The 50 states, the District of Columbia, and the 5 U.S. territories (hereafter referred to collectively as “states”) each administer a state- based Medicaid program. Federal laws authorize both federal and state entities to protect the program from fraud, waste, and abuse. Specifically, various provisions of federal law give CMS the authority to oversee Medicaid program integrity and to set requirements with which state Medicaid programs must comply. CMS oversees the states’ Medicaid programs by providing administrators with guidance related to statutory and regulatory requirements, as well as technical assistance on specific program integrity activities, such as the implementation of supporting information systems. Further, the Deficit Reduction Act of 2005 established the Medicaid Integrity Program within CMS to support and oversee state program integrity efforts. To carry out its oversight responsibilities, CMS established within that program the Medicaid Integrity Group, which was responsible for conducting comprehensive reviews of states’ Medicaid program integrity activities to assess their compliance with federal program integrity laws and regulations. Administrators of the 56 state-based programs are responsible for the day-to-day operations, including program integrity activities, of Medicaid. State Medicaid administrators employ the expertise of program integrity analysts to screen providers and determine whether the providers are eligible to enroll in the program. These analysts are also responsible for reviewing claims filed for services before they are paid, and for reviewing claims after they have been paid. Provider enrollment: When enrolling providers to participate in the program, states are to first verify the providers’ eligibility. As part of the enrollment screening process, state program integrity analysts collect certain information about the providers, which may include the results of any criminal background checks and whether they are identified on lists that exclude or bar them from participating in other states’ Medicaid programs or the federal Medicare program. Any providers who are determined to be ineligible as a result of information obtained through the screening process are excluded from participating in Medicaid. Prepayment claims review: The states also conduct reviews of claims data submitted by providers prior to payment in attempts to ensure that the claims were filed properly. For example, program integrity analysts conduct reviews to identify errors in individual claims, such as incorrect medical codes, and return claims that are found to have errors to the providers, thus preventing payment of such claims until the errors are corrected. The analysts may also compare claims data to prior incidents of known fraudulent behavior in their efforts to identify providers for further investigation. Post-payment claims review: Medicaid administrators also are to take steps to identify payments that were made to providers for improperly filed claims. In this regard, states’ program integrity analysts may compare data from multiple paid claims to related provider records as they attempt to identify behaviors consistent with fraudulent activity that had been identified previously. Providers demonstrating such behaviors would then be subjected to additional review by states’ auditors and investigators, who are tasked to take actions intended to recover the amounts reimbursed for improper or fraudulent claims. Figure 1 presents a simplified illustration of the provider enrollment, prepayment review, and post-payment review activities. The implementation of information systems is integral to states’ efforts to conduct the program integrity activities covering provider enrollment through post-payment claims review. In this regard, the Social Security provides that, to receive federal funds for Medicaid, Act, as amended,every state must implement a claims processing and information retrieval system to support the administration of the program. For the Medicaid program, this system is the Medicaid Management Information System (MMIS). In accordance with the act, as amended, and relevant regulations, CMS further defined criteria that states must meet to be approved to receive federal funds, including the implementation of system functionality that supports key Medicaid business areas. Such areas would include program performance management, business relationships, and operations management. Program integrity is a component of the performance management business area. CMS also defined requirements for implementing MMISs, including various subsystems that support program integrity activities, such as provider screening, claims processing, and utilization reviews. The MMIS provider subsystem is to be used to enroll and maintain a state’s network of providers for serving the Medicaid beneficiary population. Among other things, this subsystem is to include functionality needed to determine the eligibility of the providers participating in Medicaid. For example, the system is to allow Medicaid program administrators the ability to cross-reference license and sanction information with other states and federal agencies in order to identify providers who may not be eligible to enroll. State Medicaid programs are to define and implement functionality within this subsystem to validate providers’ enrollment based on state- specific criteria, such as license and permit expiration dates. The MMIS claims processing subsystem is to be used to review data from claims filed by providers before they are paid and is to provide functionality needed to prevent improper payments of claims. For example, when analyzing claims data prior to payment, this subsystem is to be used by Medicaid administrators to identify improperly filed claims through the implementation of prepayment edits—i.e., instructions that system developers code into the subsystem to electronically compare claims data to program requirements in order to assure that claims are filed properly before they are approved for payment. Any claims that do not pass such edits are denied for payment or flagged for additional review by program integrity analysts. The MMIS surveillance and utilization review subsystem (SURS) is to be used by program integrity analysts when they conduct post- payment reviews of claims in an attempt to detect any that were paid improperly. Specifically, the subsystem provides functionality to analyze data supporting the denial or payment of multiple claims submitted by a particular provider to help identify patterns that may indicate inappropriate provider behavior and, therefore, detect improper payments of claims. For example, payments made to a provider for an unusually large number of services for an uncommon type of procedure over a relatively short period of time could indicate fraudulent behavior on that provider’s part and, therefore, warrant additional review or investigation of the provider’s practices. Additionally, within their MMIS IT environment, states may implement other components, such as databases and data warehouses, to store the beneficiary, claims, and provider data that are collected for processing and analysis by the system and its subsystems. Further, in accordance with the Patient Protection and Affordable Care Act (PPACA), CMS identified certain prepayment edits and required state Medicaid administrators to incorporate these edits into their MMIS claims processing subsystem.for identifying incorrect coding on Medicaid claims that, if undetected, could lead to improper payments for ambulatory surgical center services, outpatient hospital services, and durable medical equipment. Specifically, states are to implement functionality Prepayment edits that provide such functionality were developed through efforts of the National Correct Coding Initiative (NCCI)—a program implemented by CMS in 1996 for the Medicare fee-for-service program. Through this initiative, CMS defined more than a million standard claims processing prepayment edits to identify coding errors that are applicable to state programs. For example, some of the edits can identify pairs of medical billing codes that indicate to program integrity analysts any services that should not be reported together, such as two codes for the same service for the same beneficiary on the same date. In such cases, the first code would be eligible for payment but the second code would be denied. Other NCCI edits required for Medicaid programs are designed to identify procedures that could not be performed during a patient’s visit because they would not be feasible based on anatomic or gender considerations. For example, processing claims data against the edits may identify services such as prenatal treatment for a male patient that would not be a likely or feasible medical service. In addition to the NCCI edits, states may design and implement prepayment edits based on their own program experiences and needs to identify improperly filed claims and prevent payment of such claims. Provider enrollment and pre- and post-payment claims data review activities, and the MMIS subsystems that support them, were designed primarily to address program integrity goals of states’ delivery of fee-for- service health care to Medicaid beneficiaries. In fee-for-service plans, providers are paid for each service that is delivered; they file claims for reimbursement from Medicaid that include detailed data specific to the service delivered during a patient’s visit. However, as we noted in May 2014, over the past 15 years, states have more frequently implemented managed care delivery systems for providing health care services for Medicaid beneficiaries.care delivery, beneficiaries obtain some or all of their medical services from organizations of providers that are under contract with the state to provide Medicaid benefits in exchange for a monthly payment. The payments to these managed care organizations are typically made by the state Medicaid programs on a predetermined, per-person basis. While the individual managed care providers do not file claims for reimbursement by Medicaid, the managed care organizations are expected to report data to state Medicaid programs that allow the Medicaid administrators to track the services received by beneficiaries enrolled in managed care. These data are referred to as encounter data and are obtained from claims for With managed reimbursement that providers submit to their managed care organizations for services delivered. Encounter data are similar to the fee-for-service claims data, but they typically do not include the same level of detail, and specific encounter data elements may be defined differently than they are for claims data. For example, encounter data generally would not include a Medicaid- billed amount for a particular beneficiary’s visit to a provider because the state does not pay the provider directly. In contrast, the data included on a Medicaid fee-for-service claim would include a specific amount for services delivered to a beneficiary during a visit since providers in fee-for- service plans bill and are reimbursed on a service-by-service basis. Thus, all the data needed for analyses by MMISs and other systems that were designed to process fee-for-service claims data will not always be consistent or available from the encounter data that managed care organizations collect and report to state Medicaid program administrators.