Federal laws require both state and federal entities to protect the Medicaid program from fraud, waste, and abuse. States have primary responsibility for reducing, identifying, and recovering improper payments. Federal entities typically provide oversight, guidance, and program and law enforcement support. States’ program integrity activities include a screening process to help ensure that ineligible providers do not participate in the Medicaid program. Federal regulations establish screening requirements that apply when states enroll FFS providers into their Medicaid program. Because states are required to enroll FFS providers, but have discretion on whether to enroll MMC plan providers, MMC plan providers would not be subject to the same screening requirements as FFS providers unless the state opted to enroll them. States that do not enroll MMC plan providers have flexibility in how they screen them. This occurs when states require the MMC plans to screen and enroll providers directly into their networks by delegating these responsibilities to the plans in their contracts. In past work, we concluded that states that maintain centralized control over the provider screening process and require MMC plan providers to enroll with the state Medicaid agency may be better positioned to ensure the integrity of their Medicaid programs. Federal health programs, including Medicaid, are prohibited from paying for any items or services rendered by an ineligible provider. The HHS- OIG determines which providers are excluded from the federal health programs, and thus ineligible, and maintains the List of Excluded Individuals and Entities (LEIE). Grounds for exclusion include convictions for program-related fraud and patient abuse, and suspension or revocation of a medical license for reasons bearing on professional competence or performance. While states may delegate provider screening to the MMC plans, the states remain responsible for ensuring that they do not pay ineligible providers for Medicaid health care items and services. CMS is prohibited by federal law from making payments to states for any amount expended for items or services provided by an ineligible provider. Any such payments constitute overpayments and are therefore subject to recoupment. In addition, civil monetary penalties may be imposed against MMC plans that employ or enter into contracts with ineligible providers. Further, PPACA and its implementing regulations require state Medicaid agencies to terminate the participation of any provider that has been terminated on or after January 1, 2011, under Medicare or under any other state Medicaid program or Children’s Health Insurance Program. CMS defines termination to mean that a state Medicaid program, Children’s Health Insurance Program, or the Medicare program has taken action to revoke a provider’s billing privileges for cause, and the provider has exhausted all applicable appeal rights or the timeline for appeal has expired. A termination for cause may include, but is not limited to, terminations based upon fraud, integrity, or quality issues. Prior to PPACA, if one state terminated a provider from its Medicaid program, the provider could potentially enroll in or continue participation in another state’s Medicaid program, leaving the latter state’s program vulnerable to potential fraud, waste, and abuse. In response to the PPACA requirement for CMS to establish a process for sharing information about terminated providers with state agencies, CMS established a web-based portal—the Medicaid provider termination notification system—where CMS and state Medicaid agencies can submit information about providers that meet CMS’s criteria for having been terminated for cause from Medicare, Medicaid, or the Children’s Health Insurance Program. However, according to CMS officials, states’ use of this portal to report terminations is voluntary. In response to PPACA’s requirement to establish procedures for screening providers, CMS issued regulations that set forth minimum requirements applicable to the screening of Medicaid FFS providers, although states have flexibility to establish more stringent screening requirements. Among other requirements, CMS designated four federal databases that states must use to screen providers: (1) the Social Security Administration’s (SSA) Death Master File (DMF), (2) HHS’s National Plan and Provider Enumeration System (NPPES), (3) the LEIE, and (4) the Excluded Parties List System (EPLS) maintained by the General Services Administration. In December 2014, CMS issued guidance to assist states when conducting required federal database checks on FFS providers. In the guidance, CMS noted that MMC plans are not mandated by regulation to screen providers who enroll in their networks. However, CMS stated that it considered the requirements under its regulation to be program safeguards that would be prudent in managed care settings. CMS also noted that states may delegate these requirements to their MMC plans through their contracts with them. In guidance issued to MMC plans, CMS recommended that plans use the LEIE and EPLS to identify ineligible providers. According to two selected states and 16 selected MMC plans that screen MMC plan providers, their efforts are challenged by fragmented information and difficulty accessing and using particular databases. According to the two selected state officials and 16 selected MMC plan representatives we contacted, the information they use to screen MMC plan providers is fragmented across multiple and disparate federal databases. Overall, these two selected states and 16 selected plans identified a total of 22 databases managed by 15 different federal agencies. Representatives from 13 of the 16 plans reported using between 5 and 8 of these federal databases, while officials from the two states that directly screen managed care providers reported using 5 and 6 databases. Table 1 lists the 22 databases that these selected state officials and plan representatives said they used in their screening of MMC plan providers, the agencies that managed them, and the role the databases play in the screening of providers. (See appendix I for additional details on each of these federal databases.) According to state Medicaid officials in the two selected states that do their own screening of providers, both states used the LEIE, EPLS, and NPPES, and one also used the DMF. In addition, both states checked CMS’s Medicare Exclusions Database and its Provider Enrollment, Chain and Ownership System (PECOS). Almost all of the selected MMC plans reported using three databases— NPPES, DMF, and HHS’s National Practitioner Data Bank—in addition to the two databases recommended by CMS guidance. Plans also reported using several other of the federal databases identified in table 1. Officials from some states noted that plans checking more databases than recommended by CMS provided better assurance they would not enroll ineligible providers and helped provide a more comprehensive background on a provider. For example, by checking federal databases beyond the two recommended by CMS for MMC plans (LEIE and EPLS), plans may find background on a provider’s termination or identify a past administrative action taken against the provider by the Drug Enforcement Administration. However, this also means that provider screenings within a state may not always be conducted consistently, as the additional databases checked may vary by plan. Additionally, all 10 selected states use the health plan accreditation requirements of the National Committee for Quality Assurance (NCQA) in their monitoring of state MMC plans, because it includes provider screening guidelines, such as assessing providers’ practice history, verifying their credentials, education, training, malpractice history and disciplinary actions, and monitoring providers’ sanctions, complaints, and quality issues. Half of the states require that their plans be accredited by NCQA, and the rest recognize NCQA accreditation as compliance with federal guidance for screening MMC plan providers. In particular, to meet the NCQA accreditation requirements, plans need to obtain information beyond what the LEIE and EPLS provide. For example, to meet NCQA’s requirement that they verify provider history and other disciplinary actions, plans must check the National Practitioners’ Data Bank, a large central federal data bank of all reports made against all health care professionals, including fraud, abuse, licensure actions, or malpractice reports. Federal internal control standards stress the importance of collecting quality information to achieve objectives and assess risks. To do this, the standards state that it is necessary to identify information requirements and use data from reliable sources. However, the variety of databases checked by states and MMC plans beyond those specified by CMS, the use of NCQA’s accreditation requirements in all 10 states, along with the current rate of improper payments to Medicaid providers, suggests that CMS might not have identified all reliable sources of information about ineligible providers. This makes it difficult for the states and MMC plans to achieve the Medicaid program’s objectives. Moreover, the variety of databases that the states and MMC plans have chosen to check raises the possibility that they might be using information of varying quality to screen providers. All of the states and MMC plans that screened providers checked more databases than are currently specified by CMS for this purpose, but CMS has not assessed whether there are benefits to checking the additional databases. Without an assessment of these additional databases and their potential contribution to improving the effectiveness of screening providers, and ultimately reducing improper Medicaid payments, CMS cannot be certain that states and MMC plans are using information of sufficient quality to screen providers. State Medicaid officials and MMC plan representatives said that accessing and using information that is fragmented across multiple and disparate federal databases hampered them in their efforts to screen providers. CMS has not collaborated with other agencies to explore options for enhancing the ability of states and plans to access and use comprehensive information during the screening process, including information about deceased providers, and thus better ensure that ineligible or potentially fraudulent providers do not bill Medicaid. State officials and plan representatives noted problems accessing two specific databases. Officials from one state and representatives from one plan identified cost as a challenge to using the DMF, which is only available with a paid subscription. CMS officials told us that they are interested in collaborating with SSA to facilitate sharing DMF data with states. Additionally, representatives from one plan said that having access to PECOS—a CMS database currently unavailable to plans— would help improve their screening process because it would help corroborate information from providers. Representatives from two plans said that they experienced challenges obtaining assistance when they had general problems using federal databases. For example, representatives from one plan said that it could be difficult to identify an individual at a federal agency who could not only assist them, but also who understands Medicaid. Plan officials said that if they were able to contact someone, the agency might be hesitant to provide the plan with additional information about a provider termination, because MMC plans are not government entities. Representatives from seven selected plans said that the technical process of conducting the matches and confirming identified matches was challenging. For example, some plan representatives said they check the eligibility status of thousands of providers at regular intervals, typically monthly, and said that these checks can be particularly challenging if the database does not allow the user to compare multiple provider names at one time. Plan representatives said that confirming the accuracy of identified matches was also challenging, because some databases contained limited provider data, particularly if a match is not based on a unique identifier, such as the national provider identifier (NPI). The lack of a consistent, unique identifier meant that it could be difficult to accurately match a potentially ineligible provider across databases. Relying solely on basic information for matching, such as providers’ names and addresses, can cause additional problems; for example, false positive matches for common names such as John Smith. In these instances, plans may have to take additional steps to confirm the match, such as contacting the provider or federal agency managing the database to obtain additional information that is not included in the database. Several plans told us that they would prefer to use the NPI to search the databases, because most providers are required to have an NPI. However, because NPI is a health-care specific unique identifier, it may not be used in databases external to HHS. Other unique identifiers that state officials and plan representatives suggested could be used across databases include Social Security numbers and taxpayer identification numbers, although the officials noted the sensitivity involved with using these numbers. These challenges affect states’ ability to ensure that only eligible providers in good standing participate in the Medicaid program. Federal internal control standards state that agencies should use quality data that are complete, current, accurate, and accessible, and have a logical connection to the program, such as the data regarding deceased individuals in the DMF, to achieve agency goals to reduce fraud. Without consistent access to the DMF, states and plans risk paying deceased providers—a potential concern that we have identified in prior work. The use of a consistent identifier would also help states and plans ensure that they are accurately identifying ineligible providers. However, CMS officials said they have not coordinated with other agencies to address these challenges. For example: Sharing CMS’s DMF data: SSA officials told us that they recently received a request from CMS asking for permission to share DMF information with states and said that they are willing to work with CMS to develop a process to do so. CMS officials told us that they have had preliminary conversations with SSA and are interested in collaborating with SSA to develop a process to share the DMF with states. In addition to helping to ensure that states have access to DMF data and protecting the federal government from fraudulent payments to deceased providers, this arrangement could decrease federal and Medicaid expenditures. For example, SSA officials told us that in fiscal year 2014 CMS paid nearly $25,200 for the DMF data, including weekly updates, and states reported annual DMF subscription and implementation costs ranging from about $2,700 to $67,000. Since one state and most of the plans reported using the DMF, CMS sharing its DMF subscription would likely produce state and federal savings for Medicaid. Collaborating with other agencies to use a unique identifier: CMS officials said that they have not considered collaborating with other agencies to explore using a unique identifier—such as the NPI—that would serve to improve the ability of states and plans to confirm the accuracy of matches across databases. Such collaboration could help to mitigate challenges experienced by states and MMC plans in confirming database matches efficiently and effectively, which potentially place federal dollars at risk for waste, fraud, and abuse. Recent legislation has the potential to address some—but not all—of the challenges related to states’ and health plans’ use of federal databases. The Department of Treasury’s Do Not Pay database is designed to reduce improper payments in federal programs and incorporates information from several of the federal databases states and plans use to screen providers. The Do Not Pay database is a source of centralized data that agencies must use to verify eligibility for federal payments and awards. The Do Not Pay database provides access to—among other data sources—EPLS, and the public version of the DMF. Officials from one state that delegates provider screenings to MMC plans said that having access to the Do Not Pay database would streamline their screening process. While the Do Not Pay database is currently only available to federal agencies, a recently enacted law will allow states and state contractors, including MMC plans, to access the database. Other states and plans also indicated that a centralized database would be ideal, although they did not refer directly to the Do Not Pay database. CMS officials told us they are considering suggesting to states and plans that they use the Do Not Pay database for Medicaid managed care provider screening. States must ensure that none of their providers has been determined to be ineligible anywhere in the United States. CMS issued guidance in 2012 encouraging states to share data on ineligible providers through its Medicaid provider termination notification system; however, doing so is optional, not all states are using the list, and the list is not available to MMC plans. In addition, CMS officials said they have not provided states with guidance on other ways to share their data on ineligible providers or how to access other states’ data on ineligible providers. Our 10 selected states varied in how they shared data on ineligible providers, the location and usability of the data they shared, and the type of information they shared. All of our 10 selected states made data on their ineligible providers publicly available. Specifically, they made their data available online, although they varied in where they posted these data on their websites and in the consistency of the information posted. For example, our review of the states’ websites found that 5 states made the data available through their state’s Office of Inspector General’s website, while the 5 other states had these data on their Medicaid websites. Within these two groups, the data were sometimes displayed on a homepage and other times required users to click through a number of webpages to locate the data. All the states provided at least some export function as part of accessing their data on ineligible providers, which can facilitate the ease with which other states can access and use the information on the website. However, 2 states limited their data exports to PDF files, which have less search functionality than other formats like Microsoft Excel, which was used by the other 8 states. Eight of the selected states had a database search feature as part of their website and an export function, which allowed users to search for individual providers. Two websites allowed for verification of a Social Security number online. (See fig. 1.) The 10 selected states also varied in the types of data they made available about their ineligible providers. All 10 states included providers’ first names, last names, and middle names or initials. Seven states included providers’ NPI in their information on ineligible providers. Seven states included a category for a medical license number in their information on ineligible providers, but these data were not consistently presented across states. Four states included provider addresses, and seven states included provider type or specialty. One state included alias’ that the ineligible providers might be using, and one state provided information on ineligible providers’ affiliations with other provider groups or practices. (See fig. 2.) The 10 states also varied in the information they provided about why providers became ineligible and in the terminology they used. All 10 states included the effective date providers became ineligible. Five states provided information on the action type that led to the provider becoming ineligible, which included, among other things, the terms “exclusion,” “terminated,” and “voluntary withdrawal.” While the HHS-OIG defines excluded providers as those providers it has determined to be ineligible for participation in federal health programs, states used varying terminology. Six states also included the reason for the exclusion. (See fig. 3.) Unlike states, MMC plans are not required to make their data on ineligible providers publicly available. The 16 selected MMC plans reported sharing these data with their state Medicaid agencies at varying intervals and in rare cases, with other plans. Representatives from the 16 selected plans said they might share their data on ineligible providers with their states during periodic meetings that covered a variety of issues. However, the frequency and scope of these meetings varied. According to plan representatives, 1 plan met with the state at least monthly, 3 plans met with the state quarterly, 7 plans met with the state annually, and 3 plans met with the state biennially; officials from 1 plan said they met with the state frequently but did not provide a specific frequency for the meetings; and 1 plan did not provide this information. Representatives from the MMC plans said they generally did not share these data with other plans, with a few exceptions. For example, representatives from 1 plan said that they share information on ineligible providers with another plan they contract with in their state. Similarly, representatives from 3 MMC plans that were subsidiaries of large health care corporations with MMC plans in multiple states told us that they shared data on ineligible providers with the other plans in their networks. However, there is no process or requirement from CMS for them to share on a consistent basis. Because states and MMC plans are prohibited from paying federal funds to providers that have been determined to be ineligible anywhere in the United States, sharing data on ineligible providers is an important control activity for preventing providers who are ineligible to participate in Medicaid in one state from enrolling in or billing Medicaid programs in other states. Federal internal control standards emphasize the importance of performing control activities routinely and consistently. The inconsistency with which this information on ineligible providers is shared across states and MMC plans creates the potential that providers could be determined to be ineligible in some states, while still receiving payments from Medicaid in other states. States and MMC plans rely on fragmented information from multiple and disparate databases to screen managed care providers to ensure that they are not paying providers determined to be ineligible to do business with the federal government. Currently, CMS guidance to states and MMC plans only touches upon a small subset of the 22 disparate databases that states and MMC plans check when screening providers, and does not provide information on what other databases would be helpful for screening providers. Because MMC plans we reviewed are using a variety of databases beyond those specified by CMS, it suggests that CMS might not have identified all reliable sources of information about ineligible providers that would be helpful to meet program objectives and assess risks. Without an assessment of these additional databases and their potential contribution to improving the effectiveness of screening providers, CMS cannot be certain that its guidance to states and MMC plans is comprehensive for screening providers. States and plans have also been hampered in their efforts to access and use databases maintained by various federal agencies, because of differences in the characteristics of the databases, including difficulty accessing databases and conducting provider matches. CMS has not coordinated with other agencies to explore what options may exist to address these challenges. CMS guidance on how states should share data on ineligible providers is also limited, resulting in significant inconsistency in how such information is shared across states. All 10 selected states made their data on ineligible providers publicly available, although they varied in where they posted the data on their websites and the consistency of the information posted. While all 10 states included providers’ names, other data—such as NPI or other identifiers—were not consistently available. Anyone checking these data would be required to do additional work to confirm a provider match and state websites would require that the states conducting the screenings know how to locate the ineligible provider list. The inconsistency with which this information is shared across states and MMC plans creates the potential that providers could be determined to be ineligible in some states, while still receiving payments from Medicaid in other states. To improve the effectiveness of states’ and plans’ MMC plan provider screening efforts, we recommend that the Acting Administrator of CMS take the following three actions: 1. Consider which additional databases that states and MMC plans use to screen providers could be helpful in improving the effectiveness of these efforts and determine whether any of these databases should be added to the list of databases identified by CMS for screening purposes. 2. Collaborate with SSA to facilitate sharing CMS’s DMF subscription with state Medicaid programs. 3. Coordinate with other federal agencies, as necessary, to explore the use of an identifier that is relevant for the screening of MMC plan providers and common across databases used to screen MMC plan providers. 4. Provide state Medicaid programs with guidance that establishes expectations and best practices on sharing provider screening data among states and MMC plans. We provided a draft copy of this report to HHS. HHS provided written comments, which are reprinted in appendix II. In its written comments, HHS described the actions it will take to address our first three recommendations. In response to our fourth recommendation to provide state Medicaid programs with guidance that establishes expectations and best practices on sharing provider screening data among states and Medicaid managed care plans, HHS commented that it developed the Medicaid provider termination notification database to assist states with the requirement to deny or terminate the enrollment of any provider that has been terminated for cause under Medicare or another state’s Medicaid program or CHIP. It added that its Medicaid managed care proposed rule, issued in June 2015, if finalized, will require that state Medicaid programs enroll providers participating in Medicaid managed care. HHS stated that this will help ensure that all Medicaid managed care providers are screened against the Medicaid provider termination notification database. However, states’ use of the Medicaid provider termination notification database is not required, not all states are using it, plans do not have access to the database, and the proposed rule does not address use of the database. Therefore, HHS’s reported actions will not address these specific issues. HHS also provided technical comments, which we incorporated as appropriate. We also provided relevant draft portions of this report to SSA, state Medicaid program offices for California, Florida, Illinois, Minnesota, Missouri, New Jersey, New York, Tennessee, Texas, and Washington, and representatives of the MMC plans. SSA provided technical comments which we incorporated as appropriate. States and plans were also in agreement with the draft portions they received, and provided some technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to our requestor, the Secretary of Health and Human Services, the Acting Commissioner of Social Security, officials from the states and plans included in our study, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or at YocomC@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix III. Description The Drug Enforcement Administration (DEA) administers a provision of the Controlled Substances Act of 1970 that, among other things, requires all health care providers entitled to dispense, administer, or prescribe controlled pharmaceuticals; and all pharmacies entitled to fill prescriptions to register with the DEA. The Controlled Substances Act authorizes the DEA to take enforcement actions, such as administrative actions, against the registrant, for various reasons, such as materially falsifying the registration application filed; having been convicted of a felony relating to a controlled substance; having had its state license or registration suspended, revoked, or denied; or having been excluded from participation in a Medicaid or Medicare program. DEA’s Administrative Actions Against Registrants shows, by year, DEA’s administrative actions. DEA Number is DEA’s complete official database of persons and organizations certified to handle controlled substances under the Controlled Substances Act. DEA authorizes the use of this database, and the inclusion of any individual or organization in the database, as proof of that entity's registration with the DEA. The Department of State compiles a list of foreign organizations that are designated by the Secretary of State as Foreign Terrorist Organizations, in accordance with section 219 of the Immigration and Nationality Act, as amended. The Social Security Administration (SSA) compiles death information about Social Security number-holders in order to ensure it does not pay Social Security benefits to deceased individuals and to establish benefits for survivors. This information is in the agency’s DMF. SSA obtains death reports from a variety of sources, including family members, funeral directors, post offices, financial institutions, other federal agencies, and states. To get death reports from the states, SSA has established formal agreements that set forth a payment structure for the states’ death reports and limit SSA’s ability to share this information. However, the Social Security Act requires SSA to share death information, to the extent feasible, including data reports by the states, with federal agencies to ensure proper payment of benefits to individuals. The act also prohibits SSA from sharing state-reported death information for any other purposes. As a result, SSA maintains two versions of the DMF. The full DMF, which contains all death records, is available to federal benefit payment agencies. The partial DMF, which excludes state- reported death information, is available publicly. The list identifies individuals and entities that have been denied export privileges, by written order to the Department of Commerce. The Export Administration Regulations (EAR) contain licensing requirements for the export, re-export and/or transfer (in-country) of specified items. The Entity List contains names of certain foreign persons—including businesses, research institutions, government and private organizations, individuals, and other types of legal persons—that are subject to the EAR. On an individual basis, the persons on the Entity List are subject to licensing requirements and policies supplemental to those found in the EAR. The list is found on the Department of Commerce’s Bureau of Industry and Security website. The General Services Administration (GSA) maintains the EPLS, an online system that includes information regarding parties debarred, suspended, proposed for debarment, excluded, or otherwise disqualified from receiving federal funds; in 2012, GSA migrated the EPLS into SAM. All federal agencies are required to send information to the EPLS on parties they have debarred or suspended. The EPLS provides only the name and address of excluded entities, but no other unique identifiers. The HHS-OIG also sends GSA monthly updates of the LEIE for inclusion in the EPLS, but the LEIE information included in EPLS does not provide all of the information from LEIE. For example, EPLS does not provide more details on LEIE excluded providers, such as the statutory basis for the exclusion action, date of birth, and address. The FEHBP provides coverage to federal employees, retirees, and their dependents through health insurance carriers that contract with the federal government. The Office of Personnel Management (OPM) negotiates these contracts and requires that each of these carriers establish a program to prevent, detect, and eliminate fraud and abuse. OPM’s Office of Inspector General suspends and debars health care providers from the FEHBP who have, among other things, lost professional licenses, been convicted of a crime related to the delivery of or payment for health care services, violated provisions of a federal program, or been debarred by another federal agency. The names of such providers are available through the secure OPM Debar Webpage. The list of sanctioned providers is also available to the public through SAM—GSA’s government-wide list of exclusions. The Department of Health and Human Services Office of Inspector General (HHS-OIG) maintains and updates monthly the LEIE, a database of providers it has excluded. The LEIE includes information on excluded providers, such as providers’ names, addresses, dates of birth, occupation at the time of exclusion, provider type, and the statutory basis for the exclusion. The LEIE is publicly available to search or download on the HHS-OIG website, and available in two formats: online and downloadable. The online search engine identifies currently excluded individuals and entities. When a match is identified, it is possible to verify the accuracy of the match using a Social Security number or employer identification number. The downloadable version of the database may be compared against state enrollment files. However, unlike the online version, the downloadable version does not include Social Security number or employer identification number. A United States Postal Service website that allows zip code searches by address, city, and state. CMS developed the MED in 2002 to collect and retrieve information that aided in ensuring that no payments are made to excluded individuals and entities for services furnished during the exclusion period. According to CMS, MED files contain a variety of identifiable and general information including names, Social Security numbers, National Provider Identifiers, addresses, exclusion types, and reinstatement dates, if applicable. CMS uses the HHS-OIG’s LEIE to populate the MED; the HHS-OIG sends monthly updates of the LEIE to CMS. The Medicare Opt-out List is a list of physicians and practitioners who do not wish to enroll in the Medicare program and have “opted-out” of Medicare. This means that neither the provider, nor the beneficiary submits the bill to Medicare for services rendered. Instead, the beneficiary pays the provider out-of-pocket and neither party is reimbursed by Medicare. The National Provider Identifier (NPI) is a national, unique 10-digit identification number assigned to health care providers that CMS adopted to be used in specified administrative and financial transactions for its health care providers and suppliers in accordance with the Health Insurance Portability and Accountability Act. CMS uses NPPES to assign NPIs to providers. NPDB, maintained by the Health Resources and Services Administration, an agency within HHS, is an information clearinghouse containing information related to the professional competence and conduct of healthcare providers. The NPDB is intended to facilitate a comprehensive review of professional credentials of health care providers and collects information on adverse licensing and certification actions, criminal convictions (health care related), civil judgments, exclusions from federal or state health care programs, and other adjudicated actions or decisions, medical malpractice payments, and any negative actions or findings taken by peer review organizations. It includes LEIE exclusions and related reinstatement actions taken by the HHS-OIG. However, because the criteria for inclusion in the NPDB are different than the criteria for inclusion in the LEIE, not all LEIE exclusions are listed in the NPDB. This HHS-OIG webpage includes the names of its most wanted fugitives on charges related to health care fraud and abuse. This is the Federal Financial Institutions Examination Council’s list of current, senior foreign political figures, their immediate family, and their close associates, who potentially pose a risk that their funds may be the proceeds of foreign corruption. PECOS is an Internet-based system to which Medicare providers submit and update their enrollment data. In response to the Patient Protection and Affordable Care Act’s requirement for CMS to establish a process for sharing information about terminated Medicare providers with state agencies, CMS provided states direct access to PECOS, where they can view specific enrollment data for each provider including identifying information such as National Provider Identifiers, tax identification numbers (TINs), and legal business names. PECOS also includes information on revoked licenses and terminated Medicare providers. While the data stored in the system are specific to Medicare providers, they are useful to state Medicaid programs. For example, states may use the data when screening providers during enrollment processes to determine whether a provider has ever been excluded from participation in Medicare and, thus, whether they should be allowed to participate in Medicaid. They also use PECOS data during provider screening to determine whether a Medicare screening has already taken place, thus eliminating the need to screen further for Medicaid participation. PACER is an electronic public access service that allows users to obtain case and docket information online from federal appellate, district, and bankruptcy courts, and the PACER Case Locator. PACER is provided by the federal judiciary in keeping with its commitment to providing public access to court information via a centralized service. As part of its enforcement efforts, the Office of Foreign Assets Control, within the Department of Treasury, publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities—such as terrorists and narcotics traffickers—designated under programs that are not country-specific. Collectively, such individuals are blocked and U.S. persons are generally prohibited from dealing with them. The Internal Revenue Service’s TIN Matching is part of a suite of Internet based pre-filing e-services that allows “authorized payers” the opportunity to match 1099 payee information against Internal Revenue Service records prior to filing information returns. An authorized payer is one who has filed forms 1099-B, 1099-DIV, 1099-INT, 1099-K, 1099- MISC, 1099-OID, or 1099-PATR with the Internal Revenue Service in at least one of the two past tax years. Interactive TIN Matching will accept up to 25 payee TIN/name combinations on-screen, while Bulk TIN Matching will allow up to 100,000 payee TIN/name combinations to be matched via a text file submission. Both programs will match the payee name and TIN with Internal Revenue Service records; decrease backup withholding and penalty notices; and reduce the error rate in TIN validation. Parties listed on the Department of Commerce’s Unverified List are ineligible to receive items subject to the Export Administration Regulations by means of a license exception. In addition, exporters must file an Automated Export System record for all exports to parties listed on the Unverified List and obtain a statement from such parties prior to exporting, re-exporting, or transferring to such parties any item subject to the Export Administration Regulations that is not subject to a license requirement. This is the Federal Bureau of Investigation’s list of wanted fugitives. In addition to the contact named above, Thomas Conahan, Assistant Director; Pauline Adams; Drew Long; Reed Meyer; Dawn Nelson; and Jennifer Whitworth made key contributions to this report.

Summary: GAO has reported that Medicaid remains a high-risk program, partly due to concerns about improper payments. Screening of providers is important to help prevent improper payments. Under managed care, states contract with plans to provide services to beneficiaries. GAO was asked to examine the screening of managed care providers. GAO examined (1) states' and plans' experiences using federal databases to screen providers; and (2) how states and plans share data about ineligible providers. GAO interviewed officials from 10 states, selected generally based on enrollment and geography, and representatives from 16 plans from among these states. GAO reviewed those states' Medicaid program websites and plan contracts, and relevant federal laws, regulations, and guidance; and interviewed officials from CMS and the Department of Health and Human Services' Office of Inspector General. GAO found that the selected states and Medicaid managed care plans face significant challenges in screening providers for eligibility to participate in the Medicaid program. Based on information we received from two selected states and 16 selected plans, GAO found that the states and plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers. These databases included databases that the Centers for Medicare & Medicaid Services (CMS) had not identified for use in screening providers. Officials from some states noted that these additional databases provided better assurance they would not enroll ineligible providers—i.e., providers who have been barred from participating in federal health care programs. Federal internal control standards stress the importance of collecting quality information to achieve objectives and assess risks. However, the variety of databases used for screening purposes beyond those identified by CMS, along with the current rate of improper payments to Medicaid providers, suggests that CMS might not have identified all reliable sources of information about ineligible providers that could help states and plans achieve program objectives. State officials and plan representatives also said that accessing and using fragmented information from multiple and disparate federal databases challenged their screening efforts. For example, they reported difficulties accessing certain databases, such as the Social Security Administration's Death Master File, and conducting and confirming identified provider matches across databases, particularly those not based on a unique national provider identifier. CMS has not coordinated with other agencies to address these challenges. Federal internal control standards state that agencies should use quality data that are complete, current, accurate, and accessible—and have a logical connection to the program—to achieve agency goals to reduce fraud. However, the difficulties states and plans experienced accessing databases and confirming matches could result in provider screening efforts that do not ensure that ineligible providers are accurately and consistently identified. GAO also found that the selected states reviewed used inconsistent practices to make data on ineligible providers publicly available. States must ensure that none of their providers has been determined to be ineligible anywhere in the United States. Although CMS has issued guidance encouraging states to share data on ineligible providers through its Medicaid provider termination notification system, doing so is optional, not all states are using the list, and it is not available to Medicaid managed care plans. Moreover, CMS has not provided states with guidance on other ways to share their data on ineligible providers or how to access other states' data on ineligible providers. The 10 states GAO selected varied in how they shared data on ineligible providers. Plans are not required to make their own data on ineligible providers publicly available, and the 16 selected plans shared their data with states at differing intervals and, in rare cases, with other plans. The inconsistency with which this information is shared across states and plans creates the potential that providers could be ineligible in some states while still receiving payments from Medicaid in other states. GAO recommends that CMS (1) consider additional databases used in screening, (2) collaborate with the Social Security Administration to improve access to the Death Master File, (3) coordinate with other agencies to develop a common identifier across databases, and (4) provide state Medicaid programs with guidance that establishes expectations and best practices on sharing provider screening data among states and plans. HHS concurred with our recommendations.