	Background

Under the Medicaid program’s federal-state partnership, CMS is  responsible for overseeing the program, while state Medicaid agencies  are responsible for the day-to-day administration of the program. Specifically, our work has identified  four key program integrity issues for the Medicaid program—enrollment  verification, managed care, provider screening, and coordination between  Medicaid and the exchanges—along with CMS’s progress in addressing  them, and additional necessary actions. For example, in response to PPACA, CMS established a  more rigorous approach to verifying financial and nonfinancial information  needed to determine Medicaid beneficiary eligibility. Despite CMS’s efforts, there continue to be gaps in the agency’s efforts to  ensure that only eligible individuals are enrolled into Medicaid. In another study, we found that CMS also had gaps in ensuring that  Medicaid expenditures for enrollees—including enrollees eligible as a  result of the PPACA expansion—are matched appropriately by the federal  government. Oversight of beneficiary eligibility is important to program  integrity. Improving Oversight of Managed Care

CMS has taken steps to provide states with additional guidance on their  oversight of Medicaid managed care organizations. Oversight of Medicaid managed care is increasing in importance as  states’ use of managed care plans to deliver services has been growing. The estimated improper  payment rate for managed care is currently less than one percent;  however, this estimate is based on a review of the payments made to  managed care organizations and does not review any underlying medical  documentation. In particular, we and  the HHS Office of Inspector General have identified incomplete and  untimely managed care encounter data. Encounter data are data that  managed care organizations are expected to report to state Medicaid  programs, allowing states to track the services received by beneficiaries  enrolled in managed care. PPACA included multiple provisions aimed at strengthening the screening  of providers who enroll to participate in Medicaid. While the act requires  that all providers and suppliers be subject to licensure checks, it gave  CMS discretion to establish a risk-based application of other screening  procedures. This requirement may address some of the potentially fraudulent  or improper payments. Additionally, CMS regulations now require that the  state Medicaid agency enroll all Medicaid managed care providers, which  has the potential to improve oversight of providers in managed care. Our work, which was based on 2 states and 16 health plans, found that  these states and health plans used information that was fragmented  across 22 databases managed by 15 different federal agencies to screen  providers—and that these databases did not always have unique  identifiers. Minimizing Duplicate Coverage between Medicaid and the Exchanges

Regarding coordination between Medicaid and the exchanges, CMS  implemented policies and procedures to ensure that individuals do not  have duplicate coverage (enrolled in Medicaid and in subsidized  exchange coverage). In response, CMS has conducted  three checks to identify individuals with duplicate coverage. CMS has also  reported that the agency intends to complete these checks at least two  times per coverage year, which has the potential to save federal—as well  as beneficiary—dollars. CMS has not developed a plan for  assessing whether the checks and other procedures are sufficient to  prevent and detect duplicate coverage. We are continuing to monitor CMS’s efforts in this  area, particularly whether CMS develops a plan, including thresholds for  the level of duplicate coverage it deems acceptable, to routinely monitor  the effectiveness of the checks and other planned procedures to prevent  and detect duplicate coverage. In closing, Medicaid represents significant expenditures for the federal  government and states, and is the source of health care for tens of  millions of Americans. Patient Protection and Affordable Care Act: CMS Should Act to  Strengthen Enrollment Controls and Manage Fraud Risk. Appendix II: Selected Recommendations Related to Medicaid Program Integrity

The following table lists selected recommendations GAO has made to the  Department of Health and Human Services regarding Medicaid program  integrity.
Why GAO Did This Study

Medicaid, a joint federal-state health care program, is a significant component of federal and state budgets, with estimated outlays of $576 billion in fiscal year 2016. The program's size and diversity make it particularly vulnerable to improper payments. In fiscal year 2016, improper payments were an estimated 10.5 percent ($36 billion) of federal Medicaid expenditures, an increase from an estimated 9.8 percent ($29 billion) in fiscal year 2015.
States, which are responsible for the day-to-day administration of the Medicaid program, are the first line of defense against improper payments. Specifically, states must implement federal requirements to ensure the qualifications of the providers who bill the program, detect improper payments, recover overpayments, and refer suspected cases of fraud and abuse to law enforcement authorities. At the federal level, CMS is responsible for supporting and overseeing states' Medicaid program integrity activities.
This testimony highlights key program integrity issues in Medicaid, the progress CMS has made improving its oversight of program integrity, and the related challenges the agency and states continue to face. This testimony is based on 10 products and 11 recommendations. Of these 11 recommendations, 3 have been implemented based on agency action.

What GAO Found

GAO's prior work has identified four Medicaid program integrity issues—where the program is vulnerable to improper payments such as those made for services that were not covered, were not medically necessary, or were not provided—as well as actions taken by the Centers for Medicare & Medicaid Services (CMS) to address the issues and additional actions that should be taken.
Enrollment Verification: In response to the Patient Protection and Affordable Care Act (PPACA), CMS established a more rigorous approach for verifying financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. Despite CMS's efforts, however, there continue to be gaps in efforts to ensure that only eligible individuals are enrolled into Medicaid, and that Medicaid expenditures for enrollees—particularly those eligible as a result of the PPACA expansion—are matched appropriately by the federal government.
Oversight of Medicaid Managed Care: CMS has provided states with additional guidance on their oversight of Medicaid managed care. Oversight of managed care is increasing in importance and improvements in measuring the improper payment rate are needed. For example, the estimated improper payment rate for managed care is based on a review of payments made to managed care organizations, and does not review any underlying medical documentation. GAO and the Department of Health and Human Services (HHS) Office of Inspector General have identified incomplete and untimely managed care encounter data—data that managed care organizations are expected to report to state Medicaid programs, allowing states to track the services received by beneficiaries enrolled in managed care.
Provider Eligibility: PPACA included multiple provisions aimed at strengthening the screening of providers who enroll to participate in Medicaid. While the act requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures, such as fingerprint-based criminal-background checks for high-risk providers. Also, CMS regulations now require that all Medicaid managed care providers enroll with the state Medicaid agency, which has the potential to improve oversight of providers in managed care. However, GAO's work based on 2 states and 16 health plans identified challenges screening providers for eligibility, partially due to fragmented information.
Coordination between Medicaid and the Exchange: CMS implemented a number of policies and procedures to ensure that individuals do not have duplicate coverage (enrolled in both Medicaid and in subsidized coverage through an exchange, which is a marketplace where eligible individuals may compare and purchase private health insurance). CMS has conducted checks to identify individuals with duplicate coverage, and plans to complete these checks at least two times per coverage year, which has the potential to save federal—as well as beneficiary—dollars. However, CMS has not developed a plan for assessing whether the checks and other procedures—such as thresholds for the level of duplicate coverage deemed acceptable—are sufficient to prevent and detect duplicate coverage.