Under the Medicaid program’s federal-state partnership, CMS is responsible for overseeing the program, while state Medicaid agencies are responsible for the day-to-day administration of the program. Although subject to federal requirements, each state develops its own Medicaid administrative structure for carrying out the program, including its approach to program integrity. To monitor program integrity in Medicaid, CMS estimates the national improper payment rate on an annual basis through the Payment Error Rate Measurement (PERM) program. The PERM involves reviews of sampled fee for service claims, payments to managed care entities, and beneficiary eligibility determinations in the states; the national improper payment rate is a weighted average of states’ rates in each of these components. State Medicaid programs do not work in isolation on program integrity; instead, there are a large number of federal agencies, other state entities, and contractors with which states must coordinate. (See fig. 1.) Recognizing the importance of federal state collaboration on program integrity issues, in November 2016, along with the Office of Management and Budget, we convened a meeting with state auditors, CMS, and other federal officials to discuss ways to strengthen collaboration between the federal government and the states. In recent years, Medicaid expenditures and enrollment grew under PPACA. Growth in enrollment is primarily due to more than half of the states choosing to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under PPACA. In addition to expanding Medicaid eligibility, PPACA required the establishment of health insurance exchanges in all states, and provided for federal subsidies to assist qualifying low-income individuals in paying for exchange coverage. States may elect to establish and operate an exchange, known as a state-based exchange, or allow CMS—which is responsible for overseeing the exchanges—to do so within the state, known as a federally facilitated exchange (FFE). As of March 2015, CMS operated an FFE in 34 states, and 17 states were approved to operate state-based exchanges. CMS has taken steps to improve Medicaid program integrity and reduce improper payments; however, additional actions should be taken to help further prevent improper payments. Specifically, our work has identified four key program integrity issues for the Medicaid program—enrollment verification, managed care, provider screening, and coordination between Medicaid and the exchanges—along with CMS’s progress in addressing them, and additional necessary actions. Since 2011, CMS has taken steps to make the Medicaid enrollment- verification process more data-driven to improve the accuracy of eligibility determinations. For example, in response to PPACA, CMS established a more rigorous approach to verifying financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. CMS created a tool called the Data Services Hub that was implemented in fiscal year 2014 to help verify beneficiary applicant information used to determine eligibility for enrollment in qualified health plans and insurance-affordability programs, including Medicaid. The hub routes to and verifies application information in various external data sources, such as the Social Security Administration and the Department of Homeland Security. According to CMS, the hub can verify key application information, including household income and size, citizenship, state residency, incarceration status, and immigration status. Despite CMS’s efforts, there continue to be gaps in the agency’s efforts to ensure that only eligible individuals are enrolled into Medicaid. In particular, our work found that federal and selected state-based marketplaces approved health insurance coverage and subsidies for 9 of 12 fictitious applications made during the 2016 special enrollment period. In another study, we found that CMS also had gaps in ensuring that Medicaid expenditures for enrollees—including enrollees eligible as a result of the PPACA expansion—are matched appropriately by the federal government. Specifically, we found that CMS had excluded from review federal Medicaid eligibility determinations in the states that have delegated authority to the federal government to make Medicaid eligibility determinations through the federally facilitated exchange. To address this gap in oversight of eligibility determinations, we recommended that CMS conduct reviews of federal Medicaid eligibility determinations to ascertain the accuracy of these determinations and institute corrective action plans where necessary. In October 2016, HHS provided additional information indicating that the department is relying upon operational controls within federal marketplaces to ensure accurate eligibility determinations as well as new processes that would identify duplicate coverage. However, we continue to believe that without a systematic review of federal eligibility determinations, the agency lacks a mechanism to identify and correct errors and associated payments. Lastly, CMS requires all states to participate annually in the Eligibility Review Pilots to test different approaches to measuring the accuracy of eligibility determinations under the new beneficiary enrollment processes. Oversight of beneficiary eligibility is important to program integrity. Our prior work has identified thousands of Medicaid beneficiaries involved in potential improper or fraudulent payments. Some of the concerns that we identified included beneficiaries having payments made on their behalf concurrently by two or more states, and payments made for claims that were dated after a beneficiary’s death. CMS has taken steps to provide states with additional guidance on their oversight of Medicaid managed care organizations. In October 2014, CMS made available on its website the managed care plan compliance toolkit to provide further guidance to states and managed care plans on identifying improper payments to providers. In May 2016, CMS issued a final rule on Medicaid managed care, which requires states to conduct periodic audits of financial data submitted by, or on behalf of each Medicaid managed care plan. The final rule takes additional steps to improve oversight of Medicaid managed care, with some provisions applying after 2018. CMS has also taken action in response to recommendations that we made with regard to increasing guidance for states, requiring states to audit managed care organizations, and providing states with additional audit support. Oversight of Medicaid managed care is increasing in importance as states’ use of managed care plans to deliver services has been growing. More than half of all Medicaid beneficiaries are now enrolled in managed care plans, and nearly 40 percent of Medicaid expenditures are for health care services delivered through managed care. The estimated improper payment rate for managed care is currently less than one percent; however, this estimate is based on a review of the payments made to managed care organizations and does not review any underlying medical documentation. Additional actions on the part of CMS and the states are critical to improving program integrity in Medicaid. In particular, we and the HHS Office of Inspector General have identified incomplete and untimely managed care encounter data. Encounter data are data that managed care organizations are expected to report to state Medicaid programs, allowing states to track the services received by beneficiaries enrolled in managed care. Our work found that encounter data for 11 states were not available in a timely manner, and that 6 states had encounter data that we deemed were unreliable. PPACA included multiple provisions aimed at strengthening the screening of providers who enroll to participate in Medicaid. While the act requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures. According to CMS’s risk-based screening, moderate- and high-risk providers and suppliers additionally must undergo pre- enrollment and post-enrollment site visits, while high-risk providers and suppliers also will be subject to fingerprint-based criminal-background checks. This requirement may address some of the potentially fraudulent or improper payments. Additionally, CMS regulations now require that the state Medicaid agency enroll all Medicaid managed care providers, which has the potential to improve oversight of providers in managed care. Prior to PPACA, if one state terminated a provider from its Medicaid program, a provider could potentially enroll in or continue participation in another state’s Medicaid program, leaving the latter state’s program vulnerable to potential fraud, waste, and abuse. Our prior work has identified hundreds of Medicaid providers who were potentially improperly receiving Medicaid payments. Potential improper behavior included providers with suspended or revoked licenses, improper mailing addresses, or deceased providers. Actions to ensure appropriate oversight of Medicaid providers, however, continue to require additional action on the part of CMS and the states. Our work, which was based on 2 states and 16 health plans, found that these states and health plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers—and that these databases did not always have unique identifiers. Our work resulted in in a recommendation that CMS identify databases best suited for oversight of provider eligibility and coordinate with other agencies to explore the use of a unique identifier. CMS regulations now require that the state Medicaid agency enroll all Medicaid managed care providers, which has the potential to improve oversight of providers in managed care. However, CMS has not yet evaluated whether the additional database merit further action or considered ways to ensure that a unique identifier is available so that providers can be accurately identified. We also found that the 10 selected states that we reviewed used inconsistent practices to make data on ineligible providers publicly available, which could result in provider screening efforts that do not identify ineligible providers. CMS has taken action that is responsive to another recommendation on providing guidance to state Medicaid programs, establishing expectations and best practices on sharing provider screening data among states and Managed care plans. In addition, the recently enacted 21st Century Cures Act takes important steps to address this recommendation including requiring CMS to establish a provider termination notification database by July 2018 and requiring the agency to establish uniform terminology for reasons for provider terminations. Regarding coordination between Medicaid and the exchanges, CMS implemented policies and procedures to ensure that individuals do not have duplicate coverage (enrolled in Medicaid and in subsidized exchange coverage). Due to changes in income and other factors, it is likely that under PPACA many low-income individuals will transition between Medicaid and subsidized exchange coverage. Our prior work found that despite CMS policies and procedures designed to prevent duplicate coverage, it was occurring. In response, CMS has conducted three checks to identify individuals with duplicate coverage. CMS has also reported that the agency intends to complete these checks at least two times per coverage year, which has the potential to save federal—as well as beneficiary—dollars. While CMS has made progress by implementing checks for duplicate coverage, weaknesses remain. CMS has not developed a plan for assessing whether the checks and other procedures are sufficient to prevent and detect duplicate coverage. In March 2016, CMS reported that it was reviewing data on the number of people identified as having duplicate coverage through the first CMS check who subsequently disenrolled from subsidized exchange coverage. CMS reported reviewing these data as a means of assessing the effectiveness of the checks for duplicate coverage. We are continuing to monitor CMS’s efforts in this area, particularly whether CMS develops a plan, including thresholds for the level of duplicate coverage it deems acceptable, to routinely monitor the effectiveness of the checks and other planned procedures to prevent and detect duplicate coverage. In closing, Medicaid represents significant expenditures for the federal government and states, and is the source of health care for tens of millions of Americans. Its long-term sustainability is critical, and will require, among other things, effective federal and state oversight. Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions that you might have. If you or your staff have any questions about this testimony, please contact Carolyn L. Yocom, Director, Health Care at (202) 512-7114 or YocomC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Ann Tynan (Assistant Director), Susan Barnidge, Leslie Gordon, Drew Long, Andrea E. Richardson, and Jennifer Whitworth. Patient Protection and Affordable Care Act: Results of Enrollment Testing for the 2016 Special Enrollment Period. GAO-17-78. Washington, D.C.: November 17, 2016. Medicaid Fee-For-Service: State Resources Vary for Helping Beneficiaries Find Providers. GAO-16-809. Washington, D.C.: August 29, 2016. Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk. GAO-16-506T. Washington, D.C.: March 17, 2016. Medicaid Managed Care: Trends in Federal Spending and State Oversight of Costs and Enrollment. GAO-16-77. Washington, D.C.: December 17, 2015. Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C.: October 16, 2015. Medicaid: CMS Could Take Additional Actions to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-665T. Washington, D.C.: June 2, 2015. Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. GAO-15-481. Washington, D.C.: May 29, 2015. Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 2015. Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity of Growing Managed Care Expenditures. GAO-14-341. Washington, D.C.: May 19, 2014. The following table lists selected recommendations GAO has made to the Department of Health and Human Services regarding Medicaid program integrity. The agency has implemented 3 of these recommendations. The agency has either not taken or has not completed steps to implement the remaining 8 recommendations, as of January 2017.

Summary: Medicaid, a joint federal-state health care program, is a significant component of federal and state budgets, with estimated outlays of $576 billion in fiscal year 2016. The program's size and diversity make it particularly vulnerable to improper payments. In fiscal year 2016, improper payments were an estimated 10.5 percent ($36 billion) of federal Medicaid expenditures, an increase from an estimated 9.8 percent ($29 billion) in fiscal year 2015. States, which are responsible for the day-to-day administration of the Medicaid program, are the first line of defense against improper payments. Specifically, states must implement federal requirements to ensure the qualifications of the providers who bill the program, detect improper payments, recover overpayments, and refer suspected cases of fraud and abuse to law enforcement authorities. At the federal level, CMS is responsible for supporting and overseeing states' Medicaid program integrity activities. This testimony highlights key program integrity issues in Medicaid, the progress CMS has made improving its oversight of program integrity, and the related challenges the agency and states continue to face. This testimony is based on 10 products and 11 recommendations. Of these 11 recommendations, 3 have been implemented based on agency action. GAO's prior work has identified four Medicaid program integrity issues—where the program is vulnerable to improper payments such as those made for services that were not covered, were not medically necessary, or were not provided—as well as actions taken by the Centers for Medicare & Medicaid Services (CMS) to address the issues and additional actions that should be taken. Enrollment Verification: In response to the Patient Protection and Affordable Care Act (PPACA), CMS established a more rigorous approach for verifying financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. Despite CMS's efforts, however, there continue to be gaps in efforts to ensure that only eligible individuals are enrolled into Medicaid, and that Medicaid expenditures for enrollees—particularly those eligible as a result of the PPACA expansion—are matched appropriately by the federal government. Oversight of Medicaid Managed Care: CMS has provided states with additional guidance on their oversight of Medicaid managed care. Oversight of managed care is increasing in importance and improvements in measuring the improper payment rate are needed. For example, the estimated improper payment rate for managed care is based on a review of payments made to managed care organizations, and does not review any underlying medical documentation. GAO and the Department of Health and Human Services (HHS) Office of Inspector General have identified incomplete and untimely managed care encounter data—data that managed care organizations are expected to report to state Medicaid programs, allowing states to track the services received by beneficiaries enrolled in managed care. Provider Eligibility: PPACA included multiple provisions aimed at strengthening the screening of providers who enroll to participate in Medicaid. While the act requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures, such as fingerprint-based criminal-background checks for high-risk providers. Also, CMS regulations now require that all Medicaid managed care providers enroll with the state Medicaid agency, which has the potential to improve oversight of providers in managed care. However, GAO's work based on 2 states and 16 health plans identified challenges screening providers for eligibility, partially due to fragmented information. Coordination between Medicaid and the Exchange: CMS implemented a number of policies and procedures to ensure that individuals do not have duplicate coverage (enrolled in both Medicaid and in subsidized coverage through an exchange, which is a marketplace where eligible individuals may compare and purchase private health insurance). CMS has conducted checks to identify individuals with duplicate coverage, and plans to complete these checks at least two times per coverage year, which has the potential to save federal—as well as beneficiary—dollars. However, CMS has not developed a plan for assessing whether the checks and other procedures—such as thresholds for the level of duplicate coverage deemed acceptable—are sufficient to prevent and detect duplicate coverage.