Under the authority of PPACA, HHS approves the operation of state- based marketplaces that meet certain standards, such as the state-based marketplaces’ ability to carry out the required functions of a marketplace consistent with relevant HHS regulations. A state-based marketplace must be a governmental agency or nonprofit entity established by the state. A state may enter into agreements with an eligible entity, such as a state Medicaid agency, to carry out one or more responsibilities of the marketplace. The three state-based marketplaces we selected to examine—Idaho, Maryland, and Rhode Island—have the following structures: Idaho. Your Health Idaho is an independent entity in charge of managing the state-based marketplace for Idaho. The marketplace was established by the state in 2013 and began operating its own platform in plan year 2015. Prior to plan year 2015, the marketplace operated through the federally facilitated marketplace. Your Health Idaho established an agreement with Idaho’s Department of Health and Welfare to conduct eligibility determinations for all applicants seeking subsidized health care. Applicants who wish to receive subsidized health care can begin an application either through Your Health Idaho or through the Department of Health and Welfare. Once eligibility for a qualified health plan is determined, the applicant’s information and eligibility determination, including any subsidy amounts for which the applicant qualifies, are sent back to Your Health Idaho, the entity that manages plan enrollment. Maryland. Maryland Health Benefit Exchange is a public corporation and independent state agency that was established in 2011 and began operations in plan year 2014. The marketplace works with three state executive-branch agencies: the Department of Health and Mental Hygiene, the Department of Human Resources, and the Maryland Insurance Administration. In accordance with federal law, applicants can apply for health coverage through an online portal operated by the marketplace and through other methods such as broker enrollments. Maryland Health Benefit Exchange maintains eligibility and enrollment data for all individuals with qualified health- plan coverage. Rhode Island. Originally established through executive order in 2011, HealthSource RI was formally established in statute in 2015 and operates as a division of the Rhode Island Department of Administration. The marketplace began operations in plan year 2014. Applicants can apply for health coverage through a single online portal operated by the marketplace. HealthSource RI maintains eligibility and enrollment data for all individuals with qualified health- plan coverage. HealthSource RI is also the system of record for premium payment information, since applicants make premium payments directly to the marketplace. In plan year 2015, 14 states, including the District of Columbia, operated their own state-based marketplaces. The remaining 37 states relied on HealthCare.gov, the federally facilitated marketplace. CMS is responsible for operating HealthCare.gov and overseeing the marketplaces operated by the states. Combined, state-based marketplaces accounted for about 28 percent of the over 9.3 million enrollments in all marketplaces as of September 2015, or about 2.6 million enrollments. California and New York together made up about 64 percent of state-based marketplace enrollments, or about 1.7 million enrollments. Our selected state-based marketplaces made up about 9 percent, about 237,000 enrollments, of the total state- based marketplace enrollments. Figure 1 shows states operating their own marketplace platforms and their percentages of the total state-based marketplace enrollments as of September 2015. PPACA generally requires that individuals maintain minimum essential health-care coverage. Minimum essential health-care coverage can include eligible employer-sponsored minimum essential coverage, such as plans offered by an individual’s employer; and non-employer- sponsored coverage, such as individual health coverage purchased directly from an insurance company, a qualified health plan purchased through a state-based or federally facilitated health-insurance marketplace, or coverage received through government-sponsored programs. Under PPACA, to be eligible to enroll in a qualified health plan offered through a state-based or federally facilitated marketplace, an individual must be a U.S. citizen or national, or otherwise lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). Individuals must meet additional eligibility requirements to receive subsidies for qualified health plans, such as meeting certain household- income thresholds. State-based marketplaces, like the federally facilitated marketplace, are required by PPACA to verify applicant information to determine eligibility for enrollment and income-based subsidies, if applicable. Specifically, the marketplaces must check for Medicaid eligibility before determining eligibility for qualified health plans; validate an applicant’s SSN, if one is provided, by comparison to SSA’s records; verify citizenship or immigration status by comparison with SSA or Department of Homeland Security (DHS) records, respectively; and verify household income and family size by comparison against tax- return data from the Internal Revenue Service (IRS), as well as data on Social Security benefits from SSA. Additionally, marketplaces must determine whether an applicant is eligible for minimum essential coverage through eligible employer-sponsored or non-employer-sponsored plans by using any available HHS-approved data source. HHS regulations permit marketplaces to accept applicant attestation as verification of meeting certain eligibility standards, such as incarceration status, residency, and minimum essential coverage, if a data source is unavailable, unless the attestation is not reasonably compatible with other information obtained by the marketplace. Finally, marketplaces are required to perform periodic examinations of data sources to identify changes to applicant information, such as an applicant’s death. If any of the applicant’s self-attested information does not match the information contained in the data source, or if a data source is not available to verify the information, a data-matching inconsistency is generated. For those inconsistencies that cannot be resolved through a reasonable effort to identify and address the cause of the inconsistency, the marketplaces must send out a notification to the applicant, who generally has 90 days to present satisfactory documentary evidence to resolve the inconsistency. During this time, applicants will receive conditional eligibility. If the inconsistency is not resolved within 90 days, unless an extension is granted, the applicant’s eligibility is determined based on the available information. Depending on the type of inconsistency and the availability of the data sources, the applicant’s eligibility may be terminated, or the applicant’s subsidy amount may be recalculated. Figure 2 shows the marketplace application eligibility- determination and enrollment process for subsidized qualified health plans according to HHS regulations. For eligible applicants, PPACA provides two possible forms of subsidies for consumers enrolling in individual health plans, both of which are generally paid directly to insurers on consumers’ behalf. The premium tax credit is a federal income-tax credit, which reduces a consumer’s monthly premium payment. The other form, known as cost-sharing reduction, is a discount that lowers the amount consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. Eligible applicants may use these subsidies to help make their health insurance more affordable. Both state-based and federally facilitated marketplaces use applicants’ reported household income and family size at their time of application to calculate the maximum allowable premium tax-credit amount. Applicants can choose to have some, all, or none of the premium tax credit paid in advance to their insurance issuer. Applicants who choose to have all or some of the credit paid in advance, known as an advance premium tax credit (APTC), must reconcile the amount paid to insurers on their behalf with the amount for which the applicants qualify based on the actual household income and family size reported on their tax returns. Applicants do not have to reconcile any cost-sharing reductions paid on their behalf. The marketplaces are required to provide IRS, through HHS, with information on enrolled individuals on a monthly basis. These data include information on the individuals enrolled in a qualified health plan through the marketplace, the coverage start and end dates, the monthly premium amounts, and the amount of APTC paid to the insurer on behalf of the taxpayer. Marketplaces also provide an annual summary of this information in the Form 1095-A, Health Insurance Marketplace Statement, to applicants who were enrolled in health insurance through the marketplace in the plan year and to IRS. Each of the selected state-based marketplaces’ key processes to verify applicant eligibility for subsidized coverage used various electronic data sources in plan year 2015. PPACA requires marketplaces to verify applicant eligibility using data sources and methods approved by HHS. As shown in table 1, the data sources included various federal data, some of which were accessed via the federal data services hub (data hub), and various state data, among other sources. As reflected in the table above for plan year 2015, two of the selected state-based marketplaces—Maryland and Rhode Island—used the data hub to perform much of their verification process. The third selected state- based marketplace—Idaho—opted to use the state’s existing benefit- eligibility system and leveraged many of its existing eligibility-verification processes, adding or modifying processes where needed, to meet the verification requirements for subsidized qualified health plans. Because Idaho used the same eligibility system for many other benefits programs, Idaho officials noted that they may have preexisting relationships with applicants applying for qualified health plans. For example, an applicant may also participate in other state-administered programs such as Medicaid or the Supplemental Nutrition Assistance Program. In such cases, Idaho leveraged this known relationship to expedite certain steps of the eligibility-determination process, such as the verification of SSN, citizenship, and lawful presence. Officials from our selected state-based marketplaces cited inherent limitations or challenges with using certain third-party data to verify eligibility, such as the age of the data, unreliable results, or limited availability. As noted above, the selected state-based marketplaces had access to local data sources, some of which may have been more current than the data sources used by the data hub. For example, all three selected state-based marketplaces supplemented federal tax income information obtained through the data hub with more-current state wage information to verify income for subsidy eligibility. IRS income information provided via the data hub can be up to 2 years old, which may cause differences between the current applicant-reported income and the information that IRS provides to the data hub. State wage information is updated quarterly. Further, state officials noted inherent challenges with receiving inaccurate or outdated information from incarceration databases. According to officials from one state-based marketplace, these databases contained information on when an individual was incarcerated, but did not always accurately record when an individual was released. Therefore, an individual may have been identified as currently incarcerated when he or she may already have been released. This information required additional follow-up work by the state-based marketplaces to determine whether the individual was still in fact incarcerated and therefore not eligible for coverage. Maryland officials stated that due to the number of false positives they received from the data hub’s connection with the SSA Prisoner Update Processing System and the investment needed to resolve these inconsistencies, they stopped using this source to determine eligibility in December 2014. The other two selected state- based marketplaces—Idaho and Rhode Island—used state or county data sources in addition to, or in place of, the Prisoner Update Processing System, but Idaho officials noted that these data sources also required additional follow-up. Rhode Island officials said that they relied on responses from the state incarceration data over the Prisoner Update Processing System to identify individuals incarcerated in its state prisons. CMS officials previously said that the Prisoner Update Processing System was unreliable for use by the federally facilitated marketplace because the data were not sufficiently current or accurate, after receiving reports that people were misidentified as incarcerated. We recommended in 2016 that CMS reevaluate its use of the Prisoner Update Processing System in eligibility determinations or explore other options, such as applicant- attestation, for the federally facilitated marketplace. CMS concurred with this recommendation. Officials from two selected state-based marketplaces also noted challenges with verifying certain types of information provided by the applicant, such as employer-sponsored minimum essential coverage, because there were limited data sources from which to verify the information. The Rhode Island state-based marketplace used the data hub to verify that applicants were not receiving health-care benefits through a federal employer. However, none of the selected state-based marketplaces verified other types of employer-sponsored coverage, such as those from a private employer, because, according to state officials, there was no comprehensive data source available. As a result, they relied on the applicants’ attestations. Idaho officials said that their staff may contact employers directly in some cases, for example if the applicant works for certain employers known to offer minimum essential coverage, such as a state employer. Maryland state-based marketplace officials told us they are developing a quarterly process to contact employers directly to verify minimum essential coverage for a random sample of applicants. Two of the selected state-based marketplaces also reported challenges with the inconsistency-resolution process as they developed their enrollment and eligibility systems. Maryland transitioned to a new enrollment and eligibility system in plan year 2015, while Rhode Island was working toward integrating its marketplace and Medicaid systems in plan year 2015. Due to these changes, the state-based marketplaces encountered some challenges, but officials from both states told us they have since improved and modified their eligibility-determination and inconsistency-resolution processes. For example, in plan year 2015, the inconsistency-resolution process was manual for these two states. While their systems were able to identify inconsistencies, they did not always create an alert when the 90-day resolution period for applicants to submit sufficient documentation had expired. As a result, some individuals with unresolved inconsistencies continued to receive coverage beyond the 90- day period. Maryland and Rhode Island officials said that they have since put in place automated or semiautomated inconsistency-resolution processes that allow them to automatically identify expired inconsistency time frames, redetermine eligibility, and terminate coverage, if appropriate, for inconsistencies that have not been resolved within the 90- day period. During plan year 2015, CMS relied on several activities to oversee and monitor state-based marketplaces’ procedures for verifying applicant eligibility for subsidized coverage. For example, CMS conducted annual reviews, collected programmatic data, and engaged in regular communication with the selected state-based marketplaces. In plan year 2015, CMS did not collect or review data from the state-based marketplaces related to eligibility-verification procedures, such as the number or types of inconsistencies generated by the state-based marketplaces or the inconsistency-resolution status. At the time of our review, however, CMS was finalizing a data-collection template to capture that information on a quarterly basis and planned to implement the template during the 2018 open-enrollment period. CMS conducted two types of annual reviews as part of its oversight and monitoring activities of the selected state-based marketplaces for plan year 2015. The first review, CMS’s State-based Marketplace Annual Reporting Tool (SMART) review, evaluated information submitted by each state-based marketplace to meet their annual reporting requirements. The second review, CMS’s Open Enrollment and Readiness Review (OERR), evaluated the selected state-based marketplaces’ critical operational areas as they prepared for the upcoming open-enrollment period. SMART review: HHS regulations require state-based marketplaces to report to CMS, at least annually, on the activities of their marketplaces. In response to these requirements and to facilitate their review, CMS developed the SMART report to compile this information into an annual reporting mechanism for the state-based marketplaces. The SMART requires the states to conduct a self- assessment of their marketplace activities, policies, and procedures in effect during the plan year and provide a summary of marketplace activities, accomplishments, and strategic priorities for the upcoming year. They also include the state-based marketplaces’ attestations indicating whether they have met certain requirements outlined in HHS regulations, such as the requirements for eligibility-verification and redetermination procedures, enrollment standards, and annual external financial and programmatic audits. CMS began requiring the states to use the SMART in 2015 to cover plan year 2014, the first year of operation for the marketplaces, and annually thereafter. Upon submission of the SMART report, the state-based marketplaces’ point of contact at CMS, known as the CMS state officer, and subject- matter experts were to assess the submissions to evaluate each state-based marketplace’s compliance with HHS regulations and standards. CMS developed a “desktop tool,” similar to a checklist, that is designed to assist the state officers in determining whether the information is sufficient and satisfies the requirements. It is also designed to provide feedback on the review. For example, CMS state officers and subject-matter experts were to review the state-based marketplaces’ fraud, waste, and abuse policies and procedures to ensure the state-based marketplaces have the ability to identify, adjudicate, and report on fraud, waste, and abuse within marketplace operations. These policies and procedures must include reporting mechanisms for both external and internal parties, penalties for noncompliance, referrals to law enforcement, and detection activities, including data analytics and ongoing monitoring of operations. As part of the SMART review process, CMS state officers were to also review each state-based marketplace’s external programmatic audit that evaluates whether the state-based marketplace’s processes and procedures were designed to prevent improper eligibility determinations and enrollment transactions, and designed to identify errors that resulted in incorrect eligibility determinations, among other items. Further, they were to review any material weaknesses or significant deficiencies identified by the audit and evaluate the state- based marketplace’s corrective action plan, if applicable. Upon completion of CMS’s 2015 SMART review, CMS state officers communicated the results in a final letter to the selected state-based marketplaces that included a summary of findings and corrective actions and incorporated the findings from the external audits, if applicable. For example, in Rhode Island’s 2015 SMART review letter, CMS requested monthly updates on the progress of the marketplace’s corrective action plan to address two findings from the marketplace’s annual external audit, among other items. In Maryland’s 2015 SMART review letter, CMS requested an action plan and associated timeline for the implementation of an incarceration-verification process, while for Idaho, CMS requested a timeline for submission of outstanding policy-level enrollment reports, among other items. State-based marketplace officials from our selected states said CMS also regularly communicated with them to track progress on ongoing issues as a result of its SMART review. For example, the Idaho state-based marketplace officials said they had a number of iterative conversations with CMS to clarify issues and receive feedback on their SMART report. OERR: CMS state officers conducted a second type of annual review of our selected state-based marketplaces that occurred before the 2016 open-enrollment period. The purpose of this review was to evaluate the state-based marketplace’s critical operational areas, including the state-based marketplace’s capabilities for performing eligibility verifications. CMS state-based marketplace oversight documentation and OERR agendas showed that CMS state officers met with the selected state-based marketplaces and walked through a list of questions and state-specific issues pertaining to how the state- based marketplace performs the required functionality. Topics to be discussed during the OERR included application processing and notices, redeterminations and renewals, eligibility verifications, inconsistency processing, and enrollment transactions, among others. CMS state officers were also to discuss with state-based marketplace officials any findings from the previous plan year’s SMART review to assess readiness for the upcoming open-enrollment period. For example, Maryland’s 2016 OERR included follow-up discussions on its incarceration-verification procedures and resolving incarceration- status inconsistencies, which were findings from its previous year’s SMART review. During plan year 2015, CMS collected quarterly enrollment metric reports from the selected state-based marketplaces, which included information such as the number of individuals that applied for coverage, the number of individuals who were determined eligible for a qualified health plan, the number of appeals, and the number of complaints, among other items. As discussed above, HHS regulations require state-based marketplaces to collect and report this type of performance-monitoring data to CMS. However, for plan year 2015, CMS did not collect information that showed the number or types of inconsistencies generated by the state-based marketplaces or their resolution status. As previously mentioned, CMS state officers were to review each state-based marketplace’s annual independent external programmatic audit as part of the SMART review to help ensure the state-based marketplaces’ procedures were designed to prevent improper eligibility determinations, among other things. However, our review of the three states’ external audits found that they did not provide CMS with insight into the overall number or type of inconsistencies or their resolution status. Further, the external programmatic audits occurred once a year and were provided to CMS after the conclusion of the plan year, which limited the states’ and CMS’s ability to use the results of these audits to make timely program changes, as appropriate. At the time of our review, CMS was revising its metrics requirements and developing a new quarterly data-collection template for the state-based marketplaces to include information related to the number and type of inconsistencies generated and their resolution status. If implemented as intended, this revision may provide CMS with the type of information needed to assess whether certain verification procedures are working effectively. For example, CMS officials said they planned to use the information to identify areas in which the states may need technical assistance or improvements that could be made for verification procedures that are generating too many inconsistencies. Too many inconsistencies could be the result of the information provided by the applicants but could also be the result of using a data source that is not providing enough relevant information. At the time of our review, the data- collection template was undergoing a final review and public comment period. CMS officials told us they planned to implement the new data- collection template during the 2018 open-enrollment period. CMS officials said they also engaged in other regular communication with the state-based marketplaces to provide ongoing guidance and solicit feedback on marketplace-related functions. CMS held a number of different types of teleconferences with state-based marketplaces to discuss various operational and technical topics, including discussions related to new CMS policies and procedures, status updates on SMART and OERR findings, and technical assistance on the implementation and operation of eligibility-verification procedures. These calls varied in frequency including weekly, biweekly, monthly, or on a periodic basis. Officials at our selected state-based marketplaces said that these calls were valuable because they give marketplaces an opportunity to receive advance notification on potential changes, provide input on future policy decisions, and share best practices with CMS and other state-based marketplaces. According to CMS officials, examples of the different types of CMS’s regular communication with the state-based marketplaces included the following: CMS state officials call discusses ongoing operations and maintenance issues, such as the SMART, OERR, audits, and other issues as appropriate. State-based marketplace enrollment weekly office-hours call discusses technical guidance and assists state-based marketplaces as they implement automated functionality to report enrollment data to CMS. State-based marketplace group and Chief Executive Officer (CEO) call shares information with state-based marketplace CEOs related to new policies and procedures that affect both the federally facilitated marketplace and state-based marketplaces. The call provides an opportunity for CEOs to clarify their understanding of various CMS policies with both CMS and their counterparts at other state-based marketplaces. State-based marketplace program-integrity call informs state- based marketplaces of program-integrity efforts related to the federally facilitated marketplace and allows state officials to share best practices related to program integrity among their respective state-based marketplaces. Eligibility verifications workgroup call provides technical assistance to state-based marketplaces on the implementation and operations of marketplace eligibility verifications, from both a programmatic and a technological perspective. This call includes discussion of underlying policy and use of the data hub, including enhancements, to effectively support eligibility verifications. Eligibility and enrollment policy forum exchanges ideas and innovations on policy and operational aspects of state and federal marketplace eligibility and enrollment activities. Metrics cluster group call provides ongoing assistance to the state- based marketplace staff that collect and report metrics data as they work to comply with CMS data-reporting requirements. Our analysis of plan year 2015 eligibility and enrollment data from three selected states identified few indications of potentially improper or fraudulent enrollments. However, our analysis did identify some quality issues in states’ data, such as SSN or name data-entry errors. Overall, we analyzed approximately 210,000 individual applicants associated with about $428 million in APTC amounts. Table 2 shows the population and APTC amounts by selected state-based marketplace. We analyzed four areas within the selected state-based marketplaces’ processes to verify applicant eligibility and identify potentially improper or fraudulent enrollments. We selected these four areas because they were related to the eligibility and verification requirements that marketplaces must follow to determine whether individuals are eligible to enroll in coverage. Specifically, we identified (1) applicants whose information, including SSN, did not match SSA’s records; (2) applicants who were potentially deceased; (3) applicants who self-attested to being noncitizens or were identified by the state-based marketplaces as having immigration- related inconsistencies; and (4) applicants who were identified by the state-based marketplace as potentially incarcerated. Additionally, we identified and reviewed a nongeneralizable selection of 60 applicants to provide illustrative examples of the four areas analyzed. Our analysis found the following: Applicants whose personal information did not match SSA’s records. We identified about 2,000 applicants of the approximately 210,000 applicants for whom SSN, first name, last name, or date of birth did not match SSA’s records. About half of the 2,000 applicants were listed as the household’s primary tax filer. These applicants’ information is necessary to reconcile the amount of APTC received on their federal tax returns at the end of the plan year. SSNs are a key identifier in the APTC reconciliation process, and invalid personal information can impair IRS’s ability to complete the reconciliation process. We have previously recommended that CMS take additional steps to resolve SSN-related inconsistencies in the federally facilitated marketplace. CMS concurred with this recommendation. Figure 3 shows the number of applicants whose personal information did not match SSA’s records. State-based marketplace officials cited inherent challenges with verifying SSN information. Specifically, officials from our selected states pointed to challenges such as applicants with name changes or incorrect dates of birth. During our review of selected applicant cases, we observed an instance in which an applicant used what appeared to be her married last name on her application. The applicant, however, had provided a passport with a different last name to verify her citizenship, and officials said she had previously received benefits under that name. Officials from the applicant’s state said that they do not automatically update names to match documents provided since the name could be out of date. In another state, we observed an instance where the state did not receive validation of an applicant’s SSN through the data hub. The applicant provided a copy of her Social Security card and her permanent resident card, which both had the same three last names. While the state had the correct SSN in its enrollment data, it had only recorded the third last name, which may have caused the applicant’s information to not match SSA’s records. We also found instances in which the SSNs contained likely data- entry errors in two of our three selected state-based marketplaces. In plan year 2015, one selected state-based marketplace allowed applicants to successfully resolve identity-related inconsistencies by providing documents that may not have had SSN information on them, such as a birth certificate. In one applicant case from this state, we observed that the state was not able to verify the applicant’s SSN through the data hub. The applicant provided a birth certificate and driver’s license to resolve the inconsistency. As a result of our review, state officials determined that the applicant’s SSN had a typographical error in the middle two digits. State officials said that to identify and appropriately resolve inconsistencies such as these, the state-based marketplace has since created a distinct SSN-related inconsistency that would require proof of SSN to resolve the inconsistency. In one selected state-based marketplace, we observed a case where a data-entry error was likely caused by an applicant incorrectly entering her SSN during the online application process. The applicant’s original application had the correct SSN but a subsequent application had an incorrect SSN. Later, her SSN was corrected and was successfully verified by the state. In the other selected state- based marketplace, we saw an instance in which a marketplace worker did not update an applicant’s SSN when documentation was provided to resolve the SSN-related inconsistency. The applicant went to a walk-in center and provided a copy of his Social Security card to resolve his inconsistency. Ultimately, the marketplace worker overrode the SSN inconsistency and did not correct the SSN, which allowed the error to remain in the state’s data. We shared information on these data-entry errors with the relevant state-based marketplaces, and officials told us they have corrected the information in their systems. Reportedly deceased applicants. We identified 21 of the almost 210,000 applicants (approximately 0.01 percent) who were deceased prior to starting coverage in plan year 2015. The majority of these applicants died after their applications were submitted, but prior to starting coverage. For 2 of the 21 applicants, 1 was deceased for 6 months prior to the start of coverage, and another for a year. Figure 4 shows the number of applicants who were reportedly deceased or whose information matched a decedent prior to plan year 2015. We identified an additional 30 of the nearly 210,000 applicants whose SSN matched an identity that was deceased before the start of coverage, but whose names or birthday did not match. We performed additional review of these applicants and found that the matches were likely the result of SSN data-entry errors in the same two selected state-based marketplaces. Specifically, the SSA Enumeration Verification System (EVS) results for these applicants indicated that their reported SSNs did not match SSA’s records. We also reviewed 11 applicant cases of these 30 applicants and found data-entry errors. For instance, in one state we reviewed a selected applicant’s case information with the state and saw that the applicant’s SSN was not verified by the data hub. The applicant provided a Social Security card, which showed that the state’s data had two digits of the applicant’s SSN transposed and the first name spelled incorrectly. Similarly, our review of an applicant case in the other state found that the applicant’s personal information, including SSN, failed verification through the data hub for plan year 2015. Though the applicant had provided a copy of his tax return that had his correct SSN on it in, his SSN was ultimately not corrected until the applicant came to a walk-in center in November 2016. We shared these applicant cases with the relevant state-based marketplaces, and they have taken steps to correct data-entry errors where necessary. Additionally, we identified 324 of the approximately 210,000 applicants (about 0.15 percent) who died during plan year 2015. The state-based marketplaces ended coverage for about 73 percent of these applicants within 2 months, while coverage continued for 3–12 months after the reported date of death for the remainder of the applicants. Through our applicant case review, we observed different ways that states received information about deceased individuals. For example, in one state, an applicant’s parent called to report that the applicant had died during plan year 2015, and the information was processed by the state-based marketplace the same day. In a different state, we observed that while the state was not aware of an applicant’s death, her insurance carrier terminated her coverage due to nonpayment. Unresolved immigration status. In Rhode Island and Maryland, almost 3,000 applicants—about 2.4 percent of 123,000 applicants from these states—did not resolve their immigration-related data- matching inconsistencies. More than half of these applicants received coverage for more than 6 months. As previously discussed, these two state-based marketplaces had manual inconsistency-resolution processes in place during plan year 2015 and may not have terminated coverage for these applicants in a timely manner. Officials from these states told us that since plan year 2015 they have implemented automated or semiautomated processes to automatically close inconsistencies and terminate coverage after the 90-day period. We were not able to test whether these automated or semiautomated inconsistency-resolution processes would appropriately terminate coverage for these applicants after the 90-day period because they were implemented after our period of review. We reviewed 12 applicant cases from our three selected state-based marketplaces in which applicants self-attested to being noncitizens or had immigration-related inconsistencies. In our review, we observed applicant cases that successfully verified immigration status as well as applicant cases in which applicants’ eligibility was terminated for failure to provide documentation. For example, in one selected case, we saw the DHS Systematic Alien Verification for Entitlements system results used to verify the applicant’s lawful presence. In another case, the state requested immigration documents from the applicant and later terminated an applicant’s coverage for failure to provide the requested documentation. Potentially incarcerated. Our selected state-based marketplaces identified 245 potentially incarcerated applicants out of the nearly 210,000 overall applicants (about 0.1 percent). As previously discussed, there are many challenges associated with using incarceration data, including the risk of false positives. We reviewed nine applicant cases from our selected state-based marketplaces to learn about the incarceration-verification process but did not independently verify the incarceration status of the selected cases. During this review, we observed an instance in which an applicant provided updated incarceration information. The applicant’s spouse called the state-based marketplace to inform it that the applicant would be incarcerated for more than 30 days. The state then determined that the applicant was no longer eligible for coverage. We provided a draft of this product to HHS, SSA, DHS, the Office of Personnel Management, Your Health Idaho, the Idaho Department of Health and Welfare, Maryland Health Benefit Exchange, and HealthSource RI for comment. In their email responses, Your Health Idaho, the Idaho Department of Health and Welfare, and HealthSource RI agreed with our findings. In its written comments, reproduced in appendix II, SSA indicated it had no comments on the draft. In their email responses, HHS, DHS, the Office of Personnel Management, and Maryland Health Benefit Exchange informed us that they had no comments. HHS, DHS, Your Health Idaho, and HealthSource RI also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objectives of this review were to (1) identify key processes used by selected state-based marketplaces to verify applicants’ eligibility for subsidized qualified health plans in plan year 2015, and how the Centers for Medicare & Medicaid Services (CMS) oversaw such efforts; and (2) assess the extent to which applicant eligibility and enrollment data from selected state-based marketplaces show indications of potentially improper or fraudulent enrollments in subsidized qualified health plans in plan year 2015. We chose the selected state-based marketplaces—Idaho, Maryland, and Rhode Island—based on factors such as whether the state used its own marketplace platform to determine eligibility and enrollment, the continued operation of the marketplace, and prior audits performed on these states. Additionally, we considered geographic location and enrollment size, among other characteristics. The results of our review and analysis of these state-based marketplaces cannot be generalized to other marketplaces. To identify key processes used by selected state-based marketplaces to verify applicants’ eligibility and to determine how CMS oversaw such efforts, we reviewed relevant federal and state statutes, Department of Health and Human Services (HHS) regulations, state policies and procedure manuals, and CMS documentation, such as annual reports submitted by the state marketplaces and report-review templates, data- metric templates, and review agendas. We also met with CMS and state agency officials and visited the state-based marketplaces that perform eligibility functions in our selected states. To identify indications of potentially improper or fraudulent enrollments in plan year 2015, we obtained and analyzed eligibility and enrollment data for applicants enrolled in the three selected state-based marketplaces from November 15, 2014, through October 31, 2015. We also obtained and analyzed advance premium tax credit (APTC) data from the three states for all of plan year 2015. Maryland and Rhode Island also provide eligibility-inconsistency data. Idaho did not provide eligibility-inconsistency data due to the way its data are stored in its system. We identified criteria for key eligibility-verification processes by examining federal and state policies, laws, and guidance, including policy and procedure manuals. We limited our analysis to applicants in our selected state-based marketplaces’ eligibility and enrollment data who applied for and enrolled in subsidized qualified health plans in plan year 2015 and received at least 1 month of health coverage and at least 1 month of APTC. To identify these applicants, we removed applicants who were part of an application but were not seeking coverage; applicants who only received coverage through a qualified dental plan; applicants who received coverage through a qualified health plan but did not seek or receive APTC; and applicants who received coverage through Medicaid or the Small Business Health Options Program marketplaces. Where appropriate, we also removed applicants for whom we could not identify the correct APTC amount, for example applicants with two APTC amounts in a single month, or whose coverage dates were not in plan year 2015. Additionally, we did not include applicants who may have enrolled between November 1, 2015, and December 31, 2015, to avoid potential changes to the data that may have been made by the plan year 2016 open-enrollment season. For the remaining records, we determined the total number of unique applicants, unique applications, and the associated APTC. We focused on four analysis areas that were based on the eligibility and verification requirements that marketplaces must follow to determine whether individuals are eligible to enroll in coverage. Specifically, we identified (1) applicants whose information, including Social Security number (SSN), did not match the Social Security Administration’s (SSA) records; (2) applicants who were potentially deceased; (3) applicants who self-attested to being noncitizens or had immigration-related inconsistencies; and (4) applicants who were identified by the state-based marketplace as potentially incarcerated. Applicants whose personal information did not match SSA’s records. To identify applicants whose personal information—name, date of birth, and SSN—did not match SSA’s records, we used the SSA Enumeration Verification System (EVS). Specifically, we processed all applicants in the three selected states’ eligibility and enrollment information through SSA EVS and analyzed the output codes to determine whether the states’ information matched SSA’s records. To determine whether the state-based marketplace had also identified an SSN-related inconsistency, we compared the SSA EVS analysis results to the state eligibility information. To identify applicants listed as the head of household or tax filer whose information did not match SSA’s records, we reviewed the state enrollment and subsidy information to identify heads of household and tax filers and then analyzed the EVS results for these applicants. Reportedly deceased applicants. To identify applicants who were potentially deceased prior to or during plan year 2015, we matched the states’ eligibility and enrollment data to the SSA public-plus-state Death Master File from June 2016. We matched records using the SSN and compared last names and dates of birth of all potential matches. For those applicants whose SSN and last names or date of birth were exact matches, we determined whether the individual was reported as deceased prior to or after the start of coverage. For applicants who were reportedly deceased prior to starting coverage, we analyzed the reported death date in relation to the application- submission and coverage-start dates. For applicants who were reportedly deceased during coverage, we analyzed the reported death date in relation to the coverage-end date. For applicants whose SSN matched, but last names or date of birth did not match, a decedent, we reviewed SSA EVS outputs and state eligibility and enrollment information to determine whether an SSN-related inconsistency existed. Unresolved immigration status. To identify applicants with unresolved immigration-related inconsistencies, we analyzed Maryland and Rhode Island eligibility data and determined the amount of coverage received based on their coverage start and end dates. Potentially incarcerated. To identify applicants who were potentially incarcerated, we analyzed all three selected states’ eligibility and enrollment data to identify applicants who were flagged by the state as being potentially incarcerated. We did not perform analyses using independent data sources for the following enrollment and subsidy eligibility requirements for the following reasons: Incarceration. While historic extracts of SSA’s Prisoner Update Processing System exist, SSA officials told us that the data may have been changed based on updated prisoner information and may be different from the data provided to the states since plan year 2015. Immigration status. The Department of Homeland Security’s Systematic Alien Verification for Entitlements data does not differentiate between states in its data hub responses, making it difficult to identify our selected states’ information. Income. Internal Revenue Service household-income information in the data hub can be up to 2 years old. Due to the age of the data, there may be discrepancies between applicants’ attested information and what state-based marketplaces can obtain through the data hub. Residency. Individuals must intend to reside in the state and do not have to have a fixed address in the state. State-based marketplaces can accept self-attestation unless the information provided by the applicant is not reasonably compatible with other information provided by the applicant or in the records of the marketplace. Employer- and government-sponsored coverage. No single comprehensive dataset was available in plan year 2015 to check eligibility for employer- and government-sponsored minimum essential coverage. To develop illustrative applicant case examples, we initially identified a nongeneralizable illustrative selection of 51 applicant cases from our three selected state-based marketplaces. Specifically, we grouped the states’ eligibility and enrollment data using the following characteristics: condition 1 applicants with personal information that did not match SSA’s records and had SSN-related inconsistencies; condition 2 applicants with personal information that did not match SSA’s records and did not have SSN-related inconsistencies; condition 3 applicants whose SSNs and names or dates of birth matched potentially deceased individuals; condition 4 applicants whose SSNs matched potentially deceased individuals but whose names or dates of birth did not; condition 5 applicants who self-attested to being noncitizens or were identified by the state as having a potential immigration-related inconsistency; and condition 6 applicants who were identified by the state as being potentially incarcerated. We randomly selected 51 applicant cases from these six conditions. Specifically, we selected 9 applicant cases from conditions 1, 2, 5, and 6, with 3 applicant cases from each selected state. From condition 3, we selected 8 applicant cases since one state had only 2 applicant cases that met the characteristics of the condition. For condition 4, we selected 7 applicant cases since one state had only 1 applicant case that met the characteristics of the condition. After our initial selection of 51 applicant cases, we further refined four of our conditions and selected 9 additional applicant cases for a total of 60 applicant cases. These refined characteristics were identified during the course of our analysis and were added to provide additional insight into the states’ eligibility and verification processes. Specifically, we refined the following: condition 1 applicants with personal information that did not match SSA’s records and had an SSN-related inconsistency with an unresolved status; condition 4 applicants whose SSNs matched potentially deceased individuals but names or dates of birth did not, and whose personal information did not match SSA’s records; and condition 5 applicants who were identified by the state as having an unresolved immigration-related inconsistency. We selected 2 applicant cases from refined condition 1; 4 applicant cases from refined condition 4; and 3 applicant cases from refined condition 5. For all 60 of our selected applicant cases, we requested and received copies of documents and information used by the state to verify eligibility for the applicants and their associated applications in advance of our site visits. We then completed on-site reviews of the selected applicant cases’ records as they appeared in the state-based marketplaces’ data systems and discussed the documents provided. During these reviews, we identified and discussed any discrepancies between the eligibility and enrollment data we received, the documents provided by the states, and the current records in the states’ data systems. Ultimately, we judgmentally selected 12 of 60 applicant cases to use as in-depth examples of how states may handle applicant inconsistencies in our report. For these 12 applicant cases, we selected 4 from each state. Our applicant case-review results are not projectable to the entire population of our selected state-based marketplaces, or to other state-based marketplaces. To determine the reliability of the data used in our analysis, we performed electronic testing to determine the validity of specific data elements in the selected state-based marketplaces’ data and in federal data files that we used to perform our work. We also interviewed officials responsible for their respective databases, and reviewed documentation related to the databases and literature related to the quality of the data. On the basis of our own testing and our discussions with agency officials, we concluded that the data elements used for this report were sufficiently reliable for our purposes. We conducted this performance audit from September 2015 to September 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, the following staff members made key contributions to this report: Philip Reiff, Assistant Director; Tracy Abdo; Mariana Calderón; Colin Fallon; Camille A. Keith; Courtney Krebs; Maria McMullen; James Murphy; Chris Wickham; and Elizabeth Wood. Private Health Insurance: In Most States and New Exchanges, Enrollees Continued to be Concentrated among Few Issuers in 2014. GAO-16-724. Washington, D.C.: September 16, 2016. Patient Protection and Affordable Care Act: Results of Undercover Enrollment Testing for the Federal Marketplace and a Selected State Marketplace for the 2016 Coverage Year. GAO-16-784. Washington, D.C.: September 12, 2016. Patient Protection and Affordable Care Act: Most Enrollees Reported Satisfaction with Their Health Plans, Although Some Concerns Exist. GAO-16-761. Washington, D.C.: September 12, 2016. Patient Protection and Affordable Care Act: Final Results of Undercover Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015. GAO-16-792. Washington, D.C.: September 9, 2016. Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk. GAO-16-29. Washington, D.C.: February 23, 2016. Patient Protection and Affordable Care Act: Preliminary Results of Undercover Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015. GAO-16-159T. Washington, D.C.: October 23, 2015. Patient Protection and Affordable Care Act: IRS Needs to Strengthen Oversight of Tax Provisions for Individuals. GAO-15-540. Washington, D.C.: July 29, 2015. Patient Protection and Affordable Care Act: Observations on 18 Undercover Tests of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided under the Act. GAO-15-702T. Washington, D.C.: July 16, 2015. Patient Protection and Affordable Care Act: Status of CMS Efforts to Establish Federally Facilitated Health Insurance Exchanges. GAO-13-601. Washington, D.C.: June 19, 2013. Patient Protection and Affordable Care Act: HHS’s Process for Awarding and Overseeing Exchange and Rate Review Grants to States. GAO-13-543. Washington, D.C.: May 31, 2013. Health Insurance: Seven States’ Actions to Establish Exchanges under the Patient Protection and Affordable Care Act. GAO-13-486. Washington, D.C.: April 30, 2013. Medicaid Expansion: States’ Implementation of the Patient Protection and Affordable Care Act. GAO-12-821. Washington, D.C.: August 1, 2012. Patient Protection and Affordable Care Act: Estimates of the Effect on the Prevalence of Employer-Sponsored Health Coverage. GAO-12-768. Washington, D.C.: July 13, 2012.

Summary: PPACA offers subsidized health-care coverage for qualifying applicants, and states may elect to operate their own health-care marketplaces to assist consumers in comparing and selecting insurance plans offered by private issuers. In plan year 2015, 14 states, including the District of Columbia, operated their own marketplaces and determined eligibility and enrollment. CMS is responsible for oversight of these marketplaces. GAO was asked to examine PPACA enrollment controls for state-based marketplaces. This report, for plan year 2015, (1) identifies key processes used by selected state-based marketplaces to verify applicants' eligibility for subsidized qualified health plans, and how CMS oversaw such efforts; and (2) assesses the extent to which applicant eligibility and enrollment data from selected states show indications of potentially improper or fraudulent enrollments in subsidized qualified health plans. GAO selected three state-based marketplaces for review—Idaho, Maryland, and Rhode Island—based on factors such as geographic distribution and enrollment size. GAO reviewed relevant documentation and interviewed CMS and state officials. GAO analyzed the selected state-based marketplaces' eligibility and enrollment data for plan year 2015 and matched these data to external data sources to identify indications of potentially improper or fraudulent enrollments, and reviewed an illustrative selection of applicants' information. The results are not generalizable to other marketplaces. GAO is not making any recommendations. For plan year 2015, GAO reviewed three selected state-based marketplaces' key processes to verify applicant eligibility for subsidized coverage and found that they used various data sources. Under the Patient Protection and Affordable Care Act (PPACA), marketplaces are required to verify applicant eligibility using data sources and methods approved by the Department of Health and Human Services (HHS). Applicant information that must be verified or validated to receive subsidized coverage includes Social Security number (SSN), citizenship or lawful presence, and income. To accomplish this verification, the selected state-based marketplaces relied on various federal data sources, including sources accessed via the federal data services hub (data hub). They also used state data sources, some of which may have been more current than the data hub sources. For example, all three selected state-based marketplaces supplemented federal tax income information accessed through the data hub, which can be up to 2 years old, with more-current state wage information to verify income. HHS's Centers for Medicare & Medicaid Services (CMS) oversaw the state-based marketplaces' verification procedures by conducting annual reviews, collecting enrollment metrics, and engaging in regular communication in plan year 2015. For the three selected states, GAO found few indications of potentially improper or fraudulent enrollments for plan year 2015 in the verification processes reviewed, but did identify data-quality issues, such as data-entry errors or name changes. About 2,000 of approximately 210,000 applicants (about 1 percent) had SSNs, names, or dates of birth that did not match the Social Security Administration's records. State officials cited inherent challenges with verifying SSN information, such as name changes. GAO also found instances in which SSNs contained likely data-entry errors. Twenty-one of approximately 210,000 applicants (about 0.01 percent) were reportedly deceased prior to starting coverage. The majority of these applicants died after their application was submitted, but prior to starting coverage. About 3,000 of approximately 123,000 applicants in two states (about 2 percent) did not resolve immigration-related inconsistencies. Inconsistencies occur when an applicant's information does not match information contained in the data source used to verify the information. The two states had manual inconsistency-resolution processes for plan year 2015 and may not have terminated coverage for these applicants in a timely manner. Officials from both states said they have since implemented or plan to implement changes to automatically close expired inconsistencies and terminate coverage, as appropriate.