One contractor reviews states’ paid claims data to  identify aberrant claims or billing anomalies. A different audit contractor conducts targeted provider  audits to determine whether or not the provider received an  overpayment. In addition to the NMAP, the MIG has implemented three activities that  are the core of its support and oversight of state program integrity—the  Medicaid Integrity Institute, comprehensive reviews, and SPIA. In 2007, the MIG established the Medicaid  Integrity Institute, the first national Medicaid training program for state  program integrity officials. 3.) Annually, the MIG collects  information through a web-based portal from each state about its program  integrity activities, which results in a publication of a one-page summary  that provides statistics on states’ program integrity staffing, expenditures,  audits for improper payments, and recoveries.officials, the SPIA represent the first national baseline collection of data   According to MIG  on state Medicaid integrity activities for the purpose of program evaluation  and technical assistance. Return on Investment. Use of Separate Review and Audit Contractors Was Inefficient, Led to Duplication, and Contributed to a Longer Audit Process

The MIG’s decision to establish separate review and audit contractors for  each state was inefficient and led to duplication because key functions  such as data analysis were performed by both types of contractors. In  turn, these inefficiencies contributed to lengthy MSIS audits, which, on  average, took almost 2 years to complete. State Medicaid policies. Although MIG officials told us that they were sensitive to the  burden placed on states by the establishment of NMAP, the use of  separate review and audit contractors nonetheless increased states’  administrative burden because both types of contractors performed the  same function and states had to review the contractors’ work to ensure  that state policies were applied correctly. The HHS-OIG reported a similar finding that the MIG’s  communication policy also contributed to a duplication of contractor  functions. 4). Other MIG Activities Show Mixed Results in Overseeing and Supporting States’ Program Integrity Activities

The MIG’s modest spending on the Medicaid Integrity Institute enhances  states’ capabilities. But, the data  collected through the SPIA, another MIG oversight activity, has been of  limited value as it is inconsistently reported, not validated, and overlaps  with information collected through comprehensive reviews and other state  reporting mechanisms. Furthermore, officials from three states recommended that the  institute offer Medicaid audit certification to state program integrity  staff. The MIG’s Comprehensive Reviews Could Help Inform the Selection of States for NMAP Audits

Comprehensive reviews yield important information about all aspects of  states’ program integrity capabilities and vulnerabilities, and such  information could be used to target NMAP audits towards states with  serious vulnerabilities. In its comprehensive reviews of 51 states, the MIG  identified 7 states as having serious program integrity infrastructure  vulnerabilities, such as not maintaining a centralized program integrity  function, yet 5 of these states had less than the typical number of audits   Two of the 7 states had no NMAP audits assigned, 3 states  assigned.had less than 1 percent of assigned audits in their states, and 2 other  states had 16 and 23 audits, respectively; these last 2 states ranked 29th  and 22nd in the assignment of 1,662 NMAP audits as of February 2012. Reporting on Program Integrity Results Is Inadequate

CMS’s limited reporting on the ROI from the Medicaid Integrity Program is  inadequate. State reporting of recoveries is similarly insufficient because  we found that most states were not fully reporting recoveries according to  specific program integrity activities and that almost half appeared to  underreport aggregate annual recoveries. Another state reported aggregate recoveries of about $195,000 over   3 years to CMS—$0, $130,000, and $65,000—but about $36 million  in its annual report to the governor for 2 of these years. To date, CMS  has provided a misleading picture of the ROI for NMAP audits and its  unpublished methodology incorporates a percentage of identified  overpayments reported on the SPIA, which is questionable. A full accounting of state and NMAP-related recoveries is an  important yardstick for measuring the effectiveness of efforts to  reduce improper payments. The apparent gaps in state reporting of  such recoveries, however, hamper federal efforts to quantify the  results of state and federal activities and make it difficult to determine  whether states are returning the federal share of recovered  overpayments. To ensure the most effective use of federal Medicaid program integrity  funding, the CMS Acting Administrator should reevaluate the agency’s  methodology for calculating an ROI for the Medicaid Integrity  Program, including reporting separately on the NMAP, and share its  methodology with Congress and the states. In response to our five  recommendations, HHS concurred with three recommendations and  partially concurred with two others. ROI methodology and reporting. We continue to believe that separately reporting an NMAP ROI  is essential to hold CMS accountable for the effective operation of those  audits, which constituted about half of CMS’s annual expenditures on the  Medicaid Integrity Program. Major Management Challenges and Program Risks: Department of  Health and Human Services.
Why GAO Did This Study

Medicaid has the second-highest estimated improper payments of any federal program that reports such data. The Deficit Reduction Act of 2005 created the Medicaid Integrity Program to oversee and support state program integrity activities. CMS, the federal agency within HHS that oversees Medicaid, established the MIG to implement this new program. This report assesses (1) the MIG's use of two types of contractors to review and audit state Medicaid claims, (2) the MIG's implementation of other oversight and support activities, and (3) CMS and state reporting on the results of their program integrity activities. GAO analyzed MIG data on its contractors' audits, training program for state officials, comprehensive state reviews, and state assessments; analyzed reports that summarized the monetary returns from MIG and state program integrity activities; and interviewed MIG officials, contractors, and state program integrity officials.

What GAO Found

The Medicaid Integrity Group's (MIG) hiring of separate review and audit contractors for its National Medicaid Audit Program (NMAP) was inefficient and led to duplication because key functions were performed by both entities. Review contractors analyze state claims data to identify aberrant claims or billing anomalies while audit contractors conduct postpayment audits to determine if payments to providers were improper. Because both types of contractors had to assess whether payments were improper under state Medicaid policies, having separate contractors doubled states' burden in ensuring that state policies were being correctly applied. Also, poor coordination and communication between the two types of contractors resulted in duplicative data analysis. In turn, these inefficiencies added to the length of audits, which on average took almost 23 months to complete. By contrast, the average duration of six audits using a more collaborative and coordinated approach was 16 months, and the amount of identified overpayments increased significantly.
Other MIG oversight and support activities--the free training provided to state officials through the Medicaid Integrity Institute, the evaluation of state program integrity procedures through triennial comprehensive reviews, and the collection of data from states through annual assessments--show mixed results in enhancing program integrity efforts. According to state officials, the modest expenditures on the institute result in valuable training and networking opportunities. The MIG, however, has not taken advantage of the potential for comprehensive reviews to inform the selection of states for federal audits. Although the MIG's comprehensive reviews yield considerable information about state program integrity vulnerabilities, states with serious program integrity vulnerabilities often had few NMAP audits. Furthermore, the data collected through state program integrity assessments (SPIA) duplicate data collected through comprehensive reviews and other reports, are not validated, and, even if the data were accurate, are less current than similar data from other sources.
Reporting by the Centers for Medicaid & Medicaid Services (CMS) on the return on investment (ROI) from the activities of the MIG is inadequate. CMS's annual reports to Congress provide a limited picture of ROI for NMAP audits, which account for over half of the MIG's annual expenditures, and it is difficult to calculate an ROI with the expenditure and activity information provided. The Department of Health and Human Services (HHS) recently announced that it will discontinue reporting a separate ROI for NMAP. In addition, CMS's ROI methodology includes a percentage of state-identified overpayments reported on the SPIA, which is questionable. To date, CMS has not published an ROI methodology. Regarding state reporting of recoveries, we found that most states were not fully reporting recoveries according to specific program integrity activities and that a sizable number appeared to underreport aggregate recoveries compared to other sources. For example, one state reported aggregate recoveries of about $195,000 over 3 years to CMS but about $36 million in its annual report to the governor for 2 of these years. The apparent gaps in state reporting of such recoveries make it difficult to determine whether states are returning the federal share of recovered overpayments. A full accounting of state and NMAP related recoveries is vital for measuring the effectiveness of efforts to reduce improper payments.

What GAO Recommends

GAO recommends that the CMS Administrator (1) eliminate duplication by merging contractor functions, (2) use comprehensive reviews to better target audits, (3) follow up with states to ensure reliable reporting of their program integrity recoveries, (4) discontinue the SPIA, and (5) reevaluate and publish its ROI methodology. In response, HHS concurred with three of GAO's recommendations and partially concurred with the need to eliminate SPIA-related duplication and to reevaluate CMS's ROI methodology. As discussed in this report, GAO continues to believe that its recommendations are valid.