Under Medicaid managed care, states contract with health plans and prospectively pay the plans a fixed monthly rate per enrollee to provide or arrange for most health services. These contracts are known as “risk” contracts because plans assume the risk for the cost of providing covered services. States’ processes for developing rates may vary in a number of ways, including the type and time frames of data they use as the basis for setting rates, referred to as the base-year data, and what approach they use to negotiate rates with health plans. After rates are developed, an actuary certifies the rates as actuarially sound for a defined period of time, typically 1 year. In order to receive federal funds for its managed care program, a state is required to submit its rate-setting methodology and rates to CMS for review and approval. This review, completed by CMS regional office staff, is designed to ensure a state complies with federal regulatory requirements for setting actuarially sound rates. CMS published a final rule on June 14, 2002, outlining the agency’s regulatory requirements for actuarially sound rates. These requirements largely focus on the process states must use in setting rates. For example, the regulations require states to document their rate-setting methodology and include an actuarial certification of rates. In addition, the regulations include a requirement that when states use data from health plans as the basis for rates they must have plan executives certify the accuracy and completeness of their data. The regulations do not include standards for the type, amount, or age of the data that states mayuse in setting rates. The regulations also do not include standards for the reasonableness or adequacy of rates. In the preamble to the final rule, CMS noted that health plans were better able to determine the reasonableness and adequacy of rates when deciding whether to contr act with a state. In July 2003, CMS finalized a detailed checklist that regional office staff could use when reviewing states’ rate-setting submissions for compliance with the actuarial soundness requirements and that states and states’ actuaries could use when developing rates. The checklist includes citations to, and a description of, each regulatory requirement; guidance on what constitutes state compliance with the requirement; and spaces for the CMS official to check whether each requirement was met and cite evidence from the state’s submission for compliance with the requirement. The checklist also provides guidance on the level of review that should occur for different types of rate changes. When the state is developing a new rate, or using new actuarial techniques or data to change previously approved rates, the checklist indicates a full review should be done, which entails reviewing the state’s submission for compliance with all of the requirements covered in the checklist. For adjustments to rates that were previously approved as meeting the regulations, the checklist indicates a partial review should be done; a partial review focuses on a few key requirements in the checklist, such as ensuring that the state has included a certification of rates from a qualified actuary. As of June 2010, CMS was in the process of revising the checklist. One of the planned changes was to emphasize the need for more complete encounter data because CMS officials indicated that the agency has determined that encounter data that do not include pricing information are not sufficient for setting rates. CMS expects to complete the checklist revisions by November 2010. (See table 1 for a summary of the sections in CMS’s checklist.) According to CMS officials, the regional officials responsible for conducting rate-setting reviews may have a financial background, but are not actuaries. Officials also noted that CMS’s OACT, which provides actuarial advice to other offices within CMS, is generally not involved with Medicaid rate-setting reviews. However, they indicated that when the CMS officials responsible for rate-setting reviews have concerns with a state’s rate-setting methodology and cannot resolve those concerns with the state, they can contact OACT to request an independent review. CMS’s regulations require that actuarially sound rates be developed in accordance with generally accepted actuarial principles and practices. There is no Actuarial Standard of Practice (ASOP) that applies to actuarial work performed to comply with CMS’s regulations. However, in 2005, the American Academy of Actuaries published a practice note that provides nonbinding guidance on certifying Medicaid managed care rates. The practice note includes a proposed definition for “actuarial soundness,” as there was no other working definition of the term that would be relevant to the actuary’s role in certifying Medicaid managed care rates. Under the definition, rates are actuarially sound if, for the period of time covered by the certification, projected premiums provide for all “reasonable, appropriate, and attainable costs;” also under the definition, rates do not have to encompass all possible costs that any health plan might incur. The note emphasizes that the definition only applies to the certification of Medicaid managed care rates, and that it differs from the definition used when certifying a health plan’s rates. The practice note also provides information on the actuary’s role in assessing the quality of data used to set rates and refers the actuary to the ASOP on data quality for further guidance. The practice note explains that if the actuary is involved in developing the rate, then the actuary would consider all available data, including FFS data, Medicaid managed care encounter data, and Medicaid managed care financial reports and financial statements. The actuary would typically compare data sources for reasonableness and check for material differences when determining the preferred source or sources for the base-year data. The ASOP on data quality clarifies that while actuaries should generally review the data for reasonableness and consistency they are not required to audit the data. The ASOP also explains that the accuracy and completeness of the data are the responsibility of those that provided them, namely the state or health plans. CMS has been inconsistent in its review of states’ rate setting. In the six CMS regional offices we reviewed, CMS had not reviewed one state’s rate setting for compliance with the actuarial soundness requirements and had not conducted a full review for another. We also identified a number of other inconsistencies in CMS’s review of states’ compliance with the actuarial soundness requirements. Variation in CMS regional offices’ practices contributed to these inconsistencies in oversight. In the six CMS regional offices we reviewed, we found inconsistencies in CMS’s review of state’s rate setting, including significant gaps in the agency’s oversight of two states’ compliance with the actuarial soundness requirements. First, CMS had not reviewed one state’s (Tennessee) rate setting for compliance with the actuarial soundness requirements or approved the state’s rates. In 2007, Tennessee began transitioning its managed care program, which included all of the state’s approximately 1 million Medicaid enrollees, to risk contracts that were subject to the actuarial soundness requirements. Since moving to risk contracts, the state submitted at least two actuarial reports to CMS’s Atlanta regional office indicating the program change, but these documents did not trigger a CMS review. These reports did not include actuarial certifications, and Tennessee officials confirmed that the state’s rates had not been certified by an actuary, which is a regulatory requirement. As a result, according to CMS officials, Tennessee received, and is continuing to receive, approximately $5 billion a year in federal funds for rates that we determined had not been certified by an actuary or assessed by CMS for compliance with the requirements. Based on issues we raised during our review, CMS determined that Tennessee was not in compliance with the actuarial soundness requirements and, as of June 2010, was working to bring the state into compliance. Second, while CMS officials said that all states should have had a full review of rate setting after the actuarial soundness requirements became effective in August 2002, it appeared that CMS officials had not completed a full rate-setting review for Nebraska. CMS had no documentation of its last full review of Nebraska’s rate setting, but officials believed that the last full review was completed in 2002. According to Nebraska officials, the state last made significant changes to its rate setting for the state fiscal year beginning in 2001, which according to criteria in CMS’s checklist would have triggered a full CMS review. Based on what CMS and Nebraska officials told us, CMS’s last full review was likely done before the actuarial requirements became effective. As a result, Nebraska received federal funds for more than 7 years for rates that may not have been in compliance with all of the actuarial soundness requirements. In addition to these gaps in oversight, we found inconsistencies in the reviews CMS completed. In instances when CMS did a full rate-setting review, it was unclear whether CMS consistently ensured that states met all of the actuarial soundness requirements. We found evidence that the rates in all 28 of the CMS files we reviewed were certified by a member of the American Academy of Actuaries, as is required by the regulations. However, the extent to which CMS ensured state compliance with other aspects of the actuarial soundness requirements—such as the requirement that rates be based only on services covered under the state’s Medicaid plan or costs related to providing these services—was unclear. For example, in nearly a third of the files we reviewed, or 8 of 28 files, CMS officials did not use the rate-setting checklist to document their review; therefore we could not determine whether CMS ensured that states were in compliance with all of the requirements. In 17 of the 20 remaining files where the CMS official used the checklist, the official cited evidence of the state’s compliance for some requirements, but not others. When officials did cite evidence, the evidence did not always appear to meet the requirements. For example, one of the requirements in the regulations is that states provide an assurance that rates are based only on services covered under the state’s Medicaid plan or costs related to providing these services. Of the 19 files where CMS officials cited evidence of such an assurance, we were unable to locate the assurance in 2 of the files.