Marketplaces are required by PPACA to verify application information to  determine eligibility for enrollment and, if applicable, determine eligibility  for the income-based subsidies or Medicaid. If there is an application inconsistency, the  marketplace is to determine eligibility using the applicant’s attestations  and ensure that subsidies are provided on behalf of the applicant, if  qualified to receive them, while the inconsistency is being resolved. In terms of concentration in the private health-insurance market, in  December 2014 we reported that, from 2010 through 2013, enrollment in  most states was concentrated among the largest issuers in each of the  three types of health-insurance markets: the large-group market (under  which individuals obtain coverage through a group plan maintained by  large employers), the small-group market (under which individuals obtain  coverage through a group plan maintained by small employers), and the  individual market (coverage sold directly to individual consumers other  than in connection with a group health-plan). The Marketplaces Approved Subsidized Coverage for the 2015 Coverage Year for 17 of 18 of our Fictitious Applicants

Our undercover testing for the 2015 coverage year found that the health- care marketplace eligibility determination and enrollment process for  qualified health-plans—that is, coverage obtained from private insurers— was vulnerable to fraud. The federal Marketplace or selected state-based  marketplaces approved each of 10 fictitious applications we made for  subsidized health-plans. Although 8 of these 10 fictitious applications  failed the initial online identity-checking process, all 10 were subsequently  approved. Four applications used Social Security numbers that, according  to the Social Security Administration, have never been issued, such as  numbers starting with “000.” Other applicants obtained duplicate  enrollment or obtained coverage by claiming that their employer did not  provide insurance that met minimum essential coverage. For eight additional fictitious applications, initially made for Medicaid  coverage, we were approved for subsidized health-care coverage in  seven of the eight cases, through the federal Marketplace and the two  selected state-based marketplaces. The Marketplaces Approved Subsidized Coverage for the 2016 Coverage Year for all 15 of Our Fictitious Applicants, Even Those Who Had Not Filed Required Tax Returns

Our undercover testing for the 2016 coverage year found that the health- care marketplaces’ eligibility determination and enrollment processes  continued to be vulnerable to fraud. The marketplaces initially approved  coverage and subsidies for our 15 fictitious applications, including 1  application for Medicaid, made through the federal Marketplace in Virginia  and West Virginia and through the state marketplace in California. However, three applicants were unable to put their policies in force  because their initial payments were not successfully processed. For four applications, to obtain 2016 subsidized coverage, we used  identities from our 2014 testing that had previously obtained  subsidized coverage. The 2016 coverage year was the first year in  which verification was required to ensure that applicants who  previously received a specific type of federal subsidy under the act  had filed a federal tax return. This was a condition for these applicants  to retain this benefit in 2016. None of the four fictitious applicants had  filed a 2014 tax return but all were approved for the 2016 subsidies. Marketplace officials told us that they allowed applicants to attest to  filing taxes if information from the IRS indicated that the applicant did  not file tax returns. Marketplace officials said one reason they allow  attestations is the time lag between when tax returns are filed and  when they are reflected in IRS’s systems. CMS officials said they  are rechecking the 2014 tax-filing status and will remove subsidies for  applicants that have not filed a 2014 tax return. In response to our findings, the Department of Health and  Human Services stated that it continues to strengthen marketplace  controls. Health-Insurance Markets Remained Concentrated in Most States in 2014, While Issuer Participation Generally Decreased

We found that enrollment in private health-insurance plans remained  concentrated among a small number of issuers in most states in 2014,  including in the newly established exchanges. On average, in each state,  11 or more issuers participated in each of three types of markets— individual, small-group, and large-group—from 2011 through 2014. However, in most states, the 3 largest issuers in each market had at least  an 80 percent share of the market during the period. Enrollment  through these exchanges was generally more concentrated among a few  issuers than was true for the overall markets.
Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces through which private issuers can sell qualifying health-care coverage, and makes subsidies available to enrollees who meet certain income and other requirements. According to the Congressional Budget Office, the estimated cost of subsidies and related spending under the act is $56 billion for fiscal year 2017, and totaling $866 billion for fiscal years 2017–2026.
GAO issued three reports in September 2016 that examined (1) enrollment controls for health-care coverage obtained through the health-insurance marketplaces, and (2) private health-insurance market concentration. This testimony summarizes those reports' findings .
For its undercover testing of the 2015 coverage year, GAO submitted fictitious applications for subsidized coverage through the federal Marketplace in New Jersey and North Dakota, and through state-based marketplaces in Kentucky and California. For the 2016 coverage year, GAO submitted fictitious applications through the federal Marketplace in Virginia and West Virginia, and through the state-based marketplace in California. The results of these undercover tests, while illustrative, cannot be generalized to the full population of enrollees. To review market concentration, GAO examined data reported by issuers to CMS for fiscal years 2011 through 2014, the latest data available.
In response to GAO's findings, the Department of Health and Human Services stated that it continues to strengthen marketplace controls.

What GAO Found

The Patient Protection and Affordable Care Act (PPACA) requires health-insurance marketplaces to verify application information, such as citizenship or immigration status and household income, to determine eligibility for enrollment and, if applicable, eligibility for income-based subsidies. While inconsistencies between the information provided by the applicant and by government sources are being resolved, marketplaces must determine eligibility using an applicant's attestations and ensure subsidies are provided, if the applicant is qualified to receive them. GAO's undercover testing for the 2015 and 2016 coverage years found that the federal and selected state health-care marketplace's eligibility determination and enrollment process were vulnerable to fraud.
For the 2015 coverage year, for example, the federal and selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health-plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued. Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.
For the 2016 coverage year, the federal and selected state marketplaces initially approved subsidies for 15 fictitious applications. However, three fictitious applicants were unable to put their policies in force because their initial payments were not successfully processed. GAO focused its testing on the remaining 12 applications. For 4 of the 12 applications, GAO used identities from its 2014 testing that had previously obtained subsidized coverage. The 2016 coverage year was the first year in which verification was required to ensure that applicants who previously received a specific type of federal subsidy under the act had filed a federal tax return. This was a condition for these applicants to retain this benefit in 2016. None of the four fictitious applicants had filed a 2014 tax return, but all for were approved for the 2016 subsidies. Marketplace officials told GAO that they allowed applicants to attest to filing taxes if information from the Internal Revenue Service (IRS) indicated that the applicant did not file tax returns. Marketplace officials said one reason they allow attestations is the time lag between when tax returns are filed and when they are reflected in IRS's systems. Centers for Medicare & Medicaid Services (CMS) officials said they are rechecking 2014 tax-filing status and will remove subsidies for applicants that have not filed a 2014 tax return.
GAO's review of concentration in the private health-insurance market found that enrollment was concentrated among a small number of health insurance companies (issuers) in most states in 2014, including in the newly established exchanges. On average, in each state and the District of Columbia, 11 or more issuers participated in each of three types of markets—individual, small-group, and large-group—from 2011 through 2014. However, in most states, the 3 largest issuers in each market had at least an 80 percent share of the market during the period. Enrollment through the exchanges was generally more concentrated among a few issuers than was true for the overall markets.