	Background

Under PPACA, health-care marketplaces were intended to provide a  single point of access for individuals to enroll in private health plans,  apply for income-based subsidies to offset the cost of these plans—which  are paid directly to health-insurance issuers—and, as applicable, obtain  an eligibility determination for other health coverage programs, such as  Medicaid or the Children’s Health Insurance Program. This is known as the advance  premium tax credit (APTC). CMS Does Not Analyze Data Hub Responses Used to Verify Applicant Information and Did Not Resolve One- Third of 2014 Federal Marketplace Applicant Inconsistencies

		CMS Does Not Analyze the Extent to Which the Data Hub Provides Applicant Verification Information

As noted, PPACA requires that consumer-submitted information in  applications for health-care coverage be verified, and CMS uses the data  hub to check external data sources when making eligibility  determinations. Overall, although the data hub plays a key role in the eligibility and  enrollment process, CMS officials said the agency does not track the  extent to which the federal agencies deliver responsive information to a  request, or, alternatively, whether they report that information was not  available. In doing so, CMS foregoes  information that could suggest potential program issues or potential  vulnerabilities to fraud, as well as information that might be useful for  enhancing program management. Meanwhile, our analysis found about 34 percent of  inconsistencies, with about $1.7 billion in associated subsidies, remained  open, as of April 2015—that is, inconsistencies still open several months  following the close of the 2014 coverage year. II), we  identified about 35,000 applications having an unresolved Social Security  number inconsistency, which were associated with about $154 million in  combined subsidies. Specifically, according to IRS officials, Social Security numbers are a key  identifier for tax reconciliation under the act. By not using  PUPS data in such a fashion, and by relying on applicant attestation in  the alternative, CMS may be granting eligibility to, and making subsidy  payments on behalf of, individuals who are ineligible to enroll in qualified  health plans. Our 11 fictitious enrollees maintained subsidized coverage throughout  2014, even though we sent fictitious documents, or no documents, to  resolve application inconsistencies. In addition, according to  GAO’s framework for managing fraud risks in federal programs, it is a  leading practice for agencies to regularly assess risks to determine a  fraud risk profile. Without  conducting a fraud risk assessment—as distinct from a more generalized  review of the eligibility determination process, as described earlier—CMS  is unlikely to know whether existing control activities are suitably designed  and implemented to reduce inherent fraud risk to an acceptable level. CMS relies on a contractor charged with document processing to  report possible instances of fraud, even though CMS does not require the  contractor to have fraud detection capabilities. A comprehensive risk  assessment identifying the potential for fraud in the enrollment process— which thus far has not been performed—could inform evaluations of  program integrity and the effectiveness of enrollment and eligibility  controls. GAO staff who made key contributions to this  report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of this review are to (1) examine the extent to which  information submitted by applicants under the Patient Protection and  Affordable Care Act (PPACA) is verified through the federal “data  services hub” (data hub)—the primary means for verifying eligibility—and  the extent to which the federal Health Insurance Marketplace  (Marketplace) resolved “inconsistencies” where applicant information  does not match information from federal data sources available through  the data hub; and (2) describe, by means of undercover testing and  related work, potential vulnerabilities to fraud in the federal Marketplace’s  application, enrollment, and eligibility verification processes, for the act’s  first open-enrollment period, for 2014 coverage. To examine outcomes of the data hub applicant verification process, we  obtained information from key federal agencies involved in the process— the Social Security Administration, the Internal Revenue Service, and the  Department of Homeland Security—on the nature and extent of their  responses to electronic inquiries made through the data hub, for the 2014  and 2015 coverage years. In addition, we obtained applicant  data on inconsistencies, subsidies awarded, and submission of required  verification documentation, from the Centers for Medicare & Medicaid  Services’ (CMS) Multidimensional Insurance Data Analytics System. To perform our undercover testing of the Marketplace application,  enrollment, and eligibility verification processes, we created 12 fictitious  identities for the purpose of making applications for individual health-care  coverage by telephone or online. They cannot, however, be generalized to the overall  population of all applicants or enrollees. Incarceration: About 2 percent (22,000) of applications had an  unresolved incarceration inconsistency and were associated with  about $68 million in total subsidies. CMS  did not terminate any coverage or adjust subsidies for Social Security  inconsistencies.
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can select private health-insurance plans. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $37 billion for fiscal year 2015. GAO was asked to examine the enrollment process and verification controls of the federal Marketplace. For the act's first open-enrollment period ending in March 2014, this report (1) examines the extent to which applicant information is verified through an electronic system, and the extent to which the federal Marketplace resolved “inconsistencies” where applicant information does not match information from federal data sources and (2) describes, by means of undercover testing and related work, potential vulnerabilities to fraud in the federal Marketplace's application, enrollment, and eligibility verification processes. GAO analyzed 2014 data from the Marketplace and federal agencies, interviewed CMS officials, and conducted undercover testing. To perform the undercover testing, GAO submitted or attempted to submit 12 fictitious Marketplace applications. The undercover results, while illustrative, cannot be generalized to the full population of enrollees.

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs.
During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.

What GAO Recommends

GAO makes eight recommendations, including that CMS consider analyzing outcomes of the verification system, take steps to resolve inconsistencies, and conduct a risk assessment of the potential for fraud in Marketplace applications. The Department of Health and Human Services concurred with GAO's recommendations.