The CCDF is the primary federal funding source to help states subsidize the cost of child care for low-income parents and to improve the quality of care. For a parent to be eligible for CCDF funds, their children must be younger than 13 years old and living with them; parents must be working, or enrolled in school or training. States may design their programs and establish work requirements, payment rates, family copayments, and other program rules within the broad parameters outlined by the federal law and regulations. States may add additional eligibility requirements, including different income thresholds, but must set the maximum family income eligibility requirement at or below 85 percent of the state median income for families of the same size. Table 1 shows the eligibility thresholds applicable to our fictitious families in the states we tested. Families may choose to purchase care from any legally operating child care provider, which may include child care centers, home-based providers, family members, neighbors, and after-school programs. Providers must be approved by the state to receive CCDF subsidies. HHS requires that states have licensing standards for child care providers, but federal law does not determine these standards or which type of providers they apply to. Some states require relative providers to undergo background checks with fingerprints, criminal and sex-offender checks, or home inspections, but other states have less stringent requirements. According to HHS, in 2008, 58 percent of children in the program were cared for in a licensed center-based child care facility, 13 percent were cared for in a licensed or regulated home-based center, 12 percent by an unregulated relative provider, and 17 percent in a variety of other arrangements. State and county CCDF agencies may pay child care providers or families directly. Payments to families may be in the form of a child care certificate that may be used only as payment or deposit for child care services. In some states, providers can directly bill the state through automated systems and have funds directly deposited into a personal bank account or receive a check by mail. In addition, families are required to contribute to the cost of care, in the form of a copayment, unless states exempt families below certain income thresholds from this requirement. CCDF rules also provide some guidance on establishing reimbursement rates for child care providers and require that a specified portion of funds be set aside for activities designed to enhance child care quality. The Child Care and Development Block Grant Act of 1990 first authorized block grants to be given to states for child care assistance and the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 further expanded the grants to states creating the current CCDF. In fiscal year 2009, $7 billion was expended for the CCDF block grants, of which $2 billion was attributable to the passage of the Recovery Act in 2009. CCDF has discretionary, mandatory, and matching components. In order to receive the matching component, a state must meet a number of spending requirements. programs from the Temporary Assistance for Needy Families (TANF) and Social Services Block Grants. Regarding Recovery Act funds provided to states for CCDF, as of September 3, 2010, HHS reported that it had disbursed to the states $1.2 billion of the $1.9 billion allo CCDF. In order to receive these funds, a state must: (1) provide matching funds at the state’s current Medicaid match rate; (2) obligate the federal and state share of matching funds in the year in which the matching funds are awarded; (3) obligate all of its mandatory funds in the fiscal year in which the mandatory funds are awarded; (4) obligate and expend its maintenance of effort (MOE) funds in the year in which the matching funds are awarded. (MOE means a state must continue to expend its own funds at the level it was matching the former Aid to Families with Dependent Children-linked child care programs in fiscal year 1994 or fiscal year 1995, whichever was greater.) reported that they had performed some activities to assess the exten which their programs were at risk of improper payments, but these activities often did not cover all payments that could be at risk. Since that report, HHS reported that it has engaged in several activities to help stat es continue to focus on improving their internal controls. For example, in response to the recommendations in our 2004 report, HHS organized, through the Child Care Bureau, a federal project team to draft an ap to address internal controls, using GAO’s report Internal Controls: Internal Control Management and Evaluation Tool as a guide. effort included drafting tools for states to use to conduct internal con self-assessments, estimates of payment error rates, and guidance fo r developing cost-benefit assessments of internal control processes; identifying and sharing best practices among states for minimizing improper payments; and taking actions to expand the system that matche state enrollment data across several programs to include CCDF. We did not review whether the states in our proactive tests and c steps to strengthen controls based on these initiatives. Our proactive testing revealed that CCDF programs in the 5 states we tested were vulnerable to fraud because states did not adequately verify the information of children, parents, and providers and lacked adequate controls to prevent fraudulent billing. In 7 of 10 cases in four states, ou r fictitious parents and children were admitted into the CCDF program because states did not verify the personal and employment information provided by the applicants. Three of those states paid $11,702 in childcare subsidies to our fraudulent providers, and two states allowed the providers to over bill for services beyond their approved limit. Only one state successfully prevented our fictitious applicants from being admitte into the program, but officials from that state told us they perform only limited background checks on providers and cannot immediately detect over b illing. Table 2 provides information about each of our undercover tests. GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). Parent was approved 3 weeks after completing a brief phone interview without requesting the applicant’s employer pay stubs. No identification documents were required for the parent or children. Department of Social and Health Services (DSHS) failed to detect the Social Security number (SSN) of a deceased individual used by the parent and the incorrect SSN used by the children. Officials told us that it is not a program requirement to verify SSNs for beneficiaries of the program. DSHS also did not perform any checks to determine that the parent’s employer was fictitious. DSHS initially denied the fictitious provider’s application because the provider’s name and SSN did not match. However, the provider was allowed to resubmit with the same personal information and a different Social Security card with a real SSN. Provider was approved within 12 days. Parent and provider were able to bill for hours exceeding the authorized amount by informing the caseworker that the parent had worked an additional 20 hours that month. No documentation was required. Parent was approved 12 days after completing a brief phone interview and submitting fabricated pay stubs and an employment verification letter. DSHS failed to detect the SSN of a deceased individual used by the parent and the incorrect SSNs used by the children. Officials told us that they are not required to verify beneficiaries’ SSNs. DSHS initially denied the fictitious provider’s application because the provider’s name and SSN did not match. Provider resubmitted using a different first name, SSN, driver’s license photograph and birth date, but the same last name, address and phone number. Even though DSHS had previously rejected a similar provider using the same address, and both applications claimed only one person lived there, DSHS failed to investigate the second application further. The application was approved within 7 days. Provider successfully billed for 16 school holidays for each school-aged child during a month of only 22 school days. DSHS officials stated that any overbilling of holiday hours would be caught during random audits that are conducted monthly on some providers. However, no audit was conducted in this case. Parent was approved for assistance after a 30 minute in- person interview where she presented photocopies of false Social Security cards, birth certificates, a driver’s license, and a death certificate for her spouse. Department of Social Services (DSS) failed to detect the SSN of a deceased person used by the parent and the incorrect SSNs used by the children. DSS accepted a fabricated letter as proof that the applicant did not receive survivor benefits for her deceased spouse. Provider passed the background check, even though she had submitted an SSN that did not match her name. This creates a risk that someone with a criminal background could steal an identity to qualify for child care payments. State officials told us they are not legally permitted to verify SSNs, even for relative child care providers. Provider received payment for 2 months of child care. We ceased proactive tests and returned assistance checks after media reports of county budget cuts in the child care assistance program. Parent was approved for assistance 4 weeks after applying by mail using photocopies of fraudulent Social Security cards, birth certificates, a utility bill, pay stubs, and a marriage certificate. Caseworker initially did not approve the application, which contained fraudulent Social Security cards showing the same SSN for the parent and one of her children. However, the caseworker accepted the parent’s explanation that the Social Security Administration had issued her the wrong Social Security card and approved her application when she submitted a card bearing a different SSN. Provider passed the background check, even though he had submitted the SSN of a deceased person. This creates a risk that someone with a criminal background could steal an identity to qualify for child care payments. State officials told us they are not legally permitted to verify SSNs, even for relative child care providers. County workers used an electronic system to prevent over billing by comparing hours billed to hours authorized and hours worked. In one instance, the provider claimed to have provided 140 hours of care to one child, but the parent’s pay stubs showed she had worked only 60 hours during that time. Caseworkers compared the billed hours to the pay stubs, detected the discrepancy and reduced the payment to the provider. However, they still permitted him to bill for an extra 2.5 hours a day that the parent supposedly spent at lunch or in transit, even though she worked just 10 minutes from the provider’s house. Department of Human Services (DHS) lost the fictitious parent’s initial applications on two occasions, one by fax and one by mail. Caseworker then discovered the faxed application 2 months later. On a third application attempt, parent was approved within 30 days after reapplying in person with photocopies of her driver’s license, Social Security cards, and pay stubs. Case worker did not ask to see original documents. DHS officials said they use state wage, employment, public assistance and child support databases to verify applicant information, and an SSA database to verify parent and child SSNs. Officials told us the system detected that the names and SSNs of our fictitious applicants did not match, but a caseworker inappropriately approved them for child care assistance. Provider was approved to receive payment for 3 months of child care assistance. State officials told us that a check was issued, but was returned to DHS due to an error at the rental mailbox store. Using the online billing system, provider attempted to bill for more hours than she was authorized to provide care. The system detected the discrepancy and successfully prevented payment for these hours. Department of Human Services lost the fictitious parent’s faxed application. When the parent resubmitted the application by mail, a caseworker initially claimed that it had not been processed, then said that the office’s mail was not being forwarded from the post office. The caseworker told her that if she reapplied in person, it would take 30 days to process the application. The applicant reapplied in person, submitting photocopied documents. Case worker did not interview the applicant or ask to see original documents. DHS denied the first application 4 months after it had originally been submitted and had no record of receiving our second application. However, the third application, which was submitted by the parent in person, was processed within 6 days. Applicant was denied because the identity of the parent and children could not be verified. Parent was approved for assistance after a 20 minute in- person interview where she presented photocopies of Social Security cards, pay stubs, birth certificates, and a driver’s license. Case worker did not ask to see original documents. Provider was originally rejected for using an SSN that did not match her name. Case workers accepted her explanation that the Social Security Administration had issued her the wrong Social Security card and allowed her to reapply with a new SSN. Provider passed a background check; however, licensing staff at the Texas Department of Family and Protective Services (DFPS) became suspicious of her multiple addresses and out- of-state driver’s license. The staff member requested that the provider appear in person with all original documentation, at which point we stopped our application. Parent completed a 15 minute in-person interview where she presented photocopies of Social Security cards, pay stubs, birth certificates, and a driver’s license. Case worker did not ask to see original documents. Texas Workforce Solutions (TWS) approved the parent for assistance, even though she had used the SSN of a deceased individual and her children had used incorrect SSNs. TWS also did not perform any checks to determine that the parent’s employer was fictitious. TWS officials told us that they do not have a system to verify the parent and children’s SSNs. DFPS had no record of receiving our initial provider application. Our second provider passed a background check and was approved 13 days after he submitted an application, but his operation was closed when DFPS could not reach him by phone. Parent’s initial application was denied 7 weeks after caseworkers compared parent and child information against state public assistance, wage and child support databases. Caseworkers also used Internet resources to identify the parent, provider, and employer addresses as nonexistent. Parent resubmitted the application using the same personal information with actual street addresses for her residence and employer. Provider also submitted a new application with an actual street address, valid SSN, and a fraudulent out-of-state driver’s license. New application was denied because caseworkers had put a warning on the case file alerting staff to the previously submitted fraudulent documentation. Illinois officials told us they do not currently require relative providers to undergo a sex offender check or a fingerprint background check, but they plan to implement these screenings in October 2010. In addition, they do not require parents to submit pay stubs on an ongoing basis, but rely on 6-month recertification to detect changes in work hours. This creates an opportunity for providers to over bill. Parent’s initial application was denied 3 months after she applied. Caseworkers compared parent and child information against state public assistance, wage and child support databases. Caseworkers also used Internet resources to identify the parent and provider’s home addresses as fictitious and the employer as nonexistent. Parent resubmitted the application using the same personal information with actual street addresses for her residence and employer. Provider also submitted a new application with a valid SSN, a nonexistent street address, and a fraudulent out- of-state driver’s license. Resubmitted application was denied when caseworkers read the case file notes, which documented previous problems with the parent and allowed the caseworker to identify discrepancies between the applications. Illinois officials told us they do not currently require relative providers to undergo a sex offender check or a fingerprint background check, but they plan to implement these screenings in October 2010. In addition, they do not require parents to submit pay stubs on an ongoing basis, but rely on 6-month recertification to detect changes in work hours. This creates an opportunity for providers to over bill. Several common themes emerged from our proactive testing, showing the specific vulnerabilities in the states’ CCDF programs. Lack of Effective Controls to Verify Parent and Child Information: Four states did not consistently verify the SSNs and addresses of our fictitious parents and children, potentially allowing unscrupulous providers to use nonexistent children to bill for additional subsidies. While HHS policy does not permit states to require that parents or children submit SSNs, all of the states we tested gave parents the option of submitting this information. However, we found that some states did not verify this information when it was provided. For example, Texas and New York did not verify our fictitious parent and children’s SSNs, which belonged to deceased people. Furthermore, 4 states accepted photocopies of the parent’s driver’s license, the children’s birth certificates, and all Social Security cards. While there is no federal requirement preventing states from accepting photocopies, they are much more difficult to identify as fraudulent than originals. In contrast to New York and Texas, Illinois, Michigan, and Washington compared information provided by the parent to data in state public assistance databases and, in Illinois and Michigan, state child support databases. In Michigan and Washington, caseworkers found that the applicants were not in these databases but conducted no further verification of their information. In one case, a Michigan caseworker also checked the applicants’ names and SSNs with the Social Security Administration (SSA), but inappropriately enrolled the family in the program even after the system identified their names and SSNs as mismatched. Michigan denied the other parent because they were not able to verify her identity or that of her children. Illinois denied both fraudulent applications after the public assistance and child support database matches found no record of the family, leading to further checks that identified other inconsistencies in the applications. Lack of Effective Controls to Verify Parent Income Eligibility: Four states lacked effective controls to verify the parent’s income by contacting the employer directly or comparing the parent’s income to state data, instead accepting fabricated pay stubs as proof of income. Without adequate verification of income, states cannot provide reasonable assurance that only eligible parents are accepted into the program. There is no federal requirement for what income documentation states must collect, but in all 5 states, parents were required to provide pay stubs and asked to declare other sources of income, such as Social Security, TANF, and/or child support. Caseworkers in New York, Texas, and Washington accepted photocopies of fabricated pay stubs from fictitious businesses and did not have effective controls to verify the existence of the employer, the validity of the company address, or the wages reported by the applicants. While officials in Michigan and Illinois told us they use state employment data to verify income at the time of application, only Illinois successfully prevented both our fictitious applicants from being accepted into the program. Illinois caseworkers said that when they saw that the applicant’s employer did not appear in the state database, they attempted to contact the business directly and were unable to reach a live employee. Caseworkers then verified the fictitious address we provided for the employer and discovered that it was in the middle of Lake Michigan, which caused them to deny the application. Lack of Effective Controls to Verify the Background of Relative Child Care Providers: The five states we tested did not conduct thorough provider background checks, generally failing to conduct nationwide background checks, verify SSNs, or compare provider information to sex offender registries. Michigan, Texas, and Washington conducted relative provider background checks using only state conviction data, creating the possibility that a provider with a criminal history in one state could be approved to care for children simply by moving to another state. New York and Illinois officials said they do not verify relative providers’ criminal background, instead matching provider information against state child abuse databases and, in New York, against the state sex offender registry. SSNs are a key element in the verification of a person’s identity, and all the states we tested required that providers submit their SSNs. However, there is no federal requirement that states verify SSNs. This creates the possibility that criminals, including registered sex offenders, using stolen identities could obtain federal subsidies to care for children. We found that New York did not verify our fictitious providers’ SSNs, approving two child care providers using SSNs that did not match their names, one of which belonged to a deceased person. Michigan officials told us that they also do not verify provider SSNs while officials in Illinois said they do not currently compare relative provider information to lists of registered sex offenders, potentially putting children at risk. However, officials said they plan to implement this screening in October 2010. While we did not test states that require fingerprinting, nationwide fingerprint background checks provide more assurance of an applicant’s identity than background checks without fingerprints. Our tests were limited to scenarios in which the provider was an unlicensed relative; therefore, our results cannot be applied to licensed child care providers, such as day care centers, which are typically subject to greater regulation. Lack of Effective Controls to Flag Suspicious Applications for Further Review: Three of four states did not have controls to flag fictitious parents and providers who reapplied to the program after their initial application had been identified as potentially fraudulent, creating the risk that applicants rejected for fraud will be able to gain admittance into the program simply by submitting slightly different information. In Washington, one fictitious provider’s application was initially rejected because a query of a federal database found that his name and SSN did not match. We then created a new fictitious provider that shared the same last name, mailing address, home address, and phone number as the rejected provider, but had a different first name, SSN, driver’s license photograph, and birth date. Even though the Department of Social and Health Services (DSHS) had previously rejected a similar provider using the same address, and both applications claimed only one person lived there, DSHS failed to investigate the second application further. Instead, the application was approved in 7 days. In the other Washington case and in one Texas case, caseworkers questioned why the provider’s SSN did not match her name but allowed her to submit a different SSN after she claimed that the SSA had issued her the wrong card. A caseworker in New York accepted the same explanation from a parent who initially used a Social Security card bearing the same SSN as her daughter. By contrast, after rejecting both of our parent applications as fraudulent, Illinois caseworkers added warnings to the case file notes to alert other staff to the previously identified fraud. When we submitted new applications with slightly different information, caseworkers linked the new applications to the rejected applications and prevented our fictitious parents from being approved for child care assistance. Weak Controls to Prevent Fraudulent Billing: All three states in which we tested billing procedures had some controls to prevent overbilling, but vulnerabilities in two states allowed providers to obtain payment for more hours than they were authorized to provide care. In Washington, the automated billing system prevented providers from claiming more than their authorized hours for regularly scheduled care, but allowed them to bill for additional “school holiday” hours without any documentation. Exploiting this vulnerability, both providers billed for excessive holiday hours; one provider successfully billed for 30 school holiday hours for each of the two children she cared for, even though she was not authorized to provide care during school hours. Furthermore, the same provider obtained payment for an additional 20 hours of care by having the parent tell her caseworker that she had worked extra hours that month. The caseworker did not require the parent to submit any documentation before authorizing the additional hours. New York required one parent to submit her pay stubs as proof of hours worked and used an electronic system to compare these to the hours billed by the provider. When our provider attempted to bill for 140 hours in April 2010, but the parent’s pay stubs showed she had worked only 60 hours, caseworkers identified the discrepancy and reduced the provider’s payment. However, they allowed the provider to bill for an extra 2.5 hours each day for time that the parent spent at lunch or in transit, even though she worked just 10 minutes from the provider’s house. Michigan used an automated system in which parents and providers separately reported the number of hours of care provided. The system compared these two reports to each other and to the hours of care authorized, detected that the provider had over billed by 5 hours every 2 weeks and reduced the payment to the authorized amount. We were not able to test controls over unauthorized billing in Illinois and Texas, but officials told us that parents are not required to submit pay stubs on an ongoing basis, and provider bills are compared only to the number of hours the provider is authorized to provide care. If a parent began working fewer hours but did not report the schedule change, a provider could continue to bill at the authorized level until 3 to 6 months later, when the parent submitted pay stubs as part of the recertification process. Delays in Processing Applications: In three counties in three states, 3 months or more elapsed between the date our fictitious applicants submitted their application and the date an agency first responded to the application. Parents applying to CCDF programs have a reasonable expectation of a timely decision on their applications. While there is no federal standard for timeliness, some states we tested established program standards for response times. For example, Michigan program requirements state that a decision be rendered within 45 days and Washington requires that a decision be made within 30 days. In our proactive tests, approval time frames for parent applicants ranged from the same day to over 4 months, with an average of 42 days to render a decision. In three cases, 3 months elapsed from the date a parent or provider submitted an application to the date the agency first responded. For example, one agency in Illinois received the parent’s application on September 3, 2009, but did not begin verifying the parent’s eligibility until November 16, 2009, finally issuing a denial letter on December 2, 2009. During this time, our undercover investigators repeatedly tried to call the agency, but frequently received a voicemail stating that calls would not be accepted due to the volume of calls and paperwork. Program officials told us that at the time of our application, that office was backlogged, but that normally, an applicant would receive a final determination within 45 days. Despite Michigan’s program standard of a response within 45 days, DHS denied our parent’s first application 4 months after it was originally submitted and lost her second application. However, her third application, which was submitted months later, was processed within 6 days. Michigan officials told us that at the time of our first two applications, both counties were in the process of adopting a new software program. The review process for one provider in Texas took 4 months. In the other case, the agency had no record of the first provider application and rendered a decision on the second within 13 days. By contrast, both counties in Washington approved parent and provider applications within 2 months of receipt. Table 3 shows the vulnerabilities we identified in our ten undercover tests of the CCDF programs by state. To prevent fraud, waste, and abuse, it is essential for states to have a well- designed system that includes preventive controls, detection and monitoring, and investigations, according to GAO’s fraud prevention model. Preventative controls in a program like CCDF would involve comparing applicant-provided information to government or third-party data and establishing controls to prevent the payment of unauthorized bills. Detection and monitoring would involve data mining for fraudulent applicant information and suspicious billing transactions, while investigation and prosecution of those caught committing fraud in the CCDF would serve as a deterrent to others contemplating defrauding the program. However, the CCDF regulations do not require states to implement specific measures to prevent or detect fraud, resulting in application processes and requirements that vary considerably by location. For example, in Washington, one of our fictitious parents was approved after giving a caseworker her information over the phone interview and having a woman, purporting to be her employer, call DSHS to verify her work schedule. In a New York county, the parent was required to provide photocopies of birth certificates and Social Security cards for all household members, a death certificate for the deceased spouse, pay stubs, a form signed by her landlord, a driver’s license, and a letter from SSA stating that she did not receive survivors’ benefits. Similar to our fictitious applications, we identified five closed criminal cases in which parents and providers defrauded the CCDF program. The parents and providers in these cases used similar methods to our proactive testing including falsifying documentation to claim eligibility, billing the state for fictitious children, and colluding to obtain payment for services that were never provided. Table 4 provides a detailed summary of cases in which individuals were convicted of fraudulently obtaining CCDF funds; a more detailed narrative on each case follows the table. Case 1: Two providers fraudulently billed Indiana for $150,310 worth of CCDF funds and operated a child care facility in a home where a convicted felon lived. According to the investigator’s report, the fraud began even before the pair opened their first home-based child care facility, when the provider who held the child care license (license holder) failed to disclose that her stepfather, a twice-convicted drug offender, lived in the home. The stepfather had access to CCDF funds through joint bank accounts with both providers, according to investigators, who also observed him transporting children for child care operations. A parent of one child enrolled in the child care home even told investigators that she was instructed not to mention the stepfather to investigators because “he wasn’t supposed to be there.” Once the child care home opened, the unlicensed provider (operator) led its day-to-day operations. As part of the scheme, she began requesting electronic access cards from parents of children enrolled at the child care home, according to the investigator’s report. These electronic access cards recorded the hours a child spent in a child care facility, allowing the operator to inflate the number of hours she billed the state for child care. Several parents interviewed by investigators acknowledged that they freely gave the operator their electronic access cards but one parent said the operator threatened to take away her spot if she did not provide the access card. Many parents acknowledged to investigators that the cards had been fraudulently swiped at times when care could not have been provided for a variety of reasons including the parent having a conflicting work schedule, the child having been moved to another child care facility, or the child being in another state at the time. While some parents claimed their electronic access cards were used without their knowledge, the investigator found that others were aware of the scheme or actively participating in it. For example, one parent provided her swipe card to the operator in exchange for cash payments every 2 weeks. Several parents also alleged that the provider mistreated their children, and the investigator observed that the child care facility was dirty and possibly unsafe. For example, several parents said that their children were not being fed all day, even though the child care home received subsidies from a federal nutrition program. Parents also alleged that their infants’ diapers were not changed, resulting in rashes. One parent claimed that the operator put her two children, ages 10 and 12, in a closet as punishment. In addition to the alleged mistreatment, several parents told the investigator that the operator attempted to extract additional payment from them by charging cash co-payments in excess of the amount permitted by the state, or by convincing them to buy her groceries using their electronic access cards to the Supplemental Nutrition Assistance Program (SNAP). About a year after they opened their first child care home, the license holder received a license for a second child care home. Like the first facility, the new child care home was run primarily by the operator with assistance from the license holder and provided additional opportunities for fraudulent billing. For example, the second facility was not always open during its regular hours and the two child care facilities did not have enough staff to cover all of the shifts for which they were supposedly open. When questioned by investigators, the operator claimed she was covering both sites by working “24 hours a day and 7 days a week.” The scheme was discovered when a caseworker noted that the operator’s own children were receiving subsidies to attend the child care home where she worked. Furthermore, several clients referred to the operator as the owner of the child care home, even though she was not licensed. In March 2009, the license holder pled guilty to welfare fraud, a class D felony, and the operator made the same plea in July 2009. Both were sentenced to 2 years in a state department of corrections jail. Case 2: The owner of a Missouri child care center fraudulently billed the state for over $112,242 in CCDF funds, neglected some children in her care, and operated a second unlicensed child care center from her home. Over 6 years, the child care center’s owner fraudulently obtained CCDF funds by falsifying invoices and attaching altered or forged attendance sheets as support for her claims, according to the plea agreement. For example, the owner forged parent signatures and attendance times, in some cases incorrectly spelling parents’ names on the attendance sheets. Several parents admitted to the investigator that they never signed any sign attendance sheets for the child care center but others said that when they first enrolled their children in the child care center, the owner had them sign blank attendance sheets. One of these parents signed a single attendance sheet her first month and the owner told her she would “take care of everything for (the parent) after that.” Using these falsified attendance sheets, the owner billed full time hours for children who attended part time and billed for children who never attended her child care center or children who had left the child care center. In addition to financial fraud, investigators uncovered instances of neglect during their interviews with parents. For example, one parent said she went to pick up her children at the child care center, but found them at the owner’s house locked in a car. Another parent said that when she arrived at the facility one day, no one could tell her where her daughter was. The parent found her daughter outside unattended. The investigators also found that the owner illegally billed the state for care provided at an unlicensed child care center that she ran out of her apartment. For example, one parent paid cash for child care provided at the unlicensed home, even though the owner billed for care supposedly provided to the same child at the licensed child care center. The parent confirmed that she was not eligible to receive CCDF funds and that her child was too young to be enrolled in the licensed facility. Furthermore, a former employee testified that she watched as many as 25 children at one time in the apartment. Investigators noted that the owner moved children from the licensed facility to her apartment in the evenings to avoid exceeding the required worker-to-child ratio at her licensed facility. The owner attempted to obstruct the investigation into her child care center, according to the investigator’s report. She encouraged parents to lie to investigators about the forged signatures, told one parent to ignore interview requests and harassed another parent by threatening to have her fired. Despite her attempts, the owner was charged and pled guilty to mail fraud in December 2008. She received 15 months in prison, and was required to pay $112,242 in restitution. Case 3: An Oregon couple created fictitious child care providers using falsified documents and stolen Social Security numbers in order to fraudulently obtain $122,616 in CCDF funds. The scam started when each parent claimed to be living at a separate address with the children, according to the investigator’s report. The husband applied for the CCDF program using a relative’s address in Lake Oswego, Oregon, even though he lived in Portland with his wife and children. The husband began receiving child care benefits in June 1998 and the wife began receiving separate benefits for the same children just one month later. Investigators later determined that the husband was the children’s caregiver, which should have disqualified the family from the program. To collect the CCDF funds, the couple created fictitious child care providers who supposedly cared for their children out of their private residences, according to the investigator’s report. Using a fraudulently obtained Social Security number, a fake name, and the address of a commercial mailbox store in Vancouver, Washington, the husband applied to become a child care provider. Once the fictitious provider was accepted into the program, the husband submitted a monthly bill showing the number of hours of care provided and used the mailbox to receive checks from the state, which he cashed using the fictitious provider’s identity. The couple created a different fictitious provider to collect the wife’s child care subsidies using the same method. In this case, however, the husband stole the Social Security number and birth date of his half brother, who lived in Washington and had never worked in Oregon. The investigators found that in order to maintain eligibility for the CCDF program, the husband falsified employment records to show that he was working. He provided pay stubs similar to those sold at office supply stores that showed his employer as “Ablazed and Mystifying Women,” which he described as a warehouse. In fact, there was no such business in Vancouver, no government agency had any records of the business, and the investigator was unable to find the building when she drove to the address. Furthermore, the husband’s alleged home address was a 30 minute drive from his supposed employer, but he had a suspended driver’s license and no vehicles registered in his name. However, he did have a driver’s license and three vehicles illegally registered in the name of one of the fictitious child care providers. A caseworker referred the husband for investigation because his employment records looked false, according to the investigator’s report. When the couple became aware of the investigation, they attempted to disrupt the investigation. The wife requested that the investigator not call her anymore and the husband claimed to have a series of family emergencies that prevented him from meeting with investigators. The father pled guilty to two counts of theft, five counts of identity theft, three counts of aggravated theft, and two counts of theft by deception and was then sentenced to 8 years in prison and $137,215 of restitution. The mother pled guilty to one count of unlawfully obtaining public funds, one count of forgery, two counts of identity theft, and two counts of theft by deception and was then sentenced to 3.5 years in prison. Case 4: Five women colluded to fraudulently bill Washington for $8,806 in CCDF funds and in some cases, assisted others in illegally obtaining child care licenses. For approximately 6 years, the five women received funds from the CCDF program and the food reimbursement program as child care providers, according to the indictment. The five women billed for fictitious children and children who attended school during the hours the women claimed to be caring for them. One woman billed for the same child twice, using the child’s real name and identifying information and also using a false name with the child’s real identifying information. Two of the women assisted others in applying for child care provider licenses using false identities even though the women had reason to believe the individuals were ineligible due to criminal history or immigration status, according to the indictment. One of the women provided one applicant with a fake name and Social Security number, and provided another applicant the name and Social Security number of one of the children under her care. Two other women provided fake references for the ineligible applicants’ false identities. After they became aware of an investigation into their activities, the five women met twice with a potential witness for the grand jury and tried to convince her to lie to investigators. A federal investigation led to an indictment by the U.S. Attorney’s Office in August 2007 charging all five women with conspiracy to make a false statement relating to a health care program and theft of public funds. Four of the women pled to conspiracy to make a false statement and one pled to theft of public funds. Each woman was sentenced to three years of probation along with restitution for the amount stolen from the program. Case 5: Two providers operating a large child care center in Wisconsin obtained over $360,000 in CCDF funds by colluding with parents to help them fraudulently qualify for child care assistance, then offered free housing and kickbacks to parents in exchange for enrolling their children in the child care center. One of the women held the child care license from the state, while the other operated the child care center. According to the prosecutor, the operator had previously run licensed child care centers, but these were closed and her license revoked due to improper billing. However, no charges were filed against her. Having lost her license, the operator went into business with her daughter, who obtained a child care license from the state in her name. Court transcripts note that at first, the child care center operated out of various private residences and served a small number of children. Later, it expanded into a new facility that was licensed to serve 64 children per shift, with three shifts each day. According to the complaint filed by the prosecutor, the operator solicited mothers to register their children at the child care center, particularly those with large numbers of children. She then charged the state for full- time care for each child, about $200 per week, even though some children did not attend the child care center at all and others only attended sporadically. To help these women meet the eligibility requirements for the CCDF program, she forged documentation showing that they were employed at her child care center. Some of these women never worked at the child care center while others worked for a limited period of time. In at least one case, the operator used CCDF funds to pay a kickback to one woman whose children were enrolled at the center. To generate more income, the prosecutor said that the operator and license holder used funds from the CCDF program to buy several rental properties, which the operator offered as rent-free housing to parents who enrolled their children in her child care center. As part of this agreement, the operator provided the parents with proof of employment that allowed them to apply for rental assistance from the city of Milwaukee. According to the prosecutor, the operator received the rental subsidy for those families accepted into the program and did not charge them any rent, a violation of the rental subsidy program’s policy. In April 2009, the operator pled guilty to theft by fraud and was sentenced to 5 years in jail followed by 12 years of extended supervision and $300,000 in restitution payments to the state. The license holder pled guilty to a computer crime for giving her mother access to the child care billing system and was sentenced to 30 days at the house of correction followed by probation. During the daughter’s sentencing, the judge noted that the program “was a joke with little if any oversight.” Not all eligible families that want to receive CCDF assistance are currently able to receive it for a variety of reasons, and fraud and abuse in the program may further reduce the availability of CCDF funds. This lack of child care assistance forces some families to cut back on spending for daily needs, working hours, and education. Of the 41 waitlisted parents we interviewed, 16 described multiple hardships—facing financial difficulties, quitting their job or education program, and worrying about negative impacts on their children’s development. Twenty-four parents said they had budget problems which forced some to cut back on spending for daily essentials such as groceries, clothing, gasoline, electricity, car payments, health insurance, or their child’s lunch money. Some parents told us they had taken out loans or depleted family savings to pay for child care. Twenty-four parents reported problems maintaining stable employment or enrollment in education, in some cases having to turn down or quit jobs that did not pay enough to cover child care expenses. Nine parents also told us that a lack of child care caused a variety of negative effects on their children, including one parent who reported having to send her child to an unlicensed relative who does not offer the educational activities that a high-quality child care center might. Another parent said that her two developmentally disabled children would receive better care at a child care center than they currently receive from their elderly grandparents. See table 5 for the experiences of 10 applicants we contacted. These applicants expressed issues common to many of the parents we interviewed. We did not attempt to verify the applicants’ statements. According to state program administrators, Recovery Act funds for the CCDF program have enabled some states to reduce or eliminate waiting lists or expand CCDF eligibility to cover additional families, but many eligible families remain without child care assistance. States’ CCDF implementation plans for fiscal years 2008 to 2009 identified 25 states that have processes to maintain some type of waiting list when demand exceeds available funds. We contacted 11 states that had active waiting lists between November 2009 and March 2010. Mississippi used Recovery Act funds to process all of the children on their waiting list, eliminating 7,000 individuals from the waiting list in April 2009. Arkansas also eliminated its waiting list but later reinstated it due to an increase in new applications. In Florida, officials used Recovery Act funding to allow children to stay in the program for longer periods. In North Carolina, officials told us Recovery Act funds allowed them to respond to the state’s high unemployment rate by expanding eligibility to unemployed parents who needed child care to search for a job. However, California told us that Recovery Act funds have not had a noticeable impact on the size of its waiting list of 134,880 families. Furthermore, New Hampshire had to institute a waiting list due to the increase in demand, though program officials acknowledged that Recovery Act funds delayed the implementation of the waiting list. In one of the counties we tested in New York, cuts to the child care budget during our undercover tests eliminated 1,091 children from the program. However, due to the low-income fraudulently reported by the parents, their fictitious children would have continued to receive assistance if we had not withdrawn them from the program. Between July 16 and September 10, 2010, we briefed HHS officials and CCDF program officials in Illinois, Michigan, New York, Texas, and Washington on the results of our work. We suggested a number of actions that HHS and states should consider to reduce fraud and abuse in CCDF programs, including: Require applicants, household members, and providers to submit Social Security numbers in order to receive child care assistance. Evaluate the feasibility of validating applicant and family member identity information with SSA. Establish more stringent verification requirements for eligibility, including validating applicant-provided information using state databases of wage, employment, public assistance, and child support information; contacting employers directly to verify employment; and using Internet resources to verify address information. Implement a system to alert staff to child care applications previously rejected for fraud to prevent the applicant from resubmitting in the same county or another county. Evaluate the feasibility of requiring all providers, including relative providers, to undergo national fingerprint criminal history checks and screenings against the national sex offender registry and state child abuse databases. Establish more stringent verification of bills submitted by child care providers, including requiring program staff to verify that the number of reported hours of child care correspond to the number of hours worked by the parent; denying unsupported claims for extra hours worked; and restricting the number of hours that a provider can bill over the authorized amount without documentation. Each of the states we tested already had some of these controls in place or has plans to implement some of them in the near future. For example, Illinois, Washington, and Michigan conduct some verification of applicant information against state child support and public assistance databases. Several counties in New York use an electronic system to compare hours worked on parents’ pay stubs to the hours billed by providers, and officials told us they plan to put the system into use state wide. Texas officials told us that they intend to implement a new, electronic billing system that will include controls to prevent over billing. However, in some cases, officials cited concerns about the cost and legal implications of increased verification. For example, Texas expressed concern that conducting fingerprint criminal history checks on providers would impose additional costs on the program. Some states noted that they are not permitted to require parents to submit SSNs, while New York state officials told us they do not have the legal authority to verify SSNs submitted by parents or providers. HHS did not respond to issues surrounding the collection and verification of SSNs at the time of our briefing. Recognizing that preventing fraud often involves additional costs, some of our suggested corrective actions allow for HHS and states to evaluate the feasibility of control activities. Responding to our findings, HHS commented that they have recently taken actions to address issues of CCDF integrity. For example, HHS officials said that program guidance issued in August 2010 discussed recommended documentation and verification procedures, including data matching with wage and employment databases; data matching with other public assistance databases; and background checks and training for providers. The guidance also highlighted on-site visits to providers to review attendance and enrollment records. Officials noted that an electronic system, the Public Assistance Reporting Information System, uses an SSN match across states to identify red flags of individuals enrolled in benefit programs in multiple states. Only eight states currently use this system for CCDF, but officials said the August 2010 program guidance encouraged more states to join. In addition, officials said that HHS has an ongoing conference call series on program integrity, which has covered promising practices on how to use data mining and automated reports to highlight cases that need further scrutiny. HHS officials also commented on upcoming initiatives related to fraud prevention. For example, officials said that state CCDF applications for fiscal years 2012-2013 will have a stronger focus on integrity, including questions on the verification of eligibility information, and procedures for identifying, investigating, and recovering fraudulent payments. In the coming year, HHS’s Self-Assessment Instrument for Internal Controls & Risk Management will be revised and piloted in more states, and will include fiscal and program evaluation and stricter controls to prevent over billing. We are sending copies of this report to the Secretary of Health and Human Services and the child care program offices of Illinois, Michigan, New York, Texas, and Washington. In addition, the report is available at no charge on the GAO Web site at http://www.gao.gov. Please contact me at (202) 512-6722 or kutzg@gao.gov if you have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. To proactively test selected states’ fraud prevention controls, we identified 26 states that received more than $100 million from the Child Care and Development Fund (CCDF) for fiscal year 2009. From these states, we identified six that did not require providers to be fingerprinted or undergo site visits and selected the five states receiving the most American Recovery and Reinvestment Act (Recovery Act) funding. We focused on these criteria because fingerprint checks could have identified our investigators as federal employees and site visits would have required us to maintain a physical address for our fictitious child care operator. In addition, we selected counties within the five states that contained large cities, where possible, and did not have waiting lists for assistance to ensure that we did not prevent real families from obtaining assistance. We tested two counties in Illinois, Michigan, New York, Texas, and Washington to develop our 10 undercover tests. Though all types of providers are potentially able to commit fraud, we chose to test cases in which a relative is paid to provide care because these providers are generally subject to less regulation than larger child care centers. Relative providers cared for 12 percent of children in the CCDF program in 2008, while other types of providers accounted for the rest. As such, our results cannot be applied to licensed child care providers, such as child care centers, nor can our results be projected to all state CCDF programs. We used commercially available hardware and software to counterfeit identification and employment documents for bogus parents, children, and providers. Once accepted, we billed the program for care provided to the fictitious children. We provided fraudulent pay stubs showing the hours worked by parents and reported those hours through automated systems or completed invoices we submitted to the state or county for payment. We received several child care assistance checks, which we did not cash and returned to program officials at the end of our investigation. During our tests, media reports indicated that the child care assistance budget in one county had been reduced. We immediately ended our undercover test in this county and returned the voided check. To select our case studies, we identified criminal convictions of child care assistance fraud nationwide using online databases and internet resources to identify closed cases. As part of the selection process, we focused on cases involving a high dollar amount of fraud or containing other elements of fraud such as stolen identities. Ultimately, we selected 5 cases from Indiana, Missouri, Oregon, Washington, and Wisconsin. We reviewed applicable court documents for each case. When possible, we also interviewed investigators and prosecutors in charge of the selected cases to obtain additional case details. To examine the impact of being unable to obtain child care on low-income parents, we contacted officials in states and counties with active child care assistance waiting lists to obtain names of parents currently eligible for child care assistance. States’ CCDF implementation plans for fiscal year 2008 to 2009 identified 25 states that have processes to maintain some type of waiting list when demand exceeds available funds. However, these waiting lists fluctuate over time and we could not identify a centralized list of all states with active waiting lists. We confirmed active waiting lists in 11 of the states from November 2009 through March 2010. Of these 11 states, Alabama, Indiana, Massachusetts, Minnesota, North Carolina, and Texas provided us with contact information for individuals on state waiting lists, which we used to contact parents directly. Starting from the top, we selected a nonrepresentative sample of 166 parents to contact and interviewed the 41 who responded to our inquiries. We collected information such as the number and ages of children and the parents’ job title and income to determine demographic information. However, we did not attempt to verify the accuracy of the information that they provided to us. Our results are not representative of the entire population of families currently in need of child care assistance. In addition to the individual named above, the following individuals made key contributions to this report: Cindy Brown-Barnes, Assistant Director; Andrew O’Connell, Assistant Director; Joshua Bartzen; Gary Bianchi; Eric Charles; Grant Fleming; Matthew D Harris; Christine Hodakievic; Aaron Holling; Jason Kelly; Barbara Lewis; Jeffrey McDermott; Andrew McIntosh; Sandra Moore; George Ogilvie; Kimberly Perteet; Gloria Proa; Lerone Reid; Ramon Rodriguez; Timothy Walker; and John Wilbur.

Summary: Through the Child Care and Development Fund (CCDF), the U.S. Department of Health and Human Services (HHS) subsidizes child care for low-income families whose parents work or attend education or training programs. In fiscal year 2009, the CCDF budget was $7 billion. States are responsible for determining program priorities and overseeing funds. Providers--who range from child care centers to relatives--bill the state for caring for approved children. Unregulated relatives represent 12 percent of providers in the CCDF program. In response to program fraud and abuse, GAO (1) proactively tested selected states' fraud prevention controls, (2) examined closed case studies of fraud and abuse, and (3) interviewed parents waitlisted for child care about the effect of this lack of assistance on their families. To do this, GAO investigators posed as parents and unregulated relative providers in 10 scenarios in five states with no waiting lists that each received more than $100 million in CCDF funding for fiscal year 2009. These states did not require fingerprint criminal history checks or site visits. For case studies of past program fraud, GAO reviewed criminal court records and interviewed agency officials. GAO spoke with parents on waiting lists in six states for their perspectives on the effect of being unable to obtain childcare. Results cannot be projected beyond these states or unregulated relative providers. The five states GAO tested lacked controls over child care assistance application and billing processes for unregulated relative providers, leaving the program vulnerable to fraud and abuse. Posing as fictitious parents and relative providers, GAO successfully billed for $11,702 in child care assistance for fictitious children and parents. In most cases, states approved GAO's fictitious parents who used Social Security numbers of deceased individuals and claimed to work at nonexistent companies. One state also approved a fictitious child care provider with a deceased person's Social Security number, creating the possibility that a criminal using a stolen identity could obtain federal subsidies to care for children. In two other states, GAO successfully billed for hours exceeding those authorized without submitting proof of additional hours worked. One state successfully prevented both fictitious applicants from being accepted, but had weak payment controls. GAO identified five recent closed criminal cases in which parents and providers defrauded the CCDF program. These cases involved parents falsifying eligibility documentation, providers billing states for fictitious children, and collusion between parents and providers to obtain payment for services that were never provided. Fraudulent payments reduce program funds available for eligible parents who depend on child care assistance to maintain employment or attend education programs. In some states, waiting lists are 1 to 2 years long. Parents on waiting lists said that without child care, they contend with multiple hardships--facing financial difficulties, quitting their job or education program, and worrying about negative effects on their children's development. In response, many of the states tested noted that they have plans to implement new controls, but expressed concern about associated cost and legal implications. HHS officials commented they have recently taken actions to address issues of CCDF integrity, including issuing program guidance on verification procedures and conducting conference calls on program integrity.