Medicaid is a significant and growing component of federal and state budgets. It is the second largest health insurance program after Medicare as measured by expenditures, and was estimated to account for the second largest share of total state spending as well, exceeded only by state spending on elementary and secondary education. Further, Medicaid is undergoing a period of transformative change, as enrollment is growing under PPACA, and program spending is projected to increase 66 percent to over $950 billion by fiscal year 2025. Growth in enrollment is primarily due to more than half of the states choosing to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under PPACA. Growth in expenditures is due to a variety of factors, including the expansion of eligibility, provider rate increases and the higher cost of health care, including prescription drugs. In addition, states’ use of managed care plans to deliver services has been growing. More than half of all Medicaid beneficiaries are now enrolled in managed care plans, and nearly 40 percent of expenditures are for health care services delivered through managed care. The Medicaid program allows for substantial flexibility for states to design and implement their programs, which has implications for program oversight. For example, in a fee-for-service delivery system, state oversight relies on claims data that health care providers submit to states in order to be paid for services. In general, this involves pre- and post- payment reviews of claims to identify payments that are improper, billing anomalies, or aberrant claims. In contrast, state oversight of managed care plans often occurs through contracts and reporting requirements, and may also involve encounter data. State oversight is different under the managed care delivery model, because the managed care plans are responsible for providing services and bear financial risk if spending on services and administration exceeds payments from the state. In 2014, we found that the federal government and the states were not well positioned to identify improper payments made to, or by, managed care plans. For example, CMS had largely delegated program integrity oversight of managed care plans to the states, but states generally focused on fee-for-service claims. State officials told us that one reason for not focusing on audits of services provided by managed care plans was that they were more complex than audits of fee-for-service claims. We made three recommendations to improve federal and state oversight of Medicaid managed care expenditures. Since then, CMS has addressed these recommendations. CMS has, for example, issued a final rule on Medicaid managed care, which requires states to conduct periodic audits of financial data submitted by, or on behalf of, each Medicaid managed care plan. CMS’s Center for Program Integrity is the agency’s focal point for Medicaid and Medicare program integrity issues. Initially, CMS’s Medicaid program integrity activities were administered by a unit separate from its Medicare program integrity activities. In an effort to strengthen and better coordinate its program integrity efforts, CMS reorganized the Center for Program Integrity in 2014 to align functional activities and integrate Medicaid and Medicare program integrity efforts where possible. CMS has a range of program integrity activities that are important to overseeing and supporting states’ Medicaid programs. Several of its core activities have undergone changes in recent years. For example: 1. Reviews of state program integrity efforts. Each year, CMS selects a group of states and reviews aspects of their program integrity efforts. From 2007 to 2013, CMS conducted comprehensive, on-site regulation-based reviews of each state’s program integrity activities every 3 years. In fiscal year 2014, CMS shifted the focus of the state program integrity reviews from a comprehensive review approach to a “focused review” approach. According to CMS, this new approach to state program integrity reviews is intended to focus on high-risk areas of concern particular to each state, reduce the burden on states, and identify more opportunities to provide technical assistance to the states. Since 2014, CMS has conducted focused reviews on selected high-risk areas each year; although these reviews have been narrower in scope than the comprehensive regulatory reviews, they still involve on-site visits to states. As with previous reviews, CMS continues to publish its findings in state-specific review reports. CMS also publishes reports that compile findings from individual state- specific reports. States are required to submit corrective action plans for addressing any areas of regulatory non-compliance that CMS identifies, and CMS follows up on states’ planned corrective actions. In 2016, CMS began off-site desk reviews of states’ program integrity efforts to supplement the focused reviews. 2. Collaborative federal-state audits. In accordance with the Deficit Reduction Act, CMS contracts with eligible entities to review the actions of Medicaid providers, and audit providers’ claims to identify overpayments. In 2012, we made several recommendations to improve the efficiency of these audits, and CMS took action to address our recommendations. For example, CMS has shifted from its previous audit approach—in which CMS contractors, the MICs, used extracts of often incomplete federal data to identify providers for audits—to a new “collaborative audit” model in which states agree to post-payment audits and provide state data to the MICs. As a part of the collaborative audit process, the state—together with CMS— determines the audit processes the MICs follow. In some instances, the MIC conducts the entire audit; in other cases, it supplements state resources by providing medical review staff and other resources. States are responsible for collecting overpayments identified by the MICs, and are permitted 1 year from the date of discovery to return the federal share. Beginning in 2016, as a component of CMS’s efforts to strengthen and consolidate its program integrity efforts, CMS began shifting from the three regional MICs focused on Medicaid to five new regional Unified Program Integrity Contractors (UPIC) responsible for a range of Medicare and Medicaid program integrity activities previously performed by other contractors. According to CMS, the purpose of the UPICs is to coordinate provider investigations across Medicare and Medicaid; improve collaboration with states by providing a mutually beneficial service; and increase contractor accountability through coordinated oversight. According to CMS officials, aspects of the UPIC program—such as the goal of having contractors work collaboratively with states—reflect their prior experiences with the collaborative audits. CMS began awarding UPIC contracts in 2016; it plans to award all the contracts by the end of 2017, and ultimately phase out the MICs. 3. Medicaid Integrity Institute. In 2007, CMS established the MII, the first national Medicaid training program for state program integrity officials. CMS entered into an interagency agreement with the Department of Justice to house the MII at the National Advocacy Center, located at the University of South Carolina. The MII offers substantive training and support in a structured learning environment at no cost to the states, with the first trainings offered in fiscal year 2008. The MII trainings include multi-day on-site courses and workgroups, as well as webinars. The MII has offered from 19 to 22 on-site courses, 1 to 3 workgroups, and 2 to 13 webinars each year from fiscal years 2012 through 2015. In fiscal year 2015, individual course sizes ranged from 25 participants to the largest class accommodating over 70 participants. Almost 3,800 attendees participated in on-site courses from fiscal years 2012 through 2015. (See app. I for attendance by state for fiscal years 2012 through 2015.) In fiscal year 2013, the MII began the Certified Program Integrity Professional credentialing program. The MII also provides a secure online platform for state-to-state information sharing known as the Regional Information Sharing System. State officials must register to gain access to the Regional Information Sharing System, and participation is voluntary. Currently there are approximately 360 users. 4. State provider enrollment and screening. CMS has taken steps to support and oversee states’ efforts to enroll and screen providers for participation in Medicaid. For example, CMS has published guidance regarding the enhanced provider screening and enrollment requirements under PPACA. CMS has also conducted site visits to assist states with challenges in implementing these requirements, and has provided education, outreach, and assistance to states through webinars, training calls, an optional data compare service, and other means, according to CMS. In addition, CMS estimates the rate of improper payments in Medicaid, and provides information, guidance, and technical assistance to states. CMS’s Medicaid Payment Error Rate Measurement (PERM) program estimates improper payments in Medicaid in three component areas: (1) fee-for-service claims, (2) managed care, and (3) eligibility. CMS calculates a national Medicaid improper payment rate, as well as improper payment rates for each state. CMS also provides states with information and opportunities for collaboration with the federal government and other states in a number of ways, including through Medicaid Fraud, Waste and Abuse TAG meetings; quarterly teleconferences with regional program integrity directors; and webinars (separate from the training webinars of the MII) for state Medicaid program integrity staff on topics such as the use of the CMS Fraud Investigation Database. To support state program integrity efforts, CMS issues guidance and publishes educational toolkits for providers and beneficiaries and toolkits for state program integrity officials. Toolkits for state program integrity officials address issues such as frequent findings from state program integrity reviews in the area of provider enrollment, provider payment suspension, and assessing data analytic capabilities. CMS also provides technical assistance in response to states’ needs, such as responses to state inquiries about specific program integrity areas and suggestions for resources to help address states’ program integrity concerns. CMS has tailored its focused program integrity reviews to states’ managed care delivery systems and other areas that are at high risk for improper payments. CMS also recently began using targeted off-site desk reviews of certain state program integrity efforts to expand its oversight efforts. From fiscal years 2014 through 2016, CMS conducted focused reviews of state program integrity efforts in 31 states, reviewing 10 or 11 states annually.