CMS’s Oversight of Medicaid Program Integrity

CMS’s Center for Program Integrity is the agency’s focal point for  Medicaid and Medicare program integrity issues. Medicaid Integrity Institute. State provider enrollment and screening. CMS also provides states with information and opportunities for  collaboration with the federal government and other states in a number of  ways, including through Medicaid Fraud, Waste and Abuse TAG  meetings; quarterly teleconferences with regional program integrity  directors; and webinars (separate from the training webinars of the MII)  for state Medicaid program integrity staff on topics such as the use of the  CMS Fraud Investigation Database. CMS Tailors Its Focused Reviews of State Program Integrity Efforts to Managed Care and Other High-Risk Areas

CMS has tailored its focused program integrity reviews to states’  managed care delivery systems and other areas that are at high risk for  improper payments. CMS’s Focused Reviews Have Emphasized Oversight of Managed Care and Other High-Risk Areas

From fiscal years 2014 through 2016, CMS conducted focused reviews of  state program integrity efforts in 31 states, reviewing 10 or 11 states  annually. As a result, CMS officials recommended that  states take steps to improve their oversight of plans. CMS Uses Targeted Desk Reviews to Expand Oversight of High-Risk Areas

To expand its oversight to conduct more frequent reviews of states, CMS  recently began supplementing its focused reviews with targeted desk  reviews—off-site reviews of certain program integrity efforts designed to  address high-risk areas. Collaborative Audits Identified Substantial Potential Overpayments, but Some States Reported Barriers to Audit Participation and Success

Collaborative audits identified substantial potential overpayments to  health care providers. 1.) CMS encourages states to use collaborative audits, but states determine  whether to have collaborative audits. 2.) Several States Had Positive Collaborative Audit Experiences, While Others Reported Barriers that May Limit Audit Participation and Success

Officials from the eight states we interviewed reported mixed experiences  with and interest in collaborative audits. Federal internal  control standards indicate that organizations should identify, analyze, and  respond to risks related to achieving objectives. Unless CMS can successfully address the potential  barriers encountered by states, some states may choose not to pursue  collaborative audits—or may pursue audits only to encounter challenges  that were not effectively minimized or prevented. 3.) CMS Lacks a Systematic Approach to Collecting and Communicating States’ Promising Program Integrity Practices

CMS uses focused state program integrity reviews as its primary method  of collecting and communicating promising program integrity practices;  however, these practices are not collected in a consistent manner and the  published reports are not timely nor easily searched electronically. In addition, CMS officials said  that individuals who perform the reviews ask states to identify promising  practices. This statement is consistent with  federal internal control standards that stipulate that agencies should use  quality information to achieve the entity’s objectives and externally  communicate necessary quality information. Both CMS and the states have a role in identifying promising program  integrity practices that can be shared in order to help improve oversight of  the Medicaid program. To better support states’ efforts to reduce improper payments and  communicate effective program integrity practices across the states, CMS  should collaborate with states to develop a systematic approach to collect promising state program  create and implement a communication strategy for sharing promising  program integrity practices with states in an efficient and timely  manner. With regard to our recommendation that CMS identify  opportunities to address barriers that limit states’ participation in  collaborative audits, HHS noted that it continually seeks to collaborate  with states on Medicaid provider audits, and seeks to work through issues  so that actions to identify potentially improper payments may proceed.
Why GAO Did This Study

Medicaid remains a high-risk program, partly due to concerns about improper payments. CMS oversees and supports states, in part, by reviewing their program integrity activities, hiring contractors to audit providers, and providing training. In recent years, CMS made changes to its Medicaid program integrity efforts, including a shift to collaborative audits.
GAO was asked to examine CMS's oversight and support of states' Medicaid program integrity efforts. GAO examined, among other issues, (1) how CMS tailors its reviews to states' circumstances; (2) states' experiences with collaborative audits; and (3) CMS's steps to share promising program integrity practices. GAO reviewed CMS documents, including state program integrity reports, and data on collaborative audits. GAO interviewed officials from CMS and eight states selected based on expenditures, managed care use, and number of collaborative audits, among other factors.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) has tailored its state program integrity reviews—in which the agency reviews states' program integrity activities—to states' managed care delivery systems and other areas at high risk for improper payments. From 2014 through 2016, CMS conducted on-site reviews in 31 states. The reviews usually addressed state oversight of managed care plans, and some reviews addressed other high-risk areas such as provider enrollment. CMS and states have found the reviews to be beneficial in identifying areas for improvement. To expand oversight to more states, CMS also began off-site desk reviews of certain state program integrity efforts.
Collaborative audits—in which CMS contractors and states work in partnership—have identified substantial potential overpayments to providers, but barriers have limited their use. CMS encourages states to use collaborative audits, but states decide whether to pursue them. Several states reported positive collaborative audit experiences, while others cited barriers—such as staff burden or problems communicating with contractors—that prevented them from seeking audits or hindered the success of audits. Federal internal control standards indicate that organizations should identify and respond to risks related to achieving objectives. Absent additional CMS action to address barriers, some states may choose not to pursue collaborative audits, or may encounter challenges after doing so.
CMS lacks a systematic approach to collecting promising state progam integrity practices and communicating them to other states. CMS's main approach—the state program integrity reviews—inconsistently identified promising practices, and those identified are neither published in a timely way nor easily searched electronically. Other CMS approaches, such as courses offered by the Medicaid Integrity Institute (a national training program for states), were not designed for sharing promising practices and do not systematically communicate them to all states. Both CMS and the states have a role in identifying promising program integrity practices. Absent further agency action, states may not have access to the range of promising state program integrity practices, which is inconsistent with federal internal control standards on the use and external communication of necessary quality information to achieve program objectives.

What GAO Recommends

To further improve its support of states' Medicaid program integrity activities, CMS should identify opportunities to address barriers that limit states' participation in collaborative audits, and, in collaboration with states, take additional steps to collect and share promising program integrity practices. The Department of Health and Human Services concurred with GAO's recommendations.