	Background

CMS has four principal programs: Medicare, Medicaid, CHIP, and the  health-insurance marketplaces. 1). Improper payments are a significant risk to the Medicare and Medicaid  programs and can include payments made as a result of fraud. The Fraud Risk Framework  describes leading practices in four components: commit, assess, design  and implement, and evaluate and adapt, as depicted in figure 2. The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires OMB to establish guidelines for federal agencies to create  controls to identify and assess fraud risks and design and implement  antifraud control activities. CMS Manages Fraud Risks as Part of Its Agency-Wide Program-Integrity Activities and through an Extensive Network of Stakeholders

		Fraud Risk Management Is a Part of CMS’s Broader Program-Integrity Approach

CMS’s antifraud efforts for its four principal programs are part of the  agency’s broader program-integrity approach to address fraud, waste,  and abuse. According to  CMS officials, in fiscal year 2016 contractors received 92 percent of  CMS’s program-integrity funding. CMS’s Efforts Managing Fraud Risks in Medicare and Medicaid Are Partially Aligned with the Fraud Risk Framework

CMS’s antifraud efforts partially align with the Fraud Risk Framework. CMS Has Shown Commitment to Combating Fraud by Creating an Organizational Structure and Taking Steps to Establish a Culture Conducive to Fraud Risk Management CMS’s Organizational Structure Includes a Dedicated Entity for Program-Integrity and Antifraud Efforts

The commit component of the Fraud Risk Framework calls for an agency  to commit to combating fraud by creating an organizational culture and  structure conducive to fraud risk management. Center for Medicaid and CHIP Services (CMCS). Center for Medicare (CM). To increase awareness of fraud risks in Medicare and Medicaid, CMS  offers and requires training for stakeholder groups such as providers,  beneficiaries, and health-insurance plans. Separately,  CMS requires health-insurance plans working with CMS to provide annual  fraud, waste, and abuse training to their employees. However, CMS does not offer or require similar fraud-awareness training  for the majority of its workforce. CMS Has Taken Steps to Identify Program Fraud Risks but Has Not Conducted a Fraud Risk Assessment for Medicare or Medicaid

			CMS Has Taken Steps to Identify Some Fraud Risks for Medicare and Medicaid

The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and to assess risks to  determine a fraud risk profile. CMS tailored  state Medicaid program-integrity reviews to areas it identified as high risk  for improper payments, such as personal care services, which may also  be at high risk for fraud. As described by CPI officials, the process aims  to collect information on fraud-related vulnerabilities from CMS  employees, contractors, and other sources, such as GAO and HHS OIG  reports. With this approach, however, it is unlikely that CMS will be able to design  and implement the most-appropriate control activities to respond to the  full portfolio of fraud risks. CMS Has Not Developed a Risk-Based Antifraud Strategy for Medicare and Medicaid, Which Would Include Plans for Monitoring and Evaluation

			CMS Has Not Developed a Risk-Based Antifraud Strategy

The design and implement component of the Fraud Risk Framework calls  for federal managers to design and implement a strategy with specific  control activities to mitigate assessed fraud risks and collaborate to help  ensure effective implementation. Without developing and documenting an antifraud strategy based on a  fraud risk assessment, as called for in the design and implement  component of the Fraud Risk Framework, CMS cannot ensure that it has  a coordinated approach to address the range of fraud risks and to  appropriately target and allocate resources for the most-significant risks. Such a strategy would (1) provide reasonable  assurance that CMS is targeting the most-significant fraud risks in its  programs and (2) help protect the government’s substantial and growing  investments in these programs. This strategy should  include an approach for monitoring and evaluation.
Why GAO Did This Study

CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion.
GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework.
GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served.

What GAO Found

The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments.
CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid.

What GAO Recommends

GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.