Federal and state Medicaid spending on long-term care continues to increase; for example it increased from $146 billion in 2013 to $158 billion in 2015. Individuals seeking long-term care generally need care that is, by definition, longer term in nature and more costly than other types of care. Spending on long-term care services provided in home and community settings, including assisted living facilities, exceeds the amount spent on institutional settings such as nursing homes. State Medicaid programs may cover certain medical and non-medical services that assisted living facilities provide; however, the Medicaid statute does not provide for coverage of room and board charges of an assisted living facility. In their federal-state partnership, both CMS and states play important roles in the oversight of Medicaid. CMS is responsible for oversight of state Medicaid programs. To conduct this oversight, CMS issues program requirements in the form of regulations and guidance, approves changes states make to their programs, provides technical assistance to states, collects and reviews required information and data from states and, in some cases, reviews individual state programs. States are responsible for the day-to-day administration of their Medicaid programs, including monitoring and oversight of the different HCBS programs through which they cover assisted living services, within broad federal rules and requirements. Each state is required to identify and designate a single state agency to administer or supervise the administration of its Medicaid program. The state Medicaid agency may partially or fully delegate the administration and oversight of the state’s HCBS programs to another state agency or other entity, such as a state unit on aging, a mental health department, or other state departments or agencies with jurisdiction over a specific population or service. However, the state Medicaid agency is ultimately accountable to the federal government for compliance with the HCBS requirements. Under different authorizing provisions of federal law, states have considerable flexibility to establish multiple HCBS programs including those covering assisted living services. A state Medicaid program can have multiple HCBS programs operating under different federal authorities. CMS is responsible for ensuring that states meet the requirements associated with their HCBS programs under these different authorities. Key to states’ monitoring of the health and welfare of Medicaid beneficiaries is their tracking of, and response to, incidents that may cause harm to a beneficiary’s health or welfare, such as abuse, neglect, or exploitation—commonly referred to as critical incidents. Such monitoring is required for most HCBS programs; however, we previously found that requirements for states related to oversight of the health and welfare of beneficiaries in different types of HCBS programs varied, and recommended that CMS take steps to harmonize those requirements across programs. The most common HCBS programs with the most stringent federal requirements are HCBS waiver programs. These programs serve beneficiaries who are eligible for an institutional level of care; that is, beneficiaries must have needs that rise to the level of care usually provided in a nursing facility, hospital, or other institution. CMS oversees states’ HCBS waiver programs specifically by reviewing and approving applications and reviewing HCBS program reports that states submit. HCBS waiver program applications include specific requirements implementing various statutory and regulatory provisions. (See text box below.) One requirement is that states have the necessary safeguards in place to protect the health and welfare of beneficiaries receiving services covered by HCBS waiver programs. For each of their HCBS waiver programs, states must demonstrate to CMS that they are meeting various requirements CMS has established regarding beneficiary health and welfare. The Six Requirements States Must Demonstrate for Home- and Community-Based Services Waiver Programs 1. Administrative authority: The Medicaid agency retains ultimate administrative authority and responsibility for the operation of the waiver program by exercising oversight of the performance of waiver functions by other state and local/regional non-state agencies (if appropriate) and contracted entities. 2. Level of care: The state demonstrates that it implements the processes and instrument(s) specified in its approved waiver for evaluating/re-evaluating an applicant’s/waiver participant’s level of care consistent with care provided in a hospital, nursing facility, or intermediate care facility. 3. Qualified providers: The state demonstrates that it has designed and implemented an adequate system for assuring that all waiver services are provided by qualified providers. 4. Service plan: The state demonstrates it has designed and implemented an effective system for reviewing the adequacy of service plans for the waiver participants. 5. Health and welfare: The state demonstrates it has designed and implemented an effective system for assuring waiver participant health and welfare. 6. Financial accountability: The state must demonstrate that it has designed and implemented an adequate system for insuring financial accountability of the waiver program. CMS also provides ongoing oversight of state HCBS programs through annual reports that states must submit for each of their HCBS waiver programs as well as renewal reports submitted about two years before an HCBS waiver is scheduled to end. The state reports are intended to provide CMS with information on the operation of state HCBS waiver programs. In contrast to long-term care services provided in nursing facilities, less is known at the federal level about the oversight and quality of care in assisted living facilities. Generally, states establish their own licensing and oversight requirements for assisted living facilities. As a result, the requirements for assisted living facilities and the type and frequency of oversight can vary across states. In contrast, nursing homes must meet a comprehensive set of federal requirements in order to receive payment for long-term care services for Medicaid and Medicare beneficiaries in addition to state requirements. CMS contracts with state entities to regularly inspect nursing facilities and investigate complaints to assess whether nursing homes meet these federal quality requirements. Annually CMS publishes a comprehensive report on nursing homes that serve Medicaid and Medicare beneficiaries, including the extent that beneficiaries are at risk for harm, based on these investigations and inspections. In addition, CMS publicly reports a summary of each nursing home’s quality data using a five-star quality rating based on health inspection results, staffing data, and quality measure data. The goal of this rating system is to help consumers make meaningful distinctions among high- and low-performing nursing homes. This type of standardized framework for oversight, investigation and inspections, and reporting on quality of care concerns does not exist for assisted living facilities and other types of HCBS providers. Forty-eight state Medicaid agencies reported collectively spending about $10 billion in state and federal Medicaid funds for assisted living services in 2014, according to our survey. The other 3 states reported that they did not pay for assisted living services. We estimate that this spending for services provided by assisted living facilities represents 12.4 percent of the $80.6 billion Medicaid spent on HCBS in all settings that year. More than 330,000 Medicaid beneficiaries received assisted living services, based on data reported to us by the 48 states. Nationally, the average spending per beneficiary on assisted living services in the 48 states in 2014 was about $30,000; states provided these HCBS services through fee-for-service and managed care delivery models. Fee-for-service spending comprised 81 percent of total spending on assisted living services and managed care spending was about 19 percent of the total. The cost per beneficiary reported by surveyed states also varied based on payment type; average per beneficiary cost was $31,000 for fee-for-service and $27,000 for managed care. About 21 percent of Medicaid assisted living enrollment was for beneficiaries receiving these services under a managed care delivery model. (See table 1.) Average per-beneficiary spending varied significantly across the states. For example, for the nine states with the lowest spending per beneficiary, average Medicaid spending ranged from about $1,700 to about $9,500 per beneficiary. In contrast, in the nine states with the highest per- beneficiary spending, the average spending ranged from about $43,000 to $108,000 per beneficiary. (See Figure 1.) For more information on each state’s enrollment, total spending, and average per beneficiary spending on assisted living services, see appendix I. The 48 states that reported covering assisted living services in 2014 said they did so through 132 different programs. The majority of the states, 31 of the 48, reported administering more than one program that covered assisted living services. As illustrated in table 2 below, of the different types of HCBS programs under which states can provide coverage for assisted living services, HCBS waivers were the most common type of program they used. Specifically, 39 states and 69 percent of the programs that provided assisted living services, were operated under the HCBS waiver program. (See appendix II for additional details on each state’s number of programs by program type and total number of HCBS programs that covered assisted living facility services in 2014.) Almost all of the 48 states that covered assisted living services did so for two groups of Medicaid beneficiaries eligible through their programs. In 45 of 48 states, aged beneficiaries received services provided by assisted living facilities. Similarly, in 43 of 48 states, physically disabled beneficiaries received services. (See Figure 2.) In 38 or more of the 48 states that covered assisted living services, six types of services were provided. For example, 45 states covered assistance with activities of daily living, such as bathing and dressing; 44 states covered medication administration; and 41 states covered coordination of meals. (See Figure 3.) State Medicaid agency approaches for oversight of assisted living services varied widely in terms of who provided the oversight for their largest programs, according to their responses to our survey. Thirteen of the 48 state Medicaid agencies reported delegating administrative responsibilities, including oversight of beneficiary health and welfare, to other state or local agencies. State Medicaid agencies may delegate the administration of programs to government or other agencies through a written agreement; however, state Medicaid agencies retain the ultimate oversight responsibility for those delegated functions. For example, among the 13 states that delegated HCBS program administration, the administering agencies were those that provided services to the aged, disabled, or both of these populations, such as the states’ Departments of Aging. (See text box, below, for examples of states’ delegation.) Examples of State Medicaid Agencies’ Delegation of Authority for Administration of Home- and Community-based Services’ Programs Covering Assisted Living Services Georgia’s Elderly & Disabled Waiver Program was operated in 2014 by the Georgia Department of Human Services Division of Aging Services, a separate agency of the state that was not a division/unit of the Medicaid agency. The Georgia Medicaid Agency maintained a formal interagency agreement with the Division of Aging Services which describes by function the required deliverables to support compliance and a schedule for delivery of reports. Nebraska’s Waiver for Aged and Adults and Children with Disabilities is operated by the state Medicaid agency Division of Medicaid and Long Term Care. The majority of services are provided by independent contractors in order to allow service delivery in the rural and frontier areas of the state. The state Medicaid agency contracts with the Area Agencies on Aging, Independent Living Centers, and Early Development Network agencies to perform a variety of operational and administrative functions including authorizing services and monitoring the delivery of services. States also varied in the types of information they reported reviewing as part of the oversight of assisted living services, and the extent to which state Medicaid agencies review the information when another agency is responsible for administration. For example, other entities outside the state Medicaid agency—such as the agency delegated to administer an HCBS program, or a contractor that manages provider enrollment—may check to ensure a provider is allowed to deliver services to Medicaid beneficiaries; in such cases, however, the state Medicaid agency might not be aware of the results of such checks. As illustrated in table 3, in all 48 states the types of information generally reviewed by either the state Medicaid agency, the agency delegated administrative responsibilities, or other agencies were: critical incident reports, the HHS Office of Inspector General’s list of excluded providers, patient service plans, and information on concerns about care received directly from patients, relatives, caregivers or the assisted living facility itself. In many cases, the state Medicaid agency did not review all information sources reviewed by other agencies. For example, although all critical incident reports were reviewed in the 48 states by either the state Medicaid agency, the agency delegated administrative responsibilities, or another agency; in 16 of those states, the state Medicaid agency was not involved in those reviews, according to responses to our survey. Instead, the critical incident reports were reviewed by another entity designated responsible for the HCBS program in the state or another state entity with regulatory responsibility over the assisted living facility. Such reviews, including any critical incidents found, may not have been communicated back to the state Medicaid agency, according to responses to our survey. State Medicaid agencies also varied in reporting the extent to which they were made aware or notified when enforcement actions were taken as a result of concerns with beneficiary care identified by other entities. Various oversight actions may be taken by the state Medicaid agency, the agency delegated to administer an HCBS program, or a state regulatory agency, such as a state agency responsible for licensing and inspecting various types of HCBS providers. When delegated agencies or other licensing agencies take corrective action, the state Medicaid agency may not be aware unless notified by the agencies taking that action. For example, in 23 states, the investigation of potential incidents related to beneficiary health and welfare was delegated to another agency but in only 6 of these states was the state Medicaid agency always notified of such an investigation based on our survey. (See table 4 and text box below.) Example of a Collaborative Approach to Monitoring and Ensuring Quality Care Specifically for Assisted Living Facilities In 2009, the Wisconsin Coalition for Collaborative Excellence in Assisted Living was formed to redesign the way quality is ensured and improved for individuals residing in assisted living communities. This public/private coalition utilizes a collective impact model approach that brings together the state, the industry, the consumer, and academia to identify and implement agreed upon approaches designed to improve the outcomes of individuals living in Wisconsin assisted living communities. The core of the coalition is the implementation of an association developed, department approved, comprehensive quality assurance, quality improvement program. For their largest HCBS programs that covered assisted living services, the 48 states varied in how they monitored “critical incidents” that caused actual or potential harm to Medicaid beneficiaries in assisted living facilities. Specifically, the 48 states varied in their ability to report the number of critical incidents; how they defined incidents, and the extent to which they made information on such incidents readily available to the public. These states varied in whether they could provide us the number of critical incidents involving beneficiaries for their largest programs covering assisted living services, and for those that could report, the number of incidents they reported varied widely. In 26 of the 48 states the Medicaid agencies were unable to report, for their largest program covering assisted living services, the number of critical incidents that had occurred in assisted living facilities in 2014. The remaining 22 states reported a total of 22,921 critical incidents involving Medicaid beneficiaries in their largest programs covering assisted living services. The number of critical incidents reported in these states ranged from 1 to 8,900. For six of these states the number of critical incidents reported was more than 1,000, (See text box, below, for examples of selected state processes managing critical incidents.) Selected States’ Processes for Managing Beneficiary Harm or Potential Harm in Assisted Living Facilities Georgia: According to state officials in 2014 there was no centralized or comprehensive system for capturing and tracking the data on actual and potential violations. State officials acknowledged the lack of a centralized system prevents the Division of Community Health from tracking the status of each problem. Nebraska: According to state officials, Nebraska’s Adult Protective Services operates an electronic system that coordinates across state social service programs. When Adult Protective Services initiates an investigation of reported harm to an assisted living resident, the state Medicaid agency is automatically notified. Reasons state Medicaid agencies reported for being unable to provide us with the number of critical incidents included limitations in the data or data systems for tracking them. Nine states reported an inability to track incidents by provider type, and thus distinguish critical incidents in assisted living facilities from other providers of home and community based services. States also cited lacking a system to collect critical incidents (9 states), and that the system for reporting could not identify whether a resident was a Medicaid beneficiary (5 states). Even in the 32 states where the state Medicaid agencies reported reviewing information about critical incidents, 20 states were unable to provide the actual number of critical incidents that occurred in assisted living facilities. State Medicaid agencies’ definitions of critical incidents also varied. As illustrated in Figure 4, all 48 states cited physical assault, emotional abuse, and sexual assault or abuse as a critical incident in their largest programs providing assisted living services in 2014. However, for other types of incidents, several states did not identify the incident as critical, including discharge and eviction from the facility (not a critical incident in 24 states), medication errors (not a critical incident in 7 states), and unauthorized use of seclusion, (not a critical incident in 6 states). For other serious incidents, a relatively small number of states did not identify the incident as critical, such as unexplained death (not a critical incident in 3 states) and missing beneficiaries (not a critical incident in 2 states). See appendix IV for a full list of the beneficiary-related incidents and the number of states that identify each as critical. Although half of the 48 states that cover assisted living services did not consider discharges or evictions to be critical incidents, according to state responses to our survey, 42 states offered certain protections related to involuntary discharge of Medicaid residents who live in assisted living facilities. The majority of protections consisted of a lease agreement requirement that applied to other housing contracts in the state, such as providing residents with eviction notices. Other protections included an appeals process (10 states) and a requirement for the facility to find an alternative location for the resident (10 states). State Medicaid agencies also varied in whether they made information on critical incidents and other key information readily available to the public. (See table 5.) Beneficiaries seeking care in an assisted living facility may want to know the number of critical incidents related to a particular facility. Through our survey we found that states differed in the availability of information related to health and welfare that was available to the public. For example, 34 of the 48 states reported that they made critical incident information available to the public by phone, website, or in person, and the remaining 14 states did not have such information available at all. Although all 48 states had information in some form on which assisted facilities accepted Medicaid beneficiaries, 8 states could not provide this information by phone and 22 states could not provide the information in person. In recent years, CMS has taken steps to improve oversight of beneficiary health and welfare in HCBS programs by adding new HCBS waiver application requirements for state monitoring of beneficiary health and welfare. CMS requires state waiver applications to include specific requirements that implement various statutory and regulatory provisions, including a provision that states assure that they will safeguard the health and welfare of Medicaid beneficiaries. In March 2014, CMS added unexplained death to the events that states must be able to identify and address on an ongoing basis, as part of their efforts to prevent instances of abuse, neglect, and exploitation, and added four new requirements for states to protect beneficiary health and welfare. (See table 6.) In its guidance implementing the 2014 requirements, CMS noted that state associations and state representatives’ work groups had agreed that “health and welfare is one of the most important assurances to track, and requires more extensive tracking to benefit the individuals receiving services, for instance by using data to prevent future incidents.” As a condition for approval of their HCBS waiver applications for each of the requirements, states must identify and agree with CMS on the type of information they will collect to provide as evidence that they will meet the requirements. However, according to CMS officials, each state Medicaid agency has wide discretion over the information it will collect and report to demonstrate that it is meeting the health and welfare requirements and protecting beneficiaries. Although CMS added the additional requirements in 2014 for safeguarding beneficiary health and welfare, the agency generally did not change requirements for how it oversees state monitoring efforts once HCBS waivers are approved. We found a number of limitations in CMS’s oversight of approved HCBS waivers that undermine the agency’s ability to effectively monitor state oversight of HCBS waivers. These limitations include: unclear guidance on what states should identify and report annually related to any identified program deficiencies; lack of requirements on states to regularly provide CMS information on critical incidents; and CMS’s inconsistent enforcement of the requirement that states submit annual reports. Unclear guidance on what states should identify and report annually related to any identified program deficiencies. Federal law requires states to provide CMS with information annually on an HCBS waiver’s impact on (1) the type and amount, and cost of services provided and (2) the health and welfare of Medicaid beneficiaries receiving waiver services. CMS reporting requirements give states latitude to determine what to report as health and welfare deficiencies found through state monitoring of their HCBS programs. With respect to health and welfare, CMS’s State Medicaid Manual directs states when preparing their annual reports to “check the appropriate boxes regarding the impact of the waiver on the health and welfare” of beneficiaries and to describe relevant information. States are required to provide a brief description of the state process for monitoring beneficiary safeguards, use check boxes to indicate that beneficiary health and welfare safeguards have been met, and identify whether deficiencies were detected during the monitoring process. If states determine that deficiencies were identified through monitoring, states are required to “provide a summary of the significant areas where deficiencies were detected” and an explanation of the actions taken to address deficiencies and ensure the deficiencies do not recur. CMS’s written instructions for completing the HCBS annual report do not provide further guidance regarding reporting of deficiencies. For example, the reporting instructions do not describe or identify 1) what states are supposed to report as deficiencies, 2) how they are to identify which deficiencies are most significant, and 3) the extent to which states need to explain the steps taken to ensure that deficiencies do not recur. The lack of clarity is inconsistent with federal internal control standards, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk. Without clear instructions as to what states must report, states’ annual reports may not identify deficiencies with states’ HCBS waiver programs that may affect the health and welfare of beneficiaries. States may determine that issues or problems they identified through monitoring do not represent reportable deficiencies and therefore may not report those deficiencies to CMS, increasing the risk that problems are not elevated to CMS’s attention. In the case of one of the selected states we reviewed, no problems were included on the annual reports submitted to CMS between 2011 and 2015. However, when CMS completed its review in the fourth year of the state’s waiver— for purpose of renewing the waiver—it determined the state was not assuring beneficiary health and welfare. CMS found that the information the state submitted for purpose of renewal suggested a “pervasive failure” by the state to assure the health and welfare of beneficiaries receiving services, including assisted living services. In particular, CMS noted the state provided insufficient information regarding the number of unexpected or suspicious beneficiary deaths. CMS concluded that the state failed to demonstrate that it has effective systems and processes for ensuring the health and welfare of beneficiaries. Lack of requirements on states to annually provide CMS information on critical incidents. Despite the importance of state critical incident management and reporting systems to protecting the health and welfare of beneficiaries, CMS lacks written requirements that states provide information needed for the agency oversight of state monitoring of critical incidents. According to CMS, a critical element of effective state oversight is the operation of data systems that support the identification of trends and patterns in the occurrence of critical incidents to identify needed improvements. Such a system is also consistent with federal internal controls standards which specify, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk. CMS requires states to operate a critical incident reporting system. On their waiver applications states must check a box indicating they operate a system and also describe their system—including who must report and when, and what must be reported. Despite this requirement for states to have critical incident reporting systems, CMS does not require states to report to CMS any data from these systems on critical incidents as part of their required annual reports. Specifically, states are not required to include, in their annual reports, the number of critical incidents reported or substantiated that involve Medicaid beneficiaries. As a result, CMS does not have a method to confirm what states describe about critical incident management systems, which is a required component of states’ waiver applications or to assess the capabilities of states’ systems. For example, CMS cannot confirm whether the state systems can report incidents by location or type of residential provider, such as assisted living facilities; the type and severity of critical incidents that occurred; and the number of incidents that involved Medicaid beneficiaries. Without annual critical incident reporting, CMS may be at risk of (1) not having adequate evidence that states are meeting CMS requirements to have an effective critical incident management and reporting system and of (2) being unaware of problems with states’ abilities to identify, track, and address critical incidents involving Medicaid beneficiaries. Our prior work has shown that the lack of explicit reporting requirements on critical incidents not only impacts HCBS waiver programs but also impacts other types of Medicaid long-term services programs as well. Specifically, In a November 2016 report, we found that CMS requirements for states to report on their critical incident monitoring systems for the HCBS waiver program were more stringent than those for other types of HCBS programs, potentially leaving those other programs at even greater risk. We recommended that CMS take steps to harmonize requirements across different types of HCBS programs. HHS concurred with the recommendation stating it would seek input from states, stakeholders, and the public regarding harmonizing requirements across programs. In an August 2017 report we found similar issues in critical incident reporting requirements for other types of long term services programs, particularly those used to provide HCBS and other long term services under managed care. We found that CMS was not always requiring states that contracted with managed care organizations to provide long term services and supports to report to CMS sufficient information on critical incidents and other key areas needed to monitor beneficiary access and quality. We recommended that CMS take steps to identify and obtain key information needed to better oversee states’ efforts to monitor beneficiary access to quality services in their managed long-term services and supports programs. HHS concurred with this recommendation and stated that the agency would take this recommendation into account as part of an ongoing review of its 2016 Medicaid managed care rule. We continue to believe that the implementation of our prior recommendations is needed to help improve CMS oversight of states monitoring of beneficiary safety. CMS’s inconsistent enforcement of the requirement that states submit annual reports. States must prepare and submit an annual report for each HCBS waiver as a condition of waiver approval. According to CMS guidance, the agency’s review of the annual report is part of the ongoing oversight of HCBS waiver programs and not submitting an annual report jeopardizes the states renewal of HCBS waiver programs. However, some states have not been timely in submitting the required annual reports for their HCBS waivers. A review of 2013 HCBS annual reports by a CMS contractor, published in 2016, found that annual reports were missing for 29 HCBS waivers and multiple years’ of annual reports were missing for 8 waivers. In 2014, CMS adopted new strategies to ensure compliance with HCBS waiver requirements, including the requirement that states submit annual reports on a timely basis. These strategies include withholding federal funding, placing a moratorium on enrollment in the waiver, or other actions the agency determines necessary. CMS officials reported that the agency had not used these new strategies with states that were delinquent in submitting their annual reports. Officials said they were in the process of reviewing how to implement these new strategies in the case of one state; however, as of August 2017 officials had not finalized a decision. CMS’s ability to provide effective oversight of state programs and protect beneficiary health and welfare is undermined by the lack of enforcement and receipt of required annual waiver reports. Effective state and federal oversight is necessary to ensure that the health and welfare of Medicaid beneficiaries receiving assisted living services are protected, especially given the particular vulnerability of many of these beneficiaries to abuse, neglect, or exploitation. CMS has taken steps to strengthen beneficiary health and welfare protections in states’ HCBS waiver programs, the most common type of program that covers assisted living services and one that serves the most vulnerable beneficiaries. In particular, CMS now has multiple requirements for states to safeguard beneficiaries’ health and welfare, including requirements to operate an effective critical incident management and reporting system to identify, investigate, and address incidents of beneficiary abuse, neglect, exploitation, and unexplained death. However, CMS’s ability to effectively monitor how well states are assuring beneficiary health and welfare is limited by gaps in state reporting to CMS. CMS has not provided clear guidance to states on what information to include in annual reports on deficiencies they identify. As a result, CMS lacks assurance that it is receiving consistent, complete, and relevant information on deficiencies that is needed to oversee beneficiary health and welfare. Lacking clear guidance on the reporting of deficiencies may result in a delayed recognition of problems that may affect beneficiary health and welfare. Further, for years, states have been required to check a box attesting that they operate a critical incident management system, but have not always been required to report information on incidents of potential or actual harm to beneficiaries. Given the increasing prevalence of assisted living facilities as a provider of services to Medicaid beneficiaries, it is unclear why more than half of states responding to our survey could not provide us information on the number of critical incidents that occurred in these facilities in their states. Reporting data from their critical incident systems, such as the number of incidents, the type and severity of the incidents, or the location or type of facility in which the incident occurred would provide evidence that an effective system is in place, provide information on the extent beneficiaries are subject to actual or potential harm, and allow for tracking trends over time. Finally, CMS has not ensured that all states submit annual reports on their HCBS waiver programs as required. Without improvements to state reporting, CMS cannot ensure states are meeting their commitments to protect the health and welfare of Medicaid beneficiaries receiving assisted living services, potentially jeopardizing their care. We are making the following three recommendations to CMS: The Administrator of CMS should provide guidance and clarify requirements regarding the monitoring and reporting of deficiencies that states using HCBS waivers are required to report on their annual reports. (Recommendation 1) The Administrator of CMS should establish standard Medicaid reporting requirements for all states to annually report key information on critical incidents, considering, at a minimum, the type of critical incidents involving Medicaid beneficiaries, and the type of residential facilities, including assisted living facilities, where critical incidents occurred. (Recommendation 2) The Administrator of CMS should ensure that all states submit annual reports for HCBS waivers on time as required. (Recommendation 3) We provided a draft of this report to HHS for review and comment. HHS provided written comments, which are reproduced in Appendix V. The department also provided technical comments, which we incorporated as appropriate. In its written comments, the department concurred with two of our three recommendations, specifically, that CMS will clarify requirements for state reporting of program deficiencies and ensure that all states submit required annual reports on time. HHS did not explicitly agree or disagree with our third recommendation to require all states to report information on critical incidents to CMS annually. The department noted it has established a workgroup to learn more about states’ health and welfare systems and that it will use the results of this workgroup to determine which additional reporting requirements would be beneficial. The workgroup’s review will continue through calendar year 2018. In technical comments, HHS indicated that after the workgroup’s review is complete it will consider annual reporting of critical incidents. We believe establishing the workgroup is a positive first step towards improving oversight and state reporting and encourage HHS to require annual reporting on critical incidents when developing additional reporting requirements. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, the Administrator of the Administration for Community Living, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at iritanik@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix VI. Our survey of state Medicaid agencies regarding coverage, spending, enrollment, and oversight of assisted living services in 2014, obtained information on challenges for Medicaid beneficiaries to access assisted living services in their states. States provided information related to factors that create challenges for Medicaid beneficiaries’ ability to access and receive assisted living services and the extent states had policies to help beneficiaries with the cost of room and board. A number of states in our survey cited common factors as creating the greatest challenges to a beneficiary’s ability to access assisted living services, including the number of assisted living facilities willing to accept Medicaid beneficiaries (13 states or 27 percent of the 48 states) program enrollment caps (9 states or 19 percent of the 48 states) beneficiaries’ inability to pay for assisted living facility room and board (9 states or 19 percent of the 48 states), which Medicaid typically does not cover low rates the state Medicaid program paid assisted living facilities (8 states or 17 percent of the 48 states). A number of states reported that they had policies to assist Medicaid beneficiaries with the costs of room and board charged by assisted living facilities, which Medicaid does not typically cover. Two common policies, cited by at least half of the states, were aimed at limiting how much assisted living facilities could charge Medicaid beneficiaries for room and board. For example, 30 of 48 states, limited the amount facilities could charge for room and board to the amount of income certain beneficiaries receive as Supplemental Security Income. The other commonly cited policies focused on providing financial assistance to the beneficiaries to defray the room and board costs. (See table 9.) In addition to the contact named above, Tim Bushfield and Christine Brudevold (Assistant Directors), Jennie Apter, Shirin Hormozi, Anne Hopewell, Kelsey Kreider, Perry Parsons, Vikki Porter, and Jennifer Whitworth made key contributions to this report.

Summary: The number of individuals receiving long term care services from Medicaid in community residential settings is expected to grow. These settings, which include assisted living facilities, provide a range of services that allow aged and disabled beneficiaries, who might otherwise require nursing home care, to remain in the community. State Medicaid programs and CMS, the federal agency responsible for overseeing the state programs, share responsibility for ensuring that beneficiaries' health and welfare is protected. GAO was asked to examine state and federal oversight of assisted living services in Medicaid. This report (1) describes state spending on and coverage of these services, (2) describes how state Medicaid agencies oversee the health and welfare of beneficiaries in these settings, and (3) examines the extent that CMS oversees state Medicaid agency monitoring of assisted living services. GAO surveyed all state Medicaid agencies and interviewed officials in a nongeneralizeable sample of three states with varied oversight processes for their assisted living programs. GAO reviewed regulations and guidance, and interviewed CMS officials. State Medicaid agencies in 48 states that covered assisted living services reported spending more than $10 billion (federal and state) on assisted living services in 2014. These 48 states reported covering these services for more than 330,000 beneficiaries through more than 130 different programs. Most programs were operated under Medicaid waivers that allow states to target certain populations, limit enrollment, or restrict services to certain geographic areas. With respect to oversight of their largest assisted living programs, state Medicaid agencies reported varied approaches to overseeing beneficiary health and welfare, particularly in how they monitored critical incidents involving beneficiaries receiving assisted living services. State Medicaid agencies are required to protect beneficiary health and welfare and operate systems to monitor for critical incidents—cases of potential or actual harm to beneficiaries such as abuse, neglect, or exploitation. Twenty-six state Medicaid agencies could not report to GAO the number of critical incidents that occurred in assisted living facilities, citing reasons including the inability to track incidents by provider type (9 states), lack of a system to collect critical incidents (9 states), and lack of a system that could identify Medicaid beneficiaries (5 states). State Medicaid agencies varied in what types of critical incidents they monitored. All states identified physical, emotional, or sexual abuse as a critical incident. A number of states did not identify other incidents that may indicate potential harm or neglect such as medication errors (7 states) and unexplained death (3 states). State Medicaid agencies varied in whether they made information on critical incidents and other key information available to the public. Thirty-four states made critical incident information available to the public by phone, website, or in person, while another 14 states did not have such information available at all. Oversight of state monitoring of assisted living services by the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is limited by gaps in state reporting. States are required to annually report to CMS information on deficiencies affecting beneficiary health and welfare for the most common program used to provide assisted living services. However, states have latitude in what they consider a deficiency. States also must describe their systems for monitoring critical incidents, but CMS does not require states to annually report data from their systems. Under federal internal control standards, agencies should have processes to identify information needed to achieve objectives and address risk. Without clear guidance on reportable deficiencies and no requirement to report critical incidents, CMS may be unaware of problems. For example, CMS found, after an in-depth review in one selected state seeking to renew its program, that the state lacked an effective system for assuring beneficiary health and welfare, including reporting insufficient information on the number of unexpected or suspicious beneficiary deaths. The state had not reported any deficiencies in annual reports submitted to CMS in 5 prior years. GAO recommendations to CMS include clarifying state requirements for reporting program deficiencies and requiring annual reporting of critical incidents. HHS concurred with GAO's recommendations to clarify deficiency reporting and stated that it would consider annual reporting requirements for critical incidents after completing an ongoing review.