	Background

Federal laws authorize both state and federal entities to protect the  Medicaid program from fraud, waste, and abuse. State and Federal Program Integrity Entities

A variety of entities are engaged in Medicaid program integrity activities. States Have Focused on FFS Claims and Have Not Closely Examined Medicaid Managed Care Program Integrity

State PI unit officials from five of the seven states in our study and MFCU  officials from four of the study states told us they primarily focus their  program integrity efforts on Medicaid FFS claims. These officials said  they have not begun to closely examine program integrity in Medicaid  managed care, which is a growing portion of overall Medicaid   State PI units and MFCUs are responsible for ensuring  expenditures.Medicaid program integrity, part of which includes monitoring managed  care program integrity. Federal Entities Have Taken Few Steps to Address Medicaid Managed Care Program Integrity

Similar to states, federal entities—CMS and HHS-OIG—have taken few  steps to address Medicaid managed care program integrity. This contractual  requirement also appears in CMS’s regulations, although CMS does not  require states to conduct such audits. Fragmentation Exists and Coordination Efforts Raise Benefits and Challenges

The involvement of multiple state and federal entities in similar activities— post-payment reviews, audits, and investigations—has resulted in  fragmented program integrity activities. Typically, as we have found in  past work, coordinating activities can alleviate many of the problems  created by fragmentation, allowing entities to avoid unnecessary  duplication and overlap. State program integrity officials we interviewed  told us that coordination efforts helped them avoid unnecessary  duplication, but presented additional challenges. The involvement of multiple federal and state entities in audits leads to  fragmentation. Conclusions

GAO identified a gap between state and federal efforts to ensure  Medicaid managed care program integrity. Federal laws require the states  and CMS to ensure the integrity of the Medicaid program, including  payments under Medicaid managed care. However, CMS  has largely delegated managed care program integrity activities to the  states. Without adequate federal support and guidance on ways to  prevent or identify improper payments in a managed care setting, states  are neither well-positioned to identify improper payments made to MCOs,  nor are they able to ensure that MCOs are taking appropriate actions to  identify, prevent, or discourage improper payments. Such efforts take on  greater urgency as states that choose to expand their Medicaid programs  under PPACA are likely to do so with managed care arrangements,  receiving a 100 percent federal match for newly eligible individuals from  2014 through 2016. Unless CMS takes a larger role in holding states  accountable, and provides guidance and support to states to ensure  adequate program integrity efforts in Medicaid managed care, the gap  between state and federal efforts to monitor managed care program  integrity leaves a growing portion of federal Medicaid dollars vulnerable to  improper payments. As implemented across the states, newer  program integrity efforts—such as RACs and MICs—may improve states’  efforts to identify and recover improper payments; however, they will also  increase the need for coordination to ensure maximum program coverage  and minimum duplication and overlap of program integrity activities. Given that combined federal and state efforts have recovered only a small  portion of the estimated improper payments, it will be important to  continue to monitor federal and state program integrity efforts in Medicaid  as a means of assessing whether the current structure is effective. Recommendations for Executive Action

In order to improve the efficiency and effectiveness of Medicaid program  integrity efforts, we recommend that the Administrator of CMS take the  following three actions:  1.  hold states accountable for Medicaid managed care program integrity  by requiring states to conduct audits of payments to and by managed  care organizations;  2.  update CMS’s Medicaid managed care guidance on program integrity  practices and effective handling of MCO recoveries; and  3.  provide the states with additional support in overseeing Medicaid  managed care program integrity, such as the option to obtain audit  assistance from existing Medicaid integrity contractors. In its written  comments, HHS stated that the Department concurred with two of our  recommendations, and stated that our first recommendation— to hold  states accountable for Medicaid managed care program integrity by  requiring states to conduct audits of payments to and by managed care  organizations—was unclear. In response to this recommendation, HHS  listed current CMS activities that the Department believes address the  first recommendation.
Why GAO Did This Study

In fiscal year 2013, the Medicaid program covered about 71.7 million individuals at a cost of $431.1 billion, of which CMS estimated that $14.4 billion (5.8 percent) were improper payments. Multiple state and federal entities are involved in program integrity efforts, such as payment review, auditing, and investigating fraud. GAO was asked to examine how these entities ensure comprehensive Medicaid program integrity. This report examines state and federal roles and responsibilities to identify potential (1) gaps in efforts to ensure Medicaid program integrity coverage; and (2) fragmentation, overlap, or duplication of program integrity efforts, and efforts to coordinate activities. GAO examined relevant federal laws and regulations, CMS guidance, and state program integrity reviews. GAO also interviewed officials from CMS and HHS's Office of Inspector General, as well as PI unit and MFCU officials from seven states.

What GAO Found

GAO identified a gap in state and federal efforts to ensure Medicaid managed care program integrity. Federal laws require the states and the Centers for Medicare & Medicaid Services (CMS) to ensure the integrity of the Medicaid program, including payments under Medicaid managed care, which are growing at a faster rate than payments under fee-for-service (FFS). However, five state program integrity (PI) units and four Medicaid Fraud Control Units (MFCU) from the seven states included in GAO's review said they primarily focus their efforts on Medicaid FFS claims and have not begun to closely examine program integrity in Medicaid managed care. In addition, federal entities have taken few steps to address Medicaid managed care program integrity.
CMS, the federal agency within the Department of Health and Human Services (HHS) that oversees Medicaid has largely delegated managed care program integrity oversight activities to the states, but has not updated its program integrity guidance since 2000.
Additionally, CMS does not require states to audit managed care payments, and state officials GAO interviewed said they require additional CMS support, such as additional guidance and the option to obtain audit assistance from existing Medicaid integrity contractors in overseeing Medicaid managed care program integrity.
The involvement of multiple entities in conducting post-payment reviews, audits, and investigations has resulted in fragmented program integrity efforts; yet the effects of fragmentation are unclear. As GAO has found in past work, coordinating activities can alleviate many problems created by fragmentation, thus allowing entities to avoid unnecessary duplication and overlap. Most of the program integrity officials from the seven states GAO included in this review said that coordination efforts helped them manage overlap and avoid unnecessary duplication; however some officials said that coordination presented additional challenges for time and staff resources. Given that combined federal and state efforts have recovered only a small portion of the estimated improper payments, continued monitoring of federal and state program integrity efforts in Medicaid will be an important means of assessing whether the current structure is effective.
Because of the gap GAO identified between state and federal program integrity efforts in managed care, neither state nor federal entities are well positioned to identify improper payments made to managed care organizations (MCOs), nor are they able to ensure that MCOs are taking appropriate actions to identify, prevent, or discourage improper payments. Improving federal and state efforts to strengthen Medicaid managed care program integrity takes on greater urgency as states that choose to expand their Medicaid programs under the Patient Protection and Affordable Care Act are likely to do so with managed care arrangements, and will receive a 100 percent federal match for newly eligible individuals from 2014 through 2016. Unless CMS takes a larger role in holding states accountable, and provides guidance and support to states to ensure adequate program integrity efforts in Medicaid managed care, the gap between state and federal efforts to monitor managed care program integrity will leave a growing portion of federal Medicaid dollars vulnerable to improper payments.

What GAO Recommends

GAO recommends that CMS increase its oversight of program integrity efforts by requiring states to audit payments to and by MCOs; updating its guidance on Medicaid managed care program integrity; and providing states additional support for managed care oversight, such as audit assistance from existing contractors. In its comments, HHS asked for clarification on the first recommendation and concurred with the other two. In response, GAO clarified its first recommendation—that CMS take the added step of requiring states to audit the appropriateness of payments to and by MCOs to better ensure Medicaid program integrity.