	Preliminary Results of Undercover Attempts to Obtain Qualified Health-Plan Coverage from the Federal Marketplace and Selected State Marketplaces

Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process remains  vulnerable to fraud. As shown in figure 1, the federal Marketplace or  selected state marketplaces approved each of our 10 fictitious  applications for subsidized qualified health plans. For 4 of these applications, we used Social Security  numbers that could not have been issued by the Social Security  Administration. Thus, this fictitious  applicant received subsidized qualified health-plan coverage from the  federal Marketplace and the two selected state marketplaces at the same  time. The other two applicants  were accepted by phone. The marketplaces are  required to seek postapproval documentation in the case of certain  application “inconsistencies”—instances in which information an applicant  has provided does not match information contained in data sources that  the marketplace uses for eligibility verification at the time of application, or  such information is not available. For the four fictitious applicants who claimed their  employer did not provide minimum essential coverage, the marketplace  did not contact our fictitious employer to confirm the applicant’s account  that the company offers only substandard coverage. In August 2015, we briefed CMS and California and Kentucky state  officials on the results of our undercover testing, to obtain their views. According to these officials, the marketplaces only inspect for documents  that have obviously been altered. Thus, if the documentation submitted  does not appear to have any obvious alterations, it would not be  questioned for authenticity. In addition, according to Kentucky officials, in  the case of the impossible Social Security number, the identity-proofing  process functioned correctly, but a marketplace worker bypassed identity- proofing steps that would have required a manual verification of the  fictitious Social Security card we submitted. If an applicant receives a  qualified health-plan subsidy because the applicant’s employer- sponsored plan does not meet the guidelines, the Kentucky marketplace  sends a notice to the employer asking it to verify the applicant  information. Preliminary Results of Undercover Attempts to Obtain Medicaid Coverage through the Federal Marketplace and Selected State Marketplaces

In addition to our applications for subsidized private health plans, we also  made eight additional fictitious applications for Medicaid coverage in  order to test the ability to apply for that program through the  marketplaces. As shown in figure 2, in these tests, we were approved for  subsidized health-care coverage for seven of the eight applications. For  three of the eight applications, we were approved for Medicaid, as  originally sought. For four of the eight applications, we did not obtain  Medicaid approval, but instead were subsequently approved for  subsidized qualified health-plan coverage. After we discussed the results of our undercover testing with California  officials, they told us their system requires applicants to provide either a  Social Security number or an individual taxpayer-identification number to  process an application. For the two New Jersey Medicaid applications, we periodically called the  state Medicaid offices over approximately 4 months, attempting to  determine the status of our applications. For our North Dakota Medicaid application in which we did not provide a  Social Security number but did provide an impossible immigration  document number, we called the North Dakota Medicaid agency to  determine the status of our application. Because we did not  disclose the specific identities of our fictitious applicants, CMS officials  could not explain why the federal Marketplace originally said our  application may be eligible for Medicaid but subsequently notified North  Dakota that it was denied. Details of Medicaid Applications through State Marketplaces

As with our applications for coverage under qualified health plans,  described earlier, the state marketplace for Kentucky directed two of our  Medicaid applicants to submit supplementary documentation. We applied for such coverage and were approved for an  advance premium tax credit and the cost-sharing reduction subsidy. By contrast, during the Medicaid application process for one applicant,  California did not direct that we submit any documentation. As noted earlier, the findings discussed in this statement are preliminary,  and we plan to issue a final report later, upon completion of our work.
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans or apply for Medicaid. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $60 billion for fiscal year 2016. PPACA requires verification of applicant information to determine enrollment or subsidy eligibility. In addition, PPACA provided for the expansion of the Medicaid program. GAO was asked to examine application and enrollment controls for the marketplaces and Medicaid.
This testimony provides preliminary results of undercover testing of the federal and selected state marketplaces during the 2015 open-enrollment period, for both private health-care plans and Medicaid. GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online, 10 of which tested controls related to obtaining subsidized health-plan coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these four states based partly on a range of population sizes and whether the state had expanded Medicaid eligibility under terms of the act. The other 8 applications, among the 18 GAO made, tested marketplace and state controls under the marketplace system for determining Medicaid eligibility in these four states. The undercover results, while illustrative, cannot be generalized to the full population of enrollees. GAO discussed the results of its testing with CMS and state officials to obtain their perspectives.

What GAO Found

Under the Patient Protection and Affordable Care Act (PPACA), health-insurance marketplaces are required to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies or Medicaid. These verification steps include reviewing and validating information about an applicant's Social Security number, if one is provided; citizenship, status as a national or lawful presence; and household income and family size.
For 10 fictitious applicants, GAO tested application and enrollment controls for obtaining subsidized health plans available through the federal Health Insurance Marketplace (Marketplace) (for New Jersey and North Dakota) and two selected state marketplaces (California and Kentucky). Although 8 of these 10 fictitious applications failed the initial identity-checking process, all 10 were subsequently approved by the federal Marketplace or the selected state marketplaces. Four applications used Social Security numbers that, according to the Social Security Administration (SSA), have never been issued, such as numbers starting with “000.” Other applicants had duplicate enrollment or claimed their employer did not provide insurance that meets minimum essential coverage.
For 8 additional fictitious applicants, GAO tested enrollment into Medicaid through the same federal Marketplace and the two selected state marketplaces, and was able to obtain either Medicaid or alternative subsidized coverage for 7 of the 8 applicants. Specifically:
Three were approved for Medicaid, which was the health-care program for which GAO originally sought approval. In each case, GAO provided identity information that would not have matched SSA records. For two applications, the marketplace directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone.
For four, GAO did not obtain approval for Medicaid; however, GAO was subsequently able to gain approval of subsidized health plans based on the inability to obtain Medicaid coverage. In 1 case, GAO falsely claimed that it was denied Medicaid in order to obtain the subsidized health plan when in fact no Medicaid determination had been made by the state at that time.
For one, GAO was unable to enroll into Medicaid, in California, because GAO declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications.
According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplaces and Medicaid offices only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity. GAO's work is continuing, and GAO plans to issue a final report at a later date.