Among health care programs, Medicaid is the largest as measured by enrollment (over 73 million in fiscal year 2017) and the second largest as measured by expenditures ($596 billion in fiscal year 2017), second only to Medicare. The CMS Office of the Actuary projected that Medicaid spending would grow at an average rate of 5.7 percent per year, from fiscal years 2016 to 2025, with projected Medicaid expenditures reaching $958 billion by fiscal year 2025. This projected growth in expenditures reflects both expected increases in expenditures per enrollee and in levels of Medicaid enrollment. Beneficiaries with disabilities and those who are elderly constitute the highest per enrollee expenditures, which are projected to increase by almost 50 percent from fiscal year 2016 to 2025. Medicaid enrollment is also expected to grow by as many as 13.2 million newly eligible adults by 2025—as additional states may expand their Medicaid programs to cover certain low-income adults under the Patient Protection and Affordable Care Act (PPACA). (See fig. 1.) The partnership between the federal government and states is a central tenet of the Medicaid program. CMS provides oversight and technical assistance for the program, and states are responsible for administering their respective Medicaid programs’ day-to-day operations—including determining eligibility, enrolling individuals and providers, and adjudicating claims—within broad federal requirements. Federal oversight includes ensuring that the design and operation of state programs meet federal requirements and that Medicaid payments are made appropriately. (See fig. 2 for a diagram of the federal-state Medicaid partnership framework.) Joint financing of Medicaid is also a fixture of the federal-state partnership, with the federal government matching most state Medicaid expenditures using a statutory formula based, in part, on each state’s per capita income in relation to the national average per capita income. States have flexibility in determining how their Medicaid benefits are delivered. For example, states may (1) contract with managed care organizations to provide a specific set of Medicaid-covered services to beneficiaries and pay the organizations a set amount, generally on a per beneficiary per month basis; (2) pay health care providers for each service they provide on a fee-for-service basis; or (3) rely on a combination of both delivery systems. Managed care continues to be a growing component of the Medicaid program. In fiscal year 2017, expenditures for managed care were $280 billion, representing almost half of total program expenditures, compared with 42 percent in fiscal year 2015. (See fig. 3.) States also have the flexibility to innovate outside of many of Medicaid’s otherwise applicable requirements through Medicaid demonstrations approved under section 1115 of the Social Security Act. These demonstrations allow states to test new approaches to coverage and to improve quality and access, or generate savings or efficiencies. For example, under demonstrations, states have extended coverage to certain populations, provided services not otherwise eligible for federal matching funds, made incentive payments to providers for delivery system improvements. As of November 2016, nearly three-quarters of states have CMS- approved demonstrations. In fiscal year 2015, total spending under demonstrations represented a third of all Medicaid spending nationwide. (See fig. 4.) In addition to other types of improper payments, Medicaid presents opportunities for fraud, because of the size, expenditures, and complexities of the program—including the variation in states’ design and implementation. Medicaid Fraud Control Units (MFCU)—state entities responsible for investigating and prosecuting Medicaid fraud—have reported on Medicaid fraud convictions and recovered monies, in their annual reports. For example, over the past 5 years, MFCUs have reported an average of 1,072 yearly Medicaid fraud convictions. They also reported about $680 million in recoveries related to fraud in fiscal year 2017—almost double the recoveries from fiscal year 2016. Our prior work has identified three broad areas of risk to the fiscal integrity of Medicaid: improper payment rates, state use of supplemental payments, and oversight of demonstration programs. CMS annually computes the national Medicaid improper payment estimate as a weighted average of states’ improper payment estimates for three component parts—fee-for-service, beneficiary eligibility determinations, and managed care. The improper payment estimate for each component is developed under its own methodology. The national rate in fiscal year 2017 was 10.1 percent, or $36.7 billion. Since 2016, Medicaid has exceeded the 10 percent criterion set in statute. As such, the program was not fully compliant with the Improper Payments Elimination and Recovery Act of 2010. In May 2018, we reported that the Medicaid managed care component of the improper payment estimate does not fully account for all program risks in managed care. We identified 10 federal and state audits and investigations (out of 27 focused on Medicaid managed care) that cited about $68 million in overpayments and unallowable managed care organization costs that were not accounted for by the managed care improper payment estimate. Another of these investigations resulted in a $137.5 million settlement to resolve allegations of false claims. We further noted that the full extent of overpayments and unallowable costs is unknown, because the 27 audits and investigations we reviewed were conducted over more than 5 years and involved a small fraction of the more than 270 managed care organizations operating nationwide as of September 2017. Some examples of the state audits that identified overpayments and unallowable costs include the following: The Washington State Auditor’s Office found that two managed care organizations made $17.5 million in overpayments to providers in 2010, which may have increased the state’s 2013 capitation rates. The Texas State Auditor’s Office found that one managed care organization reported $3.8 million in unallowable costs for advertising, company events, gifts, and stock options, along with $34 million in other questionable costs in 2015. The New York State Comptroller found that two managed care organizations paid over $6.6 million to excluded and deceased providers from 2011 through 2014. To the extent that such overpayments and unallowable costs are unidentified and not removed from the cost data used to set managed care payment rates, they may allow inflated future payments and minimize the appearance of program risks in Medicaid managed care. This potential understatement of the program risks in managed care also may curtail investigations into the appropriateness of managed care spending. The continued growth of Medicaid managed care makes ensuring the accuracy of managed care improper payment estimates increasingly important. In May 2018, we acknowledged that although CMS has increased its focus on and worked with states to improve oversight of Medicaid managed care; its efforts—for example, updated regulations and audits of managed care providers—did not ensure the identification and reporting of overpayments and unallowable costs. In May 2016, CMS updated its regulations for managed care programs, including that states arrange an independent audit of the data submitted by MCOs, at least once every 3 years. We found that although this requirement has the potential to enhance state oversight of managed care; CMS was reviewing the rule for possible revision of its requirements. We also noted that another effort to address program risks in managed care—the use of CMS program integrity contractors to audit providers that are paid by managed care organizations—has been limited. To address the program risks that are not measured as a part of CMS’s methodology to estimate improper payments, in May 2018 we recommended that CMS take steps to mitigate such risks, which could include revising its methodology or focusing additional audit resources on managed care. HHS concurred with this recommendation. Our prior work on Medicaid has also identified other program risks associated with provider enrollment and beneficiary eligibility that may contribute to improper payments. In table 1 below, we identify some examples of the previous recommendations we have made to address these types of program risks, and what, if any, steps CMS has taken in response to our recommendations. Supplemental payments are payments made to providers—such as local government hospitals and other providers—that are in addition to the regular, claims-based payments made to providers for services they provided. Like all Medicaid payments, supplemental payments are required to be economical and efficient. Supplemental payments have been growing and totaled more than $48 billion in 2016. Our prior work has identified several concerns related to supplemental payments, including the need for more complete and accurate reporting, criteria for economical and efficient payments, and written guidance on the distribution of payments. Complete and accurate reporting. Our prior work has identified increased use of provider taxes and transfers from local government providers to finance the states’ share of supplemental payments, which, although allowed under federal law, effectively shift Medicaid costs from the states to the federal government. In particular, we previously reported in July 2014 that states’ share of Medicaid supplemental payments financed with funds from providers and local governments increased the federal share from 57 percent in state fiscal year 2008 to 70 percent in state fiscal year 2012. The full extent of this shift in states’ financing structure was unknown, because CMS had not ensured that states report complete and accurate data on the sources of funds they use to finance their share of Medicaid payments, and CMS’s efforts had fallen short of obtaining complete data. (See table 2 below for our recommendation and actions CMS has taken.) For example, in July 2014, we reported that in one state, a $220 million payment increase for nursing facilities resulted in an estimated $110 million increase in federal matching funds to the state, and a net payment increase to the facilities of $105 million. (See fig. 5.) Criteria for economical and efficient payments. Our prior work has demonstrated that CMS lacks the criteria, data, and review processes to ensure that one type of supplemental payments—non-DSH supplemental payments—are economical and efficient. For example, in April 2015, we identified public hospitals in one state that received such supplemental and regular Medicaid payments that, when combined, were hundreds of millions in excess of the hospitals’ total Medicaid costs and tens of millions in excess of their total operating costs—unbeknownst to CMS. Accordingly, we concluded that CMS’s criteria and review processes did not ensure that it can identify excessive payments and determine if supplemental payments are economical and efficient. (See table 2 below for our recommendations and actions CMS has taken.) Written guidance on the distribution of payments. According to CMS policy, Medicaid payments, including supplemental payments, should be linked to the provision of Medicaid services and not contingent on the provision of local funds. However, in February 2016 we reported that CMS did not have written guidance that clarifies this policy. In February 2016, we found examples of hospitals with large uncompensated costs associated with serving the low-income and Medicaid population that received relatively little in supplemental payments, while other hospitals with relatively low uncompensated care costs—but that were able to contribute a large amount of funds for the state’s Medicaid share— received large supplemental payments relative to those costs, raising questions as to whether CMS policies are being followed. (See table 2 for our recommendation and actions CMS has taken.) Recognizing that Congress could help address some of the program risks associated with supplemental payments, in November 2012, we suggested that Congress consider requiring CMS to improve state reporting of supplemental payments, including requiring annual reporting of facility-specific payment amounts; clarify permissible methods for calculating these supplemental payments; and implement annual independent certified audits to verify state compliance with methods for calculating supplemental payments. Subsequent to our work highlighting the need for complete and accurate reporting, in January 2017 a bill was introduced in the House of Representatives that, if enacted, would require annual state reporting of non-DSH supplemental payments made to individual facilities, require CMS to issue guidance to states that identifies permissible methods for calculating non-DSH supplemental payments to providers, and establish requirements for such annual independent audits. Another bill was introduced in October 2017 that would require states to submit annual reports that identify the sources and amount of funds used to finance the state share of Medicaid payments. As of May 2018, no action had been taken on either proposed bill. Demonstration programs, comprising about one-third of total Medicaid expenditures in fiscal year 2015, can be a powerful tool for states and CMS to test new approaches to providing coverage and delivering services that could reduce costs and improve outcomes. However, our prior work has identified several concerns related to demonstrations, including the need for ensuring that (1) demonstrations meet the policy requirements of budget neutrality—that is, they must not increase federal costs—and (2) evaluations are used to determine whether demonstrations are having their intended effects. Budget neutrality of Medicaid demonstrations. Demonstration spending limits, by HHS policy, should not exceed spending that would have occurred in the absence of a demonstration. In multiple reports examining more than a dozen demonstrations between 2002 and 2017, we have identified a number of questionable methods and assumptions that HHS has permitted states to use when estimating costs. We found that federal spending on Medicaid demonstrations could be reduced by billions of dollars if HHS were required to improve the process for reviewing, approving, and making transparent the basis for spending limits approved for Medicaid demonstrations. The following are some examples of what we have previously found: In August 2014, we reported that HHS had approved a spending limit for Arkansas’s demonstration—to test whether providing premium assistance to purchase private coverage through the health insurance exchange would improve access for newly eligible Medicaid beneficiaries—that was based, in part, on hypothetical, not actual, costs. Specifically, the spending limit was based on significantly higher payment amounts the state assumed it would have to make to providers if it expanded coverage under the traditional Medicaid program, and HHS did not request any data to support the state’s assumptions. We estimated that by allowing the state to use hypothetical costs, HHS approved a demonstration spending limit that was over $775 million more than what it would have been if the limit was based on the state’s actual payment rates for services under the traditional Medicaid program. We also reported in August 2014 that HHS officials told us it granted Arkansas and 11 other states additional flexibility in their demonstrations in order to increase spending limits if costs proved higher than expected. We concluded that granting this flexibility to the states to adjust the spending limit increased the fiscal risk to the federal government. More recently, in April 2017, we reported that two states used unspent federal funds from their previous demonstrations to expand the scope of subsequent demonstrations by $8 billion and $600 million, respectively. We concluded that inflating the spending limits in this way inappropriately increased the federal government’s fiscal liability for Medicaid. We have previously made recommendations to improve oversight of spending on demonstrations, and HHS recently took action that partially responds to one of these recommendations. (See table 3 for examples of the recommendations and actions HHS has taken.) Specifically, under a policy implemented in 2016, HHS restricted the amount of unspent funds states can accrue for each year of a demonstration, and has also reduced the amount of unspent funds that states can carry forward to new demonstrations. For 10 demonstrations it has recently approved, HHS estimated that the new policy has reduced total demonstration spending limits by $109 billion for 2016 through 2018, the federal share of which is $62.9 billion. These limits reduce the effect, but do not specifically address all, of the questionable methods and assumptions that we have identified regarding how HHS sets demonstration spending limits. Evaluation of Medicaid demonstrations. In a January 2018 report, we questioned the usefulness of both state-led and federal evaluations of section 1115 demonstrations, particularly with regard to how these evaluation results may inform policy decisions. State-led evaluations. We identified significant limitations among selected state-led demonstration evaluations, including gaps in reported evaluation results for important parts of the demonstrations. (See table 4.) These gaps resulted, in part, from CMS requiring final, comprehensive evaluation reports after the expiration of the demonstrations rather than at the end of each 3- to 5-year demonstration cycle. In October 2017, CMS officials stated that the agency planned to require final reports at the end of each demonstration cycle for all demonstrations, although it had not established written procedures for implementing this new policy. We concluded in January 2018 that without written procedures for implementing such requirements, gaps in oversight could continue. Federal evaluations. Evaluations of federal demonstrations led by CMS have also been limited due to data challenges and a lack of transparent reporting. For example, delays obtaining data directly from states, among other things, led CMS to considerably reduce the scope of a large, multi-state evaluation, which was initiated in 2014 to examine the impact of state demonstrations in four policy areas deemed to be federal priorities. In our January 2018 report, we found that although CMS had made progress in obtaining needed data, CMS had no policy for making the results public. By not making these results public in a timely manner, we concluded that CMS was missing an opportunity to inform important federal and state policy discussions. In light of our concerns about state-led and federal demonstration evaluations, in January 2018, we recommended that CMS (1) establish written procedures for requiring final evaluation reports at the end of each demonstration cycle, (2) issue criteria for when it will allow limited evaluations of demonstrations, and (3) establish a policy for publicly releasing findings from federal evaluations of demonstrations. HHS concurred with these recommendations. Across our body of work, we have made 83 recommendations to CMS and HHS and suggested 4 matters for congressional consideration to address a variety of concerns about the Medicaid program. The agencies generally agreed with our recommendations and have implemented 25 of these recommendations to date, and CMS still needs to take fundamental actions in three areas—having more timely, complete, and reliable data; conducting fraud risk assessments; and strengthening federal-state collaboration—to strengthen Medicaid oversight and better manage program risks. An overarching challenge for CMS oversight of the Medicaid program is the lack of accurate, complete, and timely data. Our work has demonstrated how insufficient data have affected CMS’s ability to ensure proper payments, assess beneficiaries’ access to services, and oversee states’ financing strategies. As part of its efforts to address longstanding data concerns, CMS has taken some steps toward developing a reliable national repository for Medicaid data, most notably the Transformed Medicaid Statistical Information System (T-MSIS). Through T-MSIS, CMS will collect detailed information on Medicaid beneficiaries—such as their citizenship, immigration, and disability status—as well as any expanded diagnosis and procedure codes associated with their treatments. States are to report data more frequently—and in a timelier manner—than they have previously, and T-MSIS includes approximately 2,800 automated quality checks. The T-MSIS initiative has the potential to improve CMS’s ability to identify improper payments, help ensure beneficiaries’ access to services, and improve program transparency, among other benefits. As we reported in December 2017, implementing the T-MSIS initiative has been—and will continue to be—a multi-year effort. CMS has worked closely with states and has reached a point where nearly all states are reporting T-MSIS data. While recognizing the progress made, we noted that more work needs to be done before CMS or states can use these data for program oversight: All states need to report complete T-MSIS data. For our December 2017 report, we reviewed a sample of six states and found that none were reporting complete data. T-MSIS data should be formatted in a manner that allows for state data to be compared nationally. In December 2017, we reported that state officials had expressed concerns that states did not convert their data to the T-MSIS format in the same ways, which could limit cross- state comparisons. In our December 2017 report, we recommended that CMS take steps to expedite the use of T-MSIS data, including efforts to (1) obtain complete information from all states; (2) identify and share information across states to improve data comparability; and (3) implement mechanisms by which states can collaborate on an ongoing basis to improve the completeness, comparability, and utility of T-MSIS data. We also recommended that CMS articulate a specific plan and associated time frames for using T-MSIS data for oversight. The agency concurred with our recommendations, but has not yet implemented them. Our prior work has also noted areas where other data improvements are critical to program oversight: In July 2014, we found that there was a need for data on supplemental payments that states make to individual hospitals and other providers. In particular, our findings and related recommendation from July 2014 indicate that CMS should develop a data collection strategy that ensures that states report accurate and complete data on all sources of funds used to finance the states’ share of Medicaid payments. In January 2017, we found limitations in the data CMS collects to monitor the provision of, and spending on, personal care services— services that are at a high risk for improper payments, including fraud. In particular, data on the provision of personal care services were often not timely, complete, or consistent. Data on states’ spending on these services were also not accurate or complete. In January 2017, we recommended that CMS improve personal care services data by (1) establishing standard reporting guidance for key data, (2) ensuring linkage between data on the provision of services and reported expenditures, (3) ensuring state compliance with reporting requirements, and (4) developing plans to use data for oversight. The agency concurred with two recommendations and neither agreed nor disagreed with the other two recommendations, and has not yet implemented any. In December 2017, we examined CMS’s efforts managing fraud risks in Medicaid and compared it with our Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. This framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt. (See fig. 6.) The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires the Office of Management and Budget (OMB) to establish guidelines incorporating the leading practices from our Fraud Risk Framework for federal agencies to create controls to identify and assess fraud risks, and design and implement antifraud control activities. In July 2016, OMB published guidance, and among other things, this guidance affirms that managers should adhere to the leading practices identified in our Fraud Risk Framework. In a December 2017 report, we found that CMS’s efforts partially aligned with our fraud risk framework. In particular, CMS had shown a commitment to combating fraud, in part, by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts, and offering and requiring antifraud training for stakeholder groups, such as providers, beneficiaries, and health-insurance plans; and taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, CMS had not conducted a fraud risk assessment for Medicaid, and had not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as design and implement an appropriate evaluation. We concluded that through these actions, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicaid. As a result, in December 2017 we made three recommendations to CMS, two of which were to conduct fraud risk assessments, and create an antifraud strategy for Medicaid, including an approach for evaluation. HHS concurred with our recommendations, but has not yet implemented them. The federal government and the states play important roles in reducing improper payments and overseeing the Medicaid program, including overseeing spending on Medicaid supplemental payments and demonstrations. Our prior work shows that oversight of the Medicaid program could be further improved through leveraging and coordinating program integrity efforts with state agencies, state auditors, and other partners. Collaborative audits with state agencies. As we have previously reported, CMS has made changes to its Medicaid program integrity efforts, including a shift to collaborative audits—in which CMS’s contractors and states work in partnership to audit Medicaid providers. In March 2017, we reported that collaborative audits had identified substantial potential overpayments to providers, but barriers—such as staff burden or problems communicating with contractors—had limited their use and prevented states from seeking audits or hindered the success of audits. We recommended that CMS address the barriers that limit state participation in collaborative audits, including their use in managed care delivery systems. CMS concurred with this recommendation and has taken steps to address them for a number of states, but has not yet made such changes accessible to a majority of states. State auditors and federal partners. We have found that state auditors and the HHS-OIG offer additional oversight and information that can help identify program risks. To that end, we routinely coordinate our audit efforts with the state auditors and the HHS-OIG. For example, we have convened and facilitated meetings between CMS and state audit officials to discuss specific areas of concern in Medicaid and future opportunities for collaboration. The state auditors and CMS officials commented on the benefits of such coordination, with the state auditors noting that they can assist CMS’s state program integrity reviews by identifying program risks. State auditors also have conducted program integrity reviews to identify improper payments and deficiencies in the processes used to identify them. We believe that these reviews could provide insights into program weaknesses that CMS could learn from and potentially address nationally. Coordination also provides an opportunity for state auditors to learn methods for conducting program integrity reviews. The following are recent examples of reviews conducted: In 2017, the Oregon Secretary of State Audits Division found approximately 31,300 questionable payments to Coordinated Care Organizations (which receive capitated monthly payments for beneficiaries, similar to managed care organizations), based on a review of 15 months of data. In addition, the state auditor found that approximately 47,600 individuals enrolled in Oregon’s Medicaid program were ineligible, equating to $88 million in avoidable expenditures. Massachusetts’ Medicaid Audit Unit’s recent annual report (covering the time period from March 15, 2017, through March 14, 2018) reported that the state auditor identified more than $211 million in unallowable, questionable, duplicative, unauthorized, or potentially fraudulent billing in the program. A 2017 report released by the Louisiana Legislative Auditor’s Office stated that the office reviewed Medicaid eligibility files and claims data covering January 2011 through October 2016, and found $1.4 million in questionable duplicate payments. In fiscal year 2017, the Mississippi Division of Medicaid reported that they recovered more than $8.6 million through various audits of medical claims paid to health care providers. The division also referred seven cases to the state’s attorney general’s office, in which the division had identified $3.1 million in improper billing. At a May 2018 federal and state auditor coordination meeting that we participated in, the HHS-OIG provided examples of the financial impact of its work related to improper payments, including one review of managed care long term services and supports that identified $717 million potential federal savings, three reviews of managed care payments made after beneficiaries’ death that identified $18.2 million in federal funds to be recovered, and two reviews of managed care payments made for beneficiaries with multiple Medicaid IDs that identified $4.3 million in federal funds to be recovered. Healthcare Fraud Prevention Partnership. The Healthcare Fraud Prevention Partnership (HFPP) is an important tool to help combat Medicaid fraud. In 2012, CMS created the HFPP to share information with public and private stakeholders, and to conduct studies related to health care fraud, waste, and abuse. According to CMS, as of October 2017, the HFPP included 89 public and private partners—including Medicare—and Medicaid-related federal and state agencies, law enforcement agencies, private health insurance plans, and antifraud and other health care organizations. The HFPP has conducted studies that pool and analyze multiple payers’ claims data to identify providers with patterns of suspect billing across private health insurance plans. In August 2017, we reported that the partnership participants separately told us the HFPP’s studies helped them identify and take action against potentially fraudulent providers and payment vulnerabilities of which they might not otherwise have been aware, and fostered both formal and informal information sharing. Chairman Johnson, Ranking Member McCaskill, and Members of the Committee, this concludes my prepared statement. I would be pleased to respond to any questions you may have. If you or your staff members have any questions concerning this testimony, please contact Carolyn L. Yocom, who may be reached at 202-512-7114 or yocomc@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals who made key contributions to this testimony include Leslie V. Gordon (Assistant Director), Deirdre Gleeson Brown (Analyst-in-Charge), Muriel Brown, Helen Desaulniers, Melissa Duong, Julianne Flowers, Sandra George, Giselle C. Hicks, Drew Long, Perry Parsons, Russell Voth, and Jennifer Whitworth. Improper Payments: Actions and Guidance Could Help Address Issues and Inconsistencies in Estimation Processes. GAO-18-377. Washington, D.C.: May 31, 2018. Medicaid: CMS Should Take Steps to Mitigate Program Risks in Managed Care. GAO-18-291. Washington, D.C.: May 7, 2018. Medicaid: Opportunities for Improving Program Oversight. GAO-18-444T. Washington, D.C.: April 12, 2018. Medicaid Demonstrations: Evaluations Yielded Limited Results, Underscoring Need for Changes to Federal Policies and Procedures. GAO-18-220. Washington, D.C.: January 19, 2018. Medicaid: Further Action Needed to Expedite Use of National Data for Program Oversight. GAO-18-70. Washington, D.C.: December 8, 2017. Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework. GAO-18-88. Washington, D.C.: December 5, 2017. Improper Payments: Additional Guidance Could Provide More Consistent Compliance Determinations and Reporting by Inspectors General. GAO-17-484. Washington, D.C.: May 31, 2017. Medicaid Demonstrations: Federal Action Needed to Improve Oversight of Spending. GAO-17-312. Washington, D.C.: April 3, 2017. Medicaid Program Integrity: CMS Should Build on Current Oversight Efforts by Further Enhancing Collaboration with States. GAO-17-277. Washington, D.C.: March 15, 2017. High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017. Medicaid: CMS Needs Better Data to Monitor the Provision of and Spending on Personal Care Services. GAO-17-169. Washington, D.C.: January 12, 2017. Medicaid: Program Oversight Hampered by Data Challenges, Underscoring Need for Continued Improvement. GAO-17-173. Washington, D.C.: January 6, 2017. Improper Payments: Strategy and Additional Actions Needed to Help Ensure Agencies Use the Do Not Pay Working System as Intended. GAO-17-15. Washington, D.C.: October 14, 2016. Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers. GAO-16-402. Washington, D.C.: April 22, 2016. Medicaid: Federal Guidance Needed to Address Concerns About Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: February 5, 2016. Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C.: October 16, 2015. Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. GAO-15-481. Washington, D.C.: May 29, 2015. Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 2015. Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015. Medicaid Demonstrations: HHS’s Approval Process for Arkansas’s Medicaid Expansion Waiver Raises Cost Concerns. GAO-14-689R. Washington, D.C.: August 8, 2014. Medicaid Financing: States’ Increased Reliance on Funds from Health Care Providers and Local Governments Warrants Improved CMS Data Collection. GAO-14-627. Washington, D.C.: July 29, 2014. Medicaid Demonstration Waivers: Approval Process Raises Cost Concerns and Lacks Transparency. GAO-13-384. Washington, D.C.: June 25, 2013. Medicaid: More Transparency of and Accountability for Supplemental Payments Are Needed. GAO-13-48. Washington, D.C.: November 26, 2012. Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.: January 31, 2008. Medicaid and SCHIP: Recent HHS Approvals of Demonstration Waiver Projects Raise Concerns. GAO-02-817. Washington, D.C.: July 12, 2002. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Medicaid, a joint federal-state health care program overseen by CMS, is a significant component of federal and state budgets, with total estimated expenditures of $596 billion in fiscal year 2017. Medicaid allows significant flexibility for states to design and implement program innovations based on their unique needs. The resulting diversity of the program and its size, make the program particularly challenging to oversee at the federal level and also vulnerable to improper payments. In fiscal year 2017, estimated improper payments were $36.7 billion in Medicaid, up from $29.1 billion in fiscal year 2015. Further, the Medicaid program accounted for about 26 percent of the fiscal year 2017 government-wide improper payment estimate. This testimony focuses on the (1) major risks to the integrity of the Medicaid program, and (2) actions needed to manage these risks. This testimony draws on GAO's reports issued between November 2012 and May 2018 on the Medicaid program. GAO's work has identified three broad areas of risk in Medicaid that also contribute to overall growth in program spending, projected to exceed $900 billion in fiscal year 2025. 1) Improper payments , including payments made for services not actually provided. Regarding managed care payments, which were nearly half (or $280 billion) of Medicaid spending in fiscal year 2017, GAO has found that the full extent of program risk due to overpayments and unallowable costs is unknown. 2) Supplemental payments , which are payments made to providers—such as local government hospitals—that are in addition to regular, claims-based payments made to providers for specific services. These payments totaled more than $48 billion in fiscal year 2016 and in some cases have shifted expenditures from the states to the federal government. 3) Demonstrations , which allow states to test new approaches to coverage. Comprising about one-third of total Medicaid expenditures in fiscal year 2015, GAO has found that demonstrations have increased federal costs without providing results that can be used to inform policy decisions. GAO's work has recommended numerous actions to strengthen oversight and manage program risks. Improve data. The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, needs to make sustained efforts to ensure Medicaid data are timely, complete, and comparable from all states, and useful for program oversight. Data are also needed for oversight of supplemental payments and ensuring that demonstrations are meeting their stated goals. Target fraud. CMS needs to conduct a fraud risk assessment for Medicaid, and design and implement a risk-based antifraud strategy for the program. Collaborate. There is a need for a collaborative approach to Medicaid oversight. State auditors have conducted evaluations that identified significant improper payments and outlined deficiencies in Medicaid processes that require resolution. As a part of this body of work, GAO has made 83 recommendations to address shortcomings in Medicaid oversight and suggested four matters for congressional consideration. The Department of Health and Human Services and CMS have generally agreed with these recommendations and have implemented 25 of them. GAO will continue to monitor implementation of the remaining recommendations.