PPACA requires marketplaces to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. These verification steps  include validating an applicant’s Social Security number, if one is  provided; verifying citizenship, status as a U.S. national, or lawful  presence by comparison with Social Security Administration (SSA) or  Department of Homeland Security records; and verifying household  income by comparison with tax-return data from the Internal Revenue  Service (IRS), data on Social Security benefits from SSA, and other  available current income sources. Under  the marketplace process, applicants will be asked to provide additional  information or documentation for the marketplaces to review to resolve  the inconsistency. The Marketplaces Approved Subsidized Coverage for All 15 of Our Fictitious Applicants, Including Those Who Had Not Filed Required Tax Returns

Our undercover testing for the 2016 coverage year found that the  eligibility determination and enrollment processes of the federal and state  marketplaces we reviewed remain vulnerable to fraud, as we previously  reported for the 2014 and 2015 coverage years. Results of Applications

For each of our 15 fictitious applications, the federal or state-based  marketplaces approved coverage at time of application—specifically, 14  applications for qualified health plans, and 1 application for Medicaid. Marketplaces Approved Subsidies for Fictitious Applicants Who Had Previously Obtained Subsidized Coverage but Did Not File Required Tax Returns

CMS announced that beginning with the open-enrollment period for 2016  coverage, APTC and CSR subsidies would be discontinued for 2016  coverage for enrollees who received APTC in 2014 but did not comply  with the requirement to file a 2014 federal income-tax return and reconcile  APTC received. For one of these applicants, a  federal Marketplace representative initially told us that we were not  approved for subsidies, for tax-related reasons. CMS officials told us they chose to allow applicant attestations of tax  filing, rather than rely solely on IRS failure-to-file data, for two reasons:
Time lag between when tax returns are filed and when filings are  reflected in information IRS provides to marketplaces. Those who  obtained previous coverage through Covered California can readily be  identified, they said. According to Officials, Federal Marketplace Outcomes Appear to Be as Expected

CMS officials told us that for the federal Marketplace there generally  appeared to be reasons to explain the outcomes our fictitious applicants  experienced. The state officials noted that under PPACA the marketplace is required to  accept paper applications. The officials said  they did not have information on the number of such attestations  provided. All But One of Our Fictitious Enrollees Maintained Subsidized Coverage, Even Though We Sent Fictitious Documents, or No Documents, to Resolve Application Inconsistencies

We retained subsidized coverage for 10 of the 11 qualified-health-plan  applicants through August 2016, even though supporting documentation  we submitted was fictitious, and in some cases we submitted none or only  some of the documentation we were directed to send. Among the 11  applications for which we were directed to send documentation, we  submitted all requested documentation for five applications, partial documentation for three applications, and no documentation for the remaining three applications. In two of the cases, in which we provided only partial documentation, our  applicants were nevertheless able to clear inconsistencies through  conversations with marketplace phone representatives. The information our  applicant provided over the phone, however, did not match  documentation our applicant had filed previously. In each case, we were directed to provide proof of immigration status  and income, and in both cases, we did not provide any  documentation. In one case we lost coverage, while in the other we  retained it. Appendix I: Objective, Scope, and Methodology

The objective of this report is to describe, by means of undercover testing  and related work, potential vulnerabilities to fraud in the application,  enrollment, and eligibility-verification controls of the federal Health  Insurance Marketplace (Marketplace) and a selected state marketplace,  for the third open-enrollment period under the Patient Protection and  Affordable Care Act, for 2016 coverage. The identity or citizenship/immigration status of the applicant, or  whether the applicant had sought enrollment in multiple plans. Specifically, we selected two  states—Virginia and West Virginia—that elected to use the federal  Marketplace rather than operate a marketplace of their own. The results cannot, however, be generalized to the  overall population of applicants or enrollees. Appendix II: Comments from the Department of Health and Human Services

Appendix III: Comments from Covered California

	GAO Comment

1.
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans. States may operate their own health-care marketplace or rely on the federal Health Insurance Marketplace (Marketplace). The Congressional Budget Office estimates subsidies and related spending under PPACA at $56 billion for fiscal year 2017.
GAO was asked to review marketplace enrollment and verification controls for the act's third open-enrollment period ending in January 2016.This report provides results of GAO undercover testing of potential vulnerabilities to fraud in the application, enrollment, and eligibility-verification of the federal Marketplace and one selected state marketplace.
GAO submitted 15 fictitious applications for subsidized coverage through the federal Marketplace in Virginia and West Virginia and through the state marketplace in California. GAO's applications tested verifications related to (1) applicants' making required income-tax filings, and (2) applicants' identity or citizenship/immigration status. The results, while illustrative, cannot be generalized to the full population of enrollees. GAO discussed results with CMS, IRS, and state officials. Written comments from HHS and California are included in the report.
GAO currently has eight recommendations to CMS to strengthen its oversight of the federal Marketplace (see GAO-16-29 ). CMS concurred with the recommendations and implementation is pending.

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies. Verification steps include validating the applicant's Social Security number, if one is provided; citizenship or immigration status; and household income. PPACA requires the marketplaces to grant eligibility while identified inconsistencies between the information provided by the applicant and by government sources are being resolved. The 2016 coverage year was the first year in which a key eligibility requirement—verification of whether applicants who previously received one type of federal subsidy under the act filed federal tax returns, as a requirement to retain that benefit—went into effect.
As previously reported for the 2014 and 2015 coverage years, GAO's undercover testing for the 2016 coverage year found that the health-care marketplaces' eligibility determination and enrollment processes remain vulnerable to fraud. The marketplaces initially approved coverage and subsidies for GAO's 15 fictitious applications. However, three applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications.
For four applications, to obtain 2016 subsidized coverage, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. Although none of the fictitious applicants filed a 2014 tax return, all were approved for 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is a time lag between when tax returns are filed and when they are reflected in IRS's systems. CMS officials said they are rechecking 2014 tax-filing status.
For eight applications, GAO used new fictitious identities to test verifications related to identity or citizenship/immigration status and, in each case, successfully obtained subsidized coverage.
When marketplaces directed 11 of the 12 applicants to provide supporting documents, GAO submitted fictitious documents as follows:
For five applications, GAO provided all documentation requested and the applicants were able to retain coverage.
For three applications, GAO provided only partial documentation and the applicants were able to retain coverage. Two of these applicants were able to clear inconsistencies through conversations with marketplace phone representatives even though the information provided over the phone did not match the fictitious documentation that GAO previously provided.
For three applications, GAO did not provide any of the requested documents, and the marketplaces terminated coverage for one applicant but did not terminate coverage for the other two applicants.
According to officials from the Department of Health and Human Services' (HHS) Centers for Medicaid & Medicare Services (CMS), some of GAO's application outcomes could be explained by decisions to extend document filing deadlines.