Under CMS regulations, a consumer may qualify for an SEP due  to a specific triggering event, and generally would have up to 60 days  after the event to select and enroll in a qualified health plan. While PPACA requires marketplaces to verify application information to  determine eligibility for enrollment and income-based subsidies—such as  verifying U.S. citizenship, nationality, or lawful presence—there is no  specific legal requirement to verify the events that trigger an SEP. The February 2016 report included eight  recommendations, which are discussed below, to strengthen CMS  oversight of the Marketplace. In our February 2016 report, we recommended that the Secretary of  Health and Human Services direct the Acting Administrator of CMS to: (1)  conduct a feasibility study and create a written plan on actions that CMS can take to monitor and analyze the extent to which data hub queries  provide requested or relevant applicant verification information; (2) track  the value of enrollee subsidies that are terminated or adjusted for failure  to resolve application inconsistencies, and use this information to inform  assessments of program risks; (3) regarding cost-sharing subsidies that  are terminated or adjusted for failure to resolve application  inconsistencies, consider and document whether it would be feasible to  create a mechanism to recapture those costs; (4) identify and implement  procedures to resolve Social Security number inconsistencies where the  Marketplace is unable to verify Social Security numbers or applicants do  not provide them; (5) reevaluate CMS’s use of certain incarceration status  data and determine to either use these data or accept applicant  attestation on status in all cases; (6) create a written plan and schedule  for providing Marketplace call center representatives with access to  information on the current status of eligibility documents submitted to  CMS’s documents processing contractor; (7) conduct a fraud-risk  assessment, consistent with best practices described in GAO’s  framework for managing fraud risks in federal programs, of the potential  for fraud in the process of applying for qualified health plans through the  federal Marketplace; and (8) fully document prior to implementation, and  have readily available for inspection thereafter, any significant decision on  qualified health-plan enrollment and eligibility matters, with such  documentation to include details such as policy objectives, supporting  analysis, scope, and expected costs and effects. In formal comments on a draft of the report, HHS concurred with our  recommendations and outlined a number of steps it plans to take to  implement them. In an April 2016 letter, HHS described a number of  specific actions it had taken in response to our eight recommendations,  such as creating an integrated project team to perform the Marketplace  fraud-risk assessment. Consequently, we consider all  eight recommendations to remain open as of November 2016, pending  corroborating information. We will continue to monitor HHS’s progress in  implementing them. Implementing these recommendations as intended,  such as performing the fraud-risk assessment, could help address some  of the control vulnerabilities we identified during our SEP tests as well. Results of Undercover Attempts to Obtain Subsidized Qualified Health-Plan Coverage from the Federal Marketplace and Selected State-Based Marketplaces during an SEP

The federal or selected state-based marketplaces approved coverage  and subsidies for 9 of our 12 fictitious applicants who initially applied  online or by telephone seeking coverage during an SEP, as of October  2016. The 6  remaining fictitious applicants were not instructed to provide supporting  documentation related to the SEP triggering event. Figure 2 summarizes document submissions and outcomes for  the 12 fictitious applications for subsidized qualified health-plan coverage  during an SEP.
Officials from the marketplaces explained that they do not require  applicants to submit documentation to support certain SEP triggering  events. For other SEP triggering events, CMS officials explained that the  standard operating procedure in the federal marketplace is to enroll  applicants first, and verify documentation to support the SEP triggering  event after enrollment. However,  relying on self-attestation without verifying documents submitted to  support a SEP triggering event could allow actual applicants to obtain  subsidized coverage they would otherwise not qualify for. The remaining four of our six fictitious applicants to the selected state- based marketplaces were not instructed by the state marketplace to  provide supporting documentation to prove eligibility to enroll through the  SEP. Two of these four fictitious applicants were able to obtain and  maintain subsidized health insurance through the marketplace without  providing supporting documentation related to the SEP and are currently  enrolled in a qualified health plan. However,  according to federal and state officials, all applicants that apply for  enrollment during an SEP must attest under penalty of perjury that they  meet the conditions of eligibility for the SEP.

	Agency Comments and Our Evaluation

We provided a draft of this report to HHS, Covered California, and the  District of Columbia (DC) Health Benefit Exchange Authority. In their written comments, in terms of overall context,  these agencies reiterated that they are not required to verify the events  that trigger an SEP and instead rely on self-attestation and the associated  penalties, which we acknowledge and state in this report. As  mentioned above, prudent stewardship and good management practices  suggest that fraud risks be understood and managed to protect public  funds. Specifically, our 12 fictitious  applicants claimed to have experienced one of the following selected  events that may indicate eligibility, under certain circumstances, to enroll  in health coverage under an SEP: (1) loss of minimum essential health  coverage; (2) gained access to new qualified health plans as a result of a  permanent move to another state; (3) gained a dependent through  marriage; (4) experienced an exceptional circumstance, such as a serious  medical condition that prevented the consumer from enrolling during the  annual open enrollment period; (5) nonenrollment during the annual open  enrollment period was unintentional and the result of misinformation or  misrepresentation by a non-exchange entity providing enrollment  assistance or conducting enrollment activities; and (6) Medicaid  application filed during the annual open enrollment period was denied  after the open enrollment period had closed. We tested the six selected  triggering events in the federal marketplace.
Why GAO Did This Study

Under PPACA, consumers can enroll in health insurance coverage, or change from one qualified health plan to another, through the federal and state marketplaces either (1) during the annual open enrollment period or (2) outside of the open enrollment period, if they qualify for an SEP. A consumer may qualify for an SEP due to specific triggering events, such as a nonvoluntary loss of health-care coverage. CMS reported that 1.6 million individuals made a plan selection through an SEP in 2015.
GAO was asked to test marketplace enrollment and verification controls for applicants attempting to obtain coverage during an SEP.
This report describes the results of GAO attempts to obtain subsidized qualified health-plan coverage during the 2016 SEP in the federal marketplace and two selected state-based marketplaces—California and the District of Columbia.
To perform the undercover testing of enrollment verification, GAO submitted 12 new fictitious applications for subsidized health-insurance coverage outside of the open enrollment period in 2016. GAO's applications tested verifications related to a variety of SEP triggering events. The results cannot be generalized to all enrollees.
GAO provided a draft of this report to CMS and the selected state agencies. In their written comments, CMS and the states reiterated that they are not required to verify an SEP event and instead rely on self-attestation. However, prudent stewardship and good management practices suggest that fraud risks be understood and managed to protect public funds.

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires that federal and state-based marketplaces verify application information—such as citizenship or immigration status—to determine eligibility for enrollment in a health plan, potentially including a subsidy. However, there is no specific legal requirement to verify the events that trigger a Special Enrollment Period (SEP), which is an opportunity period to allow an individual to apply for health coverage after events such as losing minimum essential coverage or getting married. Prior to the start of GAO's enrollment tests, the Centers for Medicare & Medicaid Services (CMS), which maintains the federal Health Insurance Marketplace (Marketplace), implemented a policy to request that federal Marketplace applicants provide supporting documentation for certain SEP triggering events. According to CMS, ensuring that only qualified applicants enroll during an SEP is intended to prevent people from misusing the system to enroll in coverage only when they become sick. However, relying on self-attestation without verifying documents submitted to support an SEP triggering event, such as those mentioned above, could allow actual applicants to obtain subsidized coverage they would otherwise not qualify for.
The federal and selected state-based marketplaces approved health-insurance coverage and subsidies for 9 of 12 of GAO's fictitious applications made during a 2016 SEP. The remaining 3 fictitious applicants were denied. The marketplaces instructed 6 of 12 applicants to provide supporting documentation, such as a copy of a recent marriage certificate, related to the SEP triggering event; the remaining 6 of 12 were not instructed to do so. For 5 applicants, GAO provided no documents to support the SEP triggering event, but coverage was approved anyway. Officials from the marketplaces explained that they do not require applicants to submit documentation to support certain SEP triggering events. For other SEP triggering events, CMS officials explained that the standard operating procedure in the federal Marketplace is to enroll applicants first, and verify documentation to support the SEP triggering event after enrollment. The officials also noted that all applicants must attest to their eligibility for enrollment.


What GAO Recommends

GAO is not making any recommendations to the Department of Health and Human Services (HHS) in this report. However, GAO made eight recommendations to strengthen PPACA enrollment controls in a February 2016 report; these recommendations included conducting a fraud-risk assessment of the federal marketplace, consistent with the leading practices described in GAO's framework for managing fraud risks in federal programs. In formal comments on a draft of the February report, HHS concurred with the recommendations and outlined a number of steps it planned to take to implement them. In an April 2016 follow-up letter to GAO, HHS described a number of specific actions it had taken in response to the eight recommendations, such as creating an integrated project team to perform the Marketplace fraud-risk assessment. As of November 2016, GAO considers all eight recommendations to be still open, pending corroborating information, and will continue to monitor CMS's progress in implementing them. Implementing these recommendations by actions such as performing the fraud-risk assessment could help address the control vulnerabilities GAO identified during its most recent SEP tests.