Medicaid is a significant and growing component of federal and state budgets. It is the second largest health insurance program after Medicare as measured by expenditures, and was estimated to account for the second largest share of total state spending as well, exceeded only by state spending on elementary and secondary education. Further, Medicaid is undergoing a period of transformative change, as enrollment is growing under PPACA, and program spending is projected to increase 66 percent to over $950 billion by fiscal year 2025. Growth in enrollment is primarily due to more than half of the states choosing to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under PPACA. Growth in expenditures is due to a variety of factors, including the expansion of eligibility, provider rate increases and the higher cost of health care, including prescription drugs. In addition, states’ use of managed care plans to deliver services has been growing. More than half of all Medicaid beneficiaries are now enrolled in managed care plans, and nearly 40 percent of expenditures are for health care services delivered through managed care. The Medicaid program allows for substantial flexibility for states to design and implement their programs, which has implications for program oversight. For example, in a fee-for-service delivery system, state oversight relies on claims data that health care providers submit to states in order to be paid for services. In general, this involves pre- and post- payment reviews of claims to identify payments that are improper, billing anomalies, or aberrant claims. In contrast, state oversight of managed care plans often occurs through contracts and reporting requirements, and may also involve encounter data. State oversight is different under the managed care delivery model, because the managed care plans are responsible for providing services and bear financial risk if spending on services and administration exceeds payments from the state. In 2014, we found that the federal government and the states were not well positioned to identify improper payments made to, or by, managed care plans. For example, CMS had largely delegated program integrity oversight of managed care plans to the states, but states generally focused on fee-for-service claims. State officials told us that one reason for not focusing on audits of services provided by managed care plans was that they were more complex than audits of fee-for-service claims. We made three recommendations to improve federal and state oversight of Medicaid managed care expenditures. Since then, CMS has addressed these recommendations. CMS has, for example, issued a final rule on Medicaid managed care, which requires states to conduct periodic audits of financial data submitted by, or on behalf of, each Medicaid managed care plan. CMS’s Center for Program Integrity is the agency’s focal point for Medicaid and Medicare program integrity issues. Initially, CMS’s Medicaid program integrity activities were administered by a unit separate from its Medicare program integrity activities. In an effort to strengthen and better coordinate its program integrity efforts, CMS reorganized the Center for Program Integrity in 2014 to align functional activities and integrate Medicaid and Medicare program integrity efforts where possible. CMS has a range of program integrity activities that are important to overseeing and supporting states’ Medicaid programs. Several of its core activities have undergone changes in recent years. For example: 1. Reviews of state program integrity efforts. Each year, CMS selects a group of states and reviews aspects of their program integrity efforts. From 2007 to 2013, CMS conducted comprehensive, on-site regulation-based reviews of each state’s program integrity activities every 3 years. In fiscal year 2014, CMS shifted the focus of the state program integrity reviews from a comprehensive review approach to a “focused review” approach. According to CMS, this new approach to state program integrity reviews is intended to focus on high-risk areas of concern particular to each state, reduce the burden on states, and identify more opportunities to provide technical assistance to the states. Since 2014, CMS has conducted focused reviews on selected high-risk areas each year; although these reviews have been narrower in scope than the comprehensive regulatory reviews, they still involve on-site visits to states. As with previous reviews, CMS continues to publish its findings in state-specific review reports. CMS also publishes reports that compile findings from individual state- specific reports. States are required to submit corrective action plans for addressing any areas of regulatory non-compliance that CMS identifies, and CMS follows up on states’ planned corrective actions. In 2016, CMS began off-site desk reviews of states’ program integrity efforts to supplement the focused reviews. 2. Collaborative federal-state audits. In accordance with the Deficit Reduction Act, CMS contracts with eligible entities to review the actions of Medicaid providers, and audit providers’ claims to identify overpayments. In 2012, we made several recommendations to improve the efficiency of these audits, and CMS took action to address our recommendations. For example, CMS has shifted from its previous audit approach—in which CMS contractors, the MICs, used extracts of often incomplete federal data to identify providers for audits—to a new “collaborative audit” model in which states agree to post-payment audits and provide state data to the MICs. As a part of the collaborative audit process, the state—together with CMS— determines the audit processes the MICs follow. In some instances, the MIC conducts the entire audit; in other cases, it supplements state resources by providing medical review staff and other resources. States are responsible for collecting overpayments identified by the MICs, and are permitted 1 year from the date of discovery to return the federal share. Beginning in 2016, as a component of CMS’s efforts to strengthen and consolidate its program integrity efforts, CMS began shifting from the three regional MICs focused on Medicaid to five new regional Unified Program Integrity Contractors (UPIC) responsible for a range of Medicare and Medicaid program integrity activities previously performed by other contractors. According to CMS, the purpose of the UPICs is to coordinate provider investigations across Medicare and Medicaid; improve collaboration with states by providing a mutually beneficial service; and increase contractor accountability through coordinated oversight. According to CMS officials, aspects of the UPIC program—such as the goal of having contractors work collaboratively with states—reflect their prior experiences with the collaborative audits. CMS began awarding UPIC contracts in 2016; it plans to award all the contracts by the end of 2017, and ultimately phase out the MICs. 3. Medicaid Integrity Institute. In 2007, CMS established the MII, the first national Medicaid training program for state program integrity officials. CMS entered into an interagency agreement with the Department of Justice to house the MII at the National Advocacy Center, located at the University of South Carolina. The MII offers substantive training and support in a structured learning environment at no cost to the states, with the first trainings offered in fiscal year 2008. The MII trainings include multi-day on-site courses and workgroups, as well as webinars. The MII has offered from 19 to 22 on-site courses, 1 to 3 workgroups, and 2 to 13 webinars each year from fiscal years 2012 through 2015. In fiscal year 2015, individual course sizes ranged from 25 participants to the largest class accommodating over 70 participants. Almost 3,800 attendees participated in on-site courses from fiscal years 2012 through 2015. (See app. I for attendance by state for fiscal years 2012 through 2015.) In fiscal year 2013, the MII began the Certified Program Integrity Professional credentialing program. The MII also provides a secure online platform for state-to-state information sharing known as the Regional Information Sharing System. State officials must register to gain access to the Regional Information Sharing System, and participation is voluntary. Currently there are approximately 360 users. 4. State provider enrollment and screening. CMS has taken steps to support and oversee states’ efforts to enroll and screen providers for participation in Medicaid. For example, CMS has published guidance regarding the enhanced provider screening and enrollment requirements under PPACA. CMS has also conducted site visits to assist states with challenges in implementing these requirements, and has provided education, outreach, and assistance to states through webinars, training calls, an optional data compare service, and other means, according to CMS. In addition, CMS estimates the rate of improper payments in Medicaid, and provides information, guidance, and technical assistance to states. CMS’s Medicaid Payment Error Rate Measurement (PERM) program estimates improper payments in Medicaid in three component areas: (1) fee-for-service claims, (2) managed care, and (3) eligibility. CMS calculates a national Medicaid improper payment rate, as well as improper payment rates for each state. CMS also provides states with information and opportunities for collaboration with the federal government and other states in a number of ways, including through Medicaid Fraud, Waste and Abuse TAG meetings; quarterly teleconferences with regional program integrity directors; and webinars (separate from the training webinars of the MII) for state Medicaid program integrity staff on topics such as the use of the CMS Fraud Investigation Database. To support state program integrity efforts, CMS issues guidance and publishes educational toolkits for providers and beneficiaries and toolkits for state program integrity officials. Toolkits for state program integrity officials address issues such as frequent findings from state program integrity reviews in the area of provider enrollment, provider payment suspension, and assessing data analytic capabilities. CMS also provides technical assistance in response to states’ needs, such as responses to state inquiries about specific program integrity areas and suggestions for resources to help address states’ program integrity concerns. CMS has tailored its focused program integrity reviews to states’ managed care delivery systems and other areas that are at high risk for improper payments. CMS also recently began using targeted off-site desk reviews of certain state program integrity efforts to expand its oversight efforts. From fiscal years 2014 through 2016, CMS conducted focused reviews of state program integrity efforts in 31 states, reviewing 10 or 11 states annually. CMS reviewed one or two high-risk areas per state, including states’ oversight of managed care plans in 28 states. (See table 1.) CMS selected which states to review based on factors such as whether a state contracted with a managed care plan to deliver services, and when the agency last conducted a program integrity review in a state. For each state, CMS tailored its focused reviews to the states’ managed care plans and relevant other high-risk areas including provider enrollment and screening, personal care services, and non-emergency medical transportation. CMS identified these areas based on its assessment of high-risk program integrity areas nationwide and on input from state officials about important program integrity issues. Managed care. CMS assessed state oversight of managed care plans, and the program integrity activities of selected managed care plans that delivered services to Medicaid enrollees. For example, CMS reviewed state efforts to ensure plan compliance with contractual requirements for program integrity activities, and reviewed plans’ procedures for identifying, recovering, and reporting on overpayments made to providers. Provider enrollment and screening. CMS examined state implementation of enhanced provider enrollment and screening requirements under PPACA. For example, CMS reviewed whether states checked certain federal databases to determine providers’ eligibility to participate in Medicaid fee-for-service programs, and whether they terminated the participation of providers that had been revoked by Medicare or terminated by Medicaid and Children’s Health Insurance Program (CHIP) programs in other states. Personal care services. CMS assessed the extent of state oversight, including state processes for enrolling providers and monitoring services provided. Non-emergency medical transportation. CMS assessed the extent of state oversight and the program integrity activities of organizations that provide non-emergency medical transportation services. State Comments on CMS’s Focused State Program Integrity Review Officials from one state said CMS’s focused review was a “huge improvement” over the prior approach. In the past they felt CMS reviewed too many issues with no depth, and there was a large burden on staff. In contrast, the focused review was in-depth and involved “tremendously less work” for staff. As a result of the review, officials felt CMS understood how their state operated and that CMS was “on our side,” and state officials “absolutely” saw benefits from the review. CMS and state officials we spoke with told us that the tailored oversight of CMS’s focused reviews has been beneficial and helped identify areas for improvement. According to CMS officials, the reviews have allowed CMS to focus in-depth on important program integrity vulnerabilities, and have been less of a burden on state staff. Five of the eight states we selected had a focused review in fiscal year 2014 or fiscal year 2015. Officials from all five states said that CMS’s tailored approach was an improvement over the agency’s prior approach. They noted that CMS tailored the reviews to high-risk areas that were appropriate for their states, and that within each of those high-risk areas, CMS had focused on issues that were important to their program integrity efforts. State officials indicated that while the focused reviews still took a substantial amount of staff time, they were less of a burden on staff and they got feedback from CMS in a timely way. In addition, officials in two states added that they felt that CMS was now working with them more in partnership to address any vulnerabilities; they also appreciated that CMS shared feedback about what their states were doing well and did not focus solely on where their states needed to improve. CMS and state officials shared examples of how the focused reviews were beneficial to their program integrity efforts in their specific high-risk areas. Managed care reviews. CMS officials said that they found substantial variation across states’ managed care programs, but that their reviews identified some common issues, such as a low number of investigations conducted by managed care plans and a low amount of recoveries by plans. As a result, CMS officials recommended that states take steps to improve their oversight of plans. Officials from all four states we selected where CMS reviewed managed care programs cited benefits. For example, officials from three states noted that the meetings with CMS and managed care plan officials helped them learn more about the plans’ program integrity efforts. Further, officials from three states said that CMS’s review gave them leverage in dealing with managed care plans or led plans to focus more on program integrity. Officials in one state noted that CMS provided helpful recommendations for how to improve state oversight of managed care plans, including plans’ fraud referrals. Provider enrollment and screening. CMS officials said that their fiscal year 2014 reviews in this area found that many states were not meeting requirements for checking certain federal provider databases or had not made much progress revalidating provider enrollment. CMS officials said they have since worked with states and there has been substantial improvement. State officials said that the reviews helped identify areas where they could improve. In addition, officials from one state whose focused review had not included provider enrollment and screening said they were concerned about this area, and that it would be helpful for CMS to review their provider enrollment and screening processes to help the state identify what they are doing well and what they need to improve. Personal care services and non-emergency medical transportation. CMS officials said they generally found a lack of sufficient state oversight of personal care services and non- emergency medical transportation, and recommended states take action. For example, in one state, CMS found that there were limited program integrity requirements in the state’s contract with the organization that conducts program integrity activities related to personal care services. The contract did not require oversight that involved unannounced visits of personal care service providers, or provide sufficient direction about the re-enrollment of those providers. We spoke with officials in one state where CMS had reviewed personal care services. The state officials noted that this is a high-risk area in their state, and that due to CMS’s review, they would pay increased attention to certain vulnerabilities. These state officials added that CMS’s focused reviews can help bring program integrity vulnerabilities to the attention of state Medicaid staff responsible for administering the program, not just their program integrity staff. Although officials from our selected states generally had positive feedback about CMS’s focused reviews, some identified areas where CMS could make improvements. For example, officials in two states said that some CMS reviewers did not sufficiently understand aspects of the states’ program or policies. In one state, this created delays during the on-site portion of the review as state officials spent time clarifying reasons for certain state practices. Those officials suggested that CMS ensure that all of their reviewers are knowledgeable about the state by allowing more time for state officials to clarify state policy with all CMS reviewers before they arrive on-site. Officials with one state said that CMS could enhance the reviews by including state Medicaid Fraud Control Unit staff as part of their interviews about state program integrity issues. CMS officials told us that they plan to continue conducting focused reviews related to managed care and personal care services in fiscal year 2017. To expand its oversight to conduct more frequent reviews of states, CMS recently began supplementing its focused reviews with targeted desk reviews—off-site reviews of certain program integrity efforts designed to address high-risk areas. According to CMS officials, CMS has conducted desk reviews of one or more efforts in 40 states in 2016. Desk reviews are intended to allow the agency to address additional potential vulnerabilities, and assess and assist more states each year, thus reviewing states more often than would otherwise be feasible using on- site focused reviews alone. For this first year of desk reviews, CMS officials targeted four program integrity efforts it determined important to mitigating risks and selected states based on a range of factors, including whether a state had recently had an on-site focused state program integrity review and whether a state had an active state Recovery Audit Contractor contract. In particular, CMS assessed how states implemented corrective action plans from the PERM program and state program integrity reviews, states’ use of Recovery Audit Contractors, or whether states had terminated certain providers from participating in Medicaid or CHIP. (See table 2.) The desk reviews were in progress in 2016, and CMS planned to conduct desk reviews in these same four areas in 2017. CMS officials said they will assess the results of their focused reviews and new desk reviews to see whether this combined approach is an effective and efficient strategy for overseeing and assisting states, and whether they could make improvements for future reviews. Collaborative audits identified substantial potential overpayments to health care providers. However, some states cited investment of staff time without commensurate benefit and communication issues as barriers to audit participation and success. States’ collaborative audits with MICs have identified a substantial amount of potential overpayments to providers in recent years. Overpayments identified by collaborative audits increased from $2 million in fiscal year 2012 to $36 million in fiscal year 2015. (See fig. 1.) According to CMS officials, the increase in overpayments identified by collaborative audits was due to improved data, improved engagement and collaboration with states, increased state participation in audits, and to greater experience with targeting and conducting these audits. CMS encourages states to use collaborative audits, but states determine whether to have collaborative audits. CMS officials noted that they educate states on how MICs can provide audit assistance, conduct outreach to explore states’ interest in pursuing collaborative audits, and sometimes suggest that states consider certain types of audit targets. For example, CMS officials said that they have encouraged additional states to consider collaborative audits of hospice providers, based on prior collaborative audits that were successful in identifying overpayments to hospice providers. CMS does not require states to have collaborative audits, and while in the past the agency has independently identified and assigned MICs to conduct audits in states, it does not do so for collaborative audits. Although most states have participated in a collaborative audit, we found that states’ use of audits varied significantly—and many states have had few or no new collaborative audits assigned in recent years. Overall, 41 states had at least one collaborative audit assigned from fiscal year 2012 through June 2016, and the remaining 11 states had none. (See fig. 2.) Collaborative audits vary in their scope, complexity, and results, thus the number of audits in a state does not necessarily indicate the amount of contractor and state resources needed to complete the audits, or reflect the total amount of potential overpayments identified. However, these data illustrate states’ widely varying use of collaborative audits. Nearly all collaborative audits have been of Medicaid fee-for-service providers, but CMS would like to expand the use of these audits to examine services delivered under managed care. CMS officials told us that in three states there have been 14 collaborative audits of providers that are part of Medicaid managed care networks. There has also been a collaborative audit of a managed care organization in one of those states. CMS officials said they are looking to build on these experiences and expand the use of audits in managed care environments. Officials from one state we spoke with said they discussed having collaborative audits of managed care network providers, but that there were challenges with how to select audit targets and conduct the audits, partly because they would be relying on different types of data—managed care encounter data—rather than fee-for-service data. Officials from the eight states we interviewed reported mixed experiences with and interest in collaborative audits. Three states had positive experiences with collaborative audits and were likely to seek future audits. Two states had prior or ongoing collaborative audits, but were unlikely to seek future audits due to negative audit experiences. Two other states had not sought or participated in collaborative audits and were unlikely to seek them in the future. The remaining state had sought its first collaborative audits and was waiting for CMS approval to proceed. States’ negative audit experiences and reluctance to seek collaborative audits may limit CMS’s ability to fully leverage federal contractors to identify and recover improper payments in the future. One State’s Positive Experience with Collaborative Audits Officials from one state said their audit efforts “would not be complete” without their MIC supplementing the state’s own staff and audit efforts. This state used their MIC for “single issue” audits focusing on specific areas, which state officials said was more efficient than doing audits on a wider range of topics. Officials from the three states with positive collaborative audit experiences said the MICs were valuable partners that had augmented their states’ audit resources and identified substantial overpayments to providers that posed program integrity concerns. Officials noted that collaborative audits allowed them to target audits to their specific needs, which in their view was a significant improvement over the earlier non- collaborative audit model. For example, officials in one state said that their MIC conducted collaborative audits in areas where the state had its own audits, but needed additional support, as well as audits in areas where the state did not have experience or expertise. The state’s collaborative audits identified over $5 million in potential overpayments in fiscal years 2014 and 2015. Another state’s first two collaborative audits identified over $2 million in potential overpayments related to personal care services in fiscal year 2015. All three states were likely to seek future collaborative audits. One State’s Negative Experience with Collaborative Audits Officials from one state found the audits had only limited success in identifying improper payments, and led to “an excessive amount” of administrative burden for state staff. Officials said their MIC did not communicate sufficiently about audits, and that they did not always agree with the MIC’s findings. they noted problems with collaborative audits. In particular, officials in both states said that it took a substantial amount of time for state staff to work with the MICs on the collaborative audits. These officials also indicated that their MICs had not communicated with them sufficiently about the collaborative audits. Officials from one of the states said the audits had limited success in identifying overpayments. Officials from the other state reported barriers to completing audits of high-risk providers where they expected to identify overpayments. For example, officials said that insufficient MIC staff and other factors led to lengthy audit delays. As of May 2016, the six collaborative audits that began in this state in 2014 had not all been finalized, preventing the state from collecting overpayments in a timely way. Further, some providers went out of business before the audits were complete, preventing this state from recovering any overpayments. CMS officials stated that they work closely with states to determine audit plans and timeframes, but acknowledged that sometimes issues arise during audits or the appeals process that can create challenges. Officials from the two states that had not sought collaborative audits said that the potential burden on staff, MICs’ lack of familiarity with state programs or policy, and communication concerns were among the barriers that made them unlikely to seek collaborative audits. Officials said they believed that collaborative audits would lead to a burden for state staff without commensurate benefits and preferred to conduct audits themselves. Officials from one state said they had a well-established audit department with staff familiar with the state’s programs and regulations, and it would not be worth the effort to have those staff work with MICs on audits and deal with any resulting provider appeals. Officials in the other state said that their MIC had not taken the time to understand the state’s program and policies, and had approached the state with audit ideas geared more to Medicare or to another state. They also said the fact that the MIC would report potential program integrity vulnerabilities— and any resulting findings—to CMS, rather than communicating primarily with the state, limited their interest in collaborative audits. These officials said improvements in collaboration and communication might increase their interest in having audits. Finally, one state had requested its first collaborative audits, in which they expected to identify substantial overpayments, but had encountered delays in obtaining CMS approval to start. These state officials said they began collaborating with their MIC on potential pharmacy audit targets in November 2015, but as of June 2016, were waiting for CMS approval to proceed with finalizing their agreement with the MIC to conduct the audits. CMS officials told us that they had not approved these audits because they did not want the MIC to start audits and then have to transfer them to the UPIC. CMS officials said they have since had conversations with this state about these audits and the role of the UPIC. States’ varying experiences with collaborative audits indicates that there are opportunities for CMS to build upon its experience with these audits, and enhance its collaboration with states and contractors on future audits. Collaborative audits have been driven by states’ interest in and capacity for audits, and CMS’s collaborative approach to audits has yielded benefits for some states. However, four states we spoke with described barriers—such as staff burden, problems with MIC availability, or communication issues—that prevented them from seeking collaborative audits or from having audits that yield sufficient benefits. Federal internal control standards indicate that organizations should identify, analyze, and respond to risks related to achieving objectives. CMS officials involved with collaborative audits said they had refined the collaborative audit program over time and that they would continue to explore ways to improve their audit support for states. CMS expects to continue the collaborative approach to audits. It is too soon to tell how states will view the collaborative audits once the transition to UPICs is complete, and whether states will encounter barriers similar to those that states reported to us. Unless CMS can successfully address the potential barriers encountered by states, some states may choose not to pursue collaborative audits—or may pursue audits only to encounter challenges that were not effectively minimized or prevented. In both cases, states and CMS may not identify and recover additional overpayments. As such, CMS might be missing opportunities to better align collaborative audit efforts with states that could benefit from them. The MII is an important source of program integrity training for many states; however, states’ demand for MII courses frequently exceeded the institute’s capacity. In fiscal year 2015, the MII hosted participants from all states; the number from each state ranged from 2 in Puerto Rico to 54 in Florida. (See fig. 3.) Officials in all eight of our selected states identified the MII as one of their main resources for program integrity training. Officials from two of these states noted that their program integrity staff would have no or limited access to training without the MII. The MII course offerings are generally well received by the states and participants. Of the eight selected states, officials in six states said that the MII courses aligned well with their program integrity needs, and the MII obtained state input regarding courses to offer. Officials from the two other states indicated that MII courses do not always align with their current needs. The Value of the Medicaid Integrity Institute to Attendees One course participant commented that the training offered at the MII is the only job training they receive as program integrity professionals, besides on the job training, and the opportunity to attend these trainings has made the participant a more valuable employee. The Benefit of the Medicaid Integrity Institute Officials from one state told GAO that the networking opportunities that present themselves at the MII allow program integrity staff to establish a network of resources that they can leverage once they have completed the training; state staff often reach out to people they have met at the MII, so the benefits last well beyond the actual training dates. One of the important benefits of the MII reported by state officials and course participants in their course evaluations is the opportunity to meet with and learn from program integrity officials from across the country. Learning occurs on a formal and informal basis while on-site at the MII. In the classroom, participants learn from state officials who serve as faculty for the MII courses, and from each other through in-class discussions. While on-site at the MII, there are also informal opportunities for information sharing that can lead to further state-to-state collaboration. According to one state official we spoke with, when serving as MII faculty he discussed a problematic provider in his state. A participant recognized that they had a similar issue in their state. As a result of this conversation, the state official and participant learned that it was the same provider and a multi-state investigation resulted in the provider’s arrest. State officials in our sample also noted that collaboration and sharing continues once they leave the MII. Officials in one state mentioned the benefit of being on-site at the MII is that it is a safe place to raise program integrity questions and concerns without the fear of that resulting in a CMS audit. From fiscal year 2014 to fiscal year 2016, states’ demand for their staff to attend MII courses was high and frequently exceeded the institute’s capacity. Officials from six of our selected states indicated that they would like to send more program integrity staff to the MII, but are limited by the courses offered and MII’s limit on how many staff states can nominate to attend. Further, officials in three of these states said that they wanted additional staff to attend the certification courses, and one state official observed that due to high demand it might take several nominations before one of their staff is accepted into a course. The MII maintains a waitlist for each class with open enrollment. All but one course with open enrollment offered in fiscal year 2015 had a waitlist with between 2 to 41 potential participants on it. Currently, if an individual is unable to attend a course, the open space is transferred to the next individual on the waitlist—who is not necessarily from that same state. MII officials said that they use the waitlist to fill spaces due to cancellations in the order on the list, precluding them from simply replacing cancellations with other nominees from the same state. Officials from one state, however, said that—in the event of an unexpected cancellation for a reserved slot—the state should be able to send a replacement. States’ Demand for Medicaid Integrity Institute Exceeds Capacity Officials in one state said it would be helpful to be able to have more than one or two people attend per class to benefit from what is being taught, so they would send more people to the MII if they could. MII officials are aware of the demand for the MII offerings, but were limited in their ability to expand their capacity by classroom space constraints and staffing vacancies in fiscal year 2016. These constraints also limited the number and types of courses and webinars the institute could offer. MII officials noted that their fiscal year 2016 schedule included many “core” courses, such as Coding for Non-Coders and Managed Care Oversight Seminar (each offered twice) because the MII did not have staff to develop new courses. For example, the Pharmacy Symposium course was cancelled, because they did not have staff to develop the course. For fiscal year 2017, CMS officials indicated that there are 23 planned courses, and many of the courses contain updated agendas and course content. There will be courses focused on managed care oversight, provider audits, and provider enrollment, which will include opportunities to share best practices, among other things. CMS officials said that the courses on emerging trends in Medicaid will focus on personal care services and beneficiary fraud. MII began webinar offerings in fiscal year 2011, with the goal of expanding MII capacity and bringing course content to a larger audience. However, the number of webinar offerings in fiscal year 2016 was also limited by MII staffing vacancies. MII officials indicated that they are in the process of hiring someone to expand their webinar offerings in fiscal year 2017 and beyond to try to meet states’ demand for courses. States reported finding the webinars useful, as they can cover timely topics, reach a wider audience than the on-site courses, and do not require staff to travel to participate. However, state officials find that the webinar format is not as effective in encouraging questions and discussion as the on-site offerings, and they cannot replicate the benefits of the face-to-face interactions that occur at the MII. CMS uses focused state program integrity reviews as its primary method of collecting and communicating promising program integrity practices; however, these practices are not collected in a consistent manner and the published reports are not timely nor easily searched electronically. Other mechanisms for collecting and sharing promising practices are available, but CMS designed them for other purposes and does not use them to broadly communicate promising practices. CMS uses its focused reviews to collect and report promising program integrity practices, but these reviews do not result in the systematic inclusion of promising practices in state program integrity review reports. Both CMS and the states have a role in ensuring that promising program integrity practices are identified, collected, and shared. According to CMS officials, its focused reviews of state program integrity activities are their primary method of collecting states’ promising practices; however, the number of CMS- and state-identified promising practices included in these reports has declined from fiscal years 2013 to 2015. In the course of the review, CMS officials may or may not learn about a state’s promising practices through direct observation, input from the state, or prior experience with the state. In addition, CMS officials said that individuals who perform the reviews ask states to identify promising practices. Yet, officials from only one of the five states in our sample that CMS reviewed in fiscal year 2014 or fiscal year 2015 said reviewers asked them to identify promising practices. In addition, due to the timing of the state program integrity reviews, CMS may not be aware of the promising program integrity practices that states implement in intervening years. According to CMS officials, the combination of focused and desk reviews allows CMS to review more states more often. However, the focused reviews do not cover as many topic areas as prior reviews and desk reviews are scoped narrowly on specific areas of interest. It is not clear that CMS officials would be exposed to the full range of promising state practices. The number of state reviews that include promising practices has decreased significantly, from almost 80 percent of the published reviews in fiscal year 2013, to 25 percent in each of fiscal years 2014 and 2015. As such, CMS may not be aware of the full range of promising practices that exist in states’ varied environments. Federal internal control standards stipulate that management should use quality information and externally communicate the necessary quality information to achieve the entity’s objectives. CMS publishes any identified promising program integrity practices in the focused review reports, which are intended to help promote promising practices among states. However, these reports are not a timely mechanism for sharing the practices, in part, because of the intervals between the reviews and publication. Although CMS officials said they are working to reduce the time it takes to complete and publish the focused review reports, the agency recently reported that the process still took 278 days, on average, in fiscal year 2015, down from 489 days in fiscal year 2014. Summaries of the state reviews, which include a section on promising practices, are further delayed. For example, the most recent summary was published in June 2014, and it included promising practices identified from December 1, 2011 through December 31, 2012, and CMS officials could not say when a more updated version would be published. CMS officials said they are exploring ways to disseminate promising practices faster than the current reports allow. These delays can mean that identified promising practices may be outdated or no longer relevant by the time the report is published. For example, officials in one state said that the promising program integrity practice identified in their most recent review was no longer being used by the time their state report was published. Once published, the usefulness of these focused review reports to communicate promising practices broadly to all states is limited by the inconsistent inclusion of promising practices, and the inability to search electronically across published reports or view all promising practices in a single location. Of the reports published in fiscal years 2014 and 2015, 4 of 16 reports included promising practices; when reports do not include promising practices is it unclear why. Currently, there is no search function or index to easily find practices that relate to a specific interest among the published reports; the only approach is to review each published report to see whether there are any identified practices relevant to a state. Officials from three of the eight selected states we interviewed said that they use these reports to learn about promising program integrity practices; the remaining five states did not comment on using these reports for this purpose. All states referred to other mechanisms that they use to learn about practices that have been effective in other states. Beyond focused reviews, CMS officials said that they identify and communicate promising practices through a number of other mechanisms, such as the MII, Medicaid Fraud, Waste and Abuse TAG calls, Regional Information Sharing System, technical assistance to the states, and mass email distributions; however, for the most part, these mechanisms were not designed for the purposes of sharing promising practices, and none ensures that information about promising practices is communicated broadly to all states. Further, several mechanisms are limited in their distribution, and, as a result, the promising practices might not reach all relevant program integrity staff. While states have an interest in learning about promising practices used in states other than their own, the eight states in our sample did not have a uniform understanding of how to systematically share or access information about promising practices. Medicaid Integrity Institute: State officials in seven of our eight selected states said that attending the MII helped them learn about promising program integrity practices used in other states, which is a part of CMS’s intent for some of the offered courses. While the MII is a useful resource for attendees—and state staff can, and in some cases are required to, share the knowledge they learned with their colleagues when they return— the information presented may not reach all state audiences that could benefit. Specifically, there are limits to the number of state staff who can participate in on-site MII courses, and participation and sharing is dependent on states’ staff being able to take part in relevant classes as participants or faculty. Regional Information Sharing System: The Regional Information Sharing System is DOJ’s secure, web-based system for information sharing between state officials. It is intended to be a safe space where state program integrity staff can discuss relevant issues without CMS monitoring them. According to CMS officials, the Regional Information Sharing System is a way CMS shares promising practices among state program integrity staff. According to CMS officials, as of December 2016, there were approximately 360 Regional Information Sharing System users in the states. However, actual use by Regional Information Sharing Systems users is unknown. Officials in one state thought that the Regional Information Sharing System was not consistently used by all states. No states in our sample identified the Regional Information Sharing System as one of the ways that they identify promising practices, although officials in one state did note that they use it to share promising practices with other states. Medicaid Fraud, Waste and Abuse TAG calls: CMS officials reported that the monthly Medicaid Fraud, Waste and Abuse TAG calls between CMS, MII, and senior state officials are a venue for discussing promising state practices, among other program integrity issues. CMS officials said they work with states to develop TAG call presentations and content that helps states with program integrity administration. Officials from six of our selected states said the calls were useful in helping them learn about promising practices. However, topics that are discussed are dependent on CMS and the specific state individuals participating in the call. Medicaid Fraud, Waste and Abuse TAG calls are voluntary, and the information shared might not always reach a wide range of state program integrity officials. Technical assistance to states: CMS shares relevant promising practices when it responds to states requesting technical assistance. CMS officials said that they are providing an increasing amount of technical assistance—responding to 26 inquiries in the first quarter of fiscal year 2016 to 96 inquiries in the fourth quarter. CMS officials indicated that they rely on staff experience and knowledge of state practices to make timely and relevant referrals. Other mechanisms: CMS officials told us that they use mass email distributions to share new policies, guidance, and best practices. When we asked state officials in our eight selected states about other mechanisms for sharing, they reported learning about and sharing promising practices through online toolkits, at the annual National Association for Medicaid Program Integrity conference, direct outreach to other states, and issuing press releases and reports. Although CMS has a variety of mechanisms to share promising program integrity practices, states may not be able to easily and efficiently identify relevant practices, because they would need to monitor multiple communication mechanisms to ensure that they are receiving all potentially relevant information. Officials in one state said that while they do what they can to learn about promising practices from other states, CMS could do more to share practices and help states to learn about what is working well in other states. This statement is consistent with federal internal control standards that stipulate that agencies should use quality information to achieve the entity’s objectives and externally communicate necessary quality information. Despite CMS’s various efforts, none of these other communication mechanisms has a consistently broad reach and the agency does not have a well-understood communication strategy for using these mechanisms. As such, CMS is missing an opportunity to support states’ program integrity efforts by making the range of potential solutions across states broadly known to states in a timely and efficient manner. CMS has taken a number of important steps to tailor and improve its oversight and support of states’ Medicaid program integrity efforts. CMS’s use of focused reviews to address oversight of managed care plans and other high-risk areas has been beneficial, and generally an improvement over the agency’s earlier approach. It is too soon to tell how effective CMS’s new desk reviews will be in enhancing oversight, but CMS plans to assess how well these two types of reviews, together, meet the agency’s needs and whether additional changes could be useful. CMS’s shift to collaborative audits has helped identify a substantial amount of potential overpayments and has yielded important benefits for some states, including those who told us they viewed collaborative audits as an important part of their program integrity efforts. Some states’ negative experiences with or reluctance to seek collaborative audits, however, highlight potential areas of improvement as CMS transitions Medicaid audits to the new UPICs. It is too soon to tell how and whether the UPIC program will address states’ needs and the barriers we identified, such as burden on state staff and communication issues. However, our findings illustrate that there are opportunities for CMS to build on both the successes and challenges states have experienced in collaborative audits to help enhance its collaboration with states and UPICs as it implements and oversees this new program. There are opportunities, for example, for collaborative audits to help enhance oversight of managed care expenditures. Both CMS and the states have a role in identifying promising program integrity practices that can be shared in order to help improve oversight of the Medicaid program. Efforts that are based in the states—such as the Regional Information Sharing System—are not used consistently. CMS’s methods of collecting and communicating states’ promising program integrity practices have not always been systematic, and often are limited in their reach to state officials. Given the increasing improper payment rate in Medicaid, it is in the interest of both CMS and the states to identify and share practices that show promise in reducing improper payments in as efficient a manner as possible. CMS could take a more centralized role in collecting and communicating promising practices, providing a forum through which states could learn about what is working well in other states and consider whether such practices might succeed in their own states. To build upon CMS’s collaborative audit efforts and help enhance future collaboration, CMS should identify opportunities to address barriers that limit states’ participation in collaborative audits. Such opportunities could include improving communication with states before, during, and after audits are completed; and ensuring that audits align with states’ program integrity needs, including the need for oversight of services provided in managed care delivery systems. To better support states’ efforts to reduce improper payments and communicate effective program integrity practices across the states, CMS should collaborate with states to develop a systematic approach to collect promising state program create and implement a communication strategy for sharing promising program integrity practices with states in an efficient and timely manner. We provided a draft of this report to HHS and DOJ for their review and comment. In written comments, HHS concurred with our recommendations. With regard to our recommendation that CMS identify opportunities to address barriers that limit states’ participation in collaborative audits, HHS noted that it continually seeks to collaborate with states on Medicaid provider audits, and seeks to work through issues so that actions to identify potentially improper payments may proceed. HHS added that as it transitions its anti-fraud work from the MICs and other contractors to the new UPICs, there will be opportunities for improving communication with states and aligning MIC audits with states’ program integrity needs. With regard to our recommendations that CMS collaborate with states on both collecting and sharing promising program integrity practices, HHS said it would work to systematize the collection of promising state program integrity practices, and to share such practices with states in an accelerated manner. HHS noted that it is strongly committed to program integrity efforts in Medicaid, and has a wide variety of activities to oversee and support states’ Medicaid program integrity efforts. HHS’s written comments are reproduced in appendix II. HHS also provided technical comments, which we incorporated as appropriate. DOJ did not provide formal written comments, but provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. Rico, which we collectively refer to as “states.” In addition to the contact named above, Leslie V. Gordon (Assistant Director), Robin Burke (Analyst-in-Charge), Drew Long, Emily Loriso, and Elizabeth A. Miller made key contributions to this report. Also contributing were Vikki Porter and Jennifer Whitworth. Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers. GAO-16-402. Washington, D.C.: April 22, 2016. Medicaid and CHIP: Increased Funding in U.S. Territories Merits Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April 8, 2016. Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 2015. Medicaid Information Technology: CMS Supports Use of Program Integrity Systems but Should Require States to Determine Effectiveness. GAO-15-207. Washington, D.C.: January 30, 2015. Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity of Growing Managed Care Expenditures. GAO-14-341. Washington, D.C.: May 19, 2014. Medicaid: CMS Should Ensure That States Clearly Report Overpayments. GAO-14-25. Washington, D.C.: December 6, 2013. Medicaid: Enhancements Needed for Improper Payments Reporting and Related Corrective Action Monitoring. GAO-13-229. Washington, D.C.: March 29, 2013. Medicaid Integrity Program: CMS Should Take Steps to Eliminate Duplication and Improve Efficiency. GAO-13-50. Washington, D.C.: November 13, 2012. National Medicaid Audit Program: CMS Should Improve Reporting and Focus on Audit Collaboration with States. GAO-12-627. Washington, D.C.: June, 14, 2012.

Summary: Medicaid remains a high-risk program, partly due to concerns about improper payments. CMS oversees and supports states, in part, by reviewing their program integrity activities, hiring contractors to audit providers, and providing training. In recent years, CMS made changes to its Medicaid program integrity efforts, including a shift to collaborative audits. GAO was asked to examine CMS's oversight and support of states' Medicaid program integrity efforts. GAO examined, among other issues, (1) how CMS tailors its reviews to states' circumstances; (2) states' experiences with collaborative audits; and (3) CMS's steps to share promising program integrity practices. GAO reviewed CMS documents, including state program integrity reports, and data on collaborative audits. GAO interviewed officials from CMS and eight states selected based on expenditures, managed care use, and number of collaborative audits, among other factors. The Centers for Medicare & Medicaid Services (CMS) has tailored its state program integrity reviews—in which the agency reviews states' program integrity activities—to states' managed care delivery systems and other areas at high risk for improper payments. From 2014 through 2016, CMS conducted on-site reviews in 31 states. The reviews usually addressed state oversight of managed care plans, and some reviews addressed other high-risk areas such as provider enrollment. CMS and states have found the reviews to be beneficial in identifying areas for improvement. To expand oversight to more states, CMS also began off-site desk reviews of certain state program integrity efforts. Collaborative audits—in which CMS contractors and states work in partnership—have identified substantial potential overpayments to providers, but barriers have limited their use. CMS encourages states to use collaborative audits, but states decide whether to pursue them. Several states reported positive collaborative audit experiences, while others cited barriers—such as staff burden or problems communicating with contractors—that prevented them from seeking audits or hindered the success of audits. Federal internal control standards indicate that organizations should identify and respond to risks related to achieving objectives. Absent additional CMS action to address barriers, some states may choose not to pursue collaborative audits, or may encounter challenges after doing so. CMS lacks a systematic approach to collecting promising state progam integrity practices and communicating them to other states. CMS's main approach—the state program integrity reviews—inconsistently identified promising practices, and those identified are neither published in a timely way nor easily searched electronically. Other CMS approaches, such as courses offered by the Medicaid Integrity Institute (a national training program for states), were not designed for sharing promising practices and do not systematically communicate them to all states. Both CMS and the states have a role in identifying promising program integrity practices. Absent further agency action, states may not have access to the range of promising state program integrity practices, which is inconsistent with federal internal control standards on the use and external communication of necessary quality information to achieve program objectives. To further improve its support of states' Medicaid program integrity activities, CMS should identify opportunities to address barriers that limit states' participation in collaborative audits, and, in collaboration with states, take additional steps to collect and share promising program integrity practices. The Department of Health and Human Services concurred with GAO's recommendations.