which may be increasing. Specifically, in 2006, states reported making $6.3 billion in non-DSH supplemental Medicaid payments, of which the federal share was $3.7 billion, but not all states were reporting their payments. By 2010, this amount had grown to $14 billion, with a federal share of $9.6 billion. However, according to CMS officials, states’ reporting of non-DSH supplemental payments was likely incomplete. For example, there are now improved transparency As a result of our prior work, we have made numerous recommendations aimed at improving federal oversight of supplemental payments. Some key recommendations we made have not been implemented by CMS. We have recommended that CMS adopt transparency requirements for non- DSH supplemental payments and develop a strategy to ensure all state supplemental payment arrangements have been reviewed by CMS. CMS has taken some action to address some of these recommendations but we continue to believe additional action is warranted. CMS has raised concern that congressional action may be necessary to fully address our concerns. Additionally, given continued concerns associated with Medicaid supplemental payments, we have work under way related to states’ reporting and CMS’s oversight of DSH and non-DSH supplemental payments. See the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, Pub. L. No. 108-173, § 1001(d), 117 Stat. 2066, 2430-2431 (2003) (codified, as amended, at 42 U.S.C. § 1395r-4(j)) and Medicaid Program, Disproportionate Share Hospital Payments, Final Rule, 73 Fed. Reg. 77,904 (Dec. 19, 2008). In December 2011, we testified that the key challenge CMS faced in implementing the statutorily established federal Medicaid Integrity Program was ensuring effective coordination to avoid duplicating state program integrity efforts, particularly in the area of auditing provider claims. At the outset of the Medicaid Integrity Program, CMS stressed the need for effective coordination and acknowledged the potential for duplication with states’ ongoing efforts to identify Medicaid overpayments. However, the National Provider Audit Program results—the largest component of the Medicaid Integrity Program—call into question the effectiveness of CMS’s communication, and its ability to avoid duplication with state audit programs. After examining CMS’s program expenditures, we found that overpayments identified by its audit contractors since fiscal year 2009 were not commensurate with its contractors’ costs. From fiscal years 2009 through 2011, CMS authorized 1,663 provider audits in 44 states. However, CMS’s reported return on investment from these audits was negative. While its contractors identified $15.2 million in overpayments in fiscal year 2010, the combined cost of the National Provider Audit Program was about $36 million. In addition, CMS reported in 2011 that it was redesigning the National Provider Audit Program to achieve better results. Data limitations—in particular, the use of summary data that states submit to CMS on a quarterly basis—may have hampered the contractors’ ability to identify improper claims beyond what states already identified. It remains to be seen, however, whether CMS’s redesign of the National Provider Audit Program will result in an increase in identified overpayments. CMS’s other core oversight activities—triennial comprehensive state program integrity reviews and annual assessments—are broad in scope and were conceived to provide a basis for the development of appropriate technical assistance. However, we found that much of the information collected from the annual assessments duplicated information collected during triennial reviews. Further, our review of a sample of assessments revealed missing data and a few implausible measures, such as one state reporting over 38 million managed care enrollees. Improved data collection activities and dialogue with states will help CMS ensure that it has complete and reliable state information on which to direct its training and technical assistance resources appropriately. Finally, we found that the Medicaid Integrity Institute appears to promote effective state coordination and collaboration. We reported that states have uniformly praised the institute and a special June 2011 session brought together Medicaid program integrity officials and representatives of Medicaid Fraud Control Units—independent state units responsible for investigating and prosecuting Medicaid fraud—in 39 states to improve working relations between these important partners. As we testified in December 2011, CMS’s expanded role in ensuring Medicaid program integrity has presented both challenges to and opportunities for assisting states with their activities to ensure proper payments. We have ongoing work reviewing CMS’s Medicaid program integrity activities that will provide additional information about CMS’s oversight efforts in this area. Chairmen Gowdy and Jordan, this concludes by prepared statement. I would be happy to answer any questions that you or other Members may have. For further information about this statement, please contact Carolyn L. Yocom at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Michelle B. Rosenberg, Assistant Director; Eagan Kemp; Drew Long; Peter Mangano; Christina Ritchie; and Hemi Tewarson were key contributors to this statement. Medicaid Program Integrity: Expanded Federal Role Presents Challenges to and Opportunities for Assisting States. GAO-12-288T. Washington, D.C.: December 7, 2011. Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. Medicaid Managed Care: CMS’s Oversight of States’ Rate Setting Needs Improvement. GAO-10-810. Washington D.C.: August 4, 2010. Medicaid: Ongoing Federal Oversight of Payments to Offset Uncompensated Hospital Care Costs Is Warranted. GAO-10-69. Washington D.C.: November 20, 2009. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-1004T. Washington, D.C.: September 30, 2009. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009. Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009. Medicaid: CMS Needs More Information on the Billions of Dollars Spent on Supplemental Payments. GAO-08-614. Washington D.C.: May 30, 2008. Medicaid Financing: Long-standing Concerns about Inappropriate State Arrangements Support Need for Improved Federal Oversight. GAO-08-650T. Washington D.C.: April 3, 2008. Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.: January 31, 2008. Medicaid Financing: Long-standing Concerns about Inappropriate State Arrangements Support Need for Improved Federal Oversight. GAO-08-255T. Washington D.C.: November 1, 2007. Medicaid Financing: Federal Oversight Initiative Is Consistent with Medicaid Payment Principles but Needs Greater Transparency. GAO-07-214. Washington D.C.: March 30, 2007. Medicaid Financial Management: Steps Taken to Improve Federal Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705. Washington D.C.: June 22, 2006. Medicaid Integrity: Implementation of New Program Provides Opportunities for Federal Leadership to Combat Fraud, Waste, and Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006. Medicaid Financing: States’ Use of Contingency-Fee Consultants to Maximize Federal Reimbursements Highlights Need for Improved Federal Oversight. GAO-05-748. Washington, D.C.: June 28, 2005. Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: June 28, 2005. Medicaid Program Integrity: State and Federal Efforts to Prevent and Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004. Medicaid: State Efforts to Control Improper Payments. GAO-01-662. Washington, D.C.: June 7, 2001. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Medicaid, a joint federal-state health care program, financed care for about 67 million people at a cost of $401 billion in fiscal year 2010. At the federal level, CMS, an agency within the Department of Health and Human Services, is responsible for overseeing the design and operations of states Medicaid programs, while the states administer their respective programs day-to-day operations. The shared financing arrangement between the federal government and the states presents challenges for program oversight and Medicaid has been on GAOs list of high-risk programs since 2003, in part, because of concerns about the fiscal management of the program. Our prior work has shown that CMS continues to face challenges overseeing the Medicaid program. Oversight of managed care rate-setting has been inconsistent. In August 2010, GAO reported that the Centers for Medicare & Medicaid Services (CMS) had not ensured that all states were complying with the managed care actuarial soundness requirements that rates be developed in accordance with actuarial principles, appropriate for the population and services, and certified by actuaries. For example, GAO found significant gaps in CMSs oversight of 2 of the 26 states reviewedCMS had not reviewed one states rates in multiple years and had not completed a full review of another states rates since the actuarial soundness requirements became effective. Variation in practices across CMS regional offices contributed to these gaps and other inconsistencies in the agencys oversight of states rate setting. GAOs previous work also found that CMSs efforts to ensure the quality of the data used to set rates were generally limited to requiring assurances from states and health plansefforts that did not provide the agency with enough information to ensure the quality of the data used. With limited information on data quality, CMS cannot ensure that states managed care rates are appropriate, which places billions of federal and state dollars at risk for misspending. GAO made recommendations to improve CMSs oversight. Oversight of supplemental payments needs improvement. GAO has reported on varied financing arrangements involving supplemental paymentsdisproportionate share hospital (DSH) payments states are required to make to certain hospitals, and other non-DSH supplemental paymentsthat increase federal funding without a commensurate increase in state funding. GAOs work has found that while a variety of federal legislative and CMS actions have helped curb inappropriate financing arrangements, gaps in oversight remain. For example, while there are federal requirements designed to improve transparency and accountability for state DSH payments, similar requirements are not in place for non-DSH supplemental payments, which may be increasing. From 2006 to 2010, state-reported non-DSH supplemental payments increased from $6.3 billion to $14 billion; however, according to CMS officials, reporting was likely incomplete. GAO made numerous recommendations aimed at improving oversight of supplemental payments. Challenges exist related to CMSs role ensuring program integrity. In December 2011, GAO testified that the key challenge CMS faced in implementing the statutorily established federal Medicaid Integrity Program was ensuring effective coordination to avoid duplicating state program integrity efforts, particularly in the area of auditing provider claims. GAO found that overpayments identified by its audit contractors since fiscal year 2009 were not commensurate with its contractors costs, and CMS reported in 2011 that it was redesigning its audit program to achieve better results. Data limitations may have hampered the contractors ability to identify improper claims beyond what states had already identified. With regard to CMSs other core oversight activitiesannual assessments and triennial comprehensive state program integrity reviewsGAO found that much of the information collected from the annual assessments duplicated information collected during triennial reviews. Finally, CMSs Medicaid Integrity Institute, a national training program, appears to promote effective state coordination and collaboration.