The MIG has taken three different approaches since establishing the NMAP—test audits, Medicaid Statistical Information System (MSIS) audits, and collaborative audits. In each approach, contractors conducted post payment audits, that is, they reviewed medical documentation and other information related to Medicaid claims that had already been paid. The key differences among the three NMAP approaches were (1) the data sources used to identify audit targets, and (2) the roles assigned to states and contractors. In June 2007, the MIG hired a contractor to conduct test audits, and it implemented MSIS audits beginning in December 2007 by hiring separate review and audit contractors for each of five geographic areas of the country. Collaborative audits were introduced in January 2010. In June 2007, the MIG hired a contractor to conduct test audits in five states. Working with the MIG and the states, the contractor audited 27 providers. States provided the initial audit targets based on their own analysis of Medicaid Management Information System (MMIS) data. MMIS are mechanized claims processing and information retrieval systems maintained by individual states, and generally reflect real-time payments and adjustments of detailed claims for each health care service provided. In some cases, states provided samples of their claims data with which to perform the audits, and in other cases states provided a universe of paid claims that the MIG’s contractor analyzed to derive the sample. Twenty-seven test audits were conducted on hospitals, physicians, dentists, home health agencies, medical transport vendors, and durable medical equipment providers. In December 2007, while test audits were still under way, the MIG began hiring review and audit contractors to implement MSIS audits.audits differed from the test audits in three ways. First, MSIS audit targets were selected based on the analysis of Medicaid Statistical Information System (MSIS) data. MSIS is a national data set collected and maintained by CMS consisting of extracts from each state’s MMIS, including eligibility files and paid claims files that were intended for health care research and evaluation activities but not necessarily for auditing. As a subset of states’ more detailed MMIS data files, MSIS data do not include elements that can assist in audits, such as the explanations of benefit codes and the names of providers and beneficiaries. In addition, MSIS data are not as timely because of late state submissions and the time it takes CMS’s contractor to review and validate the data. MIG officials told us that they chose MSIS data because the data were readily available for all states and the state-based MMIS data would require a significant amount of additional work to standardize across states. (See table 1 below.) Second, MSIS audits were conducted over a wider geographic area; 44 states have had MSIS audits, compared with the small number of states selected for test audits. Third, MSIS audits use two types of contractors—review contractors to conduct data analysis and help identify audit leads, and audit contractors to conduct the audits. In the test audits, the states provided the initial audit leads. Review contractors. The MIG’s two review contractors analyze MSIS data to help identify potential audit targets in an analytic process known as data mining. The MIG issues monthly assignments to these contractors, and generally allows the contractors 60 days to complete them. For each assignment, the MIG specifies the state, type of Medicaid claims data, range of service dates, and algorithm (i.e., a specific set of logical rules or criteria used to analyze the data). The work of the review contractor is summarized in an algorithm findings report, which contains lists of providers ranked by the amount of their potential overpayment. The January through June 2010 algorithm reports reviewed by the HHS-OIG The identified 113,378 unique providers from about 1 million claims.MIG’s Division of Fraud Research & Detection oversees the technical work of the review contractors. A summary of the review contractor activities for MSIS audits is shown in figure 1. Audit contractors. The MIG’s audit contractors conduct postpayment audits of Medicaid providers. Audit leads are selected by the MIG’s Division of Field Operations, generally by looking at providers across one or more applicable algorithms to determine if they have been overpaid or demonstrated egregious billing patterns. From the hiring of audit contractors in December 2007 through February 2012, the division assigned 1,550 MSIS audits to its contractors. During an audit, the contractor may request and review copies of provider records, interview providers and office personnel, or visit provider facilities. If an overpayment is identified, the contractor drafts an audit report, which is shared with the provider and the state. Ultimately, the state is responsible for collecting any overpayments in accordance with state law and must report this information to CMS. A summary of the audit contractor activities is shown in figure 2. In June 2011, CMS released its fiscal year 2010 report to Congress, which outlined a redesign of the NMAP with an approach that closely resembled the test audits. The report described the redesign as an effort to enhance the NMAP and assist states with their program integrity priorities. CMS refers to this new approach as collaborative audits. In these collaborative audits, MIG and its contractor primarily used MMIS data and leveraged state resources and expertise to identify audit targets. In contrast, MSIS audits used separate review contractors and MSIS data to generate lists of providers with potential overpayments, and the MIG selected the specific providers to be audited. From June 2007 through February 2012, payments to the contractors for On an annual test, MSIS, and collaborative audits totaled $102 million.basis, these contractor payments account for more than 40 percent of all of the MIG’s expenditures on Medicaid program integrity activities. Contractor payments rose from $1.3 million in fiscal year 2007 and reached $33.7 million in fiscal year 2011. (See fig. 3.) The total cost of the NMAP is likely greater than $102 million because that figure does not include expenditures on the salaries of MIG staff that support the operation of the program. The MSIS audits were less effective in identifying potential overpayments than test and collaborative audits. The main reason for the difference in audit results was the use of MSIS data. According to MIG officials, they chose MSIS data because the data were readily available for all states, they are collected and maintained by CMS, and are intended for health care research and evaluation activities. However, the MSIS audits were not well coordinated with states, and duplicated and diverted resources from states’ program integrity activities. Compared with test and collaborative audits, the return on MSIS audits was significantly lower. As of February 2012, a small fraction of the 1,550 MSIS audits identified $7.4 million in potential overpayments. In contrast, 26 test audits and 6 collaborative audits together identified $12.5 million in potential overpayments (see fig. 4.) Appendix II provides details on the characteristics of MSIS audits that successfully identified overpayments. While the newer collaborative audits have not yet identified more in overpayments than MSIS audits, only 6 of the 112 collaborative audits have final audit reports (see app. III), suggesting that the total overpayment amounts identified through collaborative audits will continue to grow. In addition, the MSIS audits identified potential overpayments for much smaller amounts. Half of the MSIS audits were for potential overpayments of $16,000 or less, compared to a median of about $140,000 for test audits and $600,000 for collaborative audits. The use of MSIS data was the principal reason for the poor MSIS audit results, that is, the low amount of potential overpayments identified and the high proportion of unproductive audits. Over two-thirds (69 percent) of the 1,550 MSIS audits assigned to contractors through February 2012 were unproductive, that is, they were discontinued (625), had low or no findings (415), or were put on hold (37). (See fig. 5.) Our findings are consistent with an early assessment of the MIG’s audit contractors, which cited MSIS data issues as the top reason that MSIS audits identified a lower amount of potential overpayments. State program integrity officials, the HHS-OIG, and its audit contractors told the MIG that MSIS data would result in many false leads because the data do not contain critical audit elements, including provider identifiers; procedure, product, and service descriptions; billing information; and beneficiary and eligibility information. For example, the MIG assigned 81 MSIS audits in one state because providers appeared to be billing more than 24 hours of service in a single day. However, all of these audits were later discontinued because the underlying data were incomplete and thus misleading; the audited providers were actually large practices with multiple personnel, whose total billing in a single day legitimately exceeded 24 hours. One state official told us that when states met with the MIG staff during the roll out of the Medicaid Integrity Program, the state officials emphasized that (1) MSIS data could not be used for data mining or auditing because they were ‘stagnant,’ i.e., MSIS does not capture any adjustments that are subsequently made to a claim and (2) MMIS data were current and states would be willing to share their MMIS data with CMS. In their annual lessons-learned reports, the audit and review contractors told the MIG that the MSIS data were not timely or accurate, and recommended that the MIG help them obtain access to state MMIS data.based audits to its contractors; 78 percent of MSIS audits (1,208) were assigned after the August 2009 HHS-OIG report.