Under PPACA, health-care marketplaces were intended to provide a single point of access for individuals to enroll in private health plans, apply for income-based subsidies to offset the cost of these plans— which, as noted, are not paid directly to enrollees, but instead are paid to health-insurance issuers—and, as applicable, obtain an eligibility determination or assessment of eligibility for other health-coverage programs. These other programs include Medicaid and the Children’s Health Insurance Program. CMS, a unit of HHS, is responsible for overseeing the establishment of these online marketplaces, and the agency maintains the federal Marketplace. To be eligible to enroll in a “qualified health plan” offered through a marketplace—that is, one providing essential health benefits and meeting other requirements under PPACA—an individual must be a U.S. citizen or national, or otherwise be lawfully present in the United States; reside in the marketplace service area; and not be incarcerated (unless incarcerated while awaiting disposition of charges). To be eligible for Medicaid, individuals must meet federal requirements regarding residency, U.S. citizenship or immigration status, and income limits, as well as any additional state-specific criteria that may apply. When applying for coverage, individuals report family size and the amount of projected income. Based, in part, on that information, the Marketplace will calculate the maximum allowable amount of advance premium tax credit. An applicant can then decide if he or she wants all, some, or none of the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment. Marketplaces are required by PPACA to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for the income-based subsidies or Medicaid. These verification steps include validating an applicant’s Social Security number, if one is provided; verifying citizenship, status as a U.S. national, or lawful presence by comparison with Social Security Administration or Department of Homeland Security records; and verifying household income and family size by comparison with tax-return data from the Internal Revenue Service, as well as data on Social Security benefits from the Social Security Administration. PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another method approved by HHS. To implement this verification process, CMS developed the data services hub, which acts as a portal for exchanging information between the federal Marketplace, state-based marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other federal agencies. The Marketplace uses the data services hub in an attempt to verify that applicant information necessary to support an eligibility determination is consistent with external data sources. In February 2016, we issued a report addressing CMS enrollment controls and the agency’s management of enrollment fraud risk for the federal Marketplace. Based on our 2014 undercover testing for qualified health plans and related work, this report included eight recommendations to HHS to strengthen oversight of the federal Marketplace. HHS concurred with our recommendations; however, it is too early to determine whether HHS will fully address the issues we identified. Our recommendations addressed issues also relevant to our 2015 testing described in this report, including studying changes to improve eligibility determinations and the data services hub process; tracking the value of subsidies terminated or adjusted for failure to resolve application inconsistencies; implementing procedures for resolving Social Security number inconsistencies; and conducting a comprehensive fraud risk assessment of the potential for fraud in the process for applying for qualified health plans through the federal Marketplace. Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for qualified health plans remains vulnerable to fraud. As shown in figure 1, the federal Marketplace or selected state marketplaces approved each of our 10 fictitious applications for subsidized qualified health plans. We subsequently paid premiums to put these policies into force. As figure 1 shows, for these 10 applications, we were approved for subsidized coverage—the premium tax credit, paid in advance, and cost- sharing reduction subsidies—for all cases. The monthly amount of the advance premium tax credit for these 10 applicants totaled approximately $2,300 per month, or about $28,000 annually, equal to about 70 percent of total premiums. For 4 of these applications, we used Social Security numbers that could not have been issued by the Social Security Administration. For 4 other applications, we said our fictitious applicants worked at a company—which we also created—that offered health insurance, but the coverage did not provide required minimum essential coverage under PPACA. For the final 2 applications, we used an identity from our prior undercover testing of the federal Marketplace to apply for coverage concurrently at two state marketplaces. Thus, this fictitious applicant received subsidized qualified health-plan coverage from the federal Marketplace and the two selected state marketplaces at the same time. For 8 applications among this group of 10, we failed to clear an identity- checking step during the “front end” of the application process, and thus could not complete the process. In these cases, we were directed to contact a contractor that handles identity checking. The contractor was unable to resolve the identity issues and directed us to call the appropriate marketplace. We proceeded to phone the marketplaces and our applications were subsequently approved. The other two applicants were accepted by phone. For each of the 10 fictitious applications where we obtained qualified health-plan coverage, the respective marketplace directed that our applicants submit supplementary documentation. The marketplaces are required to seek postapproval documentation in the case of certain application “inconsistencies”—instances in which information an applicant has provided does not match information contained in data sources that the marketplace uses for eligibility verification at the time of application, or such information is not available. If there is an application inconsistency, the marketplace is to determine eligibility using the applicant’s attestations and ensure that subsidies are provided on behalf of the applicant, if qualified to receive them, while the inconsistency is being resolved using “back-end” controls. Under these controls, applicants will be asked to provide additional information or documentation for the marketplaces to review in order to resolve the inconsistency. As part of our testing, and to respond to the marketplace directives, we provided counterfeit follow-up documentation, such as fictitious Social Security cards with impossible Social Security numbers, for all 10 undercover applications. For all 10 of these fictitious applications, we maintained subsidized coverage beyond the period during which applicants may file supporting documentation to resolve inconsistencies. In one case, the Kentucky marketplace questioned the validity of the Social Security number our applicant provided, which was an impossible Social Security number. In fact, the marketplace told us the Social Security Administration reported that the number was not valid. Nevertheless, the Kentucky marketplace notified our fictitious applicant that the applicant was found eligible for coverage. For the four fictitious applicants who claimed their employer did not provide minimum essential coverage, the marketplace did not contact our fictitious employer to confirm the applicant’s account that the company offers only substandard coverage. In August 2015, we briefed CMS, California, and Kentucky officials on the results of our undercover testing, to obtain their views. According to these officials, the marketplaces only inspect for documents that have obviously been altered. Thus, if the documentation submitted does not appear to have any obvious alterations, it would not be questioned for authenticity. In addition, according to Kentucky officials, in the case of the impossible Social Security number, the identity-proofing process functioned correctly, but a marketplace worker bypassed identity-proofing steps that would have required a manual verification of the fictitious Social Security card we submitted. The officials told us they plan to provide training on how to conduct manual verifications to prevent this in the future. Further, California officials told us in June 2016 that the marketplace is upgrading its system in an effort to prevent use of impossible Social Security numbers. In the case of applicant identity verification in particular, Covered California officials told us they believed it was likely our applicants had their identities confirmed because they ultimately submitted paper applications, signed under penalty of perjury. That attestation satisfied identity verification requirements, the officials said. As for our employer-sponsored coverage testing, CMS and California officials told us that during the 2015 enrollment period, the marketplaces accepted applicants’ attestation on lack of minimum essential coverage. As a result, the marketplaces were not required to communicate with the applicant’s employer to confirm whether the attestation is valid. In June 2016, California officials further told us the marketplace is updating its application process to provide tools to consumers to help them determine whether their employer-sponsored insurance meets minimum essential coverage standards. They also told us the marketplace is updating policies and procedures for sending notices to employers and developing longer-term plans for an automated system to send notices to employers. Kentucky officials told us after our 2015 testing that applicant-provided information is entered into its system to determine whether the applicant’s claimed plan meets minimum essential coverage standards. If an applicant receives a qualified health-plan subsidy because the applicant’s employer-sponsored plan does not meet the guidelines, the Kentucky marketplace sends a notice to the employer asking it to verify the applicant information. The officials told us the employer letter details, among other things, the applicant-provided information and minimum essential coverage standards. However, our fictitious company did not receive such notification. After our 2015 testing, CMS, California, and Kentucky officials also told us there was no process to identify individuals with multiple enrollments through different marketplaces. California officials noted in June 2016 that the federal government has not made data available that would allow California to identify duplicate enrollments through different marketplaces. CMS officials told us it was unlikely an individual would seek to obtain subsidized qualified health-plan coverage in multiple states. We conducted this portion of our testing, however, to evaluate whether such a situation, such as a stolen identity, would be possible.