states through the Medicaid Integrity Institute in April 2014. Indicators of Potentially Improper Medicaid Payments to Beneficiaries and Providers Highlight Potential Weaknesses in Selected State Controls

Of the approximately 9.2 million beneficiaries in the four states that we  examined, thousands of cases from the fiscal year 2011 data analyzed  showed indications of potentially improper payments, including fraud, to  Medicaid beneficiaries and providers. The Medicaid benefits involved with  these deceased providers totaled at least $240,000 for fiscal year  2011. We found that about 50 providers in the four  states we examined had been excluded from federal health-care  programs, including Medicaid; these providers were excluded from  these programs when they billed for Medicaid services during fiscal  year 2011. Federal agencies can place individuals or  entities on SAM for a variety of reasons, including fraud, theft, bribery,  and tax evasion. CMS Has Taken Steps to Strengthen Certain Medicaid Enrollment-Screening Controls, but Gaps Remain

Through regulation, CMS has taken steps since 2011 to make the  Medicaid enrollment-verification process more data-driven. However, gaps in guidance and data  sharing continue to exist, and additional opportunities for improvements  are available for screening beneficiaries and providers. CMS Issued Regulations Requiring States to Access Additional Data Sources to Verify Medicaid Applicant Information

In response to PPACA, which was enacted in 2010, CMS issued federal  regulations in 2013 to establish a more-rigorous approach to verify  financial and nonfinancial information needed to determine Medicaid  beneficiary eligibility. Specifically, under these regulations, states are  required to use electronic data maintained by the federal government to  the extent that such information may be useful in verifying eligibility. According to CMS, the hub can  verify key application information, including household income and size,  citizenship, state residency, incarceration status, and immigration  status. Under CMS’s regulations, when  states receive an application they are to use the hub to verify an  individual’s eligibility. Gaps Remain for Screening Deceased Beneficiaries in Selected States

Medicaid services to individuals are to cease once a beneficiary dies. As a result, states may not be able to detect individuals who have  moved to and died in other states and prevent payment of potentially  fraudulent benefits. CMS Issued Guidance for Screening Provider Enrollment

PPACA authorized CMS to implement several actions to strengthen  provider-enrollment screening. Each state is given  “read only,” manual access to PECOS. According to CMS officials, as of  October 2013, CMS began providing all interested states access to a  monthly PECOS data-extract file that contains basic Medicare  enrollment information; the state officials we interviewed were  unaware that they could obtain automated data extracts from PECOS. Conclusions

The Medicaid program is a significant expenditure for the federal  government and the states, representing over $310 billion in federal  outlays in fiscal year 2014. Recommendations for Executive Action

To further improve efforts to limit improper payments, including fraud, in  the Medicaid program, we recommend that the Acting Administrator of  CMS take the following two actions:  issue guidance to states to better identify beneficiaries who are  deceased; and provide guidance to states on the availability of automated information  through Medicare’s enrollment database—the Provider Enrollment,  Chain and Ownership System (PECOS)—and full access to all  pertinent PECOS information, such as ownership information, to help  screen Medicaid providers more efficiently and effectively. HHS concurred with both of our recommendations. We do not state this in our report. Appendix I: Objectives, Scope, and Methodology

In this report, we (1) identify and analyze indicators of improper or  potentially fraudulent payments to Medicaid beneficiaries and providers  and (2) examine the extent to which federal and state oversight policies,  controls, and processes are in place to prevent and detect fraud and  abuse in determining eligibility for Medicaid beneficiaries and enrolling  providers. To identify indicators of improper or potentially fraudulent payments to  Medicaid beneficiaries and providers, we obtained and analyzed Medicaid  claims paid in fiscal year 2011, the most-recent consistently comparable  data, for four states: Arizona, Florida, Michigan, and New Jersey. Medicaid payments to these states constituted about 13 percent of all  Medicaid payments made during fiscal year 2011. These four states were  selected primarily because they had reliable data and were among states  with the highest Medicaid enrollment. All of the states included in our  review—Arizona, Florida, Michigan, and New Jersey—had MCO  arrangements in place.
Why GAO Did This Study

Medicaid is a significant expenditure for the federal government and the states, with total federal outlays of $310 billion in fiscal year 2014. CMS reported an estimated $17.5 billion in potentially improper payments for the Medicaid program in 2014.
GAO was asked to review beneficiary and provider enrollment-integrity efforts at selected states. This report (1) identifies and analyzes indicators of improper or potentially fraudulent payments in fiscal year 2011, and (2) examines the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect fraud and abuse in determining eligibility.
GAO analyzed Medicaid claims paid in fiscal year 2011, the most-recent reliable data available, for four states: Arizona, Florida, Michigan, and New Jersey. These states were chosen because they were among those with the highest Medicaid enrollment; the results are not generalizable to all states. GAO performed data matching with various databases to identify indicators of potential fraud, reviewed CMS and state Medicaid program-integrity policies, and interviewed CMS and state officials performing oversight functions.

What GAO Found

GAO found thousands of Medicaid beneficiaries and hundreds of providers involved in potential improper or fraudulent payments during fiscal year 2011—the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states had about 9.2 million beneficiaries and accounted for 13 percent of all fiscal year 2011 Medicaid payments. Specifically:
About 8,600 beneficiaries had payments made on their behalf concurrently by two or more of GAO's selected states totaling at least $18.3 million.
The identities of about 200 deceased beneficiaries received about $9.6 million in Medicaid benefits subsequent to the beneficiary's death.
About 50 providers were excluded from federal health-care programs, including Medicaid, for a variety of reasons that include patient abuse or neglect, fraud, theft, bribery, or tax evasion.
Since 2011, the Centers for Medicare & Medicaid Services (CMS) has taken regulatory steps to make the Medicaid enrollment process more rigorous and data-driven; however, gaps in beneficiary-eligibility verification guidance and data sharing continue to exist. These gaps include the following:
In October 2013, CMS required states to use electronic data maintained by the federal government in its Data Services Hub (hub) to verify beneficiary eligibility. According to CMS, the hub can verify key application information, including state residency, incarceration status, and immigration status. However, additional guidance from CMS to states might further enhance program-integrity efforts beyond using the hub. Specifically, CMS regulations do not require states to periodically review Medicaid beneficiary files for deceased individuals more frequently than annually, nor specify whether states should consider using the more-comprehensive Social Security Administration Death Master File in conjunction with state-reported death data when doing so. As a result, states may not be able to detect individuals that have moved to and died in other states, or prevent the payment of potentially fraudulent benefits to individuals using these identities.
In 2011, CMS issued regulations to strengthen Medicaid provider-enrollment screening. For example, CMS now requires states to screen providers and suppliers to ensure they have active licenses in the state where they provide Medicaid services. CMS's regulations also allow states to use Medicare's enrollment database—the Provider Enrollment, Chain and Ownership System (PECOS)—to screen Medicaid providers so that duplication of effort is reduced. In April 2012, CMS gave each state manual access to certain information in PECOS. However, none of the four states GAO interviewed used PECOS to screen all Medicaid providers because of the manual process. In October 2013, CMS began providing interested states access to a monthly file containing basic enrollment information that could be used for automated screening, but CMS has not provided full access to all PECOS information, such as ownership information, that states report are needed to effectively and efficiently process Medicaid provider applications.

What GAO Recommends

GAO recommends that CMS issue guidance for screening deceased beneficiaries and supply more-complete data for screening Medicaid providers. The agency concurred with both of the recommendations and stated it would provide state-specific guidance to address them.