Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process remains vulnerable to fraud. As shown in figure 1, the federal Marketplace or selected state marketplaces approved each of our 10 fictitious applications for subsidized qualified health plans. We subsequently paid premiums to put these policies into force. As the figure shows, for these 10 applications, we were approved for subsidized coverage—the premium tax credit, paid in advance, and cost- sharing reduction subsidies—for all cases. The monthly amount of the advance premium tax credit for these 10 applicants totaled approximately $2,300 per month, or about $28,000 annually, equal to about 70 percent of total premiums. For 4 of these applications, we used Social Security numbers that could not have been issued by the Social Security Administration. For 4 other applications, we said our fictitious applicants worked at a company—which we also created—that offered health insurance, but the coverage did not provide required minimum essential coverage under PPACA. For the final 2 applications, we used an identity from our prior undercover testing of the federal Marketplace to apply for coverage concurrently at two state marketplaces. Thus, this fictitious applicant received subsidized qualified health-plan coverage from the federal Marketplace and the two selected state marketplaces at the same time. For 8 applications among this group of 10, we failed to clear an identity- checking step during the “front end” of the application process, and thus could not complete the process. In these cases, we were directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces and our applications were subsequently approved. The other two applicants were accepted by phone. For each of the 10 undercover applications where we obtained qualified health-plan coverage, the respective marketplace directed that our applicants submit supplementary documentation. The marketplaces are required to seek postapproval documentation in the case of certain application “inconsistencies”—instances in which information an applicant has provided does not match information contained in data sources that the marketplace uses for eligibility verification at the time of application, or such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved using “back-end” controls. Under these controls, applicants will be asked to provide additional information or documentation for the marketplaces to review in order to resolve the inconsistency. As part of our testing, and to respond to the marketplace directives, we provided counterfeit follow-up documentation, such as fictitious Social Security cards with impossible Social Security numbers, for all 10 undercover applications. For all 10 of these undercover applications, we maintained subsidized coverage beyond the period during which applicants may file supporting documentation to resolve inconsistencies. In one case, the Kentucky marketplace questioned the validity of the Social Security number our applicant provided, which was an impossible Social Security number. In fact, the marketplace told us the Social Security Administration reported that the number was not valid. Despite this, however, the Kentucky marketplace notified our fictitious applicant that the applicant was found eligible for coverage. For the four fictitious applicants who claimed their employer did not provide minimum essential coverage, the marketplace did not contact our fictitious employer to confirm the applicant’s account that the company offers only substandard coverage. In August 2015, we briefed CMS and California and Kentucky state officials on the results of our undercover testing, to obtain their views. According to these officials, the marketplaces only inspect for documents that have obviously been altered. Thus, if the documentation submitted does not appear to have any obvious alterations, it would not be questioned for authenticity. In addition, according to Kentucky officials, in the case of the impossible Social Security number, the identity-proofing process functioned correctly, but a marketplace worker bypassed identity- proofing steps that would have required a manual verification of the fictitious Social Security card we submitted. The officials told us they plan to provide training on how to conduct manual verifications to prevent this in the future. As for our employer-sponsored coverage testing, CMS and California officials told us that during the 2015 enrollment period, the marketplaces accepted applicants’ attestation on lack of minimum essential coverage. As a result, the marketplaces were not required to communicate with the applicant’s employer to confirm whether the attestation is valid. Kentucky officials told us that applicant-provided information is entered into its system to determine whether the applicant’s claimed plan meets minimum essential coverage standards. If an applicant receives a qualified health-plan subsidy because the applicant’s employer- sponsored plan does not meet the guidelines, the Kentucky marketplace sends a notice to the employer asking it to verify the applicant information. The officials told us the employer letter details, among other things, the applicant-provided information and minimum essential coverage standards. However, our fictitious company did not receive such notification. CMS, California, and Kentucky officials also told us there is no current process to identify individuals with multiple enrollments through different marketplaces. CMS officials told us it was unlikely an individual would seek to obtain subsidized qualified health-plan coverage in multiple states. We conducted this portion of our testing, however, to evaluate whether such a situation, such as a stolen identity, would be possible. CMS officials told us the agency would need to look at the risk associated with multiple coverage. Kentucky officials told us that in response to our findings, call center staff have been retrained on identity-proofing processes, and that they are improving training for other staff as well. They also said they plan changes before the next open-enrollment period so that call center representatives cannot bypass identity-proofing steps, as occurred with our applications. Further, they said they plan to improve the process for handling of applications where employer-sponsored coverage is at issue. Also in response to our findings, California officials said they are developing process improvements and system modifications to address the issues we raised, and would share details later. Finally, in the case of the federal Marketplace in particular, for which, as noted, we conducted undercover testing previously, we asked CMS officials for their views on our second-year results compared to the first year. They told us the eligibility and enrollment system is generally performing as designed. According to the officials, a key feature of the system, when applicant information cannot immediately be verified, is whether proper inconsistencies are generated, in order that they can be addressed later, after eligibility is granted at time of application. Earlier, CMS officials told us the overall approach is that CMS must balance consumers’ ability to effectively and efficiently select Marketplace coverage with program-integrity concerns. In addition to our applications for subsidized private health plans, we also made eight additional fictitious applications for Medicaid coverage in order to test the ability to apply for that program through the marketplaces. As shown in figure 2, in these tests, we were approved for subsidized health-care coverage for seven of the eight applications. For three of the eight applications, we were approved for Medicaid, as originally sought. For four of the eight applications, we did not obtain Medicaid approval, but instead were subsequently approved for subsidized qualified health-plan coverage. The monthly amount of the advance premium tax credit for these four applicants totaled approximately $1,100 per month, or about $13,000 annually. For one of the eight applications, we could not obtain Medicaid coverage because we declined to provide a Social Security number. As with our applications for qualified health plans described earlier, we also failed to clear an identity-checking step for six of eight Medicaid applications. In these cases, we were likewise directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces. However, as shown in figure 2, the California marketplace did not continue to process one of our Medicaid applications. In this case, our fictitious phone applicant declined to provide what was a valid Social Security number, citing privacy concerns. A marketplace representative told us that, to apply, the applicant must provide a Social Security number. The representative suggested that as an alternative, we could apply for Medicaid in person with the local county office or a certified enrollment counselor. After we discussed the results of our undercover testing with California officials, they told us their system requires applicants to provide either a Social Security number or an individual taxpayer-identification number to process an application. As a result, because our fictitious applicant declined to provide a Social Security number, our application could not be processed. For the four Medicaid applications submitted to the federal Marketplace, we were told that we may be eligible for Medicaid but that the respective Medicaid state offices might require more information. For three of the four applications, federal Marketplace representatives told us we would be contacted by the Medicaid state offices within 30 days. However, the Medicaid offices did not notify us within 30 days for any of the applications. As a result, we subsequently contacted the state Medicaid offices and the federal Marketplace to follow up on the status of our applications. For the two New Jersey Medicaid applications, we periodically called the state Medicaid offices over approximately 4 months, attempting to determine the status of our applications. In these calls, New Jersey representatives generally told us they had not yet received Medicaid information from the federal Marketplace and, on several occasions, said they expected to receive it shortly. After our calls to New Jersey Medicaid offices, we phoned the federal Marketplace to determine the status of our Medicaid applications. In one case, the federal Marketplace representative told us New Jersey determined that our applicant did not qualify for Medicaid. As a result, the phone representative stated that we were then eligible for qualified health-plan coverage. We subsequently applied for coverage and were approved for an advance premium tax credit plus the cost- sharing reduction subsidy.