	We Obtained Coverage in 11 of 12 Applications Made through Undercover Testing

The federal Marketplace approved coverage for 11 of our 12 fictitious  applicants who initially applied online, or by telephone. Applicants for coverage are required to attest  that they have not intentionally provided false or untrue information. For each of the approved  applications, we were ultimately directed to submit supporting  documentation to the Marketplace, such as proof of income, identity, or  citizenship. However, we subsequently were able to obtain coverage for all 6  of these applications begun online by completing them by phone. The contractor was unable to  resolve the identity issues. For our 6 phone applications, we successfully completed the application  process, with the exception of one applicant who declined to provide a  Social Security number and was not allowed to proceed. Preliminary Results of Back-End Controls Testing

The Marketplace is required to seek postapproval documentation in the  case of certain application “inconsistencies”—instances in which  information an applicant has provided does not match information  contained in data sources that the Marketplace uses for eligibility  verification at time of application, or such information is not available. As of July 17, 2014, we had  received notifications indicating the Marketplace had reviewed portions of  the counterfeit documentation sent for two applications. However, according to  contractor executives, due to system limitations, processing of income  and citizenship/immigration status inconsistencies—which together  account for 75 percent of inconsistency volume—began in May and June  2014.cannot be matched to their respective applications, and become  “orphans.” As of mid-July 2014, the contractor said, there had been about  227,000 such documents. According to CMS officials, its document  processing contractor is not required under its contract to authenticate  documentation or to conduct forensic analysis. Executives of the  contractor concurred, and told us the review standard the contractor uses  is that it accepts documents as authentic unless there are obvious  alterations. We will continue to assess  CMS’s management of the application and approval process through our  ongoing work and consider any recommendations needed to address  these issues. We Were Unable to Obtain In-Person Assistance in Five of Six Undercover Attempts to Test Income-Verification Controls

We attempted six in-person applications, in order to test income- verification controls only. Specifically, we sought to determine the extent  to which, if any, in-person assisters would encourage our applicants to  misstate income in order to qualify for either of the income-based PPACA  subsidies. During our testing, we visited one in-person assister and obtained  information on whether our stated income would qualify for subsidy. One of the three non-Navigators initially said it provides assistance  only after people already have an application in progress. The non- Navigator did offer to assist us with an application, but the  HealthCare.gov website was down. After we did so, this non-Navigator did not respond to  three follow-up phone calls. The third non-Navigator did not provide assistance, telling us it  handles only applications for Medicaid. In these follow-up  attempts, we again encountered difficulty in obtaining assistance for our  applicants, including the following:
For one test, we visited two additional locations beyond the initial  location before finding an in-person assister at a third who correctly  told us our income was insufficient to qualify for subsidy. CMS Does Not Yet Have the Capability to Identify Those Who Have Paid for Policies, Limiting Our Ability to Analyze Enrollment

The federal government, in administering the two income-based  subsidies, makes payments to issuers of health insurance on behalf of  eligible consumers who have enrolled in a qualified health plan. Thus, a key factor in analyzing  enrollment in Marketplace coverage—and federal expenditures and  subsidies that follow—is the ability to identify which applicants approved  for coverage have subsequently paid premiums and put policies in force. Issuers have reported  this information to CMS, but the agency has not yet created a system to  process the information, according to CMS officials. In May 2014, CMS officials told us that work is underway to implement  such a system. However, CMS does not have a timeline for completing  and deploying this work. As a result, under current operations, CMS must  rely on health insurance issuers to self-report enrollment data reflecting  individuals for whom CMS owes the issuers the income-based subsidies  arising from obtaining coverage through the Marketplace. Appendix I: Legal Appendix

This appendix provides background on certain requirements related to the  submission of applications and eligibility-verification procedures to enroll  in qualified health plans and qualify for income-based subsidies under the  Patient Protection and Affordable Care Act (hereafter PPACA). These verification steps include validating an applicant’s Social Security  number, if one is provided; verifying an applicant’s citizenship, status as  a national, or lawful presence with the Social Security Administration  (SSA) and/or the Department of Homeland Security; verifying household  income and family size against the most recent tax-return data from the  Internal Revenue Service (IRS), as well as data on Social Security  benefits from the SSA; and verifying whether the applicant is eligible for  health coverage under another qualifying plan or program that would  preclude eligibility for subsidy purposes.
Why GAO Did This Study

PPACA provides for the establishment of health insurance exchanges, or marketplaces, where consumers can compare and select private health insurance plans. The act also expands the availability of subsidized health care coverage. The Congressional Budget Office estimates the net federal cost of coverage provisions at $36 billion for fiscal year 2014, with subsidies and related spending accounting for a large portion. PPACA requires marketplaces to verify application information to determine enrollment eligibility and, if applicable, eligibility for subsidies.
GAO was asked to examine issues related to controls for application and enrollment for coverage through the federal marketplace. This testimony discusses preliminary observations on (1) results of undercover testing in which we obtained health care coverage; (2) additional undercover testing, in which we sought to obtain consumer assistance with our applications; and (3) delays in the development of a system needed to analyze enrollment.
This statement is based on preliminary analysis from GAO's ongoing review for this subcommittee and other congressional requesters. GAO created fictitious identities to make applications through the federally facilitated exchange in several states by telephone, online, and in-person. The number and locations of the target areas are not disclosed because of ongoing testing. The results, while illustrative, cannot be generalized to the overall applicant or enrollment populations. GAO expects to issue a final report next year.

What GAO Found

Centers for Medicare & Medicaid Services (CMS) officials told us they have internal controls for health care coverage eligibility determinations. GAO's undercover testing addressed processes for identity- and income-verification, with preliminary results revealing questions as follows:
For 12 applicant scenarios, GAO tested "front-end" controls for verifying an applicant's identity or citizenship/immigration status. Marketplace applications require attestations that information provided is neither false nor untrue. In its applications, GAO also stated income at a level to qualify for income-based subsidies to offset premium costs and reduce cost sharing. For 11 of these 12 applications, which were made by phone and online using fictitious identities, GAO obtained subsidized coverage. For one application, the marketplace denied coverage because GAO's fictitious applicant did not provide a Social Security number as part of the test.
The Patient Protection and Affordable Care Act (PPACA) requires the marketplace to provide eligibility while identified inconsistencies between information provided by the applicant and by government sources are being resolved through submission of supplementary documentation from the applicant. For its 11 approved applications, GAO was directed to submit supporting documents, such as proof of income or citizenship; but, GAO found the document submission and review process to be inconsistent among these applications. As of July 2014, GAO had received notification that portions of the fake documentation sent for two enrollees had been verified. According to CMS, its document processing contractor is not required to authenticate documentation; the contractor told us it does not seek to detect fraud and accepts documents as authentic unless there are obvious alterations. As of July 2014, GAO continues to receive subsidized coverage for the 11 applications, including 3 applications where GAO did not provide any requested supporting documents.
For 6 applicant scenarios, GAO sought to test the extent to which, if any, in-person assisters would encourage applicants to misstate income in order to qualify for income-based subsidies. However, GAO was unable to obtain in-person assistance in 5 of the 6 initial undercover attempts. For example, one in-person assister initially said that he provides assistance only after people already have an application in progress. The in-person assister was not able to assist us because HealthCare.gov website was down and did not respond to follow-up phone calls. One in-person assister correctly advised the GAO undercover investigator that the stated income would not qualify for subsidy.
A key factor in analyzing enrollment is to identify approved applicants who put their policies in force by paying premiums. However, CMS officials stated that they do not yet have the electronic capability to identify such enrollees. As a result, CMS must rely on health insurance issuers to self-report enrollment data used to determine how much CMS owes the issuers for the income-based subsidies. Work is underway to implement such a system, according to CMS, but the agency does not have a timeline for completing and deploying it. GAO is continuing to look at these issues and will consider recommendations to address them.