	Background

Under PPACA, health-care marketplaces were intended to provide a  single point of access for individuals to enroll in private health plans,  apply for income-based subsidies to offset the cost of these plans— which, as noted, are not paid directly to enrollees, but instead are paid to  health-insurance issuers—and, as applicable, obtain an eligibility  determination or assessment of eligibility for other health-coverage  programs. These other programs include Medicaid and the Children’s  Health Insurance Program. Marketplaces are required by PPACA to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. These verification steps  include validating an applicant’s Social Security number, if one is  provided; verifying citizenship, status as a U.S. national, or lawful  presence by comparison with Social Security Administration or  Department of Homeland Security records; and verifying household  income and family size by comparison with tax-return data from the  Internal Revenue Service, as well as data on Social Security benefits  from the Social Security Administration. Results of Undercover Attempts to Obtain Qualified Health-Plan Coverage from the Federal Marketplace and Selected State Marketplaces

Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for  qualified health plans remains vulnerable to fraud. As shown in figure 1,  the federal Marketplace or selected state marketplaces approved each of  our 10 fictitious applications for subsidized qualified health plans. We proceeded to phone the marketplaces and  our applications were subsequently approved. For the four fictitious applicants who claimed their employer did  not provide minimum essential coverage, the marketplace did not contact  our fictitious employer to confirm the applicant’s account that the  company offers only substandard coverage. In August 2015, we briefed CMS, California, and Kentucky officials on the  results of our undercover testing, to obtain their views. According to these  officials, the marketplaces only inspect for documents that have obviously  been altered. Thus, if the documentation submitted does not appear to  have any obvious alterations, it would not be questioned for authenticity. In addition, according to Kentucky officials, in the case of the impossible  Social Security number, the identity-proofing process functioned correctly,  but a marketplace worker bypassed identity-proofing steps that would  have required a manual verification of the fictitious Social Security card  we submitted. Results of Undercover Attempts to Obtain Medicaid Coverage through the Federal Marketplace and Selected State Marketplaces

For our additional eight fictitious applications for Medicaid coverage in  2015, we were approved for subsidized health-care coverage in seven of  the eight applications. As shown in figure 2, for three of the eight  applications, we were approved for Medicaid, as originally sought. Details of Medicaid Applications through the Federal Marketplace

For the four fictitious Medicaid applications submitted to the federal  Marketplace for 2015, we were told that we may be eligible for Medicaid  but that the respective Medicaid state offices might require more  information. CMS officials said that, instead, they accept the applicant’s attestation  that the applicant was denied Medicaid coverage. For our North Dakota Medicaid application in which we did not provide a  Social Security number but did provide an impossible immigration  document number, we called the North Dakota Medicaid agency to  determine the status of our application. As part of  our 2015 testing and in response to such requests, we provided  counterfeit follow-up documentation, such as a fake immigration card with  an impossible numbering scheme, for these applicants. Appendix I: Objectives, Scope, and Methodology

The objectives of this report, which concludes work we initially presented  in a testimony in October 2015, are to describe for the 2015 coverage  year (1) results of undercover attempts to obtain qualified health-plan  coverage from the federal Health Insurance Marketplace (Marketplace)  and selected state marketplaces under the Patient Protection and  Affordable Care Act (PPACA), for the act’s second open-enrollment  period, for 2015 coverage; and (2) results of undercover attempts to  obtain Medicaid coverage through the federal Marketplace and selected  state marketplaces. The  undercover results, while illustrative, cannot be generalized to the full  population of enrollees. For all 18 fictitious applications, we used publicly  available information to construct our scenarios. We chose these two states because they  had expanded Medicaid eligibility and also delegated their Medicaid  eligibility determinations to the federal Marketplace at the time of our  testing. We made 4 of these 10 applications online and the  other 6 applications by phone.
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans or apply for Medicaid. The act requires verification of applicant information to determine enrollment or subsidy eligibility. In addition, PPACA provided for the expansion of the Medicaid program. GAO was asked to examine enrollment and verification controls for the marketplaces.
This report, which follows earlier testimony, provides final results of GAO testing and describes (1) undercover attempts to obtain health-plan coverage from the federal Marketplace and selected state marketplaces for 2015, and (2) undercover attempts to obtain Medicaid coverage through the federal Marketplace and the selected state marketplaces. GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online. Ten applications tested controls related to obtaining subsidized coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these states based partly on range of population and whether the state had expanded Medicaid eligibility under PPACA. The other 8 applications tested controls for determining Medicaid eligibility. The results, while illustrative, cannot be generalized. GAO discussed results with CMS and state officials to obtain their views. The states identified several actions being taken in response to GAO's findings.

What GAO Found

Under the Patient Protection and Affordable Care Act (PPACA), health-insurance marketplaces are required to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies or Medicaid. Verification steps include reviewing and validating an applicant's Social Security number, if one is provided; citizenship, status as a U.S. national, or lawful presence; and household income and family size.
GAO's undercover testing for the 2015 coverage year found that the health-care marketplace eligibility determination and enrollment process for qualified health plans—that is, coverage obtained from private insurers—remains vulnerable to fraud. The federal Health Insurance Marketplace (Marketplace) or selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued, such as numbers starting with “000.” Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.
For eight additional fictitious applications, initially made for Medicaid coverage, GAO was approved for subsidized health-care coverage in seven of the eight cases, through the federal Marketplace and the two selected state marketplaces.
Three of GAO's applications were approved for Medicaid, which was the health-care program for which GAO originally sought approval. In each case, GAO provided identity information that would not have matched Social Security Administration records. For two applications, the marketplace or state Medicaid agency directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone.
For four, GAO was unable to obtain approval for Medicaid but was subsequently able to gain approval of subsidized health-plan coverage. In one case, GAO falsely claimed that it was denied Medicaid and was able to obtain the subsidized health plan when in fact no Medicaid determination had been made at that time.
For one, GAO was unable to enroll into Medicaid, in California, because GAO declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications.
For both sets of testing, GAO submitted fictitious documentation as part of the application and enrollment process. According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplace or Medicaid office only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity.