Medicaid is a federal-state health care program for low-income and medically needy individuals. For fiscal year 2015, estimated Medicaid spending totaled about $554 billion, and for fiscal year 2014, Medicaid data show it served about 78 million individuals. States administer their Medicaid programs within broad federal rules and according to a state plan approved by CMS, the federal agency that oversees Medicaid. In addition to providing PCS under their state plans, states can also seek permission from CMS to provide PCS under waivers of traditional Medicaid requirements, for example, in order to provide services to a segment of the state’s eligible population. Medicaid is jointly financed by the federal government and the states, with the federal government matching most state Medicaid expenditures using a statutory formula generally based on each state’s per capita income relative to the national average. Factors That May Affect Growth of Care in Home and Community Settings Changes to federal Medicaid law in the last 35 years have expanded states’ options for providing long term care services and supports, including personal care services, in home and community settings. Factors driving these changes may include the desire and increased ability of beneficiaries who are aged and disabled to live in their homes and communities and the Supreme Court’s 1999 Olmstead decision, which held that states must serve individuals with disabilities in community-based settings under certain circumstances. (Olmstead v. L.C., 527 U.S. 581 (1999)). Medicaid is the largest funding source for long-term services and supports in the United States. In fiscal year 2014 (the most recent year for which data are available), total Medicaid spending for long-term services and supports was estimated at $152 billion. Long-term services and supports represent a broad range of health and health-related services and non-medical supports for individuals of all ages that these individuals need over an extended period of time. Long-term services and supports are generally provided in two settings: institutional facilities, such as nursing homes; and home and community settings, such as individuals’ homes or assisted living facilities. Although states’ Medicaid coverage of long-term care services provided in nursing homes is generally mandatory and coverage of these services in home and community settings is generally optional, spending on these services in the home and community setting has increased and now exceeds spending on these services in institutions (see fig. 1). All 50 states and the District of Columbia provide long-term care services to some Medicaid beneficiaries in home and community settings, according to a report produced under contract with CMS. Medicaid PCS are a key component of Medicaid long-term services and supports and include assistance with activities of daily living, such as bathing and dressing, and in some cases instrumental activities of daily living, such as preparing meals and housekeeping. PCS are typically non- medical services provided by attendants—home-care workers who may or may not have specialized training, depending on specific state and federal requirements. Attendants may be employed by a provider agency or self-employed. In some cases, they are friends or family members of the beneficiary and, under certain types of Medicaid PCS programs, can be spouses, parents, or other legally responsible relatives. States can use different delivery models to provide PCS to beneficiaries. Under an agency-directed model, a provider agency employs attendants. The provider agency hires, fires, pays, and trains the attendant to provide PCS services to Medicaid beneficiaries. Under a participant-directed model, beneficiaries or their representatives have more choice and control over the PCS the beneficiary receives and have the authority to manage PCS services by selecting, hiring, firing, and training attendants themselves. States can implement hybrid forms of these models as well; for example, by using an attendant from a provider agency but allowing the beneficiary to be involved in directly managing the attendant by doing such things as scheduling services, providing training on the beneficiary’s specific needs, and, if needed, discharging the attendant. With approval from CMS, states can choose to provide PCS under one or more types of programs authorized over the past 41 years under different sections of the Social Security Act. The various types of programs provide states with options for permitting participant direction and choices about how to limit services, among other things. For example, two types of PCS programs (HCBS Waiver and Community First Choice programs) only serve beneficiaries who are eligible for an institutional level of care; that is, beneficiaries must have needs that rise to the level of care usually provided in a nursing facility, hospital, or other institution. Some types of PCS programs require the state to provide PCS to all Medicaid beneficiaries who are eligible (PCS State Plan and Community First Choice programs), while other programs (HCBS waivers and State Plan HCBS programs) allow the state to target certain beneficiary populations (see table 1). Appendix I provides more details on the PCS programs offered by the selected states included in our review. Some beneficiaries receiving PCS can be at risk for unintentional harm as well as potential neglect, abuse, and exploitation by their attendants because of their underlying conditions. In October 2016, the HHS OIG reported cases of beneficiaries being abused or neglected by their attendants. For example, one beneficiary was hospitalized for dehydration and malnourishment after her attendant neglected her care. In 2010, the HHS OIG reported that of 55 PCS beneficiaries or their family members interviewed in New York, there were 11 reports of a beneficiary being subject to theft, 5 reports of physical abuse or threats, and 2 reported that they were abandoned by their attendant. Beneficiaries may also be at risk of unintentional physical harm from falling, particularly when the attendant cannot safely transfer clients effectively from a bed to a chair. Some beneficiaries receive care from a friend or family member, but these relationships may not always protect vulnerable beneficiaries from abuse. In addition, beneficiaries may be at risk for self-neglect or other health challenges if their attendants do not show up to provide services when scheduled or are not trained to identify signs of diminished health. A beneficiary’s capacity to manage finances and secure possessions may decline with age, onset of dementia, or other cognitive disabilities, and put them at risk of theft or financial exploitation from unscrupulous attendants for example, the unauthorized use of a beneficiary’s credit cards by an attendant. The federal Medicaid program requirements governing the provision of PCS derives from statutes enacted at different times in Medicaid’s history (see table 1). CMS has implemented these different statutory requirements by issuing regulations, as well as guidance to help states implement their Medicaid programs in accordance with applicable statutory and regulatory requirements. Guidance can include letters to state Medicaid directors, program manuals, and templates to help states apply for CMS approval to provide certain services like PCS. Together with federal statutes, the regulations and guidance issued by CMS establish a broad federal framework for the provision of PCS. States are responsible for establishing and administering specific policies and programs within the federal parameters laid out in this framework. Medicaid program requirements vary by the type of PCS program, but may include the following types of protections depending on the type of program: screening attendants to see if they are excluded as Medicaid providers; developing minimum qualification standards for attendants; establishing quality assurance processes to ensure the services provided protect the health and welfare of beneficiaries; identifying and reporting cases of potential abuse, neglect, or other events that harm, or could result in harm to beneficiaries; establishing policies and processes to ensure that services for which the state has been billed were actually provided; and reporting on the health and welfare of beneficiaries to CMS on a regular basis. The Social Security Act requires each state to designate a single state agency to administer or supervise its Medicaid program. States may designate other state and local agencies to administer and oversee the entirety of their PCS programs, or certain functions, including beneficiary enrollment or beneficiary case management. States may administer different PCS programs because the programs were designed for certain types of beneficiaries. For example, one state administers one PCS program for beneficiaries with developmental disabilities and another PCS program for those with physical disabilities. Sometimes county or other local governments provide certain Medicaid services under state Medicaid agency oversight. For example, many Medicaid programs employ county case managers who help beneficiaries gain access to needed services, including PCS. Other state or local government programs may be involved with Medicaid PCS beneficiaries, but do not directly participate in a Medicaid program. For example, almost all states have Adult or Child Protective Services, agencies that investigate and take action when allegations of maltreatment are reported. Generally, Adult Protective Service officials may work with both Medicaid beneficiaries and non-Medicaid clients, but are generally not located within a state’s Medicaid office according to an expert. In fee-for-service arrangements, attendants receive payment by submitting claims to state Medicaid agencies for the PCS they provided. Independent attendants—those who do not work for a provider agency— submit claims directly to a state Medicaid agency. Attendants who work for a provider agency typically give that agency information on the services rendered, and then the provider agency submits claims on behalf of the attendant. Both types of claims submitted to state Medicaid agencies generally identify the dates of the service, the types of services provided, and the Medicaid beneficiaries who received the services. Claims for PCS are often paid based on the duration of care. States must seek approval from CMS to implement one or more types of PCS programs by submitting proposals to CMS that explain how the state will comply with federal requirements. Upon CMS’s approval and consistent with any applicable federal requirements, states may impose additional state requirements to implement the programs. While states’ policies and procedures for providing PCS can vary across states and within a state across different PCS programs, several key steps are generally involved. As illustrated in figure 2, for Medicaid beneficiaries, states must determine beneficiaries’ eligibility for PCS, arrange for the development of a plan of service, and help connect beneficiaries to an attendant who is authorized to provide services. To oversee PCS provided to beneficiaries, states may perform a number of functions such as screening and requiring training of attendants and overseeing the delivery of services. All four selected states—California, Maryland, Oregon, and Texas— reported employing safeguards to protect beneficiaries from harm and had methods in place to ensure billed services were actually provided, but the states varied in how they implemented them and, in some cases, variations existed within states across PCS programs. The four states also reported using different methods to help ensure billed services were provided (see Appendix I for the types of PCS programs reviewed in each state). All four selected states reported employing safeguards in three common areas to help ensure Medicaid beneficiaries receiving PCS in their homes are safe from harm: (1) attendant screening and training; (2) beneficiary monitoring; and (3) addressing unusual incidents. However, states’ specific safeguard implementation methods and requirements varied by state and, in some cases, varied within a state across PCS programs. According to state Medicaid officials, many factors may affect the methods states choose to implement beneficiary safeguards, such as beneficiary risk levels, the extent to which beneficiaries are responsible for managing their own services, how state Medicaid programs are structured, input from stakeholders such as consumer advocacy groups, and state and federal requirements. All four selected states reported that attendants are required to undergo some form of background screening in all their PCS programs, but the specific background information checked varied by state. Background screenings could entail, for example, a criminal background check or a determination of whether the individual was listed on certain federal or state lists or registries, such as the HHS OIG list of excluded providers or a state’s list of excluded providers. All four selected states reported that attendants in all PCS programs are required to undergo a criminal background check. Three of the four states also required checking attendants against HHS’s OIG list of excluded providers in all state PCS programs; under Oregon’s Participant-Directed Option, the beneficiary or a representative is responsible for screenings beyond the criminal background check. Each of the four selected states also required some additional background screenings in all or most PCS programs, including checking other federal databases, and three states required checks against state administered provider lists and registries (see table 2). With the exception of the Community First Choice Option, federal PCS program requirements generally leave it to the states to establish specific attendant screening requirements. The four selected states varied as to how they used the results of criminal background checks. Beneficiaries under California’s PCS program can hire their preferred attendant in some cases if the attendant has been convicted of certain types of felonies, such as fraud against a social services program. Oregon Medicaid officials reported that they exclude attendants convicted of certain crimes, such as murder, robbery, and rape. The state has a weighing process for some crimes, such as theft or financial crimes, to determine whether or not the attendant should be excluded from providing services, according to officials. Texas Medicaid officials reported that under all state PCS programs, the state bars employment of attendants convicted of certain crimes, such as homicide and arson. Maryland Medicaid officials reported that under all state PCS programs, provider agencies decide if they want to hire a particular attendant. Balancing Attendant Qualifications with Supply of Attendants In deciding what, if any, training to require of attendants, states may balance making sure attendants are qualified to provide care with the need for an adequate supply of attendants to support the demand for in-home PCS. While more training can be beneficial for beneficiaries, training requirements can pose a barrier to participation for some attendants and diminish the supply of attendants. Regarding attendant training, each of the four selected states reported requiring that attendants receive initial training or complete an orientation for all or most state PCS programs, but specific requirements varied by state and in some cases within a state by PCS program. Under four PCS program types (State Plan PCS, HCBS Waivers, State Plan HCBS, and Community First Choice programs delivering PCS through provider agencies) states may define qualifications for attendants. The Participant- Directed Option program and Community First Choice program permit the beneficiary to train their attendants in their specific areas of personal assistance needs. Some of the selected states may require attendants to complete an orientation, but do not consider to be training. For example, California officials reported that while they require attendants in all programs to complete an orientation, they do not have initial training requirements. Oregon officials also reported that while they have no initial training requirements, they do require attendants to complete an orientation. Attendants may be required to receive additional training if they are going to provide certain healthcare services to beneficiaries, such as medication administration. All four selected states reported that attendants are permitted to perform such services in at least some programs but generally only after they are trained by nurses or other health professionals to perform the specific task. In three selected states this was done through nurse delegation, which allows nurses to delegate specific tasks to unlicensed individuals, accompanied by concomitant training and supervision. California does not permit nurse delegation, but does allow a licensed nurse or other healthcare professional to train an attendant to provide certain services, such as medication administration. All four selected states reported that in all or most PCS programs attendants were required to be trained in, or receive information on, their responsibilities regarding critical incidents, such as whether they are mandated to report incidents and how to recognize and report critical incidents. Critical incidents are events or situations that cause or may cause harm to a beneficiary’s health or welfare, such as abuse, neglect, or exploitation. Texas required attendants to undergo periodic renewal or refresher training in some programs, although requirements vary by program. For example, under the State Plan PCS program provided to beneficiaries under age 21, provider agencies must ensure a continuing systematic training program for all attendants. In addition, Maryland requires attendants to receive training on cardiopulmonary resuscitation every two years. Table 3 shows the type of training or orientation requirements in selected states. All four selected states reported that beneficiaries’ health and welfare is monitored in part by having case managers or nurses periodically check in with beneficiaries, but the frequency and means, such as in-person versus by phone or electronic message, varied among the four states and in some cases within states across PCS programs. States generally have flexibility on how they monitor beneficiaries, as Medicaid PCS program monitoring requirements are broad and do not prescribe specific frequencies or means for checking in with beneficiaries beyond requirements for annual reassessments or annual reviews of beneficiary plans of care (see table 4). State beneficiary monitoring requirements may be based on such factors as federal Medicaid PCS program requirements, as well as on state goals for balancing beneficiaries’ safety with respecting beneficiaries’ autonomy. Some selected states based the frequency of beneficiary monitoring on the risk level of the beneficiaries. For example, according to officials, Oregon’s State Plan PCS program serves beneficiaries who do not need an institutional level of care, and Oregon state officials determined that certain beneficiaries receiving services under this program could be safe with less monitoring than beneficiaries in PCS programs that serve those with greater health needs. When beneficiaries need healthcare services, such as medication administration, attendants may be allowed to provide these services; doing so may result in additional beneficiary monitoring in some states. Three of our four selected states permitted nurse delegation under all or some PCS programs. These three states—Maryland, Oregon, and Texas—required post-delegation follow-up by a nurse in these cases. For example, if an attendant administers medication to a beneficiary under nurse delegation in Maryland, a nurse must conduct an in-home visit at least every 45 days (see table 5). California does not permit nurse delegation, which places ongoing responsibilities on the nurse, such as monitoring. Instead, California permits attendants to perform certain services that a nurse might perform, called “paramedical services,” once they are ordered by a licensed professional and the beneficiary (or an authorized representative) has provided informed consent. After training the attendant, the health professional is not required to perform ongoing monitoring of the attendant. All four selected states reported that systems were in place to address unusual incidents, including provider back-up plans and tracking critical incidents involving beneficiaries. Unusual incidents are events that adversely affect or have the potential to adversely affect beneficiary health and safety, such as an attendant missing an appointment, as well as critical incidents. In general, a back-up plan is part of a customized service plan designed to ensure that an individual beneficiary receives the services and supports they need to remain safely in their homes. The plan identifies situations that could jeopardize a beneficiary’s safety and establishes a strategy to prevent or manage such situations. A back-up plan typically identifies individuals who may be called if an attendant does not show up as scheduled. Critical incidents include abuse, neglect, or other events that harm, or could result in the harm of, beneficiaries. All four selected states reported requiring individualized provider back-up plans for beneficiaries in all or most of the PCS programs they administer. California and Maryland require provider back-up plans for beneficiaries in all state PCS programs. Oregon requires provider back-up plans under the Participant-Directed Option and Community First Choice, but not under State Plan PCS. Oregon Medicaid officials explained that this is because the majority of beneficiaries receiving services under State Plan PCS receive a small number of hours—typically 20 hours or less—of services per month. Texas requires provider back-up plans under all state PCS programs delivered under the agency-provider model. Under programs operating under Texas’s participant-directed model, according to officials, the beneficiary or beneficiary representative must develop a provider back-up plan under some circumstances, such as when having a back-up plan is required by the rules of the program. All four selected states reported that the state tracked information about critical incidents involving Medicaid beneficiaries receiving PCS; however, what information they tracked and the type of data system or systems varied by state and in some cases within states by PCS program. With the exception of State Plan PCS, states are required to implement processes or systems to address critical incidents in PCS programs. One way states can attempt to assure that beneficiary safeguards are working is by tracking information such as the frequency and type of reported incidents. Tracking incident information can also promote beneficiary safety by making it easier for states to identify trends or patterns that can lead to improved program safety. All four selected states reported that they tracked information on incidents that they define as critical, and all four states’ definitions of critical incidents included, at a minimum, beneficiary abuse and neglect. California, Maryland, and some programs in Oregon and Texas, however, added other types of incidents to their definitions of critical incidents, such as accidental injuries. Two states, Oregon and Texas, defined critical incidents differently under different types of PCS programs. For example, Oregon operates PCS programs through separate departments that serve different beneficiary populations. The department that serves beneficiaries who are aged or those with physical disabilities includes abuse, neglect, and exploitation. The department serving individuals who have intellectual or developmental disabilities includes additional incidents such as serious illness or accidents. Three states—Maryland, Oregon, and Texas—identified and tracked in their data systems the type of critical incident that occurred. How states tracked information also varied by state, with two of the four states (California and Maryland) using a single statewide case management data system to track critical incidents, and the other two states (Oregon and Texas) using multiple systems (see table 6). Critical incidents involving Medicaid PCS beneficiaries can be reported to and investigated by entities other than state Medicaid agencies, such as Adult Protective Services for adult beneficiaries. Adult Protective Services officials are generally not located within a state’s Medicaid office; as a result, Medicaid staff may not learn of incidents involving Medicaid PCS beneficiaries that are reported directly to Adult Protective Services unless Adult Protective Services staff share this information. We asked Medicaid officials in each of the four selected states about the extent to which state Adult Protective Services staff share information with state Medicaid staff when Adult Protective Services investigates a case involving a Medicaid PCS beneficiary. California officials reported that while there is no policy requiring Adult Protective Services to share such information, such communication is allowed. Maryland officials reported that there is no statewide policy requiring Adult Protective Services to communicate information and findings to Medicaid case managers, but that they can generally find out whether an allegation is substantiated or not. Oregon officials told us that there can be an ongoing dialog between Adult Protective Services and case managers about beneficiaries, and it is expected that Adult Protective Services will notify a beneficiary’s case manager when there is a substantiated finding against the beneficiary’s attendant. The case manager then notifies the Medicaid program to take action against the attendant. In Texas, Adult Protective Services reports the results of its investigations to Medicaid officials at the originating state agency, according to state officials. Medicaid officials in each of the four selected states described whether they permitted the state Medicaid agency to terminate an attendant if the attendant poses a risk to the beneficiary yet has not been convicted of a crime. Maryland and Oregon (in some programs) permitted termination. In California, an attendant can be terminated if the attendant has been convicted of certain types of crimes. Texas Medicaid officials reported that the attendant’s employer, not the Medicaid agency, makes employment decisions based on the results of an Adult Protective Services investigation. The attendant can either be employed by a provider agency or by the beneficiary or beneficiary representative. The four selected states in our study reported using various methods to ensure attendants provided billed services to beneficiaries. For example, for at least some PCS programs, two states required beneficiaries to sign timesheets, two states used electronic visit verification timekeeping systems, and all four states performed quality assurance reviews for some PCS programs to ensure billed services are received. Among our four selected states, Maryland and Texas used electronic verification systems in at least some programs, Oregon is in the process of acquiring a system, and California does not use such a system (see table 7). Electronic visit verification timekeeping systems are newer, technology- based systems that electronically record when attendants begin and end providing services to a beneficiary. Such systems may include features to verify the attendant’s location and make sure the attendant is in the beneficiary’s home. These systems require a device like a phone, computer, or other device to track attendants’ start and stop times. For example, HHS reported on one electronic visit verification system. The system relied on attendants clocking in and out via a telephone in the beneficiary’s home, and if the attendant did not clock in within 15 minutes of the scheduled visit, an electronic alert was sent to the provider agency. Private Sector Use of Electronic Visit Verification Systems Three out of the four private entities we spoke with cited electronic visit verification, among other safeguards, as a key practice that helps both to keep clients safe and to ensure that billed serviced are provided. Some private sector entities we spoke with said they used electronic visit verification to track and verify attendants’ check-in and check-out times to help ensure that they are showing up to deliver services. For example, the systems allowed one entity to compare hours billed to those worked, and another entity to review daily log notes, such as the tasks performed, to gather details on specific shifts. An electronic visit verification system can generate alerts when an attendant’s time-in or time-out recordings fail to match a client’s schedule or the scheduled duration of services, when an attendant records visit information in a location other than a client’s home, or when the tasks performed do not match the signed authorization. One private entity we spoke with uses a system that has more sophisticated capabilities; for example, attendants can use the system to report clients’ changes in health condition—such as a decline in the client’s ability to perform an activity of daily living—and can send messages to a third party, such as the client’s case manager, when further assistance or consultation is needed. One private sector entity reported that electronic visit verification decreased costs. An official from this entity stated that the technology helped reduce costs related to travel time by 10 percent because the system resulted in more accurate time and travel reporting. The official stated that the technology creates efficiencies; for example, it streamlines processes, allowing administrative staff to focus on quality rather than on paperwork. In addition to direct financial savings, this official believed that electronic visit verification may deter people with nefarious intentions from seeking home care employment because of the level of monitoring these systems add. Medicaid officials from Maryland and Texas described the benefits they found using electronic verification systems: Maryland Medicaid officials cited four benefits of electronic visit verification: (1) more accurate and valid reporting of time; (2) realizing cost savings because the state is only paying for services when the attendant has verified through the system that they are in the beneficiary’s home; (3) collecting data, which allows the state to more easily review trends and identify potential service issues; and (4) absolving beneficiaries from the responsibility for verifying that an attendant’s timesheets are correct. Texas Medicaid officials reported they were motivated to use electronic visit verification because fraud is a concern, noting that the system captures when attendants actually start and stop providing services. Officials explained that attendants could easily record on paper timesheets the times they were supposed to provide services instead of the times they actually provided services. Officials reported that the use of an electronic visit verification system has saved the state money. Oregon Medicaid officials reported that the state is in the process of acquiring an electronic visit verification system and anticipate that the system will be able to track attendants’ time more accurately than paper timesheets. California Medicaid officials reported that they have no current plans to use electronic visit verification. California officials explained that they do not think this is an effective option because a high percentage of attendants in the state’s PCS program are friends or family members, some of whom live with the beneficiary. Three of the four private-sector entities we interviewed named electronic visit verification systems as a key practice for ensuring billed services are provided (see Text Box, “Private Sector Use of Electronic Visit Verification Systems”). Other practices used by these entities include: communicating with clients and their families, conducting unannounced monitoring visits, training attendants, and conducting attendant background checks. The private entities reported providing PCS to clients in multiple states, but have established some similar policies and procedures to use regardless of location. Since 2010, CMS has taken several steps to improve oversight of states’ PCS programs to help ensure that beneficiaries are safe and that billed services are provided. CMS has taken the following steps: Issued guidance to strengthen HCBS Waiver requirements. In March 2014, CMS issued guidance to strengthen requirements for beneficiary health and welfare and ensure that billed services are provided in HCBS Waiver programs by adding more detailed requirements. For example, CMS added requirements that states ensure that an incident management system is in place to address incidents that could harm beneficiaries and provide evidence that payments are only made for services rendered. Reviewed annual HCBS Waiver information submissions. In September 2014, CMS contracted with a private company to review information states submit to CMS on HCBS Waiver programs. The information includes measures that states track to ensure the health and welfare of beneficiaries and that billed services are provided. The contractor identified concerns such as variation in both the frequency and methods states used to monitor attendants. The contractor also noted positive findings such as states’ implementation of policies and processes to verify that attendants have provided care. Developed a toolkit, webinars, and training for states on how to prevent improper payments. Since 2010, CMS has also taken several steps to assist states’ efforts to reduce PCS improper payments. CMS issued a toolkit and conducted three webinars that describe program integrity concerns and best practices for addressing them. In addition, CMS’s program integrity training center for state officials, the Medicaid Integrity Institute, has held a number of courses on issues related to PCS or HCBS. For example, in June 2013 the Institute held a course on fraud related to personal care attendants. Reviewed state PCS programs. Since 2013, CMS has assessed and issued reports on three state PCS programs. All three reviews identified vulnerabilities to improper payments and two identified vulnerabilities in beneficiary safeguards. Findings included attendants being paid for more hours than authorized, billing for services not rendered, a lack of a process to track attendants that have been subject to disciplinary actions, and infrequent updates to attendant background checks and screenings. CMS made a number of recommendations to individual states, such as: refunding the federal share of one state’s overpayments; requiring background screenings at least once every five years; and tracking attendants who have received disciplinary sanctions. In contrast to the steps CMS has taken to improve oversight of states’ PCS programs, as of August 2016 CMS had not systematically collected all required state information and measures of beneficiaries’ health and welfare for the Participant-Directed Option and Community First Choice programs, nor had CMS implemented a process for states to submit the information to CMS for these programs. CMS officials told us that they are working to develop guidance for states to submit some of the information. In addition, CMS also had not exercised its authority to request information that states are required to maintain on the quality measures they use to evaluate their PCS programs, as of August 2016. CMS is responsible for monitoring and overseeing states’ implementation of federal requirements. Required reporting. Federal law requires states to report certain information related to the health and welfare of beneficiaries to CMS for two PCS programs. This required reporting will help inform CMS and Congress about the health and welfare of beneficiaries receiving services from these programs. CMS officials told us that they are working on developing guidance for states to submit the required information. For the Participant-Directed Option program, CMS has not collected the evaluations states are required to provide every 3 years. States are required to provide an evaluation of the overall impact of the program on the health and welfare of participating beneficiaries compared to non-participants. The first state was approved for a Participant-Directed Option program in 2007, and eight other states were subsequently approved, all in 2008 through 2010. In 2008, CMS stated that it would issue further guidance on the requirement, but this guidance has not been completed. Officials from one state told us that although CMS did not request the required information, the state submitted it to CMS. CMS officials stated that they have not analyzed the data from that state as of June 2016. For the Community First Choice program, CMS has collected data once in the 4 years that states have been approved to provide PCS under Community First Choice, despite the requirement for states to submit the data annually. HHS collected required state data on the physical and emotional effects of the programs on beneficiaries; these data were summarized in a report on Community First Choice released in 2016. CMS officials told us in August 2016 that they are working on developing guidance for states to submit the required information and expect to issue guidance for the Community First Choice program in 2016. Reporting measures. CMS may collect other information on the Participant-Directed Option and Community First Choice programs. States are required to track quality measures on an ongoing basis as part of their quality assurance systems. The measures must be made available to CMS upon request. For the Participant-Directed Option program, CMS officials told us that they were not aware of any CMS requests for information from states on the quality of care measures they use to monitor the performance of their PCS programs, such as the percentage of beneficiaries’ cases reviewed in which a critical incident occurred. For the Community First Choice program, officials told us that CMS has not requested information from states on the measures they use to assess beneficiaries’ outcomes resulting from the PCS services they receive, particularly for health and welfare. CMS officials have stated, however, that the measures are an important component to help ensure quality, and plan to collect the information after guidance related to collecting the measures is issued. Because CMS does not collect or analyze the required reports on beneficiary outcomes or the available data on quality measures used, CMS may not know the effects that these programs are having on beneficiaries’ well-being and may not be able to assess the extent to which the quality measures being used by states actually reflect the quality of care beneficiaries receive. CMS officials cited some steps the agency has taken to harmonize requirements across the different types of PCS programs. Agency officials described CMS’s efforts towards harmonization of requirements: CMS issued a final rule in 2014 that will help result in some harmonization across HCBS Waiver programs, State Plan HCBS programs, and Community First Choice programs, agency officials told us. The rule established new requirements for what constitutes a home- and community-based setting, among other things. For example, the 2014 final rule provides clarification and guidance to determine what community care settings other than a beneficiary’s home—such as assisted living facilities—can be considered non- institutional settings and be eligible for home and community-based services. The rule also required that beneficiaries’ plans of care reflect risk factors and have measures in place to minimize them, including back-up plans for beneficiaries who need them. These requirements were new for HCBS Waivers and State Plan HCBS program. Community First Choice programs had already been required to address risk factors. For HCBS Waiver, State Plan HCBS, and Community First Choice programs, the rule added requirements that states assure that services and supports will not harm beneficiaries. CMS’s contractor’s ongoing review of states’ annual HCBS Waiver reports could result in some harmonizing between programs that provide PCS. As CMS’s contractor develops findings on how states’ compliance with HCBS Waiver requirements, CMS officials stated that where information can be shared across authorities to ensure efficiencies and consistencies, CMS will do so in the future. CMS has implemented an effort to harmonize requirements for two types of PCS programs. CMS officials stated that states seeking approval for a State Plan HCBS program are directed to requirements in CMS guidance for HCBS Waivers. CMS officials said that State Plan HCBS and HCBS Waivers offer many of the same services and it makes sense to oversee them in a similar manner. CMS has not issued the guidance directing states to use HCBS Waiver guidance as of August 2016, but rather, CMS regional office staff communicate the requirements for HCBS Waivers to those states requesting approval for State Plan HCBS programs, according to CMS officials. However, we found that CMS’s efforts have not addressed the significant differences across federal program requirements specific to PCS related to beneficiary safety and ensuring that billed services are provided. For example, states implementing an HCBS Waiver program or a State Plan HCBS program must describe to CMS how the state Medicaid agency will determine that it is assuring the health and welfare of beneficiaries. To do so, states must describe: the activities or processes related to assessing or evaluating the program; which entity will conduct the activities; the entity responsible for reviewing the results; and the frequency at which activities are conducted. In contrast, this level of detail on the evaluation process is not required for states implementing a State Plan PCS program or a Community First Choice program. Similarly, states implementing an HCBS Waiver program or a State Plan HCBS program must demonstrate that an incident management system is in place, which requires states to document and provide the following details to CMS: indicate whether the state operates a critical incident reporting and management process; list and define critical incidents; identify entities or individuals who must report critical incidents and the reporting method (for example, phone or web-based reporting system); specify the timeframe within which critical incidents must be reported and the entity to which reports are made for each type of incident; identify the entities responsible for evaluating reports of critical incidents and how the incidents are evaluated; identify the entity responsible for following up on investigations of critical incidents and the time frame for completing an investigation; and explain the process and time frames for informing the beneficiary and other relevant parties of the results of an investigation. In contrast, states implementing a State Plan PCS program or a Community First Choice program are not required to provide similar information on their critical incident management process but, more generally, are required to describe their “process for the mandatory reporting, investigating and resolution of allegations of neglect, abuse, or exploitation.” The State Plan PCS program does not have incident management reporting requirements. Other significant differences among PCS program requirements relate to ensuring that billed services are provided. States implementing HCBS Waiver programs and State Plan HCBS programs are required to provide evidence that the state is only paying claims when services are actually rendered, while the State Plan PCS and Community First Choice programs are not required to do so. See table 8 for state Medicaid program requirements for ensuring the health and welfare of PCS beneficiaries and that billed services are provided. Based on numerous reviews of state PCS programs, the HHS OIG recommended that CMS issue regulations to reduce the significant variation in states’ PCS requirements for documenting claims for payment for services, supervision of attendants, and attendant qualification standards. Harmonizing requirements across similar programs is also consistent with federal internal control standards. These standards state that agencies should establish control activities that appropriately cover the objectives and risks of an entity’s operations. Further, risk management standards published by an international standard-setting organization suggest that a consistent process and comprehensive framework can help to ensure that risk is managed effectively, efficiently, and coherently. In the case of PCS, a consistent internal control process could include having policies and processes in place that would provide comparable assurances for protecting Medicaid beneficiaries from harm and ensuring that state and federal funds are paid only when services are actually provided, regardless of the program in which beneficiaries are enrolled. In addition, the Patient Protection and Affordable Care Act directed HHS to take steps to improve the coordination among and regulation of all providers of home- and community-based services—which includes PCS provided under different federal authorities—to achieve a more consistent administration of policies and procedures across programs. Our prior review of selected states’ implementation of HCBS options also suggests that states could benefit from more harmonization of HCBS guidance, as officials in selected states noted the complexity of operating multiple programs. In that review, officials from one state reported that the complexity resulted in a siloed approach, with different enrollment, oversight, and reporting requirements for each program. The administration and understanding of the programs available to beneficiaries is difficult for state staff and beneficiaries, according to officials in another state. The officials indicated that they would prefer CMS issue guidance on how states could operate the different HCBS program types together, rather than issuing guidance on each program separately. CMS officials told us the agency is not currently taking additional steps to harmonize requirements—within the limits of the various statutes—in response to the Patient Protection and Affordable Care Act, but may make federal guidance more similar in the future. First, officials said that they want to provide states with flexibility to implement programs that meet each state’s needs. Second, CMS officials said that the statutes authorizing the programs are different. CMS officials also stated that in the future, where the statute and regulations are similar across programs, they will work on making federal policy the same or similar. In addition, officials stated that when CMS identifies a good oversight policy or practice being used by a state for one type of PCS program, CMS can discuss best practices that may be applicable to other authorities, but CMS cannot suggest that such best practices are required. In addition to creating complexities for states and others in understanding federal requirements governing different types of HCBS programs, including PCS, the differing federal requirements across the different types of PCS programs may result in significant differences in beneficiary safeguards and fiscal oversight: Beneficiaries may experience different health and welfare safeguards depending on the program in which they are enrolled. For example, in one state we reviewed, the state requires quarterly or biannual monitoring of beneficiaries for most of its PCS programs. For a State Plan PCS program, the state requires only annual monitoring contacts. Officials told us that the reason for this difference was due to the lack of a requirement that states provide assurances to CMS that they will safeguard beneficiaries’ health and welfare. CMS may also have fewer assurances that similar beneficiaries’ safety is protected. Three of the four states we reviewed—Maryland, Oregon, and Texas—transitioned coverage of PCS for beneficiaries who need an institutional level of care from PCS programs with relatively more stringent federal beneficiary safety requirements to programs with relatively less stringent requirements. Specifically, the states transitioned PCS from HCBS Waiver programs to Community First Choice programs. In doing so, state officials in the three states reported that the state chose to apply the same quality assurance measures to services received under both the HCBS Waiver program and the Community First Choice program. Officials in two of the states said that maintaining the processes was the best way to ensure safety for beneficiaries. The states were not required to apply the same quality measures across programs, and CMS has no assurance that states that transition PCS from HCBS Waivers to Community First Choice in the future will make the same decisions. States can use different processes for each PCS program to ensure that billed services are actually provided, and some programs may not be subject to federal PCS requirements explicitly in this regard. For example, in one state we reviewed, steps taken to ensure billed services are provided under some types of PCS programs are not required in another of the state’s programs. The state reported that it used its quality assurance process in some of its PCS programs to meet with and verify service delivery with the beneficiary in an effort to ensure that billed services are provided. For example, in one PCS program, a supervisor must visit the beneficiary and document whether the attendant is delivering the authorized PCS tasks. In training materials, CMS recommended states take such an approach to detect fraud in PCS programs. The state did not apply the same process to a State Plan PCS program, and federal requirements for State Plan PCS do not include requirements that states help ensure that PCS billed services are provided specifically. Over the years, federal laws have given states a number of different options and incentives to provide Medicaid home- and community-based services. PCS are important to beneficiaries and amount to billions of dollars and expected rising costs to the federal government and states. As the federal government continues to encourage states to offer Medicaid services in community settings and as demand for such services continues to grow, CMS could do more to obtain and use information from states about their programs. CMS has not collected information states are required to prepare on two PCS programs that would inform the agency of the effects that certain PCS programs are having on beneficiaries’ well-being. Although these programs have not yet been widely adopted by states, it is likely these will grow in prevalence given incentives for states to adopt certain programs and provide more home- and community- based services. Without the required information, CMS is missing opportunities to monitor states’ programs to ensure that potentially vulnerable beneficiaries are receiving quality care. Although the various options for providing PCS have helped facilitate and encourage states to provide care for more beneficiaries in their homes, they have also resulted in a patchwork of federal requirements among programs, resulting in varying levels of beneficiary safeguards and requirements to ensure that billed services are actually provided. As a result, beneficiaries with similar needs could be receiving services in programs with significantly different safeguards in place depending on the program. Similarly, the type of fiscal controls required to prevent improper payments for these services can vary based on the type of program. Congress and others have called on HHS to take steps to improve the coordination and administration of home- and community-based services. HHS could do more towards this end by, within limits of existing law, harmonizing the patchwork of federal program requirements. A more consistent administration of policies and procedures across programs could ease some of the differences and provide some comparable approaches to safeguards and assurances and help the federal government and states better manage risks to beneficiaries and to protect the integrity of the program. CMS has taken some needed steps to harmonize requirements across the program authorities; however, significant differences remain in the federal program requirements that serve as the basis for state oversight policies and protections for their different PCS programs. To achieve a better understanding of the effect of certain PCS services on beneficiaries and a more consistent administration of policies and procedures across PCS programs, we recommend the Acting Administrator of CMS take the following two actions: collect and analyze states’ required information on the impact of the Participant-Directed Option and Community First Choice programs on the health and welfare of beneficiaries as well as the state quality measures for the Participant-Directed Option and Community First Choice programs; and take steps to harmonize requirements, as appropriate, across PCS programs in a way that accounts for common risks faced by beneficiaries and to better ensure that billed services are provided. We provided a draft of this report to HHS for comment. HHS concurred with our recommendations and noted efforts to address them. HHS stated that it plans to issue guidance for states to submit information on Community First Choice programs and is exploring the value of collecting information from states on Participant-Directed Option programs. HHS stated it will continue to take steps to assess areas to harmonize program requirements across PCS programs, including soliciting information from states, stakeholders, and the public on ideas for doing so. On November 9, 2016, CMS published in the Federal Register a request for information on numerous topics related to Medicaid home and community-based services, including input on how to ensure beneficiary health and safety and program integrity across different types of PCS programs. Input received could lead to harmonizing some program requirements. HHS also provided technical comments, which we incorporated as appropriate. HHS’s comments are reprinted in appendix II. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, relevant state agencies, and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or iritanik@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. California provides personal care services (PCS) to Medicaid beneficiaries under the following programs: State Plan PCS, Participant- Directed Option (paired with the State Plan PCS program), and Community First Choice (see table 9). California operates these three programs together in a program called In-Home Supportive Services. The California Department of Social Services oversees In-Home Supportive Services, which is generally administered by staff in each county. In-Home Supportive Services operates almost entirely under a participant-directed delivery model. Many beneficiaries choose a relative or friend to be their attendant: 69 percent of attendants in In-Home Supportive Services were a friend or family member of the beneficiary; and 58 percent of attendants live with the beneficiary. Other beneficiaries seek an attendant through county-maintained registries of attendants who are seeking positions. In 2011, California became the first state to adopt a Community First Choice program. At the time, some beneficiaries previously served through In-Home Supportive Services under State Plan PCS were transitioned into Community First Choice. Officials told us that the Community First Choice program provides an opportunity for California to enhance the state’s PCS services, and gain the enhanced federal matching rate. Maryland provides PCS to Medicaid beneficiaries under both State Plan PCS and Community First Choice (see table 10). Maryland operates these two programs (called Community Personal Assistance Services and Community First Choice) under the Maryland Department of Health and Mental Hygiene. Generally, county-based agencies assess Medicaid eligible beneficiaries for their PCS needs, and case managers and nurses monitor beneficiaries. In 2015, Maryland implemented changes to its two PCS programs to make all PCS delivered through provider agencies. However, beneficiaries may still choose a relative or friend to be their attendant. To do so, officials told us that case managers direct friends and relatives to PCS provider agencies that may hire them as attendants. Officials estimated that before the change, about one-third of beneficiaries received services through the participant-directed model. Before its Community First Choice program was approved in 2014, Maryland provided PCS under HCBS Waiver and State Plan PCS. Maryland continues to provide certain services, such as case management, to some beneficiaries under an HCBS Waiver, but provides PCS through Community First Choice. Officials told us that, when transitioning to Community First Choice, close to 90 percent of State Plan PCS beneficiaries were found to need an institutional level of care. These beneficiaries now receive PCS through Community First Choice, while beneficiaries who do not require an institutional level of care receive services through State Plan PCS. Oregon provides PCS to Medicaid beneficiaries under State Plan PCS, Participant-Directed Option (paired with an HCBS Waiver), and Community First Choice (see table 11). Two departments implement the programs: Aging and People with Disabilities generally serves seniors and people with physical disabilities through all three programs; and the Office of Developmental Disability Services serves people with intellectual or developmental disabilities, through State Plan PCS and Community First Choice programs. Oregon’s PCS programs operate almost entirely under a participant- directed model. Officials told us that many beneficiaries select either a family member or friend to serve as their attendant. Oregon maintains a registry of attendants, called the Registry and Referral System. Officials told us that all attendants must enroll in the registry, including family members and friends who serve as attendants. The state agency that oversees the registry, the Oregon Home Care Commission, also provides an orientation to new attendants and offers ongoing training. The Commission also serves as the employer of record for purposes of collective bargaining. In 2013, Oregon became the second state to adopt the Community First Choice program. The state transitioned all PCS out of its HCBS Waiver into Community First Choice, although Oregon provides some other services—such as case management—under an HCBS Waiver to some Community First Choice beneficiaries. In transitioning to Community First Choice from an HCBS Waiver, Oregon officials chose to maintain some of the same quality assurance processes of previous HCBS Waiver programs; 15 of the HCBS Waiver quality assurance measures were incorporated into Community First Choice. Officials told us that Community First Choice also has additional quality assurance measures that were not part of the previous HCBS Waivers. Community First Choice provides PCS to those who need an institutional level of care, while officials told us that State Plan PCS provides PCS to those who have do not require an institutional level of care. Texas provides PCS to Medicaid beneficiaries under four types of programs and, in some cases, administers separate programs within the same type. Texas operates: two State Plan PCS programs (one is for participants under age 21 and one is for participants age 21 or older); Participant-Directed Option (paired with State Plan PCS); and Community First Choice. Texas also operates an additional PCS program that is unique to Texas. Authorized by Section 1929(b) of the Social Security Act, Texas uses the Community Attendant Services program to provide PCS to beneficiaries who have incomes that are too high to qualify for other Medicaid services, according to officials. Texas is the only state that has adopted such a program. The programs are operated within different departments of the Texas’s Health and Human Services Commission, which operates one of two State Plan PCS programs, while one of its operating departments, the Department of Aging and Disability Services, operates another State Plan PCS program, Community First Choice, and the 1929(b) program. Texas’s PCS programs deliver PCS both through provider agencies and through a participant-directed model. Participants in each PCS program who wish to exercise more control over their services may operate under a set of requirements known as the consumer-directed services option. According to officials, many of the PCS services in Texas are now being provided by a managed care company (We excluded this type of arrangement from our study). Texas is the most recent state to adopt the Community First Choice program, as of April 2016. The state transitioned all PCS out of five of its HCBS Waivers into Community First Choice. In so doing, Texas maintained certain features of four of the five programs, including retaining the same service providers, such as attendants. For example, Texas transitioned the PCS in its HCBS Waiver program called the Community Living Assistance and Support Services into Community First Choice. This HCBS Waiver had served beneficiaries who have developmental disabilities. After the transition to Community First Choice, beneficiaries receive generally the same services through the same providers, and the claims for the services are attributed to Community First Choice. In addition to the contact name above, Tim Bushfield, Assistant Director; Anna Bonelli, Analyst-in-Charge; Christine Davis; Barbara Hansen; Laurie Pachter; Vikki Porter; Bryant Torres; and Jennifer Whitworth also made key contributions to this report.

Summary: The number of people receiving in-home personal care services—such as assistance with bathing and dressing—from Medicaid is expected to grow. States can offer these services through one or more programs under which home- and community-based services can be provided, each with different federal requirements. The provision of personal care in beneficiaries' homes can pose risks to safety, and these services have a high rate of improper payments, including instances where services for which the state was billed were not provided. In recent years Congress has directed HHS to improve coordination of these programs, which could harmonize requirements—that is, implement a more consistent administration of policies and procedures—and enhance oversight. GAO was asked to review oversight of Medicaid personal care services. GAO examined: (1) how selected states ensure that beneficiaries receiving services are safe from harm and that billed services are provided; and (2) steps CMS has taken since 2010 to improve oversight and harmonize requirements across programs. GAO reviewed policies in four states with varied programs; reviewed laws, guidance and documents; and interviewed CMS officials. Four states that GAO reviewed varied in how they implemented safeguards to protect beneficiaries receiving in-home personal care services from harm and in their methods to help ensure billed services were actually provided. For example, to help keep beneficiaries safe, the four selected states—California, Maryland, Oregon, and Texas—reported that they monitored beneficiaries by having case managers or nurses periodically check in with beneficiaries, but the frequency and means, such as in-person or by phone, varied among the states and in some cases across programs within a state. The four states also reported using different methods to help ensure that billed services were actually provided. For example, to track attendants' work time, two states required beneficiaries to sign paper timesheets for the attendants, and two states used electronic visit verification timekeeping systems for some or all programs. The Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), has taken several steps to improve oversight of states' personal care service programs and harmonize requirements but has not collected required state reports or addressed significant differences in program requirements. Since 2010, CMS steps to improve oversight of states' programs include enhancing guidance and conducting webinars to help states address improper payments. To manage risk inherent in the provision of these services, and in keeping with statutory direction to improve coordination of these programs, CMS has taken steps to better harmonize requirements across programs including directing states to follow agency guidance issued for one type of program when implementing a similar type of program. However: CMS has not systematically collected required states' reports on personal care services provided under two programs, although CMS stated that guidance for states to submit the reports is under development. Collecting these reports could improve oversight by providing CMS and Congress with information on programs' effects on beneficiaries' health and welfare. CMS harmonization efforts have not addressed the significant differences across federal program requirements specific to beneficiary safety and ensuring that billed services are provided. Consequently, the safeguards and level of assurance that CMS has regarding states' beneficiary protections and oversight of billed services can vary by program. For example, one reviewed state requires quarterly or biannual beneficiary monitoring for most programs; but one program monitors annually as federal requirements do not require more frequent monitoring. Similarly, requirements to help ensure billed services are actually provided vary widely among states and programs, contributing to uneven assurances and oversight across programs. Home- and community-based services, including personal care services, are growing in significance and in demand. A more consistent administration of policies and procedures across programs could help the federal government and states better manage risks to beneficiaries and protect the integrity of the program. GAO recommends that the Acting Administrator of CMS (1) collect and analyze required state reports on personal care services and (2) take steps to further harmonize federal program requirements, as appropriate, across programs providing these services. HHS concurred with both recommendations