Medicaid is the third largest social program in the federal budget and one of the largest components of state budgets. States and CMS share responsibility for instituting financial practices for the Medicaid program that are in compliance with applicable rules, laws, and regulations. In general, the federal government matches state Medicaid spending for medical assistance according to a formula based on each state’s per capita income. The federal contribution ranged from 50 to 77 cents of every state dollar spent on medical assistance in fiscal year 2004. For most state Medicaid administrative costs, the federal match rate is 50 percent. For skilled professional medical personnel, 75 percent federal matching is available. States are responsible for providing the state share of Medicaid funding and submitting plans, budgets, and expenditure reports to CMS that accurately report on the administration of their Medicaid programs and how they expend Medicaid funds. CMS is responsible for reviewing the states’ plans, budgets, expenditures, and operations to ensure compliance with all applicable laws and regulations. Each state develops its own administrative structure and establishes its own eligibility standards, scope of covered services, and payment rates in accordance with Medicaid statute and within broad federal guidelines. States are required to describe the nature and scope of their programs in a comprehensive plan submitted to CMS, with federal funding depending on CMS’s approval of the plan. State Medicaid plans specify the services to be provided and how the state will establish the amount it will pay for those covered services. Amendments to states’ plans are also subject to approval by CMS. Table 1 shows the amount of state and federal expenditures for Medicaid for fiscal years 2003 and 2004, the most recent years for which data are available. CMS’s Center for Medicaid and State Operations (CMSO) shares Medicaid program administration and financial management responsibilities with the 10 CMS regional offices. Two divisions in CMSO’s Finance, Systems, and Budget Group—the Division of Financial Management (DFM) and DRSF—have primary responsibility for Medicaid financial management. Figure 1 outlines CMS’s organizational structure related to Medicaid. DFM’s mission includes effectively administering the Medicaid program budget and grants, financial management policy, and administrative cost policy processes. Among other things, DFM staff in the central office are responsible for (1) determining and issuing state grant awards based on regional decision reports resulting from reviews of budget and expenditure reports, (2) reconciling state expenditure and budget reports, (3) reviewing and approving draft focused financial review reports, and (4) preparing annual financial management workplans based on input from regional offices. DRSF’s responsibilities include, but are not limited to (1) reviewing state plan amendments that involve reimbursement, (2) providing training to and coordinating the work of the funding specialists, (3) providing technical assistance to states on institutional and noninstitutional reimbursement, and (4) identifying and addressing state financing practices that could inappropriately increase federal Medicaid costs. CMS has approximately 65 regional financial analysts who are responsible for performing activities such as (1) reviewing state quarterly budget estimates and expenditure reports, (2) preparing decision reports that document approvals for federal reimbursement or deferrals or disallowances of claims for federal reimbursement, (3) assisting in assessing issues that put federal Medicaid dollars at risk and determining which issues to review in a fiscal year, (4) performing focused financial reviews, (5) providing technical assistance to the states on financial matters, and (6) serving as liaison to the states and audit entities. CMS has about 90 funding specialists who are responsible for, among other things, (1) gaining an understanding of their assigned state’s organizational structure, program structure, and budget process related to the state’s Medicaid program; (2) assisting in reviews of state plan amendments; (3) conducting reviews of state financing practices; and (4) providing technical assistance to the states. States submit quarterly budget and expenditure reports to CMS. The financial analysts in the 10 regional offices have traditionally reviewed these reports and prepared a Regional Office Decision memorandum which they submit to DFM in the central office. In some regions, the new funding specialists now have responsibility for reviews of state budget reports. Also, in some cases, the funding specialists assist financial analysts with reviews of state expenditure reports. CMS has undertaken several steps to improve its Medicaid financial management activities including its efforts to oversee state claims for federal reimbursement and to identify payment errors. CMS hired about 90 funding specialists who are examining high-risk state funding practices and working with states to eliminate those practices that inappropriately increase federal costs. CMS also created a new unit, DRSF, which reviews state plan amendments for reimbursement to identify and work with states to eliminate payment methodologies that could result in higher federal costs. CMS has continued to use focused financial reviews and OIG audits to identify inappropriate state claims for federal reimbursement and recommend changes to states’ internal control practices. In addition, CMS recently established a new performance goal for its Medicaid financial management staff to reduce cumulative questionable federal reimbursement by 10 percent in fiscal year 2006. These and other recent efforts represent improvement in CMS’s oversight activities and address weaknesses and recommendations we identified in our 2002 report. However, it is too soon to assess the impact they will have on improving overall financial management and addressing emerging issues that put federal Medicaid dollars at risk because some have just recently been initiated, and results are not known yet. Further, there are other previously identified weaknesses that the agency has not addressed. CMS has not instituted mechanisms to measure how the risk of inappropriate federal reimbursement has changed as a result of corrective actions taken. CMS also has not incorporated the use of the MSIS in its oversight of state claims or other systems projects intended to help improve its analysis capabilities. Further, CMS has not developed profiles to document information on state fraud and abuse controls to use in its oversight of state claims. Finally, CMS has not developed a strategic plan to guide its financial management activities. Because these issues are important to further improving and sustaining CMS’s oversight activities, we reiterate our prior recommendations in these areas. In late 2004, CMS began hiring for 100 new funding specialist positions. These new staff have enabled CMS to perform more in-depth reviews of high-risk issues. The funding specialists’ positions were established to help CMS gain a better understanding of how states budget for and finance their portion of Medicaid expenditures and help CMS proactively identify state payment and funding practices that could result in inappropriate claims for federal reimbursement or increased federal costs. These new funding specialists augment the activities of approximately 65 financial analysts in 10 regional offices who had previously performed many of the state financial oversight activities, including assisting the financial analysts with reviews of state budget and expenditure reports. In addition, the funding specialists performed activities that have enabled CMS to collect and summarize more information on states’ Medicaid programs to help CMS target its oversight efforts to high-risk issues such as certain payment arrangements that have been problematic in the past. A major activity of the funding specialists during their first year was the completion of state funding profiles. These profiles document the states’ Medicaid programs’ organizational structure, programmatic structure, and budget process. For many years, states only needed to provide general information on their payment methodologies, so these newly created profiles provide more detail to help CMS in its review and oversight of states’ financial issues. For example, the profiles describe the sources of each state’s nonfederal share of Medicaid funds and state payment methodologies; and include a “watch list” section where the funding specialists can highlight significant funding-related concerns that may need to be addressed in the future. For example, one state profile identifies a concern about the state’s lack of oversight of the certified public expenditures certification process for hospitals. This type of information can be helpful in ensuring proper review of future state plan amendments, among other things. CMS officials told us the state funding profiles have been made available to all CMS staff through CMS’s intranet, and said the profiles will be updated annually to account for changes in state programs, thus allowing CMS to have current information. In addition to completing state funding profiles and reviewing state budgets and expenditures, the funding specialists carry out other oversight activities, including the following: meeting with state Medicaid officials and monitoring state legislative activity, including hearings, budget sessions, and committee meetings related to states’ Medicaid programs and proposed bills to proactively identify issues that need CMS attention; reviewing state payment arrangements that CMS previously deemed problematic and that the states agreed to end to determine if the arrangements have in fact ended; assisting in the resolution of OIG audit findings; providing technical assistance to the states concerning funding and attending training and workshops to learn about and stay abreast of CMS policy and operations. Directing the activities of the new funding specialists is one of the efforts of the central office’s DRSF, which was created in early 2005. CMS established DRSF to consolidate responsibility for all state Medicaid payment policy and funding issues. A role of DRSF is to ensure that state plan amendments for reimbursement of noninstitutional and institutional services are consistently reviewed and that CMS policy is consistently applied across the nation. The activities of DRSF have improved CMS’s ability to effectively deploy its resources to carry out more targeted oversight activities. DRSF’s National Institutional Reimbursement Team and the Non-Institutional Payment Team are part of CMS’s effort to collect information on states’ funding methodologies before approving state plan amendments, including high-risk payment methodologies that have been troublesome in the past. DRSF reviews all institutional reimbursement state plan amendments before they are approved by the Director of CMSO, thus eliminating the decentralized approval process that had been in place at all 10 regional offices. This has helped to clarify the lines of authority and responsibility for the state plan amendment process—states still submit amendments to their respective region for review but they are approved by CMS’s central office. DRSF also helped clarify responsibilities between central and regional office staff by using the 10 central office funding specialists as liaisons to each of the 10 regional offices. The DRSF funding specialists help to ensure that regional funding specialists are informed and kept up to date on funding policies and matters. The funding specialists also help in conducting a series of monthly calls that DRSF has instituted between the regions and central office financial management staff to improve communication and coordination. These calls help to ensure that all staff stay informed and up to date on matters that impact state claiming and the approval of state plan amendments. These activities, which we consider significantly underway, help improve CMS’s ability to better target its oversight activities and specifically address the recommendation in our 2002 report to increase in-depth oversight of areas of higher risk as identified from the risk assessment efforts and apply fewer resources to lower risk areas. See appendix II for a complete listing of our prior recommendations and our assessment of whether or not each has been fully addressed by CMS’s actions to improve its oversight activities. These activities also help address our overarching concerns that CMS’s organizational structure created challenges to effective oversight because of unclear lines of authority and responsibility between the regions and the central office. In 2001, CMS began a risk analysis process to identify Medicaid issues that put federal dollars at risk and address those issues by conducting focused financial reviews or referring the issues to the OIG for its review. Since then, at the beginning of each fiscal year, central office and regional office financial management staff work together to identify risks and plan focused financial reviews of the issues identified. CMS’s financial management staff consider factors such as the amount of dollars involved, involvement of consultants, and time elapsed since last audit to identify risk areas. CMS’s analyses provide insight into what some of the continuing problematic Medicaid issues and potential emerging issues are. Table 2 shows which areas have consistently been identified as needing in- depth review in fiscal years 2003 through 2006. The focused financial reviews of the issues identified from the risk analyses have helped CMS identify billions of dollars in unallowable costs outside of those detected through the review of quarterly expenditure reports, as well as deficiencies in states’ financial management practices. In fiscal years 2003 and 2004, focused financial reviews resulted in CMS questioning or disallowing about $1.3 billion and about $1 billion, respectively, of state claims for federal reimbursement, according to CMS. The value of these reviews lies not just in identifying disallowances but also in providing feedback on policy issues and programmatic vulnerabilities, and in elevating the attention of both states and federal staff. CMS conducted about 57 focused financial reviews each year from fiscal years 2003 through 2005. Starting in fiscal year 2006, the number of planned focused financial reviews almost doubled from fiscal year 2005 due to the inclusion of planned reviews to be done by the funding specialists. We reviewed 35 of the 113 focused financial reviews performed by regional office financial analysts in fiscal years 2003 and 2004 to assess (1) the consistency with which the reviews were performed and reported on and (2) the extent to which states took actions to address the issues identified by CMS. We concluded that the 35 review reports were generally consistent across the regions. CMS also provided information to support that states are taking the recommended actions to address the issues identified. CMS issued reports to the states that contained recommendations requesting the states to (1) return federal reimbursement that CMS determined was not allowable (disallowances), (2) provide additional documents for CMS to determine the allowability of questionable claims (deferrals), or (3) improve certain state controls or processes. CMS gets additional coverage of risk areas from the reviews conducted by HHS’s OIG. During fiscal years 2003 through 2005, CMS contracted with OIG using funds from the HCFAC account to conduct 20 or more audits each year of issues identified from the risk assessment process. We reviewed interagency agreements between CMS and OIG for fiscal years 2003 through 2005 that provided over $3 million of HCFAC funds each year for OIG to do 20 or more audits each year relating to Medicaid issues. The interagency agreements supplemented OIG’s overall efforts to monitor Medicaid. Table 3 shows the issues that OIG agreed to audit in selected states pursuant to the interagency agreements for fiscal years 2003 through 2005. We reviewed 21 audits done by OIG in fiscal year 2004 pursuant to the interagency agreement to assess (1) the extent of the additional coverage given to issues identified by CMS as high risk and (2) the extent to which states took actions to address the issues identified by OIG. OIG identified about $13.6 million that it believed was inappropriate federal reimbursement to the states in 15 of the 21 audits. States returned about $4.5 million of disallowed claims identified in 10 of the 15 audits; CMS was still pursuing the remaining $9.1 million as of the end of our field work. OIG also made numerous other recommendations to states to improve their internal controls such as implementing controls to identify and prevent duplicate payments and complete reconciliation procedures for overpayments in a timely manner. CMS has recently developed a specific goal aimed at reducing questionable federal reimbursement and evaluating its oversight activities. CMS has established a goal to reduce by 10 percent in fiscal year 2006 the amount of federal reimbursement that has been questioned by CMS or OIG. CMS is collecting data on questionable claims for federal reimbursement identified from sources such as quarterly expenditure reviews, focused financial reviews, and OIG audits. According to a CMS official, as part of this process, CMS has identified a baseline amount of about $8 billion dollars in cumulative questionable federal reimbursement, which represents state claims that (1) CMS has determined may not be allowable or has deferred payment pending review of additional support from the states, or (2) OIG has questioned as a result of an audit. The goal for fiscal year 2006 is to resolve at least 10 percent of this $8 billion by (1) recovering amounts ultimately determined to be unallowable or (2) determining after further review that the claims are allowed. CMS officials acknowledge that the goal may not be attainable each year given the varying facts and circumstances of the questionable amounts. However, if properly established and tracked, goals of this nature should help in improving the effectiveness of CMS oversight activities. CMS has also included the goal to reduce by 10 percent the amount of questionable federal reimbursement in the fiscal year 2006 performance agreements of CMS senior financial managers in the central office. According to CMS officials, it will continue to hold managers accountable for this type of goal each fiscal year. CMS has also included specific goals and performance standards in regional office financial managers’ performance agreements. For example, one regional office has a goal for its managers to ensure that the financial analysts and funding specialists complete nine focused financial reviews and five funding source reviews in fiscal year 2006. CMS has improved its processes for tracking its financial management activities and the attainment of the goals it has set. The Financial Management Activities Report (FMAR) tracks the amount of regional office resources (staff time, personnel costs, and travel costs) spent on the various categories of activities in the financial management workplans. The Financial Issues Report tracks all questionable state claims for reimbursement identified by regional financial analysts and funding specialists in focused financial reviews, quarterly expenditure reviews, and any other activities that could result in a disallowance or deferral of state claims, including findings from OIG reports. The Financial Performance Spreadsheet is the CMS tool used to track the fiscal year 2006 goal to resolve 10 percent of the amount of cumulative, questioned claims for federal reimbursement. These actions, which we consider significantly underway, help improve CMS’s ability to monitor, measure, and evaluate its financial oversight activities and specifically address the following recommendations from our 2002 report: Include specific Medicaid financial oversight performance standards in senior managers’ performance agreements. Collect, analyze, and compare trend information on the results of oversight control activities, particularly deferral and disallowance determinations, focused financial reviews, and technical assistance. Use the information collected above to assess overall quality of financial management oversight. CMS has initiated two other programs to help carry out its responsibility at the federal level for helping ensure the propriety of Medicaid finances and comply with the Improper Payments Information Act of 2002—the Payment Accuracy Measurement pilot project, which was initiated in July 2001 and is now called the Payment Error Rate Measurement (PERM) project, and the Medicare-Medicaid data match project. Under the PERM program, states use a CMS-developed methodology to measure state Medicaid payment errors. By fiscal year 2007, CMS plans to have a national Medicaid payment error rate based on a sample of states and claims within those states. Under PERM, states will be expected to ultimately reduce their payment error rates over time by better targeting their activities to prevent and detect improper payments made to providers. Under the Medicare-Medicaid data match project, CMS facilitates the sharing of information between the Medicare and Medicaid programs by matching Medicare and Medicaid claims information on providers and beneficiaries to identify improper billing and utilization patterns which could indicate fraudulent schemes. These two projects, which we consider significantly underway, have helped CMS’s efforts to oversee state Medicaid finances and specifically address the following two recommendations from our 2002 report: Complete efforts to develop an approach to payment accuracy reviews at the state and national levels. Incorporate advanced control techniques, such as data mining, data sharing, and neural networking, where practical to detect potential improper payments. While CMS has taken a number of actions that improve its oversight and address several weaknesses we identified in our prior report, there are previously identified weaknesses that the agency has not yet addressed. Specifically, CMS has not instituted mechanisms to measure how the risk of inappropriate federal reimbursement has changed as a result of corrective actions taken. In addition, CMS has not incorporated the use of the MSIS database into its oversight of states claims or other systems projects intended to improve its analysis capabilities. CMS also has not developed profiles to document information on state fraud and abuse controls to use in its oversight of state claims. Finally, CMS has not developed a strategic plan specific to its Medicaid financial management activities. Measuring how risks have changed—In our 2002 report, we recommended that CMS develop and institute mechanisms to make risk assessment a continuous process and to measure whether risks have changed as a result of corrective actions taken to address them. CMS has processes in place to identify risks, and management has established procedures to mitigate important risks, such as detailed reviews of certain high-risk issues. However, CMS’s processes still do not have the elements of risk management that are key to assessing whether actions to mitigate risks need to be adjusted either because (1) they are not effective, (2) they are effective but need to be expanded, or (3) they are no longer needed because the risks have been resolved or reduced to a tolerable level. For example, CMS identified several Medicaid issues as part of its current risk assessment process that have been the subject of focused financial reviews across several states, for several years—issues such as those related to claims for skilled professional medical personnel, family planning, and school-based administrative services. As discussed earlier, CMS has issued reports to the states on these issues that contained recommendations requesting the states to (1) return federal reimbursement that CMS determined was not allowable (disallowances), (2) provide additional documents for CMS to determine the allowability of questionable claims (deferrals), or (3) improve certain state controls or processes. However, CMS’s current risk assessment process does not indicate how the corrective actions taken to address these issues have changed their assessment of risk or their future strategies for mitigating the risk that these issues pose. To CMS’s credit, it has recently taken steps to change policies related to state claims for targeted case management services, an issue that has been the subject of multiple focused financial reviews. While it is not clear from CMS’s risk assessment why this issue was given a higher priority than other issues identified from its risk assessment, CMS officials explained that their process for determining what might be a high-risk issue comes from continuous coordination between financial management staff and Medicaid program staff that have in-depth program knowledge about Medicaid policy and procedures. The officials further explained that the results of their coordination and the fact that an issue is a high priority may not be noticeable to others until policy changes are included, for example, in HHS’s budget submission or other legislation that is signed by the President. Documenting how the outcomes of detailed reviews are used to determine whether additional or fewer corrective actions are needed is an important step in risk management. For fiscal year 2006, CMS is planning to conduct additional detailed reviews intended to ensure that states have stopped certain intergovernmental transfers and other funding practices that have resulted in billions of dollars in inappropriate federal reimbursement. It will be important to use the results of these follow-up reviews as a basis to determine whether its prevention and mitigation steps are adequate and effective and then to adjust them accordingly. Fully documenting the results of these types of activities will help inform planning for future mitigation efforts. Because CMS has not fully implemented mechanisms to measure how risks have changed as a result of actions to address the risks, we are reiterating our prior recommendation in this area. Improving analysis capabilities—In our 2002 report, we recommended that CMS use comprehensive Medicaid payment data that states must provide to the national MSIS database. Use of these data could improve CMS’s analysis capabilities. MSIS contains Medicaid program information including data on billions of claims. This database could be used to identify trends in certain Medicaid services from prior-year claims that could be useful in analyzing current-year state claims. According to a CMS official, CMS has not yet developed the ability to make these data available for use by the financial analysts and funding specialists in their oversight activities. Further, only a few CMS staff with the requisite systems capabilities are currently able to access and analyze the data. CMS officials said they plan to make these data more accessible in the future. Because CMS has not yet incorporated use of MSIS in its oversight activities, we are reiterating our prior recommendation. CMS also has not yet completed two other systems projects intended to help improve its analysis capabilities. CMS started to develop the: (1) Transactions, Information Inquiry, and Program Performance System project—an integrated financial management tool intended to link existing Medicaid data systems and tools; and (2) Automated Medicaid State Plans Project—a project to explore collecting electronic submission of state plans that would provide timely access to critical program information. CMS officials told us that due to funding constraints, these two projects have yet to be completed. Determining the systems projects needed to enhance CMS’s analysis capabilities is important given the challenges of evaluating state Medicaid expenditures and funding practices. Collecting and using information on state fraud and abuse control activities—In our 2002 report, we recommended that CMS enhance the information that it uses in its oversight of state claims by creating profiles that document each state’s activities to oversee its Medicaid program and prevent fraud and abuse. For example, we recommended that the profiles include information on provider screening procedures and payment accuracy studies. CMS currently collects some information on these and other state program integrity efforts as part of compliance reviews that are conducted by program integrity staff in DFM and the 10 regional offices. These compliance reviews are to assess whether state Medicaid program integrity efforts comply with federal requirements such as those governing provider enrollment, claims review, and coordination with each state’s Medicaid Fraud Control Unit. However, CMS officials told us that there is limited coordination between the staff that conduct the compliance reviews and the financial management staff that oversee state claims. Further, the compliance reviews have focused on state compliance and have not evaluated the effectiveness of the states’ fraud and abuse prevention and detection activities. CMS is starting to develop strategies as part of the recently created Medicaid Integrity Program that could address the weaknesses that we have identified. The Deficit Reduction Act of 2005, enacted in February 2006, provided for the creation of a Medicaid Integrity Program and required CMS to develop a comprehensive plan for how it would implement the program. CMS officials have recently begun to develop the plan and have included proposals for hiring contractors to assess states’ program integrity activities. Information on states’ activities to oversee their Medicaid programs and prevent fraud and abuse is important to determine the appropriate level of federal oversight that should be applied to each state’s claims. Because CMS is just starting to develop its plan and results are not known yet, we are reiterating our prior recommendations in this area. Developing a strategic plan to guide Medicaid financial management activities—In our 2002 report, we reported that CMS was starting several initiatives, similar to what we are currently reporting, to bring about improvements in its financial management activities and oversight. At the time of our 2002 review, CMS did not have a written strategic plan that described its many oversight activities and initiatives and the staff responsible for implementing them. Therefore, we recommended that CMS develop a written plan and strategy for Medicaid financial oversight. However, CMS still has not published a comprehensive plan that describes the many aspects of its Medicaid financial management strategy and its plans for continuing and sustaining its recent improvement efforts. A strategic plan is a key management tool that can help clarify organizational priorities and unify agency staff in the pursuit of shared goals. Strategic plans are the starting point and basic underpinning for a system of program goal-setting and performance measurement. In accordance with the Government Performance and Results Act of 1993 (GPRA), a multiyear strategic plan articulates the fundamental mission (or missions) of an organization, and lays out its long-term general goals for accomplishing that mission, including the resources needed to reach these goals. The clearer and more precise these goals are, the better able the organization will be to maintain a consistent sense of direction, regardless of leadership changes. HHS prepares a strategic plan as required by GPRA. The HHS strategic plan contains eight broad program performance goals related to the missions and programs of its operating divisions. However only one goal relates to Medicaid financial management—an overall goal for all HHS programs to “achieve excellence in management practices.” Unlike the Medicare program that started publishing a separate comprehensive plan for financial management in fiscal year 2001 that outlined problems and plans to address weaknesses in the Medicare program’s internal controls, oversight, and financial systems, the Medicaid program has not developed its own plan for financial management that includes an appropriate level of detail to be useful as a tool to guide its financial managers. Medicaid officials told us that they have several planning documents— such as the annual financial management work plans, the FMAR, and the Financial Issues Report that we previously discussed—that they use in managing financial management activities. While these documents provide information on aspects of CMS’s financial management activities, they do not clearly define the mission of Medicaid financial management, lay out the goals for continuously implementing the mission, or provide a complete description of the operational processes, skills, technology, and other resources required to meet CMS’s financial management goals and objectives. Without a strategic plan, CMS lacks an appropriate “roadmap” to guide activities for ensuring sound financial management of the Medicaid program. Therefore, we are reiterating our recommendation in this area. During fiscal years 2003 through 2005, CMS received almost $46 million from the HCFAC account that it has used to help fund programs related to its oversight of Medicaid. Congress enacted the HCFAC program as part of the Health Insurance Portability and Accountability Act of 1996 to consolidate and strengthen ongoing efforts to combat fraud and abuse in health care programs, including the Medicare and Medicaid programs. The legislation required the establishment of the national HCFAC program and it established the HCFAC account within the Medicare Federal Hospital Insurance Trust Fund, which is funded by appropriations out of the Trust Fund. The HCFAC program is administered by HHS and the Department of Justice and is designed to coordinate federal, state, and local law enforcement activities with respect to health care fraud and abuse. HHS’s OIG, the Federal Bureau of Investigation, and the Medicare Integrity Program receive direct appropriations from the HCFAC account, while the Medicaid program must request funds from the HCFAC account and compete with other HHS programs, such as the Administration on Aging and the Office of General Counsel, for allocations from the discretionary part of the HCFAC account. Table 4 shows the discretionary HCFAC funds available to CMS in fiscal years 2003 through 2005 and the portion allocated to the Medicaid program run by CMSO for Medicaid financial management projects. CMSO used this money to help fund projects related to its oversight of Medicaid. Table 5 shows the various projects for the 3 fiscal years and the amounts allocated to those projects. The HCFAC account provided about $12 million to CMS for the funding specialists for fiscal years 2004 and 2005. The funding specialists have been funded on an annual basis with appropriations from the HCFAC account. There is the chance that adequate funding might not be provided through the HCFAC process in any given year for the funding specialists; thus CMS officials have told us they would like to pursue ways of making the funding specialist positions permanent. CMS officials told us that there was a provision in its fiscal year 2007 budget submission, but the provision was rejected during department-level discussions, so the funding specialists will continue to be funded on an annual basis with HCFAC funds. CMS officials also told us that some of the turnover of funding specialist staff was due to the uncertainty of funding and whether the positions would become permanent. Creating permanent funding specialist positions is important, given how CMS has been using them in performing reviews of high-risk issues. Other Medicaid projects included in table 5 that CMS used HCFAC funds for include: interagency agreements between CMS and OIG for OIG audits of high-risk issues such as family planning services in managed care, skilled professional medical personnel, upper payment limits, school-based claims, home- and community-based services, and Medicaid administrative costs reported by state agencies other than the Medicaid single state agency; Medicare-Medicaid data match project developed to identify improper billing and utilization patterns by matching Medicare and Medicaid claims information on providers and beneficiaries; Payment Accuracy Measurement, PERM, and SCHIP Error Rate Pilot Projects, which allow states to test a methodology to determine improper payment error rates in their SCHIP and/or Medicaid programs; Transaction, Information, Inquiry and Program Performance System to develop and enhance an integrated financial management tool linking existing CMSO data systems and tools containing critical financial, statistical, administrative, and other data; an organizational study of Medicaid financial processes within CMS done by OIG under an interagency agreement with OIG; a project referred to as the Annuities Project, which used both qualitative and quantitative research methods to develop a comprehensive picture of states’ experience with the use of annuities as an asset-sheltering device by Medicaid applicants and their spouses; a Waiver Management System Database project, which updated a current Waiver Management System Database; and a project to research options for automating the Medicaid state plan process from the creation and submission of state plan amendments at the state level through approval at the central office and regional offices. We obtained documentation to support the use of HCFAC funds for the above projects. Since we last reported in 2002, CMS has made improvements to the processes it uses in its efforts to oversee states and identify payment errors. Efforts undertaken, such as the hiring of the funding specialists, consolidating the review of reimbursement state plan amendments, and the Medicare-Medicaid data match project have enhanced CMS’s ability to identify issues that put federal Medicaid dollars at risk. While CMS’s actions address previously identified weaknesses and recommendations from our 2002 report related to (1) targeting resources to higher risk areas, (2) monitoring performance, (3) establishing mechanisms for ensuring accountability, (4) developing an approach to payment accuracy reviews and (5) incorporating advanced control techniques, it is too soon to assess the impact they will have on improving overall financial management and addressing emerging issues that put federal Medicaid dollars at risk because the results of some efforts are not known yet. In addition, several weaknesses remain in CMS’s oversight that could be addressed by implementing our prior recommendations that remain open. Specifically, CMS still lacks processes to adjust oversight activities for changes in risk; therefore, we reiterate our prior recommendation related to measuring whether risks have changed as a result of corrective actions to address them. Also, because CMS has not yet addressed weaknesses we identified in its analysis capabilities, we reiterate our prior recommendation for CMS to incorporate using MSIS data in its analysis of state claims. We also reiterate our prior recommendations to CMS for collecting and using information on state fraud and abuse control activities because this information is important to determining the appropriate level of federal oversight of state claims. The absence of a strategic plan could hinder CMS in sustaining its current efforts and addressing the weaknesses that we have identified. Therefore, we reiterate our prior recommendation that CMS develop a strategic plan specific to Medicaid financial management. Also, CMS may not have the staff and systems needed to continuously identify and target high-risk issues. Therefore, we stress the importance of creating permanent funding specialist positions and determining what systems projects are needed to improve their analysis capabilities. To further improve and sustain CMS’s oversight of state claims, including its ability to identify and address emerging issues, we recommend that the Administrator of CMS take the following two additional actions: Create permanent funding specialist positions. Determine what systems projects are needed to further enhance data analysis capabilities. In written comments on a draft of this report, which are reprinted in appendix III, CMS agreed with our findings and recommendations and stated that it will continue examining issues raised in this report, including prior recommendations from our 2002 report that are still outstanding. CMS also stated that it will work to implement the two recommendations made in this report. CMS expressed its support for our recommendation to create permanent funding specialist positions, which are currently funded with HCFAC dollars, and stated it will consider alternative approaches to provide adequate resources. CMS further stated it will follow our second recommendation and begin the process of determining the system projects that are needed to further enhance data capabilities. CMS also provided additional information on several of the activities we reported on, including additional activities of the funding specialists and actions being taken on our prior recommendations. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this letter. We will then send copies to the Secretary of Health and Human Services, Administrator of CMS, Inspector General of HHS, and other interested parties. Copies will be made available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8341 or calboml@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors are acknowledged in appendix IV. To identify the extent to which the Centers for Medicare & Medicaid Services (CMS) has improved its oversight, including its ability to identify and address emerging issues that put federal Medicaid dollars at risk, we performed work at CMS headquarters and two regional offices. We reviewed and assessed aspects of CMS’s financial oversight processes, which include identifying high-risk areas in order to develop an annual regional office financial management workplan and conducting focused financial reviews of high-risk areas. We reviewed 35 of the 113 focused financial reviews conducted by CMS regional offices for fiscal years 2003 and 2004. We selected reviews of specific issues that were reviewed across regions and fiscal years, such as disproportionate share hospital payments and school-based administrative services. We did not select certain issues, such as upper payment limits and intergovernmental transfers, because these issues have been well-covered in other reports and by CMS’s actions. We looked for consistency of the reviews among regions and fiscal years and the extent to which states implemented CMS’s recommendations. We obtained and reviewed documentation showing the activities and work performed by the new funding specialists hired by CMS during 2004 and 2005 as part of its efforts to improve its financial management of the Medicaid program. We reviewed our prior reports and reports by the Department of Health and Human Service’s Office of Inspector General (OIG) and others. We also reviewed interagency agreements between CMS and OIG. We interviewed OIG staff, and CMS officials and staff at the CMS central office in Baltimore, Maryland, and two regional offices—New York and Chicago. We selected the New York and Chicago regional offices to visit based on the number of focused financial reviews we selected to review that were performed by these regions. Sixteen of the 35 focused financial reviews we selected to review were performed by these two regions; the remaining 19 focused financial reviews were done by seven other regional offices. We also considered the Comptroller General’s Standards for Internal Control in the Federal Government. To determine how CMS used funds from the Health Care Fraud and Abuse Control (HCFAC) account for fiscal years 2003 through 2005, we obtained from CMS a list of Medicaid projects that were funded from the HCFAC account in fiscal years 2003 through 2005. We obtained and examined documentation from CMS such as invoices; grant awards; interagency agreements; and accounting, budget, and payroll records that support the information provided by CMS on how it spent HCFAC funds for fiscal years 2003 through 2005. We also reviewed the HCFAC program and funding legislation, 42 U.S.C. §§ 1320a-7c, 1395i(k). We requested written comments on a draft of this report from the Administrator of CMS or his designee. His written comments are reprinted in appendix III. We conducted our review from February 2005 to May 2006 in accordance with generally accepted government auditing standards. Staff members who made key contributions to this report include Kimberly Brooks (Assistant Director), Theresa Bowman, Lisa Crye, Abe Dymond, Diane Morris, Michelle Smith, and Edward Tanaka. Medicaid Integrity: Implementation of New Program Provides Opportunities for Federal Leadership to Combat Fraud, Waste, and Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006. Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: June 28, 2005. Medicaid: States’ Efforts to Maximize Federal Reimbursements Highlight Need for Improved Federal Oversight. GAO-05-836T. Washington, D.C.: June 28, 2005. Medicaid Financing: States’ Use of Contingency-Fee Consultants to Maximize Federal Reimbursements Highlights Need for Improved Federal Oversight. GAO-05-748. Washington, D.C.: June 28, 2005. Health Care Fraud and Abuse Control Program: Results of Review of Annual Reports for Fiscal Years 2002 and 2003. GAO-05-134. Washington, D.C.: April 29, 2005. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 2005. Medicaid Program Integrity: State and Federal Efforts to Prevent and Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004. Medicaid: Intergovernmental Transfers Have Facilitated State Financing Schemes. GAO-04-574T. Washington, D.C.: March 18, 2004. Medicaid: Improved Federal Oversight of State Financing Schemes Is Needed. GAO-04-228. Washington, D.C.: February 13, 2004. Major Management Challenges and Program Risks: Department of Health and Human Services. GAO-03-101. Washington, D.C.: January 2003. Medicaid Financial Management: Better Oversight of State Claims for Federal Reimbursement Needed. GAO-02-300. Washington, D.C.: February 28, 2002.

Summary: Medicaid--the federal-state health care financing program--covered over 56 million people at a cost of $295 billion in fiscal year 2004, the latest fiscal year for which complete data are available. The Centers for Medicare & Medicaid Services (CMS) is the federal agency responsible for overseeing states' Medicaid programs and ensuring the propriety of expenditures reported by states for federal reimbursement. In 2002, GAO reported on weaknesses in CMS's oversight of Medicaid financial management and made recommendations to CMS to strengthen its oversight process. In fiscal year 2003, CMS started receiving funds from the Health Care Fraud and Abuse Control (HCFAC) program to help improve Medicaid financial management. GAO was asked to evaluate CMS's financial management activities, including following up on prior recommendations. In this report, GAO examined (1) the extent to which CMS has improved its ability to identify and address emerging issues that put federal Medicaid dollars at risk and (2) how CMS used funds for Medicaid from the HCFAC account. CMS has undertaken several steps to improve its Medicaid financial management activities, including its efforts to oversee state claims for federal reimbursement and to identify payment errors. CMS hired about 90 funding specialists, thus enhancing its ability to address high-risk state funding practices that inappropriately increase federal costs. CMS also created a new unit that centralized responsibility for approving state plan amendments related to reimbursement. CMS continued to identify billions of dollars in questionable federal reimbursement through focused financial reviews. CMS also set goals aimed at reducing questionable federal reimbursement and holding financial managers accountable and enhanced its internal processes for tracking results of its financial management activities. These and other efforts, such as CMS's approach for measuring payment errors under the Improper Payments Information Act, represent improvements in the processes that CMS uses in its oversight of states. While these actions also address previously identified weaknesses and recommendations from our 2002 report, it is too soon to assess the impact they will have on improving overall financial management and addressing emerging issues that put federal Medicaid dollars at risk because some have just recently been initiated and results are not known yet. Further, there are a number of previously identified weaknesses that the agency has not yet addressed. Specifically, CMS has not instituted mechanisms to measure how the risk of inappropriate federal reimbursement has changed as a result of corrective actions taken. In addition, CMS has not incorporated the use of the Medicaid Statistical Information System database into its oversight of states' claims or other systems projects intended to improve its analysis capabilities. Further, CMS has not developed profiles to document information on state fraud and abuse controls to use in its oversight of state claims. Finally, CMS has not developed a strategic plan specific to its Medicaid financial management activities. Because these issues are important to further improving and sustaining CMS's oversight activities, we reiterate and build on our prior recommendations in these areas. During fiscal years 2003 through 2005, CMS received almost $46 million from the HCFAC account that it used to help fund programs related to its oversight of the Medicaid program, including about $12 million for the funding specialists for fiscal years 2004 and 2005. The funding specialist positions have been funded on an annual basis with appropriations from the HCFAC account. There is the chance that adequate funding might not be provided through the HCFAC process in any given year for the funding specialists; therefore, creating permanent funding specialist positions is important. CMS used the other $34 million for other projects such as researching options for automating the Medicaid state plan process, and interagency agreements with the OIG to conduct audits of high-risk areas. GAO obtained documentation to support the use of HCFAC funds for these projects.