Under PPACA, health-care marketplaces were intended to provide a single point of access for individuals to enroll in private health plans, apply for income-based subsidies to offset the cost of these plans—which are paid directly to health-insurance issuers—and, as applicable, obtain an eligibility determination for other health coverage programs, such as Medicaid or the Children’s Health Insurance Program. CMS operates the federal Marketplace in about two-thirds of the states. To be eligible to enroll in a qualified health plan offered through a marketplace, an individual must be a U.S. citizen or national, or otherwise lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). Marketplaces, in turn, are required by law to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies. These verification steps include validating an applicant’s Social Security number, if one is provided; verifying citizenship, status as a national, or lawful presence by comparison with SSA or DHS records; and verifying household income and family size by comparison against tax-return data from IRS, as well as data on Social Security benefits from SSA. In particular, PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another method approved by HHS. To implement this verification process, CMS developed the data hub, which acts as a portal for exchanging information between the federal Marketplace, state-based marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other federal agencies. The Marketplace uses the data hub in an attempt to verify that applicant information necessary to support an eligibility determination is consistent with external data sources. For qualifying applicants, the act provides two forms of subsidies for consumers enrolling in individual health plans, both of which are paid directly to insurers on consumers’ behalf. One is a federal income tax credit, which enrollees may elect to receive in advance, which reduces a consumer’s monthly premium payment. This is known as the advance premium tax credit (APTC). The other, known as cost-sharing reduction (CSR), is a discount that lowers the amount consumers pay for out-of- pocket charges for deductibles, coinsurance, and copayments. Under PPACA, an applicant’s filing of a federal income tax return is a key element of “back-end” controls—those that occur later in the application or enrollment process, versus those occurring at the outset, or “front end.” When applicants apply for coverage, they report family size and the amount of projected income. Based, in part, on that information, the Marketplace will calculate the maximum allowable amount of APTC. An applicant can then decide if he or she wants all, some, or none of the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment. If an applicant chooses to have all or some of his or her credit paid in advance, the applicant is required to “reconcile” on his or her federal tax return the amount of advance payments the government sent to the applicant’s insurer on the applicant’s behalf with the tax credit for which the applicant qualifies based on actual reported income and family size. To facilitate this reconciliation process, the Marketplace sends enrollees Form 1095-A, which reports, among other things, the amount of APTC paid on behalf of the enrollee. This information is necessary for enrollees to complete their tax returns. The accuracy of information reported on this form, then, is important for determining an applicant’s tax liability, and ultimately, government revenues. As noted, PPACA requires that consumer-submitted information in applications for health-care coverage be verified, and CMS uses the data hub to check external data sources when making eligibility determinations. Hence, the extent to which federal agencies that support the verification system can provide or verify applicant information is a key element of the eligibility and enrollment process. Under the data hub process, verification efforts include the following: SSA: The agency responds to data hub inquiries with information from its records on applicant citizenship status, Social Security number, incarceration status, and death. In responding to data hub inquiries, SSA employs a two-step process: It first seeks to match an applicant’s name, Social Security number, and date of birth. If SSA can successfully establish this initial match, it will then seek to respond to other requests from the data hub for information, if made, based on specifics of a particular application, such as an applicant’s citizenship status. SSA also provides CMS with information on monthly and annual Social Security benefits paid to individuals under the Old Age, Survivors, and Disability Insurance program, if necessary to determine eligibility. IRS: The agency provides federal tax information on household income and family size, to be used for determining eligibility for insurance affordability programs, including the APTC and CSR subsidies. DHS: The agency provides applicant citizenship and immigration status information. If SSA cannot verify citizenship (as described above) and an applicant has also provided an immigration document number relating to citizenship, DHS will be asked to verify the applicant’s citizenship, or other immigration status. Or, if applicants have identified themselves as eligible noncitizens and provide immigration document information, DHS will be asked to verify that status. If the eligibility information applicants provide to the federal Marketplace cannot be verified through the external sources, such as SSA, IRS, and DHS, an inconsistency will result. In particular, an inconsistency can arise when the data hub query process yields no information; or when information is available through the data hub, but it does not match information the applicant has provided. CMS officials told us the key performance measures for the data hub are computer system availability and the extent to which transmissions of queries and responses are successfully accomplished; that is, that an inquiry is made and a corresponding reply received, without regard to content. According to CMS officials, the data hub only captures a code for type of reply that is generated when agencies respond to the inquiries, and those codes are not associated with any other applicant-identifying information or information that may have been provided in response to the query. There are no additional data kept on what information might have been transmitted in the source agency’s response, such as income or family size. Likewise, the data hub does not track whether information provided through the data hub matches information originally provided by the applicant, the officials said. Overall, although the data hub plays a key role in the eligibility and enrollment process, CMS officials said the agency does not track the extent to which the federal agencies deliver responsive information to a request, or, alternatively, whether they report that information was not available. From the standpoint of data hub operations, either outcome is valid, CMS officials told us, and the agency does not focus on the distinction. Additionally, CMS officials said they do not analyze data provided in response to data hub inquiries. By design, the data hub does not store individual transactional data that could be collectively analyzed over time. For policy reasons, the officials said, the agency did not want the data hub to become a data repository itself, and in particular, a repository of sensitive personal data. The CMS officials also said the agency is barred legally from maintaining IRS taxpayer information in the data hub. With CMS unable to provide us with information on data hub inquiry outcomes, we sought available information from the responding federal agencies. SSA, IRS, and DHS officials generally told us they do not analyze outcomes of data hub inquiries. Instead, they focus on responding to inquiries received. Our review also found that SSA, IRS, and DHS had limited information on the nature and extent of the inquiries made by the data hub. According to the three agencies, available statistics reflect data hub inquiries in general, and cannot be broken out by program, such as a qualified health plan or Medicaid. In addition, according to agency officials, an unknown number of data hub applicant inquiries were duplicates, which we could not eliminate from our examination. Instead, agency officials told us, they generally process inquiries sequentially as they are received from the data hub. Thus, while the agencies can provide some information on data hub queries, they cannot provide comprehensive information specifically on number of inquiries and individuals represented by those queries. Our examination of available statistics from SSA, IRS, and DHS, subject to the limitations noted, showed that while the agencies could successfully provide applicant verification information in a large percentage of cases, they nevertheless did not have data in their records to verify information for millions of data hub inquiries. SSA. According to statistics provided by SSA, the agency accomplished its match on name, Social Security number, and date of birth in a large majority of cases for PPACA’s first enrollment cycle, for 2014 coverage, as shown in table 1. However, for about 4.4 million inquiries—or about 5 percent of the total— the applicant information did not match SSA records. In addition, after completion of the name, Social Security number, and date of birth match, when SSA attempted to verify additional information, the agency could not confirm citizenship in about 8.2 million inquiries where individuals claimed they were citizens. We also obtained updated figures for the second enrollment cycle—for 2015 coverage. SSA’s total matching percentage was slightly higher (96.1 percent vs. 94.9 percent), and the number of unsuccessful citizenship queries was lower (3.6 million vs. 8.2 million), according to available data from SSA. IRS. According to IRS, household income and family size information was not available for inquiries representing about 30.7 million people, including the following: Inquiries representing about 25 million people for whom tax-return information was unavailable, primarily because, according to IRS, no tax returns were found in agency records or there was a mismatch between taxpayer identification number and name. Inquiries representing about 3.2 million people where spouse information reported on an application does not match spouse information on file. A spouse mismatch may occur when one partner remarries, or ceases to be a spouse, IRS officials told us. Inquiries representing about 1.3 million people involved in identity theft—victims themselves, or those associated with people who are victims. For 2015 coverage, the total figure for which IRS was unable to provide income and household size verification information was similar, at 29.2 million people versus 30.7 million people, according to IRS data. DHS. Among the major federal agencies involved in the data hub process, DHS handled the smallest number of inquiries during the first enrollment cycle—approximately 3.5 million, regarding applicant immigration status. Of these, DHS provided applicant status information through its automated inquiry process in about 3 million inquiries. It could not initially provide information through the data hub process for approximately 510,000 inquiries, or about 15 percent, of the total. For 2015 coverage, the figure for unresolved queries was about the same: status information provided in about 3.5 million inquiries, but with about 634,000, or about 15 percent, initially unresolved, according to DHS data. According to DHS, the reasons for failure to obtain an automated resolution are: a mismatch between reported name and date of birth; inability to find the identifying number of immigration documentation supplied by the applicant; expired documentation; and missing information on the legal category used to admit an immigrant. As noted earlier, CMS does not analyze outcomes of the data hub query process. A variety of standards, however, call for agencies to routinely examine performance and progress toward key goals. Internal control standards for the federal government require that departments and agencies assess program quality and performance over time and work to address any identified deficiencies. In addition, management must continually assess and evaluate controls to assure that the activities the agency employs to implement its controls are sufficient and effective. In particular, information critical to achieving agency objectives, including information related to critical success factors—such as, in this case, the effectiveness of PPACA’s primary enrollment control process—should be identified and regularly reported to management. In addition, according to GAO’s fraud framework, it is a leading practice to conduct ongoing monitoring and periodic evaluations, to, among other things, provide assurances to managers they are effectively preventing, detecting, and responding to potential fraud, and also to support decisions about allocating resources. Monitoring activities, because of their ongoing nature, can serve as an early warning system for managers to help identify and promptly resolve issues and ensure compliance with current law, regulations, and standards. Moreover, monitoring enables a program to quickly respond to emerging risks to minimize the impact of fraud. A centerpiece of federal management and accountability standards, the Government Performance and Results Act, requires regular review of progress in achieving objectives, including data-driven analysis on progress toward key performance goals and management-improvement priorities. Further, creation of a written plan and timetable for actions to monitor and analyze outcomes of the data hub query process would demonstrate organizational commitment to program oversight and improvement, move such actions closer to fruition, and establish a schedule for accountability. By not assessing the extent to which data hub–provided data matches consumer–provided information, CMS foregoes analysis of the extent to which responding agencies successfully deliver applicant verification information in response to data hub requests. In doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, to the extent hub inquiries cannot provide requested verification information—leading to generation of applicant inconsistencies—there is a greater burden on both the agency and the applicant to resolve the inconsistency. Also, as our enrollment testing work showed (see discussion later in this report), the inconsistency resolution process that occurs after the initial application is vulnerable to fraudulent submission of applicant documentation. Thus, analysis of data hub query outcomes could be used to assess whether additional data sources or processes could be used to improve the front- end verification process. CMS officials acknowledged that the current system often leads to generation of inconsistencies because information applicants submit often is more current than information maintained by the federal agencies. By analyzing the outcomes of data hub inquiries, and in particular, clarifying the nature and extent of inconsistencies arising from this process, CMS could, for example, assess whether other sources of data, such as the National Directory of New Hires, could be useful for more current applicant information on income. Similarly, CMS could analyze the information to examine whether other sources of citizenship information, such as the Department of State’s passport data, could be used to aid in verifying applicant citizenship. The data hub’s limited capture of transactional details also means there is not a detailed audit trail between health marketplaces and the federal agencies responding to inquiries, to determine whether a query was appropriately handled. Finally, information that federal agencies maintain, but that is not currently part of the inquiry response process, could also enhance the verification process. For example, on the key variable of household income, IRS reports a limited number of response codes to the data hub when it cannot provide information in response to a hub inquiry. Among them is a generalized description that tax-return information is unavailable. Internally, however, IRS tracks more specific reasons for why tax-return information is unavailable, such as no tax return on file or a mismatch between name and taxpayer identification number. As for feasibility of scrutinizing data hub inquiry outcomes, CMS officials told us that, as currently operated, the data hub is not equipped to allow such analysis, and that the time required for any such analysis would likely hinder a key data hub goal of providing real-time responses. Further, they said, in some cases, analysis within the data hub would not be possible—for example, as noted earlier, the data hub cannot store protected taxpayer information. We note, however, that any such analysis need not take place within the data hub itself. CMS officials agreed it is possible that such analytical work could be performed on outcomes of hub operations outside the data hub itself, but cautioned that attempting to institute performance criteria could be challenging because success of data hub queries is inherently limited by data available in the source agencies. A comprehensive feasibility study of actions CMS could take to monitor and analyze data hub query outcomes, both quantitatively and qualitatively, would provide a means for the agency to assess a key operation, as standards provide, and could also lead to improved program performance and accountability. Such a study, at the least, could examine not only baseline performance of the data hub process in delivering usable information for applicant verification, but also examine data more qualitatively, such as to identify trends or patterns that could suggest improvements in verification or actions that could reduce the number of inconsistencies that require further attention. As part of our review, we obtained data from CMS on applicant inconsistencies generated for the federal Marketplace and the value of APTC and CSR subsidies associated with them, for the 2014 coverage year. In particular, to observe the number of inconsistencies created and subsequently resolved, we examined applications that were awarded subsidies and that were created and submitted during the 2014 open- enrollment period plus a special enrollment period extension that followed. Overall, based on this population, we identified about 1.1 million applications with a total of about 2 million inconsistencies. These applications had combined APTC and CSR subsidies of about $4.4 billion associated with them for coverage year 2014. We found, based on our analysis of CMS data, that the agency resolved about 58 percent of the total inconsistencies, meaning the inconsistencies were settled by consumer action, such as document submission, or removed due to events such as life change, application deletion, or consumer cancellation. Meanwhile, our analysis found about 34 percent of inconsistencies, with about $1.7 billion in associated subsidies, remained open, as of April 2015—that is, inconsistencies still open several months following the close of the 2014 coverage year. Figure 1 shows the total number of inconsistencies included in our analyses, plus their resolution status and associated subsidy amounts. Among all applications in our analysis, we identified approximately 690,000 applications with about 1.2 million inconsistencies that had been resolved through consumer or other actions. The subsidies associated with these applications were about $2.5 billion for APTC and $534 million for CSR. We also identified about 431,000 applications that had about 679,000 unresolved inconsistencies as of April 2015. These applications had associated with them subsidy amounts of about $1.4 billion for APTC and $313 million for CSR, for a total of about $1.7 billion. CMS, through its contractor, terminated or adjusted the subsidies for about 128,000 other applications based on failure to submit required documentation. These terminated or adjusted applications had about 159,000 inconsistencies. The total value of subsidies associated with these applications was about $360 million, with about $293 million in APTC and $67 million in CSR subsidies. Appendix II presents further details of our analysis of application inconsistencies, including breakouts by number and category of inconsistencies. Because unresolved inconsistencies can lead to termination or adjustment of subsidies, which in turn affects government costs for the program, we asked CMS for details of such actions. CMS officials told us the agency does not track the value of APTC or CSR subsidies that change when CMS terminates or adjusts subsidy amounts. Instead, CMS compiles the number of individuals or households affected by such actions. According to federal internal control standards, managers should obtain financial information to make operating decisions, monitor performance, and allocate resources. Tracking the amount of subsidies eliminated or reduced would provide financial information on direct cost to the federal government for such subsidies in a manner that tallies of individuals or households cannot. Hence, by not tracking the magnitude of such subsidy changes, CMS does not collect and have available key financial information relevant to effective program management. In addition, according to GAO’s fraud framework, it is a leading practice to assess expected costs and benefits of control activities, to determine whether a particular control is cost-effective. The costs to the government for these subsidies would be a key element of an assessment of the cost-effectiveness of eligibility and enrollment control activities. By not tracking such costs, CMS cannot make a fully informed judgment on best implementation of such control activities. Relatedly, we also identified that, unlike APTC subsidies, CSR subsidies are not subject to a recapture process at the individual level, such as reconciliation on the taxpayer’s federal income tax return. In particular, in discussions with CMS and IRS officials, we found that no entity has established a process to identify and recover the value of CSR subsidies. The CSR subsidies increase government costs; and, according to IRS, excess CSR payments, if not recovered by CMS, would be taxable income to the individual for whom the payment was made. CMS officials told us the agency plans to reconcile CSR payments made from the government to insurers. But CMS officials said neither PPACA nor its implementing regulations currently provide for reconciliation or recapture of CSR subsidies at the individual level. According to federal internal control standards, program managers should be effective stewards of public resources and detect or prevent unauthorized use of agency assets. In addition, according to GAO’s framework for managing fraud risk in federal programs, it is a leading practice for program managers to seek to ensure program integrity by, among other things, ensuring that funds are spent effectively and assets are safeguarded. While there is already a recapture process for APTC subsidies, CMS has not evaluated the feasibility, including whether new statutory authority would be required, as well as the expected costs and benefits, of creating a mechanism to recapture CSR subsidies. By doing so, the agency can be more assured it is fulfilling its responsibility to spend funds effectively. Given the multiagency approach to reconciling APTC, any such feasibility evaluation could likewise involve another agency. Further, to the extent that recapture is feasible or reasonable under current statutory authority, creation of a written plan and timetable for providing such a process would demonstrate organizational commitment to fiscal responsibility, move such a project closer to fruition, and establish a schedule for accountability. In addressing inconsistencies, CMS decided not to seek terminations of policies or adjustments to subsidies for certain inconsistency types for 2014 and 2015 enrollment. CMS officials told us that their system did not have the capability to take action related to a number of different inconsistency types. As shown in our analysis of 2014 data, CMS did not terminate or adjust subsides for any applications with incarceration or Social Security number inconsistencies, plus other inconsistencies. Further, CMS officials told us that they currently do not plan to take any actions on individuals with unresolved incarceration or Social Security number inconsistencies. Under PPACA, applicants with a Social Security number must provide it, to allow for verification of citizenship or immigration status. However, having a Social Security number is not a condition of eligibility. Under CMS regulations, the Marketplace must validate all Social Security numbers provided by submitting them to SSA along with other identifying information. If the Marketplace is unable to validate the Social Security number, it must follow the standard process for resolving all types of inconsistencies. In our inconsistency analysis (discussed in further detail in app. II), we identified about 35,000 applications having an unresolved Social Security number inconsistency, which were associated with about $154 million in combined subsidies. CMS officials told us they did not take action to terminate coverage or adjust subsidies during 2014 based on Social Security number inconsistencies. They said this decision was because such inconsistencies are generally related to other inconsistencies, such as citizenship or immigration status, and that document submissions for citizenship or immigration status may also resolve Social Security number inconsistencies. Overall, CMS officials told us they do not consider missing or invalid Social Security number information to be a stand-alone inconsistency that must be resolved, and do not take adverse action in such cases. However, CMS regulations state that “to the extent that the is unable to validate an individual’s Social Security number through the Social Security Administration,” the Marketplace must follow its standard inconsistency procedures. Further, when promulgating this regulation, CMS explained that transmission of Social Security numbers to SSA for validation “is separate from the provision regarding citizenship verification, and only serves to ensure that SSNs provided to the can be used for subsequent transactions, including for verification of family size and household income with IRS.” However, our analysis found more than 2,000 applications with Social Security number inconsistencies that had no corresponding citizenship or immigration inconsistencies. We also identified nearly 5,500 applications with Social Security number inconsistencies that had no corresponding income inconsistency. These applications had total subsidies of about $10 million and $31 million associated with them, respectively. They indicate that Social Security number inconsistencies can stand alone, unrelated to other inconsistencies. Moreover, as discussed in our July 2015 testimony and summarized later in this report, we successfully enrolled and received subsidies for eight undercover identities that either did not provide a Social Security number or had an invalid Social Security identity. Thus, we view unresolved Social Security inconsistencies as a potential fraud vulnerability in the application process. Social Security number inconsistencies also affect tax compliance. As noted earlier, if an applicant chooses to have all or some of his or her premium tax credit paid in advance, the applicant must reconcile the amount of APTC with the tax credit for which he or she ultimately qualifies based on actual reported income and family size. Although CMS officials told us they do not consider missing or invalid Social Security number information to be a stand-alone inconsistency that must be resolved, IRS officials told us a valid Social Security number is critical to tax compliance efforts. In particular, according to the officials, IRS receives applicant information, including amount of APTC subsidy received, from the federal Marketplace and state-based marketplaces. If this information does not include a Social Security number, or has an invalid Social Security number, IRS cannot use the marketplace data to verify that taxpayers have properly filed APTC information on their tax returns. Specifically, according to IRS officials, Social Security numbers are a key identifier for tax reconciliation under the act. If a health-insurance marketplace does not provide valid Social Security information to IRS, but a taxpayer nevertheless reports receipt of APTC on his or her tax return, IRS can then contact the taxpayer, the officials told us. This situation results in greater burden on the taxpayer and IRS to resolve the discrepancy. However, if a marketplace does not provide Social Security information to IRS, and a taxpayer does not report receipt of APTC—as a fraudulent filer might do—then IRS is unable to identify unreported APTC benefits (that should be subject to reconciliation) at the time of filing, the officials said. In addition, a missing or invalid Social Security number impairs IRS outreach to taxpayers who have received the APTC subsidy, IRS officials told us. IRS uses information from the marketplaces to identify those who received APTC, but who did not file a tax return, or who did file a return but requested a filing deadline extension. After close of the filing deadline, IRS sends letters to these taxpayers, reminding them to file a return and reconcile the APTC amount. Without Social Security number information, IRS cannot know who filed a tax return, and thus does not include those taxpayers in its APTC outreach efforts, officials told us. Thus, according to IRS officials, it is important for tax compliance efforts that CMS validate Social Security numbers—for reconciling APTC, and for outreach efforts. If IRS does not receive valid Social Security numbers, the key back-end control intended by the tax reconciliation process can be frustrated, they said. If IRS is unable to reconcile APTC subsidies, that inability could lead to loss of tax revenue that should otherwise be collected by the government. We asked IRS whether it could provide information on the amount of APTC that went unreconciled, or outreach efforts foregone, due to missing or invalid Social Security numbers, but officials told us such information was not readily available and would take substantial effort to obtain. CMS could make greater efforts to resolve Social Security number inconsistencies within its existing system and in the same fashion as it handles other inconsistencies. According to data we reviewed for our inconsistency analysis (discussed earlier), Social Security number inconsistencies are separately identified. In addition, Social Security documents, such as a Social Security card or Social Security benefits letter, are already among acceptable forms of documentation that applicants can provide in response to Marketplace requirements. As noted earlier, PPACA provides that incarcerated individuals are not eligible to enroll in a qualified health plan through a marketplace, with the exception of those incarcerated pending disposition of charges. CMS currently uses SSA’s Prisoner Update Processing System (PUPS) database to generate incarceration inconsistencies when there are indications an applicant may be incarcerated. As part of the inconsistency resolution process, the Marketplace notifies applicants to send documentation to resolve the inconsistency. To do so, consumers can submit documentation such as release papers, CMS officials told us. The PUPS system contains information on incarcerated individuals in all 50 state corrections departments, the Federal Bureau of Prisons, and local and other facilities. According to SSA, it is the only national database with records of federal, state, and local incarcerations. SSA uses PUPS to identify individuals who may no longer be eligible for SSA benefits due to incarceration. In addition to SSA, other federal programs, such as Medicare, use PUPS data. In its 2013 computer-matching agreement with CMS, SSA acknowledged that PUPS is not as accurate as other SSA data and contains information that SSA may not have independently verified. Thus, the agreement states that CMS will independently verify information it receives from PUPS and will provide individuals an opportunity to contest an incarceration inconsistency before any adverse action in an eligibility determination. Overall, according to SSA officials, PUPS information can be used to identify individuals who require additional follow-up to determine eligibility. In our inconsistency analysis (discussed in app. II), we identified about 22,000 applications having an unresolved incarceration inconsistency, which were associated with about $68 million in combined subsidies. CMS officials, however, told us they did not terminate eligibility for incarceration inconsistencies, because the agency determined in fall 2014 that PUPS was unreliable for use by the Marketplace. Specifically, CMS determined that PUPS data were not sufficiently current or accurate for use by the Marketplace after receiving reports that people were misidentified as incarcerated, officials told us. PUPS data for inmate release were also unreliable, they said. As a result, CMS officials told us the agency elected to rely on applicant attestations on incarceration status. Under this approach, CMS officials told us, the Marketplace continues to make an initial verification attempt using the PUPS data. If a consumer maintains he or she is not incarcerated, CMS will rely on that representation and not take adverse action, regardless of what PUPS indicates, officials told us. According to HHS officials, the Marketplace no longer requires applicants to submit documentation on incarceration status. SSA officials told us that CMS did not communicate concerns about reliability of PUPS data to them until after CMS had determined the data to be unreliable. They told us CMS requested a modification to the PUPS data that would result in fewer false positives—where a person is identified as incarcerated but actually has never been so, according to the SSA officials. SSA estimated a cost of $100,000 to provide the modification. However, according to SSA officials, CMS was unable to fund the modification and thus deferred the enhancement until after 2016 enrollment. SSA officials also noted to us that although CMS has expressed concerns about use of PUPS data under PPACA, it continues to use PUPS for the Medicare program. CMS officials explained that PUPS data are acceptable for Medicare because that program uses the data to determine whether Medicare payments are prohibited for claims (regulations generally bar Medicare payments for those jailed), but not for determining overall Medicare eligibility. SSA considers PUPS data to be accurate for its purposes, because it verifies information about its beneficiaries before taking action, agency officials told us. SSA provides more information to CMS through the data hub than is actually validated by SSA. As a result, SSA officials told us it is imperative that an agency obtaining PUPS information take steps to verify that information. CMS officials told us that, thus far, the agency has not used PUPS data as an indicator for additional follow-up on individual applicant information. Reflecting SSA’s use of its PUPS data as a lead for further investigation, a relatively small portion of prisoner alerts generated eventually led to benefit suspensions, according to agency officials. PUPS generated about 1.01 million alerts from October 2012 to August 2015, which prompted notices being sent to beneficiaries. Ultimately, SSA officials said the agency suspended about 131,000 Social Security and 237,000 Supplemental Security Income beneficiaries. Our review of documentation CMS provided for its decision to take no adverse action on incarceration inconsistencies showed it did not contain key information supporting the agency’s decision to not use PUPS data. Specifically, the documentation did not provide specific details on why, or to what extent, people were misidentified as incarcerated; why CMS also judged inmate release information to be unreliable; any criteria or assessment employed to conclude that the PUPS data were not sufficiently current or accurate; or the potential cost associated with not verifying incarceration status. According to federal internal control standards, significant events must be clearly documented, and the documentation should be readily available for examination. Without clearly identifying such elements as analysis, scope, and costs of significant decisions, CMS is at greater risk of providing benefits to ineligible applicants, and also may undermine confidence in the applicant verification process and compromise overall program integrity. Although SSA acknowledges that PUPS has a lower level of reliability than other SSA data sources, CMS nevertheless could use information from PUPS in the manner in which it was intended to be used—as a lead for further investigation—to identify individuals who may be required to provide additional documentation for their eligibility determinations. By not using PUPS data in such a fashion, and by relying on applicant attestation in the alternative, CMS may be granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. Further, if CMS has determined that PUPS or other data sources are not sufficiently reliable, CMS is maintaining an inconsistency resolution process that is not necessary, given the decision to ultimately rely on applicant attestation. As a result, in continuing to identify incarceration inconsistencies and directing applicants to submit documentation to resolve them, and then processing that documentation, CMS imposes unnecessary cost and burden on both applicants and the Marketplace. In light of the decision to accept applicant attestation, the inconsistency resolution process, whatever its outcome, is not necessary for continued coverage. As described in our July 2015 testimony, we identified vulnerability to fraud, and other issues, when we obtained, through undercover testing, federal Marketplace approval of subsidized coverage for 11 of 12 fictitious applicants for 2014 coverage. In particular, as we reported in our testimony: We obtained the APTC subsidy in all cases, totaling about $2,500 monthly, or about $30,000 annually, for all 11 approved applicants. We also obtained eligibility for CSR subsidies. Appendix III summarizes outcomes for all 12 of our phone and online applications, and shows the fictitious applicant scenarios we used to attempt the applications. In all 11 cases in which we obtained coverage, the Marketplace directed us, either orally or in writing, to send supporting documentation. However, the Marketplace did not always provide clear and complete communications. As a result, during our testing, we did not always know the current status of our applications or specific documents required in support of them. Our 11 fictitious enrollees maintained subsidized coverage throughout 2014, even though we sent fictitious documents, or no documents, to resolve application inconsistencies. Following our document submissions, the Marketplace told us, either in writing or in response to phone calls, that the required documentation for all our approved applicants had been received and was satisfactory, even when we had sent no documentation. CMS officials told us that call center representatives do not have available to them information on current status of inconsistencies and applicant submission of documents. The CMS officials said the agency hopes to add the ability to provide inconsistency status information to the call center representatives, but they did not know how long this would take. There have been no cases of fraudulent applications or documentation referred to the U.S. Department of Justice or the HHS Office of Inspector General, because CMS’s document-processing contractor has not identified any fraud cases to CMS. However, the contractor is not required to detect fraud, nor is it equipped to do so. Instead, CMS requires the contractor only to inspect for documents that have obviously been altered. Overall, according to CMS officials, the agency has limited ability to detect and respond to attempts at fraud. They told us CMS must balance consumers’ ability to “effectively and efficiently” select Marketplace coverage with “program-integrity concerns.” As explained later in this section, CMS effectively waived certain applicant documentation requirements for 2014, which likely accounted for some of our applicants’ ability to retain coverage. Specifically, for the 2014 coverage year, CMS directed its document contractor not to terminate policies or subsidies if an applicant submitted any documentation to the Marketplace. Typically, applicants submit documentation after receiving a notice from the Marketplace. Thus, if an applicant submitted at least one document, whether it resolved an inconsistency or not, that would be deemed a sufficient good-faith effort so that the Marketplace would not terminate either the policy or subsidies of the applicant, even if other documentation had initially been required. The Marketplace automatically reenrolled coverage for all 11 fictitious applicants for 2015. Although tax filing information is key to reconciling APTC, we found errors with the information CMS reported on 1095-A forms for 3 of our 11 fictitious applicants. The Marketplace later terminated subsidized coverage for 6 of our 11 applicants in early 2015, but after contacts with Marketplace representatives, we restored coverage for 5 of these applicants—with larger subsidies. In the case of call center representatives not having current information on consumer document submissions, internal control standards for the federal government call for agency management to ensure there are adequate means of communicating with, and obtaining information from, external stakeholders that may have a significant impact on the agency achieving its goals. In addition, CMS has noted the importance of the quality of consumers’ experiences with the Marketplace, particularly in dealing with call centers. The inability of call center representatives to obtain current document status information after the application process is complete is not only a potential vulnerability for efficient and effective operation of the system, but can also be a frustration for consumers attempting to provide requested eligibility information, and could cause them to not file documentation as appropriate. In turn, that could affect CMS’s goal of extending health-insurance coverage to all qualified applicants. Given CMS officials’ stated desire to add the ability to provide inconsistency status information to the call center representatives, creation of a written plan and timetable for doing so would demonstrate organizational commitment, move such a project closer to completion, and establish a schedule for accountability. Regarding fraud vulnerability an agency may face, federal internal control standards provide that a key internal control is to assess risks an agency faces from both internal and external sources. Similarly, a strategic goal for HHS, CMS’s parent agency, is to strengthen program integrity and responsible stewardship by, among other things, fighting fraud and focusing on performance and risk management. In addition, according to GAO’s framework for managing fraud risks in federal programs, it is a leading practice for agencies to regularly assess risks to determine a fraud risk profile. As part of that process, agencies should identify inherent fraud risks to their programs and determine the likelihood and impact of those risks on program objectives. In addition to financial impacts, fraud risks can affect a program’s reputation and compliance with statutes and regulations. We asked CMS to provide us with any fraud risk assessment for the eligibility and enrollment process the agency may have conducted. Agency officials were unable to provide us with any such assessment. CMS officials did tell us the agency plans to conduct an assessment of the Marketplace’s eligibility determination process, including the application process and the inconsistency resolution process. CMS officials did not provide a firm date for completion. We note, however, that while such work could be constructive, it would not necessarily constitute the type of thorough fraud risk assessment as provided in GAO’s fraud framework. In addition, CMS officials told us the agency is beginning to perform risk assessments of the accuracy of payments made to insurers to fund APTC and CSR subsidies. Again, while such work could be constructive, we distinguish this from a fraud risk assessment of the eligibility and enrollment process. As previously noted, we retained coverage and subsidies for all 11 applicants originally covered, even though we had submitted fictitious documents or no documents to resolve application inconsistencies. These results, while not generalizable, nevertheless illustrate that the Marketplace enrollment process is vulnerable to fraud. Without conducting a fraud risk assessment—as distinct from a more generalized review of the eligibility determination process, as described earlier—CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level. Moreover, CMS is at greater risk of improperly providing benefits as well as facing reputational risks to the program through perceptions that program integrity is not a priority. In the case of CMS effectively waiving certain document submission requirements, PPACA authorized the agency, for the 2014 coverage year, to extend the period for applicants to resolve inconsistencies unrelated to citizenship or lawful presence. Additionally, regulations provide that CMS may extend the period for an applicant to resolve any type of inconsistency when the applicant demonstrates a “good-faith effort” to submit the required documentation during the resolution period. CMS officials told us that the submission of a single document served as sufficient evidence of a good-faith effort by the applicant to resolve all inconsistencies, and CMS therefore extended the inconsistency resolution period through the end of 2014. Hence, CMS did not terminate coverage for any applicant who made such an effort in 2014. Our analysis of CMS documentation of the agency’s application of the good-faith effort regulation showed CMS did not sufficiently analyze or document its decision and its impact. Specifically, documentation CMS provided to us did not include information on key factors including the number of applications and inconsistencies this decision affected or was expected to affect; expected costs associated with the decision; or an explicit rationale, created at the time of the decision, for why partial submission of documents constituted a “good-faith effort” sufficient to resolve all inconsistencies. According to federal internal control standards, significant events—in this case, applying CMS’s good-faith regulation to effectively waive submission of satisfactory documents to resolve application inconsistencies—must be clearly documented, and the documentation should be readily available for examination. All such documentation and records should be properly managed and maintained. To the extent CMS’s implementation of the good-faith effort regulation allows otherwise ineligible applicants to obtain and maintain subsidized coverage, it contributes to what has been called a practice of “pay and chase”— attempting to recover overpayments (potentially obtained through fraud) once they have already been made. Without clearly identifying and fully documenting, on a contemporaneous basis, the policy objectives, supporting analysis, scope, and expected costs and effects of implementing the good-faith effort, or other significant decisions on enrollment and eligibility matters, CMS undermines transparency and ability to communicate most effectively with both internal and external stakeholders, and also may undermine confidence in the applicant verification process and compromise program integrity. HHS did provide us with an explanation of the agency’s decision to apply the good-faith effort regulation in such a way that certain applicant document submission requirements were effectively waived. Due to what an HHS official said were “resource limitations and operational challenges,” the Marketplace had limited ability to provide assistance to applicants with data matching issues in 2014. According to the official, the Marketplace often had no ability to identify and match which applicants had even submitted documentation until well after the 90-day inconsistency resolution period. Further, once the Marketplace was able to increase its capacity to match applications with applicant-submitted documentation, it still took months to catch up, the official said. Compounding the difficulties, the official said, was that the Marketplace’s initial guidance to consumers needing to submit verification documentation was not sufficiently specific. The result, according to HHS, was that applicants were effectively denied the statutorily mandated period to resolve inconsistencies, and the Marketplace would not have been authorized to terminate enrollment of those who had made a good-faith effort to resolve their inconsistencies. According to the official, the decision to apply the good-faith effort regulation in a way that waived certain document submission requirements recognized that applicants required a better understanding of the eligibility process and that many consumers faced frustrating technical problems with seeking to resolve inconsistencies. CMS officials told us that the agency was generally enforcing the full submission requirement for 2015, and that good-faith extensions granted in 2015 were decided on a case-by-case basis and were of limited length. All consumers, regardless of whether they benefitted from the good-faith effort extension in 2014, will still be subject to deadlines for filing sufficient documentation, they said. In particular, according to the officials, those who made a good-faith effort by submitting documentation, but failed to clear their inconsistencies in 2014, were among the first terminations in 2015, which they said took place in February and early March. In addition, according to HHS, CMS expects to issue guidance outlining how the Marketplace will determine whether an applicant has demonstrated a good-faith effort to obtain the required documentation, and expects good- faith extensions for applications for 2016 coverage to be very limited. CMS also provided some information on other terminations and adjustments. Officials told us that from April through June of 2015, enrollment in coverage through the federal Marketplace was terminated for about 306,000 consumers with citizenship or immigration status data- matching issues who failed to produce sufficient documentation. In addition, according to the officials, about 735,000 households with income inconsistencies had their APTC or CSR subsidies adjusted for coverage year 2015. By comparison, HHS reported that more than 8.84 million people selected or were automatically reenrolled in 2015 plans through the federal Marketplace as of the end of the second open-enrollment period on February 15, 2015. While the information CMS provided reflected gross terminations and adjustment activity, it did not include details on fiscal impact of the actions. Implementation of the new PPACA eligibility and enrollment provisions for the act’s first year was a broad, complex, and costly undertaking. In light of that, standards for achieving efficiency and transparency, and assessing risk and fraud potential, are especially relevant. CMS effectively waived a significant portion of the Marketplace eligibility determination procedures for the 2014 coverage year. However, as our review demonstrated, the enrollment process is vulnerable to fraud. Our work indicates a number of areas where CMS should act to enhance program integrity and management and better assess potential fraud risk. The data hub plays a pivotal role in the application process, supporting the electronic data matching used to assess applicant eligibility, which in turn determines billions of dollars in federal spending. As such, CMS program management would benefit from the ability to monitor and analyze the extent to which data hub queries provide requested or relevant applicant verification information. CMS officials stressed to us that, by design, the hub itself is not equipped to perform analysis, but agreed that any such analysis need not take place within the data hub itself. Data hub inquiries are important not only as a front-end control measure, but also because what happens at the front end affects back- end controls as well: The more applicant inconsistencies that arise following data hub queries—because the data hub process cannot successfully confirm applicant information—the more emphasis accrues to back-end controls. These back-end controls involve efforts first by applicants to submit required documentation and then by the Marketplace to resolve the inconsistencies. But as our work showed, the process is vulnerable to fraud. A greater understanding of the effectiveness of the data hub process could inform assessments about effectiveness of enrollment and eligibility controls, while still incorporating procedures that seek to safeguard applicant information. Underscoring the need for comprehensive data collection and analysis is that the agencies responding to data hub inquiries themselves have limited and inconsistent information available on query outcomes. CMS could conclude, upon making a comprehensive review of data hub inquiry outcomes, that current procedures are adequate. But without such a review, CMS cannot make a best-informed judgment. In the case of not seeking to resolve Social Security number and incarceration inconsistencies, CMS officials effectively further waived program eligibility controls. In the case of incarceration inconsistencies, incarceration status is one of three initial eligibility criteria specified by PPACA. In the case of Social Security inconsistencies, regulations specify a resolution process that CMS did not follow, and the CMS decision also undermines IRS tax compliance efforts—a key control for ensuring that APTC subsidies, a significant federal cost under the program, are properly received. Similarly, the inability of Marketplace call center representatives to have current information on the status of applicant document submissions can create consumer frustration and impair timely and accurate filing of eligibility information. CMS has assumed a passive approach to identifying and preventing fraud. CMS relies on a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have fraud detection capabilities. Adopting a more strategic, risk-based approach could help identify fraud vulnerabilities before they could be exploited in the enrollment process. A comprehensive risk assessment identifying the potential for fraud in the enrollment process— which thus far has not been performed—could inform evaluations of program integrity and the effectiveness of enrollment and eligibility controls. In particular, as part of that, determining the value of terminated or adjusted subsidy payments—both APTC and CSR—could provide insight into financial risk the federal government faces when eligibility requirements are not met or it is determined application fraud may have occurred. In the specific case of CSR subsidies, it could be reasonable, depending on amounts determined to be at stake, to seek a method, and additional legislative authority, as necessary, for recovering benefits received, as there currently is for the APTC subsidy. CMS’s effective waiving of certain document filing requirements for applicant inconsistencies, through its application of the good-faith effort regulation, was a significant policy and financial decision—it allowed an unknown number of applicants to retain coverage, including subsidies, they might otherwise have lost, thus producing higher costs for the federal government. Similarly, we found CMS’s decision on the reliability of PUPS data for resolving incarceration inconsistencies to be only partially documented. By failing to fully document its actions, including factors such as factual basis, scope, and cost, CMS undermines transparency and ability to communicate effectively with both internal and external stakeholders, and also may undermine confidence in the program. To better oversee the efficacy of PPACA’s enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, we recommend that the Secretary of Health and Human Services direct the Acting Administrator of CMS to take the following eight actions: 1. Conduct a comprehensive feasibility study on actions that CMS can take to monitor and analyze, both quantitatively and qualitatively, the extent to which data hub queries provide requested or relevant applicant verification information, for the purpose of improving the data-matching process and reducing the number of applicant inconsistencies; and for those actions identified as feasible, create a written plan and schedule for implementing them. 2. Track the value of APTC and CSR subsidies that are terminated or adjusted for failure to resolve application inconsistencies, and use this information to inform assessments of program risk and performance. (See related recommendation 7.) 3. In the case of CSR subsidies that are terminated or adjusted for failure to resolve application inconsistencies, consider and document, in conjunction with other agencies as relevant, whether it would be feasible to create a mechanism to recapture those costs, including whether additional statutory authority would be required to do so; and for actions determined to be feasible and reasonable, create a written plan and schedule for implementing them. 4. Identify and implement procedures to resolve Social Security number inconsistencies where the Marketplace is unable to verify Social Security numbers or applicants do not provide them. 5. Reevaluate CMS’s use of PUPS incarceration data and make a a. use the PUPS data, among other things, as an indicator of further research required in individual cases, and to develop an effective process to clear incarceration inconsistencies or terminate coverage, or b. if no suitable process can be identified to verify incarceration status, accept applicant attestation on status in all cases, unless the attestation is not reasonably compatible with other information that may indicate incarceration, and forego the inconsistency process. 6. Create a written plan and schedule for providing Marketplace call center representatives with access to information on the current status of eligibility documents submitted to CMS’s documents processing contractor. 7. Conduct a fraud risk assessment, consistent with best practices provided in GAO’s framework for managing fraud risks in federal programs, of the potential for fraud in the process of applying for qualified health plans through the federal Marketplace. 8. Fully document prior to implementation, and have readily available for inspection thereafter, any significant decision on qualified health plan enrollment and eligibility matters, with such documentation to include details such as policy objectives, supporting analysis, scope, and expected costs and effects. We provided a draft of this report to HHS, SSA, IRS, and DHS for their review and comment. HHS provided written comments, reproduced in appendix IV, in which the agency concurred with our recommendations. HHS said it is committed to verifying consumer eligibility for Marketplace plans and subsidies provided to qualifying applicants. HHS outlined several actions it plans to take, or is considering, to strengthen its oversight of the federal Marketplace. However, while concurring with our recommendations, HHS did not elaborate on particular actions it would take to implement them. For example, while saying HHS is working to provide call center representatives with current status of eligibility documentation, there is no indication how and when this will be done. Similarly, while agreeing to reevaluate use of PUPS incarceration data, HHS said it continues to use PUPS data as a “trusted data source” while also questioning its utility. Because actions in response to our recommendations have yet to be implemented, and it is not yet clear when and how such steps will be taken, it is too early to determine whether they will fully address the issues we identified. All four agencies provided us with technical comments, which we have incorporated, as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, the Acting Commissioner of Social Security, the Commissioner of Internal Revenue, the Secretary of Homeland Security, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. The objectives of this review are to (1) examine the extent to which information submitted by applicants under the Patient Protection and Affordable Care Act (PPACA) is verified through the federal “data services hub” (data hub)—the primary means for verifying eligibility—and the extent to which the federal Health Insurance Marketplace (Marketplace) resolved “inconsistencies” where applicant information does not match information from federal data sources available through the data hub; and (2) describe, by means of undercover testing and related work, potential vulnerabilities to fraud in the federal Marketplace’s application, enrollment, and eligibility verification processes, for the act’s first open-enrollment period, for 2014 coverage. To examine outcomes of the data hub applicant verification process, we obtained information from key federal agencies involved in the process— the Social Security Administration, the Internal Revenue Service, and the Department of Homeland Security—on the nature and extent of their responses to electronic inquiries made through the data hub, for the 2014 and 2015 coverage years. We also interviewed agency officials and reviewed statutes, regulations, and other policy and related information. To assess the reliability of the agency summary data on data hub responses, we interviewed officials responsible for their respective data and reviewed relevant documentation. We concluded the data were sufficiently reliable for our purposes. In addition, we obtained applicant data on inconsistencies, subsidies awarded, and submission of required verification documentation, from the Centers for Medicare & Medicaid Services’ (CMS) Multidimensional Insurance Data Analytics System. These data include subsidies provided and submission status of required verification documents as of April 2015, for coverage received for the act’s first open-enrollment period, including for our undercover applications. Specifically, the enrollment period included was October 1, 2013, to March 31, 2014, and also included a special enrollment extension into April 2014. These data included application information, such as application version, date of creation, date of submission, and total application-level subsidies for coverage year 2014; and inconsistency information, such as type of inconsistency and resolution status as of April 2015. For our analysis, we excluded applications modified from their original version, as well as applications with submission and creation dates after the special enrollment period ending in April 2014. To examine inconsistency resolution, we grouped inconsistencies into CMS-identified categories and determined, at the application level, subsidy amounts associated with them. As provided to us by CMS, subsidy information is at the application level, while inconsistencies occur at the individual level. As a result, subsidy amounts are not mutually exclusive by resolution status. For example, a single application may have an open inconsistency in one category, but a resolved inconsistency in another. Thus, subsidy amounts associated with the application would be reflected in subsidy totals for each resolution status. This limitation, however, does not affect our overall calculation of subsidies associated with applications with one or more unresolved inconsistencies. To identify applications with Social Security number inconsistencies and no associated citizenship/immigration or income inconsistency, we first identified applications with Social Security number inconsistencies. We used those applications’ unique identifiers to match them to applications with citizenship/immigration or income inconsistencies, and then removed those applications appearing in both categories. Additionally, we interviewed CMS officials to obtain an understanding of the application data that CMS maintains and reports. To assess the reliability of the CMS applicant data on inconsistencies, we performed electronic testing to determine the validity of specific data elements we used to perform our work. We also interviewed CMS officials and reviewed relevant documentation. On the basis of our discussions with agency officials and our own testing, we concluded the data were sufficiently reliable for our purposes. To perform our undercover testing of the Marketplace application, enrollment, and eligibility verification processes, we created 12 fictitious identities for the purpose of making applications for individual health-care coverage by telephone or online. Because the federal government, at the time of our review, operated a marketplace on behalf of the state in about two-thirds of the states, we focused our work on those states. We selected three of these states for our undercover applications, and further selected target areas within each state. To maintain independence in our testing, we created our applicant scenarios without knowledge of specific control procedures, if any, that CMS or other federal agencies may use in accepting or processing applications. We thus did not create the scenarios with intent to focus on a particular control or procedure. The results obtained using our limited number of fictional applicants are illustrative and represent our experience with applications in the three states we selected. They cannot, however, be generalized to the overall population of all applicants or enrollees. In particular, our tests were intended to identify potential control issues and inform possible further work. We began our undercover testing in January 2014 and concluded it in April 2015. We shared details of our work with CMS during the course of our testing, to seek agency responses to the issues we raised. For these 12 applicant scenarios, we chose to test controls for verifications related to the identity or citizenship/immigration status of the applicant. This approach allowed us to test similar scenarios across different states. We made half of these applications online and half by phone. In these tests, we also stated income at a level eligible to obtain both types of income-based subsidies available under PPACA—a premium tax credit and cost-sharing reduction (CSR). Our tests included fictitious applicants who provided invalid Social Security identities, noncitizens incorrectly claiming to be lawfully present in the United States, and applicants who did not provide Social Security numbers. As appropriate, in our applications for coverage and subsidies, we used publicly available information to construct our scenarios. We also used publicly available hardware, software, and materials to produce counterfeit or fictitious documents, which we submitted, as appropriate for our testing, when instructed to do so. We then observed the outcomes of the document submissions, such as any approvals received or requests to provide additional supporting documentation. Overall, our review covered the act’s first open-enrollment period, for 2014 coverage, as well as follow-on work through 2014 and into 2015 after close of the open-enrollment period. For both objectives, we reviewed statutes, regulations, and other policy and related information. We also used federal internal control standards and GAO’s fraud risk management framework to evaluate CMS’s controls. We conducted this performance audit from January 2014 to February 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with investigative standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. Figure 2 presents details of our analysis of inconsistency data from the Centers for Medicare & Medicaid Services (CMS), by number of applications, in the population identified for our analysis of CMS data, with associated subsidies. The population was applications made during the 2014 open-enrollment period—October 1, 2013, to March 31, 2014—plus a special enrollment period extension into April 2014; and, in addition, only applications that were not subsequently modified. These applications had associated with them a total of about $3.6 billion in advance premium tax credit subsidies and about $781 million in cost-sharing reduction subsidies. Income: Approximately 27 percent (287,000) of applications in our review had an unresolved income inconsistency, and these were associated with more than $1 billion in combined APTC and CSR subsidies. By comparison, CMS adjusted applicant subsidies for about 6 percent (64,000) of applications with income inconsistencies, which were associated with $193 million in total subsidies. Citizenship/immigration status: About 13 percent (141,000) of applications had an unresolved citizenship or immigration inconsistency and were associated with more than $633 million in combined subsidies. CMS terminated coverage of relevant individuals for about 6 percent (65,000) of applications with citizenship or immigration status inconsistencies, which were associated with almost $172 million in total subsidies. Incarceration: About 2 percent (22,000) of applications had an unresolved incarceration inconsistency and were associated with about $68 million in total subsidies. CMS did not terminate any coverage for incarceration inconsistencies. Social Security number: More than 3 percent (35,000) of applications had an unresolved Social Security inconsistency and were associated with about $154 million in combined subsidies. CMS did not terminate any coverage or adjust subsidies for Social Security inconsistencies. Table 2 presents a breakout, by number of inconsistencies, of all inconsistency types in the population identified for our analysis of CMS data. Our analysis examined about 1.1 million unmodified applications with at least one inconsistency. Figure 3 summarizes outcomes for all 12 of our phone and online applications, and shows the fictitious applicant scenarios we used to attempt the applications. In addition to the contact name above, Matthew Valenta and Gary Bianchi, Assistant Directors; Maurice Belding; Mariana Calderón; Marcus Corbin; Carrie Davidson; Paul Desaulniers; Colin Fallon; Suellen Foth; Sandra George; Robert Graves; Barbara Lewis; Maria McMullen; James Murphy; George Ogilvie; Shelley Rao; Ramon Rodriguez; Christopher H. Schmitt; Julie Spetz; Helina Wong; and Elizabeth Wood made key contributions to this report.

Summary: PPACA provides for the establishment of health-insurance marketplaces where consumers can select private health-insurance plans. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $37 billion for fiscal year 2015. GAO was asked to examine the enrollment process and verification controls of the federal Marketplace. For the act's first open-enrollment period ending in March 2014, this report (1) examines the extent to which applicant information is verified through an electronic system, and the extent to which the federal Marketplace resolved “inconsistencies” where applicant information does not match information from federal data sources and (2) describes, by means of undercover testing and related work, potential vulnerabilities to fraud in the federal Marketplace's application, enrollment, and eligibility verification processes. GAO analyzed 2014 data from the Marketplace and federal agencies, interviewed CMS officials, and conducted undercover testing. To perform the undercover testing, GAO submitted or attempted to submit 12 fictitious Marketplace applications. The undercover results, while illustrative, cannot be generalized to the full population of enrollees. The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs. During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level. GAO makes eight recommendations, including that CMS consider analyzing outcomes of the verification system, take steps to resolve inconsistencies, and conduct a risk assessment of the potential for fraud in Marketplace applications. The Department of Health and Human Services concurred with GAO's recommendations.