HHS officials described the data hub process to us as being part of an innovative, multilayered approach to verifying applicant information efficiently and without undue burden on individuals and families. Through secure electronic connections, the data hub provides real-time responses to eligibility queries, HHS told us. In our February 2016 report, however, we found that although the data hub plays a key role in the eligibility and enrollment process, CMS officials said the agency does not track the extent to which the federal agencies deliver responsive information to a request, or, alternatively, whether they report that information was not available. Additionally, CMS officials said they do not analyze data provided in response to data hub inquiries. This is because, they said, by design, the data hub does not store individual transactional data that could be collectively analyzed over time. For policy reasons, the officials said, the agency did not want the data hub to become a data repository itself, and in particular, a repository of sensitive personal data. The CMS officials also said the agency is barred legally from maintaining IRS taxpayer information in the data hub. Asked about analysis of data hub responses, CMS officials told us when we conducted work for our February 2016 report that the key performance measures for the data hub are the extent to which the system is available for queries, and the extent to which transmissions of queries and responses are successfully accomplished; that is, that an inquiry is made and a corresponding reply received, without regard to content. Further, the federal agencies responding to data hub queries generally told us they do not analyze outcomes of data hub inquiries. Instead, SSA, IRS, and DHS officials said they focus on responding to inquiries received. Our review also found that SSA, IRS, and DHS had limited information on the nature and extent of the inquiries made by the data hub. According to the three agencies, available statistics reflect data hub inquiries in general, and cannot be broken out by program, such as a qualified health plan or Medicaid. In addition, according to agency officials, an unknown number of data hub applicant inquiries were duplicates, which we could not eliminate from our examination. Instead, agency officials told us, they generally process inquiries sequentially as they are received from the data hub. Thus, we found that while the agencies can provide some information on data hub queries, they cannot provide comprehensive information specifically on number of inquiries and individuals represented by those queries. We further found, based on our examination of available statistics from SSA, IRS, and DHS, that while the agencies could successfully provide applicant verification information in a large percentage of cases, they did not have data in their records to verify information for millions of data hub inquiries over the course of PPACA’s first two enrollment cycles, for 2014 and 2015 coverage. We concluded that by not assessing the extent to which data hub– provided data matches applicant-provided information, CMS foregoes analysis of the extent to which responding agencies successfully deliver applicant verification information in response to data hub requests. In doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. We recommended that HHS direct CMS to conduct a comprehensive feasibility study on actions CMS can take to monitor and analyze, both quantitatively and qualitatively, the extent to which data hub queries provide requested or relevant applicant verification information, for the purpose of improving the data-matching process and reducing the number of applicant inconsistencies; and for those actions identified as feasible, create a written plan and schedule for implementing them. HHS said it concurred with our recommendation and is reviewing options for such a study. For qualifying applicants, the act provides two forms of subsidies for consumers enrolling in individual health plans, both of which are paid directly to insurers on consumers’ behalf. One is a federal income tax credit, which enrollees may elect to receive in advance of filing tax returns, and which reduces a consumer’s monthly premium payment. This is known as the advance premium tax credit (APTC). The other, known as cost-sharing reduction (CSR), is a discount that lowers the amount consumers pay for out-of-pocket charges such as deductibles, coinsurance, and copayments. In our report, for applicants who obtained subsidies but had application inconsistencies, we identified about 1.1 million applications with a total of about 2 million inconsistencies. These applications had combined APTC and CSR subsidies of about $4.4 billion associated with them for coverage year 2014. We found, based on our analysis of CMS data, that the agency resolved about 58 percent of the total inconsistencies, meaning the inconsistencies were settled by consumer action, such as document submission, or removed due to events such as life change, application deletion, or consumer cancellation. Meanwhile, our analysis found that about 34 percent of inconsistencies, with about $1.7 billion in associated subsidies, remained open, as of April 2015—that is, inconsistencies still open several months following the close of the 2014 coverage year. We also found, based on our analysis of the 2014 data, that CMS did not terminate or adjust subsides for any applications with incarceration or Social Security number inconsistencies, plus other inconsistencies. Further, CMS officials told us that they currently do not plan to take any actions on individuals with unresolved Social Security number or incarceration inconsistencies. Social Security number inconsistencies. Under CMS regulations, the Marketplace must validate all Social Security numbers provided by submitting them to SSA along with other identifying information. If the Marketplace is unable to validate the Social Security number, it must follow the standard process for resolving all types of inconsistencies. In our analysis, we identified about 35,000 applications that had an unresolved Social Security number inconsistency, which were associated with about $154 million in combined subsidies. We reported that CMS officials told us they did not take action to terminate coverage or adjust subsidies during 2014 based on Social Security number inconsistencies. They said this was because such inconsistencies are generally related to other inconsistencies, such as citizenship or immigration status, and that document submissions for citizenship or immigration status may also resolve Social Security number inconsistencies. Overall, CMS officials told us they do not consider missing or invalid Social Security number information to be a stand-alone inconsistency that must be resolved, and do not take adverse action in such cases. However, CMS regulations state that “to the extent that the is unable to validate an individual’s Social Security number through the Social Security Administration,” the Marketplace must follow its standard inconsistency procedures. Further, when promulgating this regulation, CMS explained that transmitting Social Security numbers to SSA for validation “is separate from the provision regarding citizenship verification, and only serves to ensure that SSNs [Social Security numbers] provided to the can be used for subsequent transactions, including for verification of family size and household income with IRS.” In addition to unresolved Social Security number inconsistencies generally, our analysis also found in particular more than 2,000 applications with Social Security number inconsistencies that had no corresponding citizenship or immigration inconsistencies. We also identified nearly 5,500 applications with Social Security number inconsistencies that had no corresponding income inconsistency. These applications had total subsidies of about $10 million and $31 million associated with them, respectively. They indicate that Social Security number inconsistencies can stand alone, unrelated to other inconsistencies. Social Security number inconsistencies also affect tax compliance. Missing or invalid Social Security numbers can affect IRS verification that taxpayers have properly filed APTC information on their tax returns, as well as impair IRS outreach to taxpayers who have received the APTC subsidy. We recommended that HHS direct CMS to identify and implement procedures to resolve Social Security number inconsistencies where the Marketplace is unable to verify Social Security numbers or applicants do not provide them. HHS concurred with our recommendation, but did not provide details on how it would seek to implement it. Incarceration inconsistencies. In our inconsistency analysis that we reported on in February 2016, we identified about 22,000 applications having an unresolved incarceration inconsistency, which were associated with about $68 million in combined subsidies. CMS officials, however, told us they did not terminate eligibility for incarceration inconsistencies, because the agency determined in fall 2014 that SSA’s Prisoner Update Processing System (PUPS) was unreliable for use by the Marketplace. As a result, CMS officials told us the agency elected to rely on applicant attestations on incarceration status. PPACA provides that incarcerated individuals are not eligible to enroll in a qualified health plan through a marketplace, with the exception of those incarcerated pending disposition of charges. CMS currently uses PUPS to generate incarceration inconsistencies when there are indications an applicant may be incarcerated. As part of the inconsistency resolution process, the Marketplace notifies applicants to send documentation to resolve the inconsistency. To do so, consumers can submit documentation such as release papers, CMS officials told us. Under CMS’s approach to incarceration inconsistencies, agency officials told us, the Marketplace continues to make an initial verification attempt using the PUPS data. If a consumer maintains he or she is not incarcerated, CMS will rely on that representation and not take adverse action, regardless of what PUPS indicates, officials told us. According to HHS officials, based on the data reliability issue, the Marketplace no longer requires applicants to submit documentation on incarceration status. In its 2013 computer-matching agreement with CMS, SSA acknowledged that PUPS is not as accurate as other SSA data and contains information that SSA may not have independently verified. Thus, the agreement states that CMS will independently verify information it receives from PUPS and will provide individuals an opportunity to contest an incarceration inconsistency before any adverse action in an eligibility determination. Overall, according to SSA officials, PUPS information can be used to identify individuals who require additional follow-up to determine eligibility. We reported that our review of documentation CMS provided for its decision to take no adverse action on incarceration inconsistencies showed it did not contain key information supporting the agency’s decision to not use PUPS data. Specifically, the documentation did not provide specific details on why, or to what extent, people were misidentified as incarcerated; why CMS also judged inmate release information to be unreliable; any criteria or assessment employed to conclude that the PUPS data were not sufficiently current or accurate; or the potential cost associated with not verifying incarceration status. We concluded that without clearly identifying such elements as analysis, scope, and costs of significant decisions, CMS is at greater risk of providing benefits to ineligible applicants, and also may undermine confidence in the applicant verification process and compromise overall program integrity. We further concluded that by not using PUPS data as a lead for further investigation, and by relying on applicant attestation in the alternative, CMS may be granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. We recommended that HHS direct CMS to reevaluate use of PUPS incarceration data and make a determination to either (1) use the PUPS data, among other things, as an indicator of further research required in individual cases, and to develop an effective process to clear incarceration inconsistencies or terminate coverage; or (2) if no suitable process can be identified to verify incarceration status, accept applicant attestation on status in all cases, unless the attestation is not reasonably compatible with other information that may indicate incarceration, and forego the inconsistency process. HHS concurred with our recommendation, but did not provide details on how it would seek to implement it. We also recommended that HHS direct CMS to fully document prior to implementation, and have readily available for inspection thereafter, any significant decision on qualified health plan enrollment and eligibility matters, with such documentation to include details such as policy objectives, supporting analysis, scope, and expected costs and effects. HHS concurred with our recommendation, and said it was committed to documenting significant decisions. Chairman Hatch, Ranking Member Wyden, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony, please contact Seto J. Bagdoyan, Director, Forensic Audits and Investigative Service, (202) 512-6722 or BagdoyanS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. GAO staff who made key contributions to this testimony, or previous related work, are Matthew Valenta and Philip Reiff, Assistant Directors; Mariana Calderón; Marcus Corbin; Carrie Davidson; Colin Fallon; Suellen Foth; Sandra George; Barbara Lewis; Maria McMullen; James Murphy; Shelley Rao; Christopher H. Schmitt; Elizabeth Wood; and the Forensic Audits and Investigative Service investigative unit. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony summarizes the information contained in GAO's February 2016 report, entitled Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk , GAO-16-29 . The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs. During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.