In our February 2016 report, however, we found that although the data  hub plays a key role in the eligibility and enrollment process, CMS  officials said the agency does not track the extent to which the federal  agencies deliver responsive information to a request, or, alternatively,  whether they report that information was not available. In addition, according to agency  officials, an unknown number of data hub applicant inquiries were  duplicates, which we could not eliminate from our examination. In  doing so, CMS foregoes information that could suggest potential program  issues or potential vulnerabilities to fraud, as well as information that  might be useful for enhancing program management. We recommended  that HHS direct CMS to conduct a comprehensive feasibility study on  actions CMS can take to monitor and analyze, both quantitatively and  qualitatively, the extent to which data hub queries provide requested or  relevant applicant verification information, for the purpose of improving  the data-matching process and reducing the number of applicant  inconsistencies; and for those actions identified as feasible, create a  written plan and schedule for implementing them. The Federal Marketplace Did Not Resolve About One- Third of Applicant Inconsistencies for Coverage Year 2014, Involving $1.7 Billion in Associated Subsidies

For qualifying applicants, the act provides two forms of subsidies for  consumers enrolling in individual health plans, both of which are paid  directly to insurers on consumers’ behalf. One is a federal income tax  credit, which enrollees may elect to receive in advance of filing tax  returns, and which reduces a consumer’s monthly premium payment. This is known as the advance premium tax credit (APTC). Meanwhile, our analysis  found that about 34 percent of inconsistencies, with about $1.7 billion in  associated subsidies, remained open, as of April 2015—that is,  inconsistencies still open several months following the close of the 2014  coverage year. We also found, based on our analysis of the 2014 data, that CMS did not  terminate or adjust subsides for any applications with incarceration or  Social Security number inconsistencies, plus other inconsistencies. In  our analysis, we identified about 35,000 applications that had an  unresolved Social Security number inconsistency, which were associated  with about $154 million in combined subsidies. Social Security number inconsistencies also affect tax compliance. In our inconsistency analysis that we  reported on in February 2016, we identified about 22,000 applications  having an unresolved incarceration inconsistency, which were associated  with about $68 million in combined subsidies. As part of the inconsistency resolution  process, the Marketplace notifies applicants to send documentation to  resolve the inconsistency. Overall, according to SSA officials, PUPS information can  be used to identify individuals who require additional follow-up to  determine eligibility. We further concluded that by not using PUPS data as a  lead for further investigation, and by relying on applicant attestation in the  alternative, CMS may be granting eligibility to, and making subsidy  payments on behalf of, individuals who are ineligible to enroll in qualified  health plans. We recommended that HHS direct CMS to reevaluate use of PUPS  incarceration data and make a determination to either (1) use the PUPS  data, among other things, as an indicator of further research required in  individual cases, and to develop an effective process to clear  incarceration inconsistencies or terminate coverage; or (2) if no suitable  process can be identified to verify incarceration status, accept applicant  attestation on status in all cases, unless the attestation is not reasonably  compatible with other information that may indicate incarceration, and  forego the inconsistency process.
Why GAO Did This Study

This testimony summarizes the information contained in GAO's February 2016 report, entitled Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk , GAO-16-29 .

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs.
During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.