Under a managed care service  delivery model, states pay MCOs a capitation payment, which is a fixed  periodic payment per beneficiary enrolled in an MCO—typically, per  member per month. State stakeholders—Medicaid managed care offices, state Medicaid  program integrity units, Medicaid Fraud Control Units (MFCUs), and in  many cases state auditors—and MCO stakeholders—MCOs that contract  with states to deliver Medicaid services—play important roles in the  oversight of managed care payment risks and have a variety of program  integrity responsibilities. Four of  these risks relate to the payments state Medicaid agencies make to  MCOs, and two relate to payments that MCOs make to providers. 2 and 3.) In terms of the relative importance of these payment risks, two payment  risks were more frequently cited by stakeholders as having a higher level  of risk than other types—incorrect MCO fee-for-service payments to  providers and inaccurate state capitation rates. Multiple Challenges Exist for Effective Program Integrity Oversight and Stakeholders Identified Strategies to Address Them Key Challenges to Oversight Included Resource Allocation, the Quality of Data and Technology, and the Adequacy of State Policies and Practices

We identified six challenges to effective program integrity oversight in  Medicaid managed care based on our review of Medicaid audit reports  and other sources. Some  stakeholders also described strategies to address these challenges. CMS Has Assisted States in Addressing Payment Risks, but Some Efforts Have Been Delayed and There Are Gaps in Oversight

CMS has taken important steps to address payment risks in Medicaid  managed care, issuing a final rule, increasing guidance, and conducting  oversight activities. These delays and gaps are  inconsistent with the agency’s current program integrity plan, which  established goals for improving state oversight of program integrity in  Medicaid managed care, as well as the financial accountability of  Medicaid MCOs. As of May 2018, no issuance date has been set for the guidance. The lack of sufficient auditing in managed care is inconsistent  with federal internal control standards that require federal agencies to identify  risks through such activities as auditing. Gaps in monitoring also exist because CMS lacks a process  for consistently collecting information about overpayments and  documenting that states account for overpayments when setting  capitation rates. Conclusions

Managed care has the potential to help states reduce Medicaid program  costs and better manage utilization of health care services. Without taking  actions to address these issues, CMS is missing an opportunity to  develop more robust program integrity safeguards that will best mitigate  payment risks in managed care. Recommendations For Executive Action

We are making the following three recommendations to CMS:
The Administrator of CMS should expedite the planned efforts to  communicate guidance, such as its compendium on Medicaid  managed care program integrity, to state stakeholders related to  Medicaid managed care program integrity. (Recommendation 1)
The Administrator of CMS should eliminate impediments to  collaborative audits in managed care conducted by audit  contractors and states, by ensuring that managed care audits are  conducted regardless of which entity—the state or the managed  care organization—recoups any identified overpayments. 10.) Appendix II: Examples of Different Types of Payment Risks in Medicaid Managed Care

To identify examples of payment risks in Medicaid managed care, we  reviewed Department of Health and Human Services’ (HHS) Office of  Inspector General (HHS-OIG) publications and our prior work; obtained  input from the National State Auditor’s Association; and conducted  literature searches and key word searches of online databases, which  identified additional state audits and investigations involving Medicaid  managed care payment. Appendix III: Challenges to Effective Program Integrity Oversight in Medicaid Managed Care

We asked 49 stakeholders involved in program integrity oversight to  consider the following six challenges to effective program integrity  oversight: (1) availability and allocation of resources; (2) access to and  quality of data and technology; (3) state policies and practices; (4)  provider compliance with program requirements; (5) managed care  organization (MCO) management of program integrity; and (6) federal  regulations, guidance, and review. Stakeholders were asked whether  any of these presented a challenge to each of six types of payment risks  in Medicaid managed care in their state, including (1) improper state  capitation payments to MCOs for ineligible or deceased individuals; (2)  inaccurate state capitation rates; (3) state payments to MCOs that have  not fulfilled contract requirements; (4) state duplicate payments to MCOs  and providers; (5) incorrect MCO fee-for-service payments to providers  for improper claims; and (6) incorrect MCO capitation payments to  providers that have not complied with program requirements. Some examples include the following:
Quality of data and technology was the most cited challenge for  duplicate state payments.
Why GAO Did This Study

Federal spending on services paid for under Medicaid managed care was $171 billion in 2017, almost half of the total federal Medicaid expenditures for that year. Federal and state program integrity efforts have largely focused on Medicaid fee-for-service delivery where the state pays providers directly, rather than managed care, where it pays MCOs. As a result, less is known about the types of payment risks under managed care.
GAO was asked to examine payment risks in Medicaid managed care. In this report, GAO (1) identified payment risks; (2) identified any challenges to state oversight and strategies to address them; and (3) assessed CMS efforts to help states address payment risks and oversight challenges. To do this work, GAO reviewed findings on managed care payment risks and oversight challenges from federal and state audits and other sources. GAO also interviewed 49 state program integrity stakeholders in 10 states selected based on size, the percent of population in managed care, and geography. Stakeholders included the state Medicaid managed care office, state Medicaid program integrity unit, state auditor, Medicaid Fraud Control Unit, and an MCO.

What GAO Found

Under Medicaid managed care, managed care organizations (MCO) receive a periodic payment per beneficiary in order to provide health care services. Managed care has the potential to help states reduce Medicaid program costs and better manage the use of health care services. However, managed care payments also have the potential to create program integrity risks. GAO identified six types of payment risks associated with managed care, including four related to payments that state Medicaid agencies make to MCOs, and two related to payments that MCOs make to providers. Of the six payment risks GAO identified, state stakeholders responsible for ensuring Medicaid program integrity more often cited the following two as having a higher level of risk:
incorrect fee-for-service payments from MCOs, where the MCO paid providers for improper claims, such as claims for services not provided; and
inaccurate state payments to MCOs resulting from using data that are not accurate or including costs that should be excluded in setting payment rates.
GAO also identified multiple challenges to program integrity oversight for managed care programs. Stakeholders most frequently cited challenges related to (1) appropriate allocation of resources, (2) quality of the data and technology used, and (3) adequacy of state policies and practices. Some stakeholders offered strategies to address these challenges, including collaborating with other entities to identify problem providers and fraud schemes, as well as having effective data systems to better manage risks.
The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has initiated efforts to assist states with program integrity oversight for managed care. However, some of these efforts have been delayed, and there are also gaps in oversight.
CMS's planned Medicaid managed care guidance to states has been delayed due to the agency's internal review of the regulations; as of May 2018, no issuance date had been set for the guidance.
CMS established a new approach for conducting managed care audits beginning in 2016. However, only a few audits have been conducted, with none initiated in the past 2 years. In part, this is due to certain impediments identified by states, such as the lack of some provisions in MCO contracts.
CMS has updated standards for its periodic reviews of the state capitation rates set for MCOs. However, overpayments to providers by MCOs are not consistently accounted for in determining future state payments to MCOs, which can result in states' payments to MCOs being too high.
Lack of guidance and gaps in program integrity oversight are inconsistent with federal internal control standards, as well as with CMS's goals to (1) improve states' oversight of managed care; (2) use audits to investigate fraud, waste, and abuse of providers paid by MCOs; and (3) hold MCOs financially accountable. Without taking action to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will help mitigate payment risks in Medicaid managed care.

What GAO Recommends

GAO recommends that CMS (1) expedite issuing planned guidance on Medicaid managed care program integrity, (2) address impediments to managed care audits, and (3) ensure states account for overpayments in setting future MCO payment rates. The Department of Health and Human Services concurred with these recommendations.