Under PPACA, health-insurance marketplaces were intended to provide a single point of access for individuals to enroll in participating private health plans, apply for income-based subsidies to offset the cost of these plans, and, as applicable, obtain an eligibility determination or assessment of eligibility for other health-coverage programs, such as Medicaid or the Children’s Health Insurance Program. To be eligible to enroll in a “qualified health plan” offered through a marketplace—that is, one providing essential health benefits and meeting other requirements under PPACA—an individual must be a U.S. citizen or national, or otherwise lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). To be eligible for Medicaid, individuals must meet federal requirements regarding residency, U.S. citizenship or immigration status, and income limits, as well as any additional state-specific criteria that may apply. Under the Medicaid expansion, states may choose to provide Medicaid coverage to nonelderly adults who meet income limits and other criteria. Under PPACA, the federal government is to fully reimburse states through fiscal year 2016 for the Medicaid expenditures of “newly eligible” individuals who gained Medicaid eligibility through the expansion. According to the CMS Office of the Actuary, federal expenditures for the Medicaid expansion are estimated at $430 billion from 2014 through 2023. PPACA requires marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant’s Social Security number, if one is provided; verifying citizenship, status as a U.S. national, or lawful presence by comparison with Social Security Administration (SSA) or Department of Homeland Security records; and verifying household income by comparison with tax-return data from the Internal Revenue Service (IRS), data on Social Security benefits from SSA, and other available current income sources. In particular, PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another method approved by HHS. To implement this verification process, CMS developed the data services hub (data hub), which acts as a portal for exchanging information between the federal Marketplace, state-based marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other federal agencies. The Marketplace uses the data hub in an attempt to verify that applicant information necessary to support an eligibility determination is consistent with external data sources. For qualifying applicants, the act provides two possible forms of subsidies for consumers enrolling in individual health plans, both of which are generally paid directly to insurers on consumers’ behalf. One is a federal income-tax credit, which enrollees may elect to receive in advance, and which reduces a consumer’s monthly premium payment. When taken in advance, this benefit is known as the advance premium tax credit (APTC). The other, known as cost-sharing reduction (CSR), is a discount that lowers the amount consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. Under PPACA, an applicant’s filing of a federal income-tax return, including a required additional form, is a significant eligibility requirement for continued receipt of federal subsidies. When applicants apply for coverage, they report family size and the amount of projected income. On the basis, in part, of that information, the Marketplace will calculate the maximum allowable amount of APTC. An applicant can then decide whether he or she wants all, some, or none of the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment. If an applicant chooses to have all or some of his or her credit paid in advance, the applicant is required to “reconcile” on his or her federal income-tax return the amount of advance payments the government sent to the applicant’s insurer on the applicant’s behalf with the tax credit for which the applicant qualifies based on actual reported income and family size. Reconciliation is accomplished using IRS Form 8692, Premium Tax Credit (PTC). To receive advance payment of the tax credit at time of application, applicants must attest they will file a tax return for the year for which they receive APTC. CMS announced that, beginning with the open- enrollment period for 2016 coverage, APTC and CSR subsidies will be discontinued for 2016 coverage for enrollees who received APTC in 2014, but did not comply with the requirement to file a federal income-tax return and reconcile receipt of their APTC subsidy. Under PPACA’s application process, “inconsistencies” are generated when individual applicant information does not match information from federal data sources—either because information an applicant provided does not match information contained in data sources that a marketplace uses for eligibility verification at the time of application, or because such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved. Under the marketplace process, applicants will be asked to provide additional information or documentation for the marketplaces to review to resolve the inconsistency. Our undercover testing for the 2016 coverage year found that the eligibility determination and enrollment processes of the federal and state marketplaces we reviewed remain vulnerable to fraud, as we previously reported for the 2014 and 2015 coverage years. For each of our 15 fictitious applications, the marketplaces approved coverage, including for 6 fictitious applicants who had previously obtained subsidized coverage but did not file the required federal income-tax returns. Although IRS provides information to marketplaces on whether health-care applicants have filed required returns, the federal Marketplace and our selected state marketplace allowed applicants to instead attest that they had filed returns, saying the IRS information was not sufficiently current. The marketplaces we reviewed also relaxed documentation standards or extended deadlines for filing required documentation. After initial approval, all but one of our fictitious enrollees maintained subsidized coverage, even though we sent fictitious documents, or no documents, to resolve application inconsistencies. Marketplace officials told us that without specific identities of our fictitious applicants—which we declined to provide, to protect the identities—they could not comment on individual outcomes. In general, however, they told us our results indicate their marketplace processes worked as designed. For each of our 15 fictitious applications, the federal or state-based marketplaces approved coverage at time of application—specifically, 14 applications for qualified health plans, and 1 application for Medicaid. Each of the 14 applications for qualified health plans was also approved for APTC subsidies. These subsidies totaled about $5,000 on a monthly basis, or about $60,000 annually. These 14 qualified-health-plan applications also each obtained CSR subsidies, putting the applicants in a position to further benefit if they used medical services. However, our successful applicants did not seek medical services. These subsidies are not paid directly to enrolled consumers; instead, the federal government pays them to health-plan issuers on consumers’ behalf. For the first time in our three rounds of undercover application testing since the 2014 coverage year, we successfully cleared an online identity- checking step for one fictitious applicant. Known as “identity proofing,” the process uses personal and financial history on file with a credit-reporting agency. The marketplace generates questions that only the applicant is believed likely to know. According to CMS, the purpose of identity proofing is to prevent someone from creating an account and applying for health coverage based on someone else’s identity and without the other person’s knowledge. Although intended to counter such identity theft involving others, identity proofing also serves as an enrollment control for those applying online. For our 2014 and 2015 undercover testing, we failed to clear identity proofing in each online application we made. In this latest round of testing, we cleared identity proofing in one online application by successfully answering the identity questions presented: (1) name the county for the applicant address provided, (2) identify the high school from which the applicant graduated, and (3) identify the last four digits of a cellular phone number. Although our applicant’s identity was fictitious, the eligibility system may still have been able to generate questions based on a “likely” match, CMS officials told us. For our state marketplace applications, in four of five cases, marketplace representatives were unable to verify our applicants’ identities and, as a result, suggested that we visit enrollment counselors to present identification in person. As a representative said to one of our applicants, “I can’t look at your picture ID” and, “I have to be able to confirm that you are who you say you are … in case you were an impostor calling us.” We avoided such in-person visits, however, by filing paper applications (which under PPACA must be an option available to applicants). In such cases, an applicant signature is provided under penalty of perjury and threat of civil or criminal penalty. In our paper applications, we provided signatures for our fictitious identities and filed the forms. In another of the state marketplace cases, we were able to complete the application over the phone, without being asked identity-proofing questions. Our federal Marketplace applicants received no similar instructions on visiting enrollment counselors or submitting paper applications. For the 14 qualified-health-plan applications, we attempted to pay the required premiums to put policies into force, as we did in both of our previous rounds of testing. For 11 applicants, we successfully made premium payments. However, for three applicants, our initial premium payments—made to insurers we selected—were unsuccessful, and we were unable to resolve the issue. While we believed we had received confirmation of premium payments, insurers said payments were not received on a timely basis.