Medicaid is jointly financed by the federal government and the states, with the federal government reimbursing states for a share of their expenditures for Medicaid covered services provided to eligible beneficiaries. The federal share of spending is based on a statutory formula that determines a federal matching rate for each state. States may provide Medicaid services under either or both a fee-for- service model and a managed care model. Under a fee-for-service delivery model, states make payments directly to providers for services provided, and the federal government reimburses the state its share of spending based on these payments. Under a managed care service delivery model, states pay MCOs a capitation payment, which is a fixed periodic payment per beneficiary enrolled in an MCO—typically, per member per month. The federal government reimburses its share of spending based on the capitation payments states made to the MCO. In return for the capitated payment, each MCO is responsible for arranging for and paying providers’ claims for all covered services provided to Medicaid beneficiaries. For example, MCOs may pay providers on a fee- for-service basis or with a monthly capitation payment per beneficiary, or through some other payment approach in which the provider assumes some risk for providing covered services. In either case, MCOs are required to report to the states information on services utilized by Medicaid beneficiaries—information typically referred to as encounter data. Figure 1 illustrates these models. Program integrity refers to the proper management and function of the Medicaid program to ensure that quality and efficient care is being provided, while Medicaid payments are used appropriately and with minimal waste. Program integrity efforts encompass a variety of administrative, review, and law enforcement strategies. State stakeholders—Medicaid managed care offices, state Medicaid program integrity units, Medicaid Fraud Control Units (MFCUs), and in many cases state auditors—and MCO stakeholders—MCOs that contract with states to deliver Medicaid services—play important roles in the oversight of managed care payment risks and have a variety of program integrity responsibilities. A stakeholder’s program integrity responsibilities can be specialized—such as for MFCUs, which focus on fraudulent behavior—or varied—such as for state Medicaid managed care offices and MCOs, which are responsible for monitoring fraud and other issues, such as compliance with quality standards or ensuring MCOs meet contract requirements. (See table 1.) Two of the stakeholders—state Medicaid managed care offices and MCOs—have responsibilities for program operation in addition to program integrity oversight responsibilities. For example, state Medicaid managed care offices’ program operations responsibilities include enrolling beneficiaries, negotiating contracts with MCOs, developing capitation rates, and making monthly capitation payments to MCOs. MCOs’ program operation responsibilities include establishing contracts with providers, creating provider networks, ensuring that enrollees have an ongoing source of primary care and timely access to needed services, and processing and paying provider claims. In a previous report, we found that state Medicaid program integrity efforts focus primarily on payments and services delivered under fee-for- service, and do not closely examine program integrity in managed care. For example, officials from five of seven states that we spoke to for that report said that they primarily focused their program integrity efforts on fee-for-service claims. They also noted that program integrity in Medicaid managed care was more complex than for fee-for-service. CMS’s program integrity responsibilities take a variety of forms. CMS issues program requirements for states through regulations and guidance; for example, regulations requiring states to establish actuarially sound capitation rates and to ensure that MCOs have an adequate network of providers, as well as to ensure that all covered services are available and accessible to beneficiaries in a timely manner. CMS also requires states to submit MCO contracts and capitation rates to CMS for review and approval, and report key information such as encounter data collected from MCOs. The agency provides technical assistance and educational support to states, including having staff available to help states with specific issues or questions, and providing courses on program integrity issues. The agency also conducts periodic reviews to assess state program integrity policies, processes, and capabilities. In addition, CMS has engaged audit contractors to help states audit providers receiving Medicaid payments, including payments made by MCOs to providers. We identified six types of payment risks through our review of Medicaid audit reports and other sources. Most of the stakeholders we spoke to agreed that these payment risks exist in Medicaid managed care. Four of these risks relate to the payments state Medicaid agencies make to MCOs, and two relate to payments that MCOs make to providers. (See figs. 2 and 3.) In terms of the relative importance of these payment risks, two payment risks were more frequently cited by stakeholders as having a higher level of risk than other types—incorrect MCO fee-for-service payments to providers and inaccurate state capitation rates. The remaining four payment risks were more frequently cited as having lower or unknown levels of risk: improper state capitation payments, state payments to noncompliant MCOs, incorrect MCO capitation payments, and duplicate state payments. (See fig. 4.) When we asked stakeholders to designate a level of risk, stakeholders whose primary responsibility is program integrity—state auditors, MFCU officials, and state Medicaid program integrity staff—were more likely to assign a higher level of risk for certain types of payment risks than state Medicaid managed care officials and MCO officials. (See app. I for additional information on risk level designation by stakeholder group.) Stakeholders provided the following examples of payment risks that they rated as having “some” or “high” risk in the state. (See table 2.) See appendix II for further examples of payment risks identified as part of our review of audits and other reports. We identified six challenges to effective program integrity oversight in Medicaid managed care based on our review of Medicaid audit reports and other sources. Among these six challenges, stakeholders most frequently cited allocation of resources, quality of data and technology, and adequacy of state policies and practices as key challenges. Some stakeholders also described strategies to address these challenges. Through our research on examples of payment risks in Medicaid managed care, we identified six areas that can present challenges to program integrity oversight, including (1) availability and allocation of resources; (2) access to and quality of data and technology; (3) state policies and practices; (4) provider compliance with program requirements; (5) MCO management of program integrity; and (6) federal regulations, guidance, and review. Allocation of resources, quality of data and technology, and state policies and practices were the three most commonly cited challenges to program integrity oversight by stakeholders. (See fig. 5.) Stakeholders described the following examples of challenges to program integrity oversight they had observed. See appendix III for more information on the particular challenges for each of the payment risks. Availability and allocation of resources. Stakeholders who cited resource allocation as an oversight challenge to managed care cited several key issues, such as the number of staff allocated to an activity, the expertise needed, and the ability to retain and replace staff. (See table 3.) Some stakeholders identified resource issues within their own organizations, while some identified resource issues they said existed in other organizations. Access to and quality of data and technology. Stakeholders who cited the quality of data and technology as oversight challenges to managed care provided examples related to timely access to data, inaccurate and unreliable data, and problems with information systems and interfaces. (See table 4.) State policies and practices. Stakeholders who cited state policies and practices as an oversight challenge to managed care described insufficient contract requirements, lack of state monitoring, and problems with state oversight. (See table 5.) Stakeholders from the state program integrity office, the MFCU, and the state auditor’s office more frequently identified state policies and practices as a challenge than stakeholders from the state Medicaid managed care agency. MCO management of program integrity. Stakeholders who cited MCO management as an oversight challenge to managed care described how inadequate MCO oversight and monitoring—as well as incomplete MCO reporting to the state agency—can increase the risk of different types of payment risks. (See table 6.) Stakeholders from the state Medicaid managed care agency, the state program integrity office, and the MFCU were more likely than MCO stakeholders to cite these issues as challenges. In particular, a few state officials noted that there was variation in size and resources among the MCOs in their respective states. Provider compliance with program requirements. Stakeholders who cited provider compliance as a challenge to oversight indicated that providers are the primary source of inaccurate payments, because of improper billing, which may include fraudulent billing. These stakeholders also stated that some types of providers presented a higher risk than others in their state. Several stakeholders pointed out that certain providers intentionally commit fraud, while others may be unaware of changes in policies or procedures and therefore unintentionally submit inaccurate claims. Several stakeholders noted that it is the responsibility of providers to bill correctly, while a few others pointed out that because the payment process is complicated, MCOs and state agencies may not identify inaccurate payments. Stakeholders also selected from a list of 19 types of providers the 3 or 4 that in their view represented the highest payment risks in the state. The two most frequently mentioned health care providers or services were (1) durable medical equipment, and (2) psychiatric and behavioral health care providers. (See table 7.) Federal regulations, guidance, and review. Over half of the stakeholders who identified federal regulations, guidance, and review as oversight challenges to managed care cited the complexity of federal regulations and the lack of federal guidance as key issues. For example, one stakeholder said that there needed to be more clarity about the new regulations for setting capitation rates for MCOs, while another said that there was a lack of clarity about the respective roles of states and MCOs in program integrity oversight. One stakeholder noted that most of the responsibility for operating the Medicaid program lies with the state, not with the federal government. Some stakeholders we interviewed identified strategies, controls, or best practices to address the challenges to oversight of Medicaid managed care payment risks. As shown in table 8, they identified a variety of strategies such as ensuring high quality data, collaboration among state agencies and MCOs, imposing sanctions on noncompliant MCOs, enhancing contract requirements, and conducting regular monitoring. CMS has taken important steps to address payment risks in Medicaid managed care, issuing a final rule, increasing guidance, and conducting oversight activities. However, some efforts are incomplete, and there are gaps in key oversight activities. In May 2016, CMS issued a final rule on Medicaid managed care. According to CMS, the rule is intended to enhance regulatory provisions related to program integrity and payment risks, among other things. These regulatory provisions varied in terms of when the requirements were applicable. For example, for contracts beginning on or after July 1, 2017, the rule requires state contracts with MCOs to require MCOs to promptly report all overpayments made to providers, and to specify the overpayments due to potential fraud; states to account for overpayments when setting capitation payment amounts; and states to establish procedures and quality assurance protocols to ensure that MCOs submit encounter data that is complete and accurate. These requirements have the potential to enhance MCO and state oversight of managed care, and address payment risks involving incorrect MCO payments to providers and inaccurate state capitation rates for MCOs. CMS is currently reviewing the rule for possible revision of its requirements and an announcement on the results of the review is expected in 2018. Most stakeholders we spoke to identified ways in which the managed care rule could have a positive impact on managed care program integrity oversight. Of the 49 stakeholders we spoke to, 28 made positive statements about the rule’s potential impact on program integrity oversight of payment risks in managed care, 9 stakeholders said they were not familiar enough with the managed care rule to comment on it, and the remaining 12 stakeholders provided a range of comments about the rule. The 28 stakeholders with positive comments identified a variety of ways in which they said the managed care rule would help, including establishing transparency in setting state capitation rates; providing clear guidelines for MCO reporting, and clear authority for states to require reporting; obtaining information on overpayments identified and collected by holding MCO leadership accountable for meeting program reducing medical costs, despite additional short-term administrative costs. Comments by the other 12 stakeholders who were familiar with the rule included statements that the rule should have been more aggressive in requiring MCOs to implement efforts related to program integrity; would have limited impact for them, because many of its requirements were already in place in their state; and set time frames for implementation that were hard to meet. In addition to issuing the rule, CMS has sought to increase guidance available to states through training, technical assistance, and other educational resources. (See table 9.) Lastly, CMS efforts have included updating the requirements used in capitation rate setting reviews, contract oversight, and other types of audits and reviews, as described below. Review of state capitation rates for Medicaid MCOs. CMS reviews states’ capitation rates at least once every year, and in 2017 made revisions to its rate review guidance to states, incorporating new requirements from the managed care rule. According to CMS officials, the agency typically conducts between 250 and 300 rate reviews annually to determine whether states’ rate development methodologies meet generally accepted actuarial principles, as well as federal laws and requirements. Review of state Medicaid MCO contracts. CMS regularly reviews state contracts with MCOs to ensure that contract provisions meet federal requirements. In 2017, CMS updated its criteria for Medicaid managed care contract review and approval, and revised the guide that it provides to states to help them develop effective MCO contracts. CMS contracted audits. In 2016, CMS began to transition and consolidate audits of providers to a type of contractor called Unified Program Integrity Contractors (UPIC). This transition is intended to integrate contracted audit activities across CMS health care programs, such as Medicaid and Medicare, according to CMS. Additionally, UPIC audits can include health care providers who participate in multiple federal programs. Within the Medicaid program, UPICs may conduct audits with states interested in pursuing what are called “collaborative audits.” CMS’s contract with UPICs allows for audits of providers in MCO networks. Focused program integrity reviews. CMS officials said that in 2016, the agency updated the review guide used to conduct focused program integrity reviews of state Medicaid managed care programs. CMS program integrity reviews have identified some common issues, such as a low number of investigations of overpayments conducted by managed care plans and a low amount of recoveries by plans. However, CMS officials stated these reviews are not focused primarily on assessing specific payment risks. For example, these reviews do not involve an actual review or audit of MCO payments to providers to assess the extent that inaccurate payments were made. Instead, they review program integrity policies and processes, such as whether and how the state monitors overpayments, and whether MCOs comply with state requirements. Despite CMS’s efforts to improve oversight of program integrity in Medicaid managed care, there have been delays in issuing guidance, and gaps in key auditing and monitoring activities. These delays and gaps are inconsistent with the agency’s current program integrity plan, which established goals for improving state oversight of program integrity in Medicaid managed care, as well as the financial accountability of Medicaid MCOs. Publication of CMS guidance that would assist states in oversight of payment risks has been delayed. CMS officials told us in April 2017 that they planned to issue a compendium of guidance related to the managed care rule’s program integrity regulations. The compendium is intended to provide guidance on (1) MCO program integrity requirements, (2) state audits of MCO encounter data that must be conducted at least every 3 years, and (3) MCO overpayments to providers. However, in September 2017, CMS officials told us that although they had a draft of the compendium, they did not have a timeline for issuing it, because the managed care rule was under review. As of May 2018, no issuance date has been set for the guidance. Over half of the stakeholders we interviewed who identified federal responsibilities as an oversight challenge to managed care cited the complexity of federal regulations and the lack of federal guidance as key issues. The lack of available federal guidance resulting from delays in issuing such guidance is inconsistent with federal internal control standards that call for federal agencies to communicate quality information to those responsible for program implementation for the purposes of achieving program objectives and addressing program risks. Until such guidance is issued, stakeholders’ ability to effectively address challenges to payment risks in Medicaid managed care will continue to be hindered. Although audits of providers that bill and are paid by MCOs can provide important information about payment risks and are included in the UPIC statement of work, only 14 of the 762 audits initiated by CMS contractors during the period of fiscal year 2014 through 2017 were managed care audits. Our review of three CMS contracted managed care audits indicated that the amount of inaccurate MCO payments to providers—as well as MCO and provider noncompliance with contracts—can be significant. For example, one audit of an MCO’s payments to selected providers found that 8.94 percent of payments were in error, representing over $4 million in overpayments for a 6-month period. This audit also identified a lack of provider compliance with requirements to provide preventive care services and care coordination to members, and a lack of MCO compliance with requirements to monitor member enrollment, resulting in the MCO paying providers for individuals who were not enrolled. CMS officials shared plans to increase collaborative audits in managed care in the future. CMS officials said the agency is in the early planning stages to pilot an audit of MCO providers in one state, with the goal of addressing challenges encountered in prior managed care audits. CMS is also in discussions with states and audit contractors to conduct potential audits and investigations in fiscal years 2018 and 2019. However, CMS and audit contractor officials identified several circumstances related to states’ contracts with MCOs that they said have created gaps in their auditing activity. According to CMS officials, states have reported a reluctance to conduct provider audits when states’ contracts with MCOs (1) allow the MCO to retain identified overpayments, or (2) do not explicitly discuss how identified overpayments are addressed. Officials with the two operating UPICs told us that CMS’s general guidance to them was to restrict their audits to states with MCO contracts where the states can recoup overpayments from the MCOs. According to one contractor, because few states have such contracts, the vast majority of the contractors’ audits are of providers paid on a fee-for-service basis. However, overpayments to providers can affect state and federal expenditures regardless of a state’s particular recoupment policy, because if they are not accounted for, they may increase future capitation rates paid to MCOs. Audit contractor officials also said the lack of access to MCO coverage and policy materials, and the inability to directly access encounter or claims data, prevent them from doing analyses to identify potential provider fraud, abuse, and waste for investigation. While CMS officials said they encourage states to participate in additional collaborative audits of managed care, they did not identify steps the agency is taking to address the circumstances that limit collaborative audits conducted. The lack of sufficient auditing in managed care is inconsistent with federal internal control standards that require federal agencies to identify risks through such activities as auditing. CMS has incomplete information on the scope and extent of MCO overpayments to providers, which results in a gap in monitoring MCO payments. Gaps in monitoring also exist because CMS lacks a process for consistently collecting information about overpayments and documenting that states account for overpayments when setting capitation rates. A few examples of these issues include the following: While CMS regularly reviews states’ proposed capitation rates, it lacks a process to consistently ensure any overpayments are accounted for by the states. According to an official with CMS’s Office of the Actuary, their review of state capitation rates does not require documentation of the amount of overpayments that occurred the prior year, how they were determined, or how they were incorporated into setting capitation rates. According to this official, issues between states and MCOs—such as contractual issues related to how overpayments are handled—are beyond the scope of their review and responsibilities. However, such information could be important to program integrity oversight; for example, 11 stakeholders we interviewed said that state capitation rates did not account for overpayments, because they had observed that overpayments were not reported by MCOs, were not monitored by the state, or both. Although some of CMS’s focused program integrity reviews have suggested that there is under-reporting of MCO overpayments to providers, CMS officials explained that these reviews are intended to assess state compliance with regulations, and not to determine the extent of under-reporting or why overpayments are under- reported. States’ and CMS’s contracted auditors have conducted only a few collaborative audits in managed care, even though such audits can identify overpayments made by MCOs to providers. These gaps in monitoring of overpayments are inconsistent with federal internal control standards that require federal agencies to monitor operating effectiveness through audits and reviews. Without more complete information on the extent of overpayments and a process to ensure they are accounted for in state capitation rates, CMS is unable to ensure that MCOs are effectively identifying overpayments and documenting that they are accounted for when reviewing and approving state capitation rates. As a result, CMS cannot be sure that states are holding MCOs financially accountable for making proper payments, that states are paying accurate capitation payments to MCOs, or that the federal government’s share of Medicaid expenditures is accurate. Managed care has the potential to help states reduce Medicaid program costs and better manage utilization of health care services. However, oversight of managed care is critical to achieving these goals. Payment risks are not eliminated under managed care; in fact, they are more complex and difficult to oversee. While CMS has taken important steps to improve program integrity in managed care—including strengthening regulations, developing guidance for states on provider enrollment in Medicaid managed care, and beginning to include managed care in the monitoring and auditing process—the efforts remain incomplete, because of delays and limited implementation. To date, CMS has not issued its planned compendium with guidance on program integrity in Medicaid managed care, taken steps to address known factors limiting collaborative audits, or developed a process to help ensure that overpayments to providers are identified by the states. Without taking actions to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will best mitigate payment risks in managed care. We are making the following three recommendations to CMS: The Administrator of CMS should expedite the planned efforts to communicate guidance, such as its compendium on Medicaid managed care program integrity, to state stakeholders related to Medicaid managed care program integrity. (Recommendation 1) The Administrator of CMS should eliminate impediments to collaborative audits in managed care conducted by audit contractors and states, by ensuring that managed care audits are conducted regardless of which entity—the state or the managed care organization—recoups any identified overpayments. (Recommendation 2) The Administrator of CMS should require states to report and document the amount of MCO overpayments to providers and how they are accounted for in capitation rate-setting. (Recommendation 3) We provided a draft of this product to the Department of Health and Human Services for comment. HHS concurred with these recommendations, stating that it is committed to Medicaid program integrity. HHS also cited examples of activities underway to improve oversight of the Medicaid program, such as training offered through the Medicaid Integrity Institute, and guidance provided in the Medicaid Provider Enrollment Compendium. The full text of HHS’s comments is reproduced in appendix IV. HHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Health and Human Services and the Administrator of CMS. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix V. We asked stakeholders involved in program integrity oversight to assign a level of risk—either low, some, or high—to six types of payment risks in Medicaid managed care. We interviewed officials in the following five organizations in each of 10 states: state Medicaid managed care office, state program integrity unit, Medicaid Fraud Control Unit (MFCU), state auditor’s office, and a managed care organization (MCO). (See table 1 for a description of each of these entities.) Figures 6 through 9 below illustrate the risk level stakeholders assigned to the four types of payment risk that are associated with states’ periodic capitation payments to MCOs. Figures 10 and 11 illustrate the risk level stakeholders assigned the two types of payment risks associated with MCO payments to providers. In some cases, stakeholders said they did not have enough information to assign a level of risk (“Don’t know”) or that one of the payment risks did not apply in their state (“Not applicable”). For some payment risks, the stakeholders whose primary responsibility is program integrity—state auditors, MFCU officials, and state Medicaid program integrity staff—were more likely to assign a higher level of risk than state Medicaid managed care officials and MCO officials who have responsibilities both for program operation and program integrity. For example, some of the risk levels cited in our interviews by state auditors, MFCU officials, and state Medicaid program integrity staff included the following: State auditors most frequently cited improper state capitation payments as high risk in the state. Three state auditors identified duplicate state payments as high risk. Just over half of all state auditors, MFCU officials, and state Medicaid program integrity staff identified inaccurate state capitation rates as some or high risk. In contrast, state Medicaid managed care officials and MCO officials were less likely to assign high risk to payment types. Some examples include the following: No state Medicaid managed care officials cited a high level of risk for any of the six payment types. Two MCO officials cited a high level of risk for incorrect MCO fee- for-service payments. No other MCO officials cited a high level of risk for any of the other payment types. Stakeholder views on the risk level of different payment risks are outlined in the figures that follow. Improper state capitation payments may occur when the state makes monthly capitation payments to an MCO for beneficiaries who are ineligible for or not enrolled in Medicaid, or who have died. (See fig. 6.) Inaccurate state capitation rates occur when a state established a capitation rate that is inaccurate primarily due to issues with the data used to set the rates. Data issues could include inaccurate encounter data, unallowable costs, overpayments that are not adjusted for in the rate, or older data that do not reflect changes in care delivery practices that affect MCO costs. (See fig. 7.) State payments to noncompliant MCOs occur when a state pays MCOs a periodic capitation per beneficiary even though the MCO has not fulfilled state contract requirements. Examples of unfulfilled contract requirements include an MCO failing to establish an adequate provider network, reporting inaccurate encounter data for services, or failing to report the amount of overpayments the MCO has made to providers. (See fig. 8.) Duplicate state payments to an MCO occur when a health care provider submits a fee-for-service claim to the state Medicaid program for services that were covered under the MCO contract. (See fig. 9.) Incorrect MCO fee-for-service payments occur when the MCO pays providers for improper claims, such as claims for services (1) not provided, or provided by ineligible providers; or (2) that represent inappropriate billing, such as billing individually for bundled services or for a higher intensity of services than needed. (See fig. 10.) Incorrect MCO capitation payments occur when MCOs pay providers a periodic fixed payment without assurances they have provided needed services. (See fig. 11.) To identify examples of payment risks in Medicaid managed care, we reviewed Department of Health and Human Services’ (HHS) Office of Inspector General (HHS-OIG) publications and our prior work; obtained input from the National State Auditor’s Association; and conducted literature searches and key word searches of online databases, which identified additional state audits and investigations involving Medicaid managed care payment. We grouped these examples of payment risks into six broad categories or types based on similar key characteristics. Tables 10 through 15 provide examples of each of the six types of payment risks we identified: (1) improper state capitation payments, which are state capitation payments to MCOs for ineligible or deceased individuals; (2) inaccurate state capitation rates; (3) state payments to non-compliant managed care organizations (MCO); (4) duplicate state payments to MCOs and providers; (5) incorrect MCO fee-for-service payments to providers; and (6) incorrect MCO capitation payments to providers that have not complied with program requirements. We asked 49 stakeholders involved in program integrity oversight to consider the following six challenges to effective program integrity oversight: (1) availability and allocation of resources; (2) access to and quality of data and technology; (3) state policies and practices; (4) provider compliance with program requirements; (5) managed care organization (MCO) management of program integrity; and (6) federal regulations, guidance, and review. Stakeholders were asked whether any of these presented a challenge to each of six types of payment risks in Medicaid managed care in their state, including (1) improper state capitation payments to MCOs for ineligible or deceased individuals; (2) inaccurate state capitation rates; (3) state payments to MCOs that have not fulfilled contract requirements; (4) state duplicate payments to MCOs and providers; (5) incorrect MCO fee-for-service payments to providers for improper claims; and (6) incorrect MCO capitation payments to providers that have not complied with program requirements. Figure 12 illustrates the number of times stakeholders cited a particular challenge for each of the payment risks. The frequency with which each of the challenges was identified differed to some extent for different payment risks. Some examples include the following: Quality of data and technology was the most cited challenge for duplicate state payments. State policies and practices was the most cited challenge for inaccurate state capitation rates. Provider compliance with program requirements was the most cited challenge for two payment types: (1) incorrect MCO fee-for- service payments to providers, and (2) incorrect MCO capitation payments to providers. Resource allocation was the second most cited challenge for five of the six payment risk types, although it was not the most cited challenge for any one payment risk type. In addition to the contact name above, Tim Bushfield (Assistant Director), Mary Giffin (Analyst-in-Charge), Arushi Kumar, Julie Flowers, Drew Long, Vikki Porter, Katie Thomson made key contributions to this report. Other staff who made contributions to the report were Jessica Broadus, Barbie Hansen and Erika Huber.

Summary: Federal spending on services paid for under Medicaid managed care was $171 billion in 2017, almost half of the total federal Medicaid expenditures for that year. Federal and state program integrity efforts have largely focused on Medicaid fee-for-service delivery where the state pays providers directly, rather than managed care, where it pays MCOs. As a result, less is known about the types of payment risks under managed care. GAO was asked to examine payment risks in Medicaid managed care. In this report, GAO (1) identified payment risks; (2) identified any challenges to state oversight and strategies to address them; and (3) assessed CMS efforts to help states address payment risks and oversight challenges. To do this work, GAO reviewed findings on managed care payment risks and oversight challenges from federal and state audits and other sources. GAO also interviewed 49 state program integrity stakeholders in 10 states selected based on size, the percent of population in managed care, and geography. Stakeholders included the state Medicaid managed care office, state Medicaid program integrity unit, state auditor, Medicaid Fraud Control Unit, and an MCO. Under Medicaid managed care, managed care organizations (MCO) receive a periodic payment per beneficiary in order to provide health care services. Managed care has the potential to help states reduce Medicaid program costs and better manage the use of health care services. However, managed care payments also have the potential to create program integrity risks. GAO identified six types of payment risks associated with managed care, including four related to payments that state Medicaid agencies make to MCOs, and two related to payments that MCOs make to providers. Of the six payment risks GAO identified, state stakeholders responsible for ensuring Medicaid program integrity more often cited the following two as having a higher level of risk: incorrect fee-for-service payments from MCOs, where the MCO paid providers for improper claims, such as claims for services not provided; and inaccurate state payments to MCOs resulting from using data that are not accurate or including costs that should be excluded in setting payment rates. GAO also identified multiple challenges to program integrity oversight for managed care programs. Stakeholders most frequently cited challenges related to (1) appropriate allocation of resources, (2) quality of the data and technology used, and (3) adequacy of state policies and practices. Some stakeholders offered strategies to address these challenges, including collaborating with other entities to identify problem providers and fraud schemes, as well as having effective data systems to better manage risks. The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has initiated efforts to assist states with program integrity oversight for managed care. However, some of these efforts have been delayed, and there are also gaps in oversight. CMS's planned Medicaid managed care guidance to states has been delayed due to the agency's internal review of the regulations; as of May 2018, no issuance date had been set for the guidance. CMS established a new approach for conducting managed care audits beginning in 2016. However, only a few audits have been conducted, with none initiated in the past 2 years. In part, this is due to certain impediments identified by states, such as the lack of some provisions in MCO contracts. CMS has updated standards for its periodic reviews of the state capitation rates set for MCOs. However, overpayments to providers by MCOs are not consistently accounted for in determining future state payments to MCOs, which can result in states' payments to MCOs being too high. Lack of guidance and gaps in program integrity oversight are inconsistent with federal internal control standards, as well as with CMS's goals to (1) improve states' oversight of managed care; (2) use audits to investigate fraud, waste, and abuse of providers paid by MCOs; and (3) hold MCOs financially accountable. Without taking action to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will help mitigate payment risks in Medicaid managed care. GAO recommends that CMS (1) expedite issuing planned guidance on Medicaid managed care program integrity, (2) address impediments to managed care audits, and (3) ensure states account for overpayments in setting future MCO payment rates. The Department of Health and Human Services concurred with these recommendations.