Medicaid is the third largest social program in the federal budget and is also one of the largest components of state budgets. Although it is one federal program, Medicaid consists of 56 distinct state-level programs—one for each state, District of Columbia, Puerto Rico, and each U.S. territory. Each state has a designated Medicaid agency that administers its program under broad federal guidelines. The federal government matches state Medicaid spending for medical assistance according to a formula based on each state’s per capita income. The federal share can range from 50 cents to 83 cents of each Medicaid dollar spent. HCFA administers the Medicaid program at the federal level. In accordance with the Medicaid statute, it sets broad guidelines for the states, but within them, each state establishes its own eligibility standards; determines the type, amount, duration, and scope of covered services; sets payment rates; oversees the integrity of its program; and develops its administrative structure. States are required to describe the nature and scope of their program in a comprehensive written plan submitted to HCFA—with federal funding for state Medicaid services contingent on HCFA’s approval of the plan. HCFA is responsible for ensuring that state Medicaid programs meet all federal requirements. In addition to Medicaid, HCFA also has responsibility for administering Medicare, a federal health insurance program for certain disabled persons and those 65 years and older. While Medicaid and Medicare have different structures and governance, some low-income beneficiaries and many providers participate in both programs. There are also—in 47 states and the District of Columbia—separate MFCUs that are responsible for investigating and prosecuting Medicaid provider fraud, patient abuse, and financial fraud. In 1999, MFCUs received authority to investigate cases involving Medicare fraud as well. Most MFCUs are part of the state Attorney General’s office, and most prosecute the cases they investigate. MFCUs that have been federally certified for more than 3 years receive 75 cents in federal funding for every dollar they spend, up to a limit established by federal regulations. In addition to state Medicaid agencies and MFCUs, other state and federal agencies assist in dealing with Medicaid improper payments. Because of their responsibilities to ensure sound fiscal management in their states, state auditors or state inspectors general may become involved in Medicaid payment safeguard activities through efforts such as testing payment system controls or investigating possible causes of mispayment. At the federal level, the Federal Bureau of Investigation (FBI) and the OIG investigate, and U.S. Attorneys prosecute, certain Medicaid fraud cases, such as those that involve multiple states or also involve fraud against other health care programs. Funding for these agencies to pursue fraud and abuse in federal health care programs is available from the Health Care Fraud and Abuse Control Program (HCFAC). Established in 1996 by Section 201 of the Health Insurance Portability and Accountability Act (HIPAA), it funds, consolidates, and strengthens federal fraud control efforts under the Department of Justice (DOJ) and HHS. This fund provided $154.3 million in fiscal year 2000 to the OIG and DOJ. Separately, the FBI received an additional $76 million in HIPAA-specified funding for fiscal year 2000. Medicare has been the major focus of this effort, but Medicaid has also benefited. In its joint report with DOJ on the HCFAC fund, HHS reported returning nearly $45 million dollars to Medicaid as a result of these fraud control activities for fiscal years 1997 through 1999. With state and federal Medicaid payments projected to total $221.6 billion this fiscal year, even a small percentage loss due to improper payments represents a significant loss to taxpayers. The magnitude of improper payments throughout Medicaid is unknown, although a few states have attempted to determine the level by measuring the accuracy of their program’s payments. An even more difficult portion of improper payments to identify are those attributable to intentional fraud—recent cases in California and other states provide examples of losses due to fraudulent activities. There are no reliable estimates of the extent of improper payments throughout the Medicaid program. However, at least three states have conducted studies to try to measure their program’s payment accuracy rates and pinpoint where payment vulnerability occurs, with varied success. Illinois, in 1998, reported an estimated payment accuracy rate of 95.3 percent, with a margin of error of +/- 2.3 percentage points, of total dollars paid. The estimate was based on a sample of individual paid claims, for which the state reviewed medical records and interviewed patients to verify that services were rendered and medically necessary. As a result of this audit, the state identified key areas of weakness and targeted several areas needing improvement. For example, because the Illinois payment accuracy review indicated that nearly one-third of payments to nonemergency transportation providers were in error, the Illinois Medicaid program has taken a number of steps to improve the accuracy of payments to this provider type. Texas, also in 1998, reported an estimated payment accuracy rate of 89.5 percent in the acute medical care fee-for-service portion of the program. However, in making that estimate, reviewers had trouble locating many patients and records due to statutorily imposed time constraints. Further work led the state, in 1999, to revise the estimate to between 93.2 and 94 percent. In developing the estimate, the state identified ways to reduce improper payments through expanded use of computerized fraud detection tools, such as matching Medicaid eligibility records with vital statistics databases to avoid payments for deceased beneficiaries. In January 2001, Texas reported that a more recent study estimated a payment accuracy rate of 92.8 percent in its acute medical care fee-for-service payments. Kansas, in 2000, reported an estimated payment accuracy rate of 76 percent with a margin of error of +/- 9 percentage points. The estimate was based on a sample of individual paid claims, as in Illinois. The payment accuracy study recommended increased provider and consumer education, as well as improvements to computerized payment systems. In addition, Kansas officials undertook focused reviews of certain types of claims that were identified as vulnerable to abuse. In their payment accuracy studies, these states commonly identified errors such as missing or insufficient documentation to show whether the claim was claims for treatments or services that were not medically necessary; claims that should have been coded for a lower reimbursement amount; and claims for treatments or services that the program did not cover. Because payment accuracy studies can provide useful guidance toward developing cost-effective measures to reduce losses, HCFA has sought HCFAC funding for grants to states for such efforts. HCFA also has established a workgroup to develop guiding principles, definitions, and reporting protocols for payment accuracy studies. HCFA and its workgroup of state officials are also trying to assess whether, given the many differences among the various Medicaid programs, a common methodology can be developed that would allow valid comparison of error rates across states. State payment accuracy studies may not fully identify improper payments that might be related to fraud, due primarily to fraud’s covert nature. Losses due to fraudulent billing and other related practices are difficult to quantify. However, these amounts can be significant, as was demonstrated recently in California’s program, in which millions of dollars were paid to numerous fraudulent providers. Since July 1999, a state-federal task force targeting questionable pharmaceutical and durable medical equipment suppliers for improper billing has charged 115 providers, wholesalers, and suppliers in cases involving about $58 million in fraud. At least 69 individuals have been convicted and paid about $20 million in restitution. An additional 300 entities are being investigated for suspected fraud that could exceed $250 million. In one case, a family-run equipment company defrauded the program out of more than $9 million by submitting thousands of claims for equipment and supplies that were never delivered to patients. Investigators also found the following. “Bump and run” schemes in which individuals bill for a few months for services that are not rendered, stop billing before being detected, and then start again under a new name. Wholesalers who gave pharmacies and suppliers false invoices to substantiate false claims. Use of “marketers” who recruit and pay beneficiaries $100 or more to lend their Medicaid identification cards for use in improper billing. Use of beneficiary identification numbers stolen from a hospital to bill for services not provided. Use of identification from providers who had retired or moved out of the state. Purchase of an established business in order to fraudulently bill under its name. Administrative weaknesses in the California Medicaid program made these activities easier to accomplish. For example, the program was issuing new billing numbers to individuals with demonstrated histories of current or past questionable billing practices. The program allowed providers to have multiple numbers, and applicants did not have to disclose past involvement in the program or any ongoing audits. As a result, in some cases, individuals who had past questionable billings applied for a new provider number and were reinstated with full billing privileges. In addition, applicants for a billing number for a business that needed a license—such as a pharmacy— did not have to disclose that actual owners were not the licensed individuals. This allowed unlicensed individuals to pay medical professionals for the use of their licenses to obtain a provider number. California has taken steps to try to close such loopholes. In addition to single-state schemes, fraudulent activities sometimes involve large-scale multistate schemes. One case led to a $486 million civil settlement in early 2000—one of the largest health care settlements ever. It followed a 5-year investigation of a dialysis firm billing Medicare and several state Medicaid programs for intradialytic parenteral nutrition that was not necessary or not provided in the quantity claimed. The company had an ownership interest in a laboratory that also double-billed for unnecessary tests and paid kickbacks to nephrologists and clinics that used the laboratory. In another case, a national laboratory headquartered in Michigan was ordered to pay $6.8 million in a multistate settlement for billing Medicare and five Medicaid programs for bogus medical tests. Improper billing schemes such as the ones discussed above are the principal types of fraud cases developed by MFCUs, according to MFCU directors responding to our survey. Improper billing includes “upcoding,” in which the provider misrepresents treatment provided and bills for a more costly procedure; “ghost” or “phantom” billing, in which a provider bills for services never provided; and delivering more services than are either necessary or appropriate for the patient’s diagnosis. However, other types of fraud occur, including improper business practices—such as kickbacks for steering services to a provider—or misrepresentation of qualifications, such as an individual falsely claiming to be a physician. MFCU directors have found a wide variety of providers involved in fraud, including physicians, dentists, pharmacies, durable medical equipment providers, and transportation providers. Beneficiaries also engage in fraud, either by misrepresenting assets to become eligible for the program, lending or selling their identification numbers for another’s use, or obtaining products such as pharmaceuticals for resale. Fraud is not merely a financial concern—it can also pose a risk to the physical health of beneficiaries. For example, providers have drawn blood unnecessarily in order to better substantiate billing for tests that were not performed, and dentists have conducted extensive unnecessary dental work on beneficiaries in order to bill the program. The amount of resources and effort that state Medicaid programs devote to protecting the integrity of their programs varies. Some states have focused their efforts on preventing improper payments by strengthening their prepayment claims checking. States’ abilities to detect improper payments also vary, in part because some lack sophisticated information technology that can help them analyze and track instances of inappropriate billing. Strong leadership in certain states is resulting in stricter laws and restructured operations to better ensure that the Medicaid program pays claims appropriately. Resources for addressing improper Medicaid payments are generally modest. In our survey, 25 state Medicaid agencies reported spending one- tenth of 1 percent or less of program expenditures on these efforts. Others, such as California, spend about one-fourth of 1 percent of program expenditures on preventing and detecting improper payments. However, this is not unique to Medicaid. As we recently reported, the Medicare program devotes little more than one-fourth of 1 percent of its program expenditures to safeguarding payments. As a result, we recommended that the Congress increase funding for these important activities. All states forgo some of the federal funds available to help their MFCUs investigate and prosecute fraud. MFCUs, once federally certified and in operation for 3 years, are eligible for 75 cents in federal funds for every dollar they spend, up to a maximum federal contribution of the greater of $125,000 per quarter or one-fourth of 1 percent of the state Medicaid program’s total expenditures in the previous quarter. However, only 10 percent of MFCUs receive enough state funding to obtain even half of the allowed federal match. States ranged from having enough state funding to obtain less than 7 percent to having up to 86 percent of their allowed federal match. Many Medicaid state agency fraud control and MFCU officials reported gaps in staff, staff training, or technology acquisition. Many state officials said that they wanted to increase their workforce by hiring staff with specific skills, such as auditing, computer analysis, and clinical knowledge, and adding the technology to analyze large amounts of claims data. For example, in our survey, only 14 of 53 state agencies reported that they have statisticians to help collect, organize, and analyze data to spot improper billing practices. Further, although information technology to store and analyze large amounts of data easily has improved significantly in recent years, some states reported using very old information technology to assess program billing. Four state Medicaid agencies reported using software that is at least 15 years old to assess claims before payment, and three state Medicaid agencies reported using software at least that old to analyze claims after payment to ensure the billings were proper. While about half of the state agencies and a third of MFCUs reported that their program integrity unit budgets were steady or declining in the previous 3 years, we did learn that other states showed a more promising trend. In our survey, 8 state Medicaid agencies and 4 MFCUs reported that their budgets for program integrity activities had increased significantly, while another 15 state agencies and 27 MFCUs reported that their budgets had increased somewhat. As a result, they reported that they were able to hire additional staff and increase program safeguards. For example, Connecticut’s increased funding allowed the state Medicaid agency to hire additional staff to increase audits and site visits to providers. Georgia’s state Medicaid agency also received increased funding, which allowed it to increase staffing levels and to make a number of additional improvements, such as opening an office to cover the southern part of the state. Preventing improper payments can be a cost-effective way to protect program dollars. Prevention can help avoid what is known as “pay and chase” in which efforts must be made to detect and attempt to recover inappropriate payments after they have been made. Such postpayment efforts are often costly and typically recover only a small fraction of the identified misspent funds, although they can identify parts of the program where controls, such as on payments, may need strengthening. States use a variety of preventive approaches—such as prepayment computer “edits,” manual reviews, provider education, and thoroughly checking the credentials of individuals applying to be program providers—and the scope and effectiveness of these activities varies among the states. All 41 of the state Medicaid agencies responding to our survey about prepayment claims review reported that they use such reviews to varying degrees. These include automated computer “edits” and manual reviews to help ensure payment accuracy. Typically, their edits check the mathematical accuracy of claims, the correct use of payment codes, and patients’ Medicaid eligibility. Such reviews help ensure that the services listed on the claim are covered, medically necessary, and paid in accordance with state and federal requirements. For example, an edit can be used to deny a claim for obstetrical care for a male beneficiary. Some states have thousands of such edits in their payment systems that identify duplicate claims, invalid dates, missing codes, or claims for services that conflict with previous care provided to the beneficiary. Although widely used, recent experiences from several states that are aggressively working to detect overpayments suggest that their existing prepayment edits have not been catching various types of improper payments. A few states have hired a private contractor to help analyze claims data to uncover overpayments. For example, with the aid of this contractor, Florida learned that it was paying some pharmacies 10 times more than it should for asthma inhalant because its edit did not stop claims listing the amount in unit doses rather than in grams, as required. Following this contractor’s overpayment review, Kentucky made edit changes it estimates will prevent $2 million in improper payments. This same contractor assisted Washington in making edit and other policy changes that are anticipated to save $4 million. Investigations in other states have also identified the need for new and revised edits. Some MFCU officials reported that they had advised their state agencies to strengthen certain edits based on the cases they had investigated. For example, the North Carolina MFCU suggested an edit to its state agency to identify and bundle laboratory services that should not have been billed separately. Also, the Louisiana MFCU reported that it had recommended that its Medicaid agency develop an edit to prevent duplicate payment of children’s medical screenings and physician visits and to ensure that physicians and certified nurse practitioners working together do not send in duplicate claims for the same services. Manual reviews before claims are paid can further help prevent improper payments, but they are resource-intensive, thus limiting the number of such reviews that can be done cost effectively. Manual reviews involve a trained specialist—such as a nurse—examining documentation submitted with a claim and possibly requesting additional information from providers, beneficiaries, and other related parties. Because of the cost and time involved, manual prepayment review is often targeted to certain providers. For example, if a provider’s claims pattern is substantially different from his or her peers, or if there is a sudden increase in claims volume for a given provider, or if there is substantial evidence of abuse or wrongdoing, payment may be withheld until a reviewer determines whether the aberrations or increases are appropriate and can be substantiated. Table 1 shows examples of prepayment reviews currently being used by some states. Because billing mistakes can be inadvertent, educating providers on how to comply with program rules and file claims correctly can often prevent errors. For example, in our survey, almost all state Medicaid agencies reported initiating meetings with providers, usually to discuss coding and policy changes. Seventeen state Medicaid agencies reported that their staff met with providers to discuss safeguarding the confidentiality of provider and beneficiary Medicaid numbers. In addition, 17 state Medicaid programs alerted providers to prevalent fraud schemes. State Medicaid agencies also reported conveying information on proper billing procedures to providers through a variety of other means, such as letters, bulletins, Internet sites, and professional meetings. Some states use more extensive provider enrollment measures to help prevent dishonest providers from entering the Medicaid program and to ensure better control over provider billing numbers. While all states collect some basic information on providers, states have considerable latitude in how they structure their provider enrollment processes. In addition, states are required to check if those providers who should be licensed are licensed and whether the provider has been excluded from participating in other federal health programs. Checking a provider’s criminal record and business site has been found to be important by states such as Florida to ensure that providers entering the program are legitimate. Nine of the states responding to our survey reported having a provider enrollment process that included all four of these checks—licensure, excluded provider status, criminal record, and business location verification—in their provider enrollment processes. Table 2 provides examples of these activities. Most Medicaid agencies reported checking whether applicants whose practice requires licensure had a valid license and whether they had been excluded from participating in other federal health programs. However, less than half of the states responding to our survey reported checking whether applicants have criminal records. While conducting such checks on a targeted basis might be useful in helping to protect the program, they can be time-consuming and difficult to perform, according to states that have attempted them. This is due in part to often inaccurate and incomplete statewide databases containing records on criminal convictions. Nineteen of 52 state Medicaid programs reported that they conducted site visits to determine if an applicant had a bona fide operation. Of those that do conduct site visits, most limit them to particular types of providers they believe have a greater likelihood of abusing the program. For example, Kansas Medicaid officials reported that, based on a risk analysis, there is a greater risk that durable medical equipment suppliers are not legitimate providers and, therefore, the Medicaid program conducted site visits of these applicants. Many states allow providers, once enrolled, to bill the program indefinitely without updating information about their status. Poor control over provider billing numbers can make Medicaid programs more vulnerable to improper payment. In our survey, 26 states reported allowing providers to continue to bill indefinitely while other states had an enrollment time limit, which often varied by provider type. However, 33 states reported that they cancel inactive billing numbers—generally for providers who have not billed the program for more than 1 to 3 years. Such efforts can be important, as questionable providers have been known to keep multiple billing numbers “in reserve” in case their primary billing number is suspended. In California, some individuals falsely billed the Medicaid program using the numbers of retired practitioners. Just as states are uneven in their efforts to prevent improper payments, they also vary in their ability to detect improperly paid claims. Because prepayment reviews cannot catch all erroneous claims, Medicaid programs must have systems in place to retrospectively review paid claims. While some states are using software from the early 1980s to analyze paid claims, other states—such as Texas and Washington—are implementing state-of- the-art systems to improve their ability to detect and investigate potential improper payments. Each Medicaid state agency is required to have an automated claims processing and retrieval system that can be used to detect postpayment errors. These automated claims processing systems, known as Medicaid Management Information Systems (MMIS), contain a Surveillance and Utilization Review Subsystem (SURS) that state agency officials can use to identify providers with aberrant billing patterns. For example, these might include providers with a large increase in Medicaid activity or with billing patterns that are significantly different from their peers and that result in enhanced reimbursement. Almost all states reported conducting focused reviews or investigations when a provider’s billing was aberrant to determine if any improper payments had been made. State Medicaid officials told us that when their state Medicaid agency discovers that improper payments have been made, it takes action to recover the improper payment, and, if warranted, refers the provider to its state MFCU for possible criminal investigation and prosecution. Providers who have been identified as having significant billing problems generally receive continued scrutiny if they remain in the program. The systems used to uncover such aberrant billing—MMIS and SURS— were developed in the early 1980s when computer algorithms to identify potentially inappropriate claims were less sophisticated and analysis required more programming skill. Newer systems allow staff to use desktop computers to directly query large databases of claim, provider, and beneficiary information, without requiring the assistance of data processing professionals. Several state officials reported that buying or leasing these upgraded computer systems and hiring staff skilled in their use would be their top priority if they had more funding. Other states are already purchasing or leasing such systems, as the following examples illustrate. Texas is using private contractors to design, develop, install, and train staff to use a state-of-the-art system intended to integrate detection and investigation capabilities. It is intended to allow the state to uncover potentially problematic payment patterns that old SURS profiling methodologies would have missed. It also includes a “neural network” that is intended to “learn” from the data it analyzes and adjust its algorithms to identify previously overlooked aberrant payment patterns. The system is further enhanced with modules designed to help develop cases for prosecution. The first 2 years of the project cost Texas $5.8 million, but according to state Medicaid officials, Texas had already collected $2.2 million in overpayments in the system’s first year of operation. Kentucky has hired a private contractor to use an advanced computer system to analyze claims payment data. It is paying that contractor through contingency fees based on overpayment collections related to these efforts. Using claims data from January 1995 through June 1998, the contractor identified $137 million in overpayments, of which the state has collected between $4 and $5 million. That compares to previous recovery efforts by the state that, on average, netted about $75,000 a year. Under its new Payment Integrity Program, Washington is using a private contractor to design, develop, install, and train staff to analyze data on an advanced computer system. The system improves access to data and includes fraud and abuse identification software with prepackaged algorithms to analyze the data and identify overpayments, as well as develop leads that would need further investigation. It also allows agency staff to develop algorithms and perform their own online reviews. Since the program started in June 1999, the contractor and state agency staff have identified overpayments totaling more than $2.95 million. Some states have developed detection strategies that combine the use of advanced technology with special investigative protocols. For example, New Jersey conducted special audits of transportation services, cross- matching data on transportation claims to beneficiary medical appointments, and sometimes contacting providers to confirm that the beneficiary actually arrived and was treated. Also, using billing trend reports, New Jersey audited pharmacies with abnormally large numbers of claims for a newly covered high-priced drug, and then audited the pharmacies’ purchases from wholesalers, thus discovering that these pharmacies were billing for a larger amount of this drug than had been shipped to them. Beneficiaries can also play a role in helping state Medicaid agencies detect improper payments. Forty-two states reported having hotlines that beneficiaries could use to report suspected improprieties. Fourteen states reported alerting beneficiaries to certain types of fraudulent schemes. Twenty-seven reported taking other types of actions. For example, some states commented that they mail explanation-of-benefit statements to beneficiaries to increase awareness of the services being billed in their names, so that if beneficiaries are not receiving billed services, they will be able to inform the state. State Medicaid agencies are primarily responsible for conducting program integrity activities, but they share this responsibility with other agencies. For example, they are required to refer potential fraud cases to the MFCUs for investigation and prosecution. Cases that may involve improper billing of Medicare or private insurers as well as Medicaid may also require investigation by the OIG or the FBI, and may involve prosecution by DOJ. In addition, other state agencies, such as those responsible for licensure, can become involved in an investigative effort. Federal regulations require Medicaid agencies and MFCUs to have an agreement to cooperate; however, the actual level of cooperation between state Medicaid agencies and MFCUs varies. State Medicaid agencies are required to refer suspected fraud cases to MFCUs for investigation and possible prosecution, provide needed records to the MFCUs, and enter into a Memorandum of Understanding establishing procedures for sharing information and referring cases. In our survey, MFCUs generally reported that about one-third of the cases that they open are referred by their state Medicaid agency. The most common criterion reported by state agencies for referring cases to MFCUs was a belief of an intent to commit an impropriety on the part of a provider. The number of cases state agencies reported referring in their previous fiscal year varied substantially. This is not surprising because Medicaid agencies differ in size, organization, scope of services, and beneficiary eligibility requirements. They also operate in different states, each of which has its own legal system and business climate, differences that can affect the number and quality of fraud referrals made by the state agency. In addition to differences in referral patterns, the reported level of interaction between states’ Medicaid agencies and MFCUs also varied. For example, meetings between the two organizations to discuss pending cases are important for preventing agency actions that could compromise a fraud unit investigation or for alerting MFCU officials to cases the state agency is developing. Most state Medicaid agencies reported having joint meetings at least six times a year; however, eight states reported that they conduct such meetings only one to three times each year. New Jersey is a state where the Medicaid agency and MFCU have worked together to further each agency’s efforts through close cooperation. Medicaid agency staffers are sometimes detailed to the MFCU to continue working cases they have developed. The state agency and MFCU hold joint meetings monthly to discuss developing cases, case progress, and to plan strategies for investigations, prosecutions, and administrative actions. The MFCU tries to use search warrants and other methods to gather evidence in suspected fraud cases so that information can be shared with the Medicaid agency. This is in contrast to the use of another MFCU tool—grand jury investigations—which have secrecy rules to prevent disclosure of evidence. This level of cooperation allows the state Medicaid agency to take immediate administrative action to stop improper payments without disrupting criminal case development. The MFCU also works to have defendants who are pleading guilty sign a consent order debarring or disqualifying them from participating in Medicaid, eliminating the need for state agency debarment or disqualification proceedings. In contrast to New Jersey, in another state, the director of an MFCU reported to us that MFCU investigators were denied access to state Medicaid agency meetings, which made it more difficult for both agencies to develop potential fraud cases. State Medicaid and MFCU officials told us that close collaboration among state agencies or state and federal law enforcement agencies was particularly important for certain types of cases. In the handful of states whose MFCUs lack authority to serve warrants or prosecute cases, MFCUs must work with other agencies to ensure that these activities take place. When dealing with individuals whose fraudulent or abusive activities cross state lines, one MFCU may need to work with other states’ agencies or with federal officials. Some cases involve efforts to defraud both Medicare and Medicaid, which can require an MFCU to work with the OIG or FBI. Such interagency collaboration has been fostered by the HCFAC program, which has increased funding for federal health care law enforcement efforts. Implementing section 407 of the Ticket to Work and Work Incentives Improvement Act of 1999, which authorized MFCUs to address cases that involve Medicare as well as Medicaid fraud, will also likely necessitate enhanced cooperation between MFCUs and federal law enforcement officials. Nearly all MFCUs responding to our survey reported that they have conducted joint investigations with other organizations in the last 3 years. Most commonly, this involved conducting joint investigations with their state agency, state licensing boards, the OIG, FBI, or a federal task force. Cooperative efforts have led to joint prosecutions. Twenty-seven states reported jointly prosecuting criminal cases with federal attorneys in the previous 3 years—about half doing so at least four times. Such cooperation can augment state officials’ activities. This was demonstrated in California, where members of a task force created by the FBI, the U.S. Attorney’s office, the California State Controller’s office, the Attorney General’s office, and the state Department of Health uncovered numerous fraud and abuse cases in the Los Angeles area. The Controller’s staff audited suppliers and referred to the FBI those with insufficient inventories or purchase records to substantiate claims volume. The FBI investigated further and made referrals to the U.S. Attorney. Meanwhile, the governor created a fraud prevention bureau within the state agency that worked closely with on-site FBI agents to investigate provider operations. Once a case was developed, the FBI referred it to the MFCU and U.S. Attorney’s office for prosecution. During our review, we found that several states—including Georgia, New Jersey, North Carolina, and Texas—have enacted stricter rules or restructured operations to better ensure the integrity of their Medicaid programs. A few examples of their accomplishments follow. Legislative changes: Some states are enacting health-care-specific criminal and civil legislation—often modeled after federal law. With these statutes, prosecutors no longer must develop cases based on more generic mail fraud, racketeering, theft, or conspiracy statutes. For example, New Jersey enacted the Health Care Claims Fraud Act, which creates the specific crime of health care claims fraud and provides for 10-year prison sentences, fines of up to five times the amount gained through fraud, and professional license revocation. Meanwhile, civil statutes—such as one enacted in North Carolina and other states authorizing action against providers who “knowingly” submit false Medicaid claims for payment— allow prosecutors to take advantage of less stringent evidentiary requirements than those required by criminal statutes. Restructuring operations: Some states are enhancing their program safeguard operations through restructuring. Texas created an Office of Investigations and Enforcement in 1997 within the state Medicaid agency, giving it power to take administrative actions against providers. These actions cannot be appealed when the Office has tangible evidence of potential fraud, abuse, or waste. It also can impose sanctions and recover improper payments. Meanwhile, Georgia established an MFCU in 1995 that differs from most in that it includes auditors from the state Department of Audits, investigators from the state Bureau of Investigation, and prosecutors from the state Attorney General’s office. They work together as a discreet entity under memoranda of understanding signed by the three agencies. HCFA and the OIG—the agencies that are responsible for the Medicaid program at the federal level—are taking steps to promote effective Medicaid program integrity by providing technical help to the states to facilitate states’ efforts. These federal agencies also conduct some information gathering on state activities in order to guide state efforts. Many state agency and MFCU officials reported that their agencies had benefited greatly from federal technical assistance, guidance, and training, and would welcome more assistance. In 1997, HCFA began a new approach as a facilitator, enabler, and catalyst of states’ program integrity efforts. To do so, HCFA established the National Medicaid Fraud and Abuse Initiative, led by staff from HCFA’s southern consortium and headquarters, with designated, part-time coordinators for the Initiative in each of HCFA’s 10 regional offices. The strategy for the Initiative was to partner with the states and have state representatives work with HCFA staff to set the agenda and goals for the effort. The Initiative provides networking, information sharing, and training opportunities for state agencies and their program integrity partners. Participants in early Initiative meetings identified 10 major focus areas— including payment accuracy measurement, managed care, and information technology. Workgroups are developing recommendations in each area. The Initiative also includes the Medicaid Fraud and Abuse Control Technical Advisory Group, consisting of HCFA and state officials, which serves as an ongoing forum for sharing issues, solutions, resources, and expertise among states; advising HCFA on policies, procedures, and program development; and making recommendations on federal policy and legislative changes. The Initiative has resulted in several tangible products and events, including a fraud statute Web site, managed care guidelines, seminars on innovations and obstacles in safeguarding Medicaid, and a technology conference. These efforts are described in table 3. State Medicaid officials that we spoke with reported that Initiative activities are helping them with their program safeguard efforts by providing important networking, information sharing, and training opportunities. Our survey results indicated that staff from 41 state Medicaid agencies attended Initiative-sponsored training last year, and more than 40 percent of state agencies had staff serve on Initiative panels. In fact, nearly 75 percent of state Medicaid agency survey respondents would like more of the types of assistance HCFA has been providing, including additional training; technical assistance on use of technology; guidance on managed care fraud detection and prevention; and information on innovative practices in other states. According to HCFA and some state officials, this approach has been more effective than previous efforts to guide state activities. Prior to 1997, HCFA reviewed information systems—including state SURS unit activities— through formal “systems performance reviews” of program controls. These controls included those related to payment and program safeguard activities. HCFA could impose penalties on states that failed these reviews, and some HCFA and state officials told us that states found the reviews burdensome. Section 4753 of the Balanced Budget Act of 1997 repealed HCFA’s authority to conduct such reviews. State and federal officials agree that federal attention to state program protection efforts declined after these mandatory reviews were eliminated. HCFA officials told us that staff in HCFA’s regional offices continued to provide some oversight of state efforts, but not in a coordinated way. However, without a regular review of state activities to address improper payments, HCFA staff had little information with which to guide states where more effective efforts were needed. To get a more comprehensive and systematic view of state antifraud efforts, the regional Initiative coordinators conducted structured site reviews of certain program safeguards in eight states in fiscal year 2000. These reviews examined how state Medicaid agencies identify and address potential fraud or abuse, whether state agencies are complying with appropriate laws and regulations—such as how they check to ensure that only qualified providers participate in the program—and potential areas for improvement. Reviews in another eight states are being conducted in fiscal year 2001. However, these reviews, as with all of HCFA’s Initiative endeavors, focus only on state efforts to address potential fraud and abuse; they do not address all of the ways states may be trying to prevent or detect improper payments, and whether these efforts could be improved. The OIG initially certifies, and each year recertifies, that MFCUs are complying with federal requirements and are eligible for federal funding. The OIG determines whether an MCFU should be recertified primarily based on reports the MFCUs submit on their activities. The OIG assesses these reports to determine whether each unit has used federal funds effectively and has met a set of 12 performance standards. These standards, which the OIG developed in conjunction with the National Association of Medicaid Fraud Control Units, cover areas such as staffing, training, types of cases (whether they constitute potential fraud or physical abuse of beneficiaries), case flow, and monitoring of case outcomes. For example, in the area of staffing, the OIG checks whether an MFCU has the minimum number of staff required. This includes at least one attorney experienced in investigating criminal cases or civil fraud, one experienced auditor capable of supervising financial records reviews and assisting in fraud investigations, and one senior investigator with substantial experience in conducting and supervising criminal investigations. The OIG may also conduct site visits to observe MFCU operations or provide guidance. Eight MFCUs received such visits in fiscal year 1999. OIG officials said they rarely decertified MFCUs. If decertified, an MFCU can reapply for federal certification when officials believe it will meet the required standards. Such is the case with the District of Columbia’s MFCU, which was decertified in 1983 for “lack of productivity.” It was recertified in 2000. The MFCUs generally reported being satisfied with OIG oversight and guidance, but indicated several areas where the OIG could provide more assistance—especially by providing more training. More than 45 percent of MFCUs reported that their staff attended OIG-sponsored training in the past fiscal year. MFCUs also would like the OIG to do the following. MFCU officials wanted the OIG to provide more training and assistance in their new authority to address cases that involve both Medicare and Medicaid fraud. Survey respondents were particularly interested in learning more about Medicare program rules, how Medicare claims processing contractors operate, and recent Medicare fraud schemes. They also wanted help in working with HCFA and Medicare claims processing contractors to get timely, online access to Medicare claims data. The OIG has begun to provide training on Medicare related issues. MFCUs would like the OIG to increase the number of OIG staff in regions and local areas to increase their participation in joint investigations. Medicaid remains vulnerable to payment error and, while most states are taking steps to address their programs’ vulnerabilities, their efforts are uneven. Some states have worked diligently to prevent or detect improper payments, while others have not been as proactive. The federal government has provided technical assistance and a forum for information exchange for the states, as well as some guidance. Given that states are responsible for administering Medicaid and investigating and prosecuting any fraudulent activities, states must set their own course to ensure the integrity of their Medicaid programs. But the federal government has a responsibility to actively partner with states to ensure that they succeed. In recent years, HCFA and other federal investigative organizations have played a more active role as partners in this endeavor. We provided draft copies of this report to HHS for comment. HHS officials provided written comments (see appendix III). We also provided excerpts from the draft report that dealt with state activities to states that we had visited. The reviewing officials suggested some technical corrections, which we incorporated into the report where appropriate. In its written comments, HHS provided information on the Department’s most recent efforts to prevent improper payments and to combat fraud and abuse in the Medicaid program. Among other activities, these efforts include a resource guide for states, a summary report of the joint HHS-DOJ technology conference, and a data exchange project between Medicaid and Medicare. HHS highlighted efforts to review program integrity activities in states and indicated that it intends to broaden the scope of the review in future fiscal years. Both the OIG and HCFA have developed training for state officials, including training for MFCU officials on Medicare. Finally, HHS reported that it has established a Web site at www.hcfa.gov/medicaid/fraud to provide states with additional technical assistance and guidance in their efforts to prevent and detect improper payments and to address fraud and abuse. As agreed with your office, unless you announce this report’s contents earlier, we plan no further distribution until 30 days after the issue date. We will then send copies to the Honorable Tommy G. Thompson, Secretary of HHS; the Honorable Thomas Scully, Administrator of HCFA; Mr. Michael Mangano, Acting Inspector General; and other interested parties. We will make copies available to others upon request. If you or your staff have any questions about this report, please call me at (312) 220-7600 or Sheila K. Avruch at (202) 512-7277. Other major contributors to this report were Barrett Bader, Bonnie Brown, Joel Grossman, and Elsie Picyk. As we developed our work on this report, we focused on the risk of improper Medicaid fee-for-service payments, states’ efforts to address improper payments—including efforts to investigate and prosecute fraud— and the guidance and oversight the states are receiving from federal oversight agencies. To do this work, we used information from our surveys, state visits, interviews, and analyses of agency program integrity documents and literature. To address the risk of improper fee-for-service payments, we reviewed studies that Illinois, Kansas, and Texas have conducted to measure payment accuracy in their Medicaid programs, and we interviewed state officials on the studies’ methodologies, findings, and limitations. To gain information on the types of improper billing schemes and other types of fraud cases, we interviewed state officials and reviewed state and HCFA documents. We also used results from our state survey, described below. To find out about state activities and federal oversight from the states’ perspective, we analyzed the results of surveys we sent to the 56 state Medicaid agencies and the 47 federally certified MFCUs then in existence. Fifty-three of the 56 state Medicaid agencies and 46 of the 47 MFCUs responded to our surveys. An additional MFCU in the District of Columbia, which had been decertified in 1983, was recertified in March 2000 after we sent out our survey. To facilitate their answering our questionnaire, we asked respondents, in several questions on the surveys, to base their answers on data from their most recently completed fiscal years, whether state or federal. (See appendix II for copies of our questionnaires and results.) To supplement the survey analyses, we visited state Medicaid programs and MFCUs in four states: Georgia, New Jersey, Texas, and Washington. We chose these states to provide regional diversity, and because they were among the ones considered by federal officials to be particularly active in efforts to identify and respond to improper payment practices—either through the use of new technology or by other means. Also, by telephone, we interviewed Medicaid, MFCU, and state government officials in other states that have taken steps to strengthen their Medicaid program integrity efforts. To better understand efforts to control improper payments at the national level, we interviewed officials at HCFA’s Central Office and leaders of the agency’s National Medicaid Fraud and Abuse Initiative in HCFA’s Atlanta and Dallas regional offices, as well as officials at the OIG. To gain a more broad-based perspective on other joint agency investigations and prosecutions, we interviewed representatives of the FBI, the U.S. Attorneys office, and the Civil and Criminal Divisions of DOJ. In addition, we participated in several meetings on control of improper payments, including fraud, which were sponsored by HCFA and others. Finally, we interviewed representatives of provider and supplier groups and technology companies that have developed software that is useful in the detection of improper payments. In addition, we reviewed literature on health care fraud and abuse, including studies by the OIG, HCFA, and others. We performed our work from September 1999 through April 2001 in accordance with generally accepted government auditing standards. Major Management Challenges and Program Risks: Department of Health and Human Services (GAO-01-247, Jan., 2001). National Practitioner Data Bank: Major Improvements Are Needed to Enhance Data Bank’s Reliability (GAO-01-130, Nov. 17, 2000). Medicaid: State Financing Schemes Again Drive Up Federal Payments (GAO/T-HEHS-00-193, Sept. 6, 2000). Financial Management: Improper Payments Reported in Fiscal Year 1999 Financial Statements (GAO/AIMD-00-261-R, July 27, 2000). Medicaid: HCFA and States Could Work Together to Better Ensure the Integrity of Providers (GAO/T-HEHS-00-159, July 18, 2000). Medicaid In Schools: Improper Payments Demand Improvements in HCFA Oversight (GAO/HEHS/OSI-00-69, Apr. 5, 2000). Medicaid: Federal and State Leadership Needed to Control Fraud and Abuse (GAO/T-HEHS-00-30, Nov. 9, 1999). Financial Management: Increased Attention Needed to Prevent Billions in Improper Payments (GAO/AIMD-00-10, Oct. 29, 1999). The first copy of each GAO report is free. Additional copies of reports are $2 each. A check or money order should be made out to the Superintendent of Documents. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Orders by visiting: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders by phone: (202) 512-6000 fax: (202) 512-6061 TDD (202) 512-2537 Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. Web site: http://www.gao.gov/fraudnet/fraudnet.htm e-mail: fraudnet@gao.gov 1-800-424-5454 (automated answering system)

Summary: State Medicaid programs make a wide variety of payments to individuals, institutions, and managed health care plans for services provided to beneficiaries whose eligibility status may fluctuate because of changes in income. Because of the size and the nature of the program, Medicaid is potentially at risk for billions of dollars in improper payments. The exact amount is unknown because few states measure the overall accuracy of their payments. Some improper Medicaid payments by states are the result of fraud by billers or program participants, but such improper payments are hard to measure because of the covert nature of fraud. Efforts by state Medicaid programs to address improper payments are modestly and unevenly funded. Half of the states spend no more than 1/10th of one percent of program expenditures to safeguard program payments. States also differ in how they help prevent improper payments as well as the degree to which they coordinate their investigations and prosecutions of fraud. Federal guidance to the states relies largely on technical assistance. The Health Care Financing Administration has recently taken a more active role to facilitate states' efforts and provide a national forum to share information.