Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process remains vulnerable to fraud. As shown in figure 1, the federal Marketplace or selected state marketplaces approved each of our 10 fictitious applications for subsidized qualified health plans. We subsequently paid premiums to put these policies into force. As the figure shows, for these 10 applications, we were approved for subsidized coverage—the premium tax credit, paid in advance, and cost- sharing reduction subsidies—for all cases. The monthly amount of the advance premium tax credit for these 10 applicants totaled approximately $2,300 per month, or about $28,000 annually, equal to about 70 percent of total premiums. For 4 of these applications, we used Social Security numbers that could not have been issued by the Social Security Administration. For 4 other applications, we said our fictitious applicants worked at a company—which we also created—that offered health insurance, but the coverage did not provide required minimum essential coverage under PPACA. For the final 2 applications, we used an identity from our prior undercover testing of the federal Marketplace to apply for coverage concurrently at two state marketplaces. Thus, this fictitious applicant received subsidized qualified health-plan coverage from the federal Marketplace and the two selected state marketplaces at the same time. For 8 applications among this group of 10, we failed to clear an identity- checking step during the “front end” of the application process, and thus could not complete the process. In these cases, we were directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces and our applications were subsequently approved. The other two applicants were accepted by phone. For each of the 10 undercover applications where we obtained qualified health-plan coverage, the respective marketplace directed that our applicants submit supplementary documentation. The marketplaces are required to seek postapproval documentation in the case of certain application “inconsistencies”—instances in which information an applicant has provided does not match information contained in data sources that the marketplace uses for eligibility verification at the time of application, or such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved using “back-end” controls. Under these controls, applicants will be asked to provide additional information or documentation for the marketplaces to review in order to resolve the inconsistency. As part of our testing, and to respond to the marketplace directives, we provided counterfeit follow-up documentation, such as fictitious Social Security cards with impossible Social Security numbers, for all 10 undercover applications. For all 10 of these undercover applications, we maintained subsidized coverage beyond the period during which applicants may file supporting documentation to resolve inconsistencies. In one case, the Kentucky marketplace questioned the validity of the Social Security number our applicant provided, which was an impossible Social Security number. In fact, the marketplace told us the Social Security Administration reported that the number was not valid. Despite this, however, the Kentucky marketplace notified our fictitious applicant that the applicant was found eligible for coverage. For the four fictitious applicants who claimed their employer did not provide minimum essential coverage, the marketplace did not contact our fictitious employer to confirm the applicant’s account that the company offers only substandard coverage. In August 2015, we briefed CMS and California and Kentucky state officials on the results of our undercover testing, to obtain their views. According to these officials, the marketplaces only inspect for documents that have obviously been altered. Thus, if the documentation submitted does not appear to have any obvious alterations, it would not be questioned for authenticity. In addition, according to Kentucky officials, in the case of the impossible Social Security number, the identity-proofing process functioned correctly, but a marketplace worker bypassed identity- proofing steps that would have required a manual verification of the fictitious Social Security card we submitted. The officials told us they plan to provide training on how to conduct manual verifications to prevent this in the future. As for our employer-sponsored coverage testing, CMS and California officials told us that during the 2015 enrollment period, the marketplaces accepted applicants’ attestation on lack of minimum essential coverage. As a result, the marketplaces were not required to communicate with the applicant’s employer to confirm whether the attestation is valid. Kentucky officials told us that applicant-provided information is entered into its system to determine whether the applicant’s claimed plan meets minimum essential coverage standards. If an applicant receives a qualified health-plan subsidy because the applicant’s employer- sponsored plan does not meet the guidelines, the Kentucky marketplace sends a notice to the employer asking it to verify the applicant information. The officials told us the employer letter details, among other things, the applicant-provided information and minimum essential coverage standards. However, our fictitious company did not receive such notification. CMS, California, and Kentucky officials also told us there is no current process to identify individuals with multiple enrollments through different marketplaces. CMS officials told us it was unlikely an individual would seek to obtain subsidized qualified health-plan coverage in multiple states. We conducted this portion of our testing, however, to evaluate whether such a situation, such as a stolen identity, would be possible. CMS officials told us the agency would need to look at the risk associated with multiple coverage. Kentucky officials told us that in response to our findings, call center staff have been retrained on identity-proofing processes, and that they are improving training for other staff as well. They also said they plan changes before the next open-enrollment period so that call center representatives cannot bypass identity-proofing steps, as occurred with our applications. Further, they said they plan to improve the process for handling of applications where employer-sponsored coverage is at issue. Also in response to our findings, California officials said they are developing process improvements and system modifications to address the issues we raised, and would share details later. Finally, in the case of the federal Marketplace in particular, for which, as noted, we conducted undercover testing previously, we asked CMS officials for their views on our second-year results compared to the first year. They told us the eligibility and enrollment system is generally performing as designed. According to the officials, a key feature of the system, when applicant information cannot immediately be verified, is whether proper inconsistencies are generated, in order that they can be addressed later, after eligibility is granted at time of application. Earlier, CMS officials told us the overall approach is that CMS must balance consumers’ ability to effectively and efficiently select Marketplace coverage with program-integrity concerns. In addition to our applications for subsidized private health plans, we also made eight additional fictitious applications for Medicaid coverage in order to test the ability to apply for that program through the marketplaces. As shown in figure 2, in these tests, we were approved for subsidized health-care coverage for seven of the eight applications. For three of the eight applications, we were approved for Medicaid, as originally sought. For four of the eight applications, we did not obtain Medicaid approval, but instead were subsequently approved for subsidized qualified health-plan coverage. The monthly amount of the advance premium tax credit for these four applicants totaled approximately $1,100 per month, or about $13,000 annually. For one of the eight applications, we could not obtain Medicaid coverage because we declined to provide a Social Security number. As with our applications for qualified health plans described earlier, we also failed to clear an identity-checking step for six of eight Medicaid applications. In these cases, we were likewise directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces. However, as shown in figure 2, the California marketplace did not continue to process one of our Medicaid applications. In this case, our fictitious phone applicant declined to provide what was a valid Social Security number, citing privacy concerns. A marketplace representative told us that, to apply, the applicant must provide a Social Security number. The representative suggested that as an alternative, we could apply for Medicaid in person with the local county office or a certified enrollment counselor. After we discussed the results of our undercover testing with California officials, they told us their system requires applicants to provide either a Social Security number or an individual taxpayer-identification number to process an application. As a result, because our fictitious applicant declined to provide a Social Security number, our application could not be processed. For the four Medicaid applications submitted to the federal Marketplace, we were told that we may be eligible for Medicaid but that the respective Medicaid state offices might require more information. For three of the four applications, federal Marketplace representatives told us we would be contacted by the Medicaid state offices within 30 days. However, the Medicaid offices did not notify us within 30 days for any of the applications. As a result, we subsequently contacted the state Medicaid offices and the federal Marketplace to follow up on the status of our applications. For the two New Jersey Medicaid applications, we periodically called the state Medicaid offices over approximately 4 months, attempting to determine the status of our applications. In these calls, New Jersey representatives generally told us they had not yet received Medicaid information from the federal Marketplace and, on several occasions, said they expected to receive it shortly. After our calls to New Jersey Medicaid offices, we phoned the federal Marketplace to determine the status of our Medicaid applications. In one case, the federal Marketplace representative told us New Jersey determined that our applicant did not qualify for Medicaid. As a result, the phone representative stated that we were then eligible for qualified health-plan coverage. We subsequently applied for coverage and were approved for an advance premium tax credit plus the cost- sharing reduction subsidy. In the other case, the federal Marketplace representative told us the Marketplace system did not indicate whether New Jersey received the application or processed it. The representative advised we phone the New Jersey Medicaid agency. Later on that same day, we phoned the federal Marketplace again and falsely claimed that the New Jersey Medicaid office denied our Medicaid application. Based on this claim, the representative said we were eligible for qualified health-plan coverage. We subsequently applied for coverage and were approved for an advance premium tax credit plus the cost-sharing reduction subsidy. The federal Marketplace did not ask us to submit documentation substantiating our Medicaid denial from New Jersey. We asked to meet with New Jersey Medicaid officials to discuss the results of our testing, but they declined our request. CMS officials told us that New Jersey had system issues that may have accounted for problems in our Medicaid application information being sent to the state. CMS officials told us that this system issue is now resolved. In addition, CMS officials told us they do not require proof of a Medicaid denial when processing qualified health-plan applications; nor does the federal Marketplace verify the Medicaid denial with the state. CMS officials said that instead, they accept the applicant’s attestation that the applicant was denied Medicaid coverage. For our North Dakota Medicaid application in which we did not provide a Social Security number but did provide an impossible immigration document number, we called the North Dakota Medicaid agency to determine the status of our application. An agency representative told us the federal Marketplace denied our Medicaid application and therefore did not forward the Medicaid application file to North Dakota for a Medicaid eligibility determination. We did not receive notification of denial from the federal Marketplace. Subsequently, we called the federal Marketplace and applied for subsidized qualified health-plan coverage. The federal Marketplace approved the application, granting an advance premium tax credit plus the cost-sharing reduction subsidy. Because we did not disclose the specific identities of our fictitious applicants, CMS officials could not explain why the federal Marketplace originally said our application may be eligible for Medicaid but subsequently notified North Dakota that it was denied. For the North Dakota Medicaid application for which we did not provide a valid Social Security identity, we received a letter from the state Medicaid agency about a month after we applied through the federal Marketplace. The letter requested that we provide documentation to prove citizenship, such as a birth certificate. In addition, it requested a Social Security card and income documentation. We submitted the requested documentation, such as a fictitious birth certificate and Social Security card. The North Dakota Medicaid agency subsequently approved our Medicaid application and enrolled us in a Medicaid plan. After our undercover testing, we briefed North Dakota Medicaid officials and obtained their views. They told us the agency likely approved the Medicaid application because our fake Social Security card would have cleared the Social Security number inconsistency. The officials told us they accept documentation that appears authentic. They also said the agency is planning to implement a new system to help identify when applicant-reported information does not match Social Security Administration records. As with our applications for coverage under qualified health plans, described earlier, the state marketplace for Kentucky directed two of our Medicaid applicants to submit supplementary documentation. As part of our testing and in response to such requests, we provided counterfeit follow-up documentation, such as a fake immigration card with an impossible numbering scheme for these applicants. The results of the documentation submission are as follows: For the application where the fictitious identity did not match Social Security records, the Kentucky agency approved our application for Medicaid coverage. In our discussions with Kentucky officials, they told us they accept documentation submitted—for example copies of Social Security cards—unless there are obvious alterations. For the Medicaid application without a Social Security number and with an impossible immigration number, the Kentucky state agency denied our Medicaid application. A Kentucky representative told us the reason for the denial was that our fictitious applicant had not been a resident for 5 years, according to our fictitious immigration card. The representative told us we were eligible for qualified health-plan coverage. We applied for such coverage and were approved for an advance premium tax credit and the cost-sharing reduction subsidy. In later discussions with Kentucky officials, they told us the representative made use of an override capability, likely based on what the officials described as a history of inaccurate applicant immigration status information for a refugee population. Kentucky officials also said their staff accept documentation submitted unless there are obvious alterations, and thus are not trained to identify impossible immigration numbers. Finally, Kentucky officials said they would like to have a contact at the Department of Homeland Security with whom they can work to resolve immigration-related inconsistencies, similar to a contact that they have at the Social Security Administration to resolve Social Security-related inconsistencies. By contrast, during the Medicaid application process for one applicant, California did not direct that we submit any documentation. In this case, our fictitious applicant was approved over the phone even though the fictitious identity did not match Social Security records. We shared this result with California officials, who said they could not comment on the specifics of our case without knowing details of our undercover application. As noted earlier, the findings discussed in this statement are preliminary, and we plan to issue a final report later, upon completion of our work. Chairman Pitts, Ranking Member Green, and Members of the subcommittee, this concludes my statement. I look forward to the subcommittee’s questions. For questions about this statement, please contact Seto Bagdoyan at (202) 512-6722 or BagdoyanS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Matthew Valenta and Gary Bianchi, Assistant Directors; Maurice Belding, Jr.; Mariana Calderón; Ranya Elias; Suellen Foth; Maria McMullen; James Murphy; George Ogilvie; Ramon Rodriguez; Christopher H. Schmitt; Julie Spetz; and Elizabeth Wood. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans or apply for Medicaid. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $60 billion for fiscal year 2016. PPACA requires verification of applicant information to determine enrollment or subsidy eligibility. In addition, PPACA provided for the expansion of the Medicaid program. GAO was asked to examine application and enrollment controls for the marketplaces and Medicaid. This testimony provides preliminary results of undercover testing of the federal and selected state marketplaces during the 2015 open-enrollment period, for both private health-care plans and Medicaid. GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online, 10 of which tested controls related to obtaining subsidized health-plan coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these four states based partly on a range of population sizes and whether the state had expanded Medicaid eligibility under terms of the act. The other 8 applications, among the 18 GAO made, tested marketplace and state controls under the marketplace system for determining Medicaid eligibility in these four states. The undercover results, while illustrative, cannot be generalized to the full population of enrollees. GAO discussed the results of its testing with CMS and state officials to obtain their perspectives. Under the Patient Protection and Affordable Care Act (PPACA), health-insurance marketplaces are required to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies or Medicaid. These verification steps include reviewing and validating information about an applicant's Social Security number, if one is provided; citizenship, status as a national or lawful presence; and household income and family size. For 10 fictitious applicants, GAO tested application and enrollment controls for obtaining subsidized health plans available through the federal Health Insurance Marketplace (Marketplace) (for New Jersey and North Dakota) and two selected state marketplaces (California and Kentucky). Although 8 of these 10 fictitious applications failed the initial identity-checking process, all 10 were subsequently approved by the federal Marketplace or the selected state marketplaces. Four applications used Social Security numbers that, according to the Social Security Administration (SSA), have never been issued, such as numbers starting with “000.” Other applicants had duplicate enrollment or claimed their employer did not provide insurance that meets minimum essential coverage. For 8 additional fictitious applicants, GAO tested enrollment into Medicaid through the same federal Marketplace and the two selected state marketplaces, and was able to obtain either Medicaid or alternative subsidized coverage for 7 of the 8 applicants. Specifically: Three were approved for Medicaid, which was the health-care program for which GAO originally sought approval. In each case, GAO provided identity information that would not have matched SSA records. For two applications, the marketplace directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone. For four, GAO did not obtain approval for Medicaid; however, GAO was subsequently able to gain approval of subsidized health plans based on the inability to obtain Medicaid coverage. In 1 case, GAO falsely claimed that it was denied Medicaid in order to obtain the subsidized health plan when in fact no Medicaid determination had been made by the state at that time. For one, GAO was unable to enroll into Medicaid, in California, because GAO declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications. According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplaces and Medicaid offices only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity. GAO's work is continuing, and GAO plans to issue a final report at a later date.