Medicaid was established in 1965 by Title XIX of the Social Security Act as a joint federal–state program to finance health care for certain low- income, aged, or disabled individuals. Medicaid is an entitlement program, under which the federal government pays its share of expenditures for any necessary, covered service for eligible individuals under each state’s federally approved Medicaid plan, as described below. States pay qualified health-care providers for covered services provided to eligible beneficiaries and then seek reimbursement for the federal share of those payments. Title XIX of the Social Security Act allows flexibility in the states’ Medicaid plans. Although the federal government establishes broad federal requirements for the Medicaid program, states can elect to cover a range of optional populations and benefits. Guidelines established by federal statutes, regulations, and policies allow each state some flexibility to (1) broaden eligibility standards; (2) determine the type, amount, duration, and scope of services; (3) set the rate of payment for services; and (4) administer its own program, including processing and monitoring of medical claims and payment of claims. Differences in program design can lead to differences in state programs’ vulnerabilities to improper payments and state approaches to protecting the program. States are required to submit plans to CMS to outline their plans to verify Medicaid eligibility factors, including income, residency, age, Social Security numbers (SSN), citizenship, and household composition. With more than 50 distinct state- based programs that are partially federally financed, overseeing Medicaid is a complex challenge for CMS and states. In order to participate in Medicaid, federal law requires states to cover certain population groups (mandatory-eligibility groups) and gives the states the flexibility to cover other population groups (optional-eligibility groups). States set individual eligibility criteria within federal minimum standards. There are other nonfinancial eligibility criteria that are used in determining Medicaid eligibility. In order to be eligible for Medicaid, individuals need to satisfy federal and state requirements regarding residency, immigration status, and documentation of U.S. citizenship. Beginning in October 2013, states were required to use available electronic data sources to confirm information included on the application, while minimizing the amount of paper documentation that consumers need to provide. As of March 25, 2011, federal regulations require that certain ordering and referring physicians or other professionals providing services under the state plan or under a waiver of the plan must be enrolled as participating providers, which includes screening the providers upon initial enrollment and when follow-up verification occurs (at least every 5 years). The follow-up verification is referred to as revalidation or reenrollment. As part of the enrollment process, and depending on the provider’s risk level, states may be required to collect certain information about the providers’ ownership interests and criminal background, search exclusion and debarment lists, and take action to exclude those providers who appear on those lists. When state officials discover potentially fraudulent activity in the enrollment process, states must refer that activity or providers to law-enforcement entities for investigation and possible prosecution. In May 2014 we reported that states have historically provided Medicaid benefits using a fee-for-service system, in which health-care providers are paid for each service. However, according to CMS, in the past 15 years, states have more frequently implemented a managed-care delivery system for Medicaid benefits. In a managed-care delivery system, beneficiaries obtain some portion of their Medicaid services from an organization under contract with the state, and payments to MCOs are typically made on a predetermined, per person, per month basis. Currently, two-thirds of Medicaid beneficiaries receive some of their services from MCOs, and many states are expanding their use of managed care to additional geographic areas and Medicaid populations.According to HHS, approximately 27 percent, or $74.7 billion, of nationwide federal Medicaid expenditures in fiscal year 2011 (the fiscal year our review focused on) were attributable to Medicaid managed care. States oversee MCOs that provide care to Medicaid beneficiaries through contracts and reporting requirements, which may include identifying improper payments to providers within their plans. Pub. L. No. 109-171, § 6034, 120 Stat. 4, 74 (2006) (codified at 42 U.S.C. § 1396u-6). In September 2014, the Center for Program Integrity was reorganized to integrate the Medicare and Medicaid program-integrity functions across the Center for Program Integrity, so that all Center for Program Integrity units are focused on both programs. To achieve Medicare–Medicaid integration, the Medicaid Integrity Group was also reorganized and integrated with Medicare staff so that the Medicaid Integrity Group no longer exists as a separate identifiable unit. states through the Medicaid Integrity Institute in April 2014. HHS OIG oversees Medicaid program integrity through its audits, investigations, and program evaluations. It is also responsible for enforcing certain civil and administrative health-care fraud laws. States have primary responsibility for reducing, identifying, and recovering improper payments. Of the approximately 9.2 million beneficiaries in the four states that we examined, thousands of cases from the fiscal year 2011 data analyzed showed indications of potentially improper payments, including fraud, to Medicaid beneficiaries and providers. The numbers on beneficiaries and providers may not reflect the total incidence of potentially improper payments, including fraud, because it was not possible to fully investigate claims that did not have a valid SSN. For example, we were unable to match beneficiaries and providers without valid SSNs to the full DMF, making it difficult to fully investigate such cases for other indicators of improper payments or fraud. In addition to beneficiaries, we found hundreds of Medicaid providers who were potentially improperly receiving Medicaid payments. As described below, these cases show indications of certain types of fraud or improper benefits. Providers with suspended or revoked medical licenses. All physicians applying to participate in state Medicaid programs must hold a current, active license in each state in which they practice. During enrollment, states are required to screen out-of-state licenses to confirm the license has not expired and that there are no current limitations on the license. Additionally, states are required to provide CMS with information and access to certain information respecting sanctions taken against health-care practitioners and providers by their own licensing authorities. Using data from the Federation of State Medical Boards (FSMB), we found that approximately 90 medical providers in the four selected states had their medical licenses revoked or suspended in the state in which they received payment from Medicaid during fiscal year 2011. Medicaid approved the associated claims of these cases at a cost of at least $2.8 million. Invalid addresses for providers. A drop-box or mailbox scheme is a common fraud scheme in which a fraud perpetrator will set up a medical-oriented business and will use a CMRA as his or her official address. The four states we examined for our review required providers to provide the physical service location of their business when they apply to provide Medicaid services. Our analysis matching Medicaid data to USPS address-management tool data found that at least 220 providers may have inappropriately used a virtual address as their physical service location. Specifically, these providers used a CMRA address as their physical service location. For these providers, Medicaid approved claims of at least $318,000. Additionally, our analysis found nearly 26,600 providers with addresses that did not match any USPS records. These unknown addresses may have errors due to inaccurate data entry or differences in the ages of MMIS and USPS address-management tool data, making it difficult to determine whether these cases involve fraud through data matching alone. Our analysis also identified 47 providers with foreign addresses as their location of business. These providers had addresses in Canada, China, India, and Saudi Arabia. Our analysis found that 8 of the 47 providers with foreign addresses had been paid over $90,000 in Medicaid claims during fiscal year 2011. In December 2010, CMS released guidance on implementing the Patient Protection and Affordable Care Act (PPACA) provisions prohibiting payments to institutions or entities located outside of the United States. CMS’s guidance went into effect on June 1, 2011. Approximately 28 percent of the claims we identified occurred after CMS’s guidance went into effect. Deceased providers. We identified over 50 deceased providers in the four states we examined whose identities received Medicaid payments. Our analysis matching Medicaid eligibility and claims data to SSA’s full DMF found these individuals were deceased before the Medicaid service was provided. The Medicaid benefits involved with these deceased providers totaled at least $240,000 for fiscal year 2011. These benefits are an indication of improper or potentially fraudulent payments. Excluded providers. We found that about 50 providers in the four states we examined had been excluded from federal health-care programs, including Medicaid; these providers were excluded from these programs when they billed for Medicaid services during fiscal year 2011. The selected states paid the claims at a cost of about $60,000. The federal government can exclude health-care providers from participating in the Medicaid program for several reasons. Excluded providers can be placed on one or both of the following exclusion lists, which state Medicaid officials must check no less frequently than monthly: the List of Excluded Individuals and Entities (LEIE), managed by HHS, and the System for Award Management (SAM), managed by GSA. The LEIE provides information on health- care providers that are excluded from participation in Medicare, Medicaid, and other federal health-care programs because of criminal convictions related to Medicare or state health programs or other major problems related to health care (e.g., patient abuse or neglect). SAM provides information on individuals or entities that are excluded from participating in any other federal procurement or nonprocurement activity. Federal agencies can place individuals or entities on SAM for a variety of reasons, including fraud, theft, bribery, and tax evasion. On the basis of our matching of state prison data to Medicaid claims data, we found that 16 providers in the selected states were incarcerated in state prisons at some point in fiscal year 2011.