States’ program integrity activities include a screening process to help  ensure that ineligible providers do not participate in the Medicaid  program. Selected States and Medicaid Managed Care Plans Face Significant Challenges Screening Providers

According to two selected states and 16 selected MMC plans that screen  MMC plan providers, their efforts are challenged by fragmented  information and difficulty accessing and using particular databases. Efforts to Screen Providers Are Based on Information that Is Fragmented across Multiple and Disparate Federal Databases

According to the two selected state officials and 16 selected MMC plan  representatives we contacted, the information they use to screen MMC  plan providers is fragmented across multiple and disparate federal  databases. Overall, these two selected states and 16 selected plans  identified a total of 22 databases managed by 15 different federal  agencies. Officials  from some states noted that plans checking more databases than  recommended by CMS provided better assurance they would not enroll  ineligible providers and helped provide a more comprehensive  background on a provider. Federal internal control standards stress the importance of collecting  quality information to achieve objectives and assess risks. However, the variety of databases  checked by states and MMC plans beyond those specified by CMS, the  use of NCQA’s accreditation requirements in all 10 states, along with the  current rate of improper payments to Medicaid providers, suggests that  CMS might not have identified all reliable sources of information about  ineligible providers. Federal  internal control standards state that agencies should use quality data that  are complete, current, accurate, and accessible, and have a logical  connection to the program, such as the data regarding deceased  individuals in the DMF, to achieve agency goals to reduce fraud. The use of a consistent identifier would also help states and plans  ensure that they are accurately identifying ineligible providers. Collaborating with other agencies to use a unique identifier: CMS  officials said that they have not considered collaborating with other  agencies to explore using a unique identifier—such as the NPI—that  would serve to improve the ability of states and plans to confirm the  accuracy of matches across databases. Selected States and Medicaid Managed Care Plans Use Inconsistent Practices to Make Data on Ineligible Providers Publicly Available

States must ensure that none of their providers has been determined to  be ineligible anywhere in the United States. CMS issued guidance in  2012 encouraging states to share data on ineligible providers through its  Medicaid provider termination notification system; however, doing so is  optional, not all states are using the list, and the list is not available to  MMC plans. In addition, CMS officials said they have not provided  states with guidance on other ways to share their data on ineligible  providers or how to access other states’ data on ineligible providers. 1.) 2.) 3.) Unlike states, MMC plans are not required to make their data on ineligible  providers publicly available. The 16 selected MMC plans reported  sharing these data with their state Medicaid agencies at varying intervals  and in rare cases, with other plans. The inconsistency with which this information on ineligible providers is  shared across states and MMC plans creates the potential that providers  could be determined to be ineligible in some states, while still receiving  payments from Medicaid in other states. CMS has not  coordinated with other agencies to explore what options may exist to  address these challenges. CMS guidance on how states should share data on ineligible providers is  also limited, resulting in significant inconsistency in how such information  is shared across states. 2. 4. In response to our fourth recommendation to provide  state Medicaid programs with guidance that establishes expectations and  best practices on sharing provider screening data among states and  Medicaid managed care plans, HHS commented that it developed the  Medicaid provider termination notification database to assist states with  the requirement to deny or terminate the enrollment of any provider that  has been terminated for cause under Medicare or another state’s  Medicaid program or CHIP. List of Excluded Individuals and Entities (LEIE)

The Department of Health and Human Services Office of Inspector General (HHS-OIG)  maintains and updates monthly the LEIE, a database of providers it has excluded.
Why GAO Did This Study

GAO has reported that Medicaid remains a high-risk program, partly due to concerns about improper payments. Screening of providers is important to help prevent improper payments. Under managed care, states contract with plans to provide services to beneficiaries.
GAO was asked to examine the screening of managed care providers. GAO examined (1) states' and plans' experiences using federal databases to screen providers; and (2) how states and plans share data about ineligible providers. GAO interviewed officials from 10 states, selected generally based on enrollment and geography, and representatives from 16 plans from among these states. GAO reviewed those states' Medicaid program websites and plan contracts, and relevant federal laws, regulations, and guidance; and interviewed officials from CMS and the Department of Health and Human Services' Office of Inspector General.

What GAO Found

GAO found that the selected states and Medicaid managed care plans face significant challenges in screening providers for eligibility to participate in the Medicaid program. Based on information we received from two selected states and 16 selected plans, GAO found that the states and plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers. These databases included databases that the Centers for Medicare & Medicaid Services (CMS) had not identified for use in screening providers. Officials from some states noted that these additional databases provided better assurance they would not enroll ineligible providers—i.e., providers who have been barred from participating in federal health care programs. Federal internal control standards stress the importance of collecting quality information to achieve objectives and assess risks. However, the variety of databases used for screening purposes beyond those identified by CMS, along with the current rate of improper payments to Medicaid providers, suggests that CMS might not have identified all reliable sources of information about ineligible providers that could help states and plans achieve program objectives. State officials and plan representatives also said that accessing and using fragmented information from multiple and disparate federal databases challenged their screening efforts. For example, they reported difficulties accessing certain databases, such as the Social Security Administration's Death Master File, and conducting and confirming identified provider matches across databases, particularly those not based on a unique national provider identifier. CMS has not coordinated with other agencies to address these challenges. Federal internal control standards state that agencies should use quality data that are complete, current, accurate, and accessible—and have a logical connection to the program—to achieve agency goals to reduce fraud. However, the difficulties states and plans experienced accessing databases and confirming matches could result in provider screening efforts that do not ensure that ineligible providers are accurately and consistently identified.
GAO also found that the selected states reviewed used inconsistent practices to make data on ineligible providers publicly available. States must ensure that none of their providers has been determined to be ineligible anywhere in the United States. Although CMS has issued guidance encouraging states to share data on ineligible providers through its Medicaid provider termination notification system, doing so is optional, not all states are using the list, and it is not available to Medicaid managed care plans. Moreover, CMS has not provided states with guidance on other ways to share their data on ineligible providers or how to access other states' data on ineligible providers. The 10 states GAO selected varied in how they shared data on ineligible providers. Plans are not required to make their own data on ineligible providers publicly available, and the 16 selected plans shared their data with states at differing intervals and, in rare cases, with other plans. The inconsistency with which this information is shared across states and plans creates the potential that providers could be ineligible in some states while still receiving payments from Medicaid in other states.

What GAO Recommends

GAO recommends that CMS (1) consider additional databases used in screening, (2) collaborate with the Social Security Administration to improve access to the Death Master File, (3) coordinate with other agencies to develop a common identifier across databases, and (4) provide state Medicaid programs with guidance that establishes expectations and best practices on sharing provider screening data among states and plans. HHS concurred with our recommendations.