Capitated  payments are periodic payments approved by CMS that state  Medicaid agencies make to contracted MCOs to cover the provision of  medical services to enrollees, as well as the MCOs’ administrative  expenses and their profits or earnings. In contrast to the FFS component, the managed  care component of the PERM neither includes a medical review of  services delivered to enrollees, nor reviews of MCO records or data. Payment Error Rate Measurement for Managed Care Has Limitations, Which Are Not Mitigated by Current CMS and State Oversight

The managed care component of the PERM measures the accuracy of  the capitated payments state Medicaid agencies make to MCOs. Among the 27 audits and investigations of Medicaid managed care  programs we reviewed, 10 identified about $68 million in MCO  overpayments to providers and unallowable MCO costs that were not  accounted for in PERM estimates. However, the full extent of these  overpayments and unallowable costs is unknown, because these audits  and investigations were conducted over more than 5 years and involved a  small fraction of the more than 270 MCOs operating nationwide as of  September 2017. As a result, the PERM  improper payment estimate potentially understates the extent of program  integrity risks in Medicaid managed care. CMS and State Oversight of Managed Care Do Not Ensure the Identification and Reporting of Overpayments and Unallowable Costs

As noted, CMS has increased its focus on and worked with states to  improve oversight of Medicaid managed care; however, these efforts and  the oversight efforts of states do not ensure the identification and  reporting of overpayments and unallowable costs. In recent years, the  agency has sought to strengthen oversight of managed care programs  through updated regulations; reviews of states’ managed care programs  (Focused Program Integrity Reviews) and collaborative audits, which are  conducted jointly by federal program integrity contractors and states; and  state monitoring of overpayments. Federal internal control standards call for agency management to identify,  analyze, and respond to risks. CMS has taken some steps to identify,  analyze, and respond to risks through its regulations, Focused Program  Integrity Reviews, and collaborative audits. Conclusions

The 0.3 percent improper payment rate for Medicaid managed care, as  measured by the PERM, is significantly lower than the improper payment  rate of 12.9 percent for Medicaid FFS. Without better measurement of program risks—particularly as  expenditures for Medicaid managed care continue to grow—CMS cannot  be certain that the low improper payment rate for managed care, as  measured by the PERM, accurately reflects lower risks in managed care. Recommendation

The Administrator of CMS should consider and take steps to mitigate the  program risks that are not measured in the PERM, such as overpayments  and unallowable costs; such an effort could include actions such as  revising the PERM methodology or focusing additional audit resources on  managed care. Given the size  of the Medicaid program, its vulnerability to improper payments, and the  growth in managed care, it is critical to have a full accounting of program  integrity risks in managed care in order to best ensure the integrity of the  whole Medicaid program. HHS also provided  technical comments, which we incorporated as appropriate. Appendix I: Federal and State Audits and Investigations of Medicaid Managed Care

We reviewed 16 federal and state audits and 11 notices of investigations  of Medicaid managed care organizations (MCO) and providers issued  from January 2012 to September 2017. These audits and investigations show  cases of MCO overpayments to providers or unallowable costs, which  are not accounted for by the Centers for Medicare & Medicaid  Services’ Payment Error Rate Measurement (PERM) ; errors in capitated payments (e.g., capitated payments made for  deceased individuals), which are accounted for in the PERM; and gaps in managed care oversight.
Why GAO Did This Study

The improper payment rate is a sentinel measure of program integrity risks for the Medicaid program. CMS and the states oversee Medicaid, whose size, structure, and diversity make it vulnerable to improper payments. CMS estimates the Medicaid improper payment rate annually through its PERM, which includes an estimate for Medicaid managed care, in which states contract with MCOs to provide services to Medicaid enrollees.
GAO was asked to study the PERM methodology for managed care. In this report, GAO examined the extent to which the PERM accounts for program integrity risks in Medicaid managed care, including CMS's and states' oversight. GAO identified program integrity risks reported in 27 federal and state audits and investigations issued between January 2012 and September 2017; reviewed federal regulations and guidance on the PERM and CMS's Focused Program Integrity Reviews; and contacted program integrity officials in the 16 states with a majority of 2016 Medicaid spending for managed care, as well as CMS officials and program integrity experts.

What GAO Found

The Centers for Medicare & Medicaid Services' (CMS) estimate of improper payments for Medicaid managed care has limitations that are not mitigated by the agency's and states' current oversight efforts. One component of the Payment Error Rate Measurement (PERM) measures the accuracy of capitated payments, which are periodic payments that state Medicaid agencies make to managed care organizations (MCO) to provide services to enrollees and to cover other allowable costs, such as administrative expenses. However, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data. Further, GAO's review of the 27 federal and state audits and investigations identified key program risks.
Ten of the 27 federal and state audits and investigations identified about $68 million in overpayments and unallowable MCO costs that were not accounted for by PERM estimates; another of these investigations resulted in a $137.5 million settlement.
These audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017.
To the extent that overpayments and unallowable costs are unidentified and not removed from the cost data used to set capitation rates, they may allow inflated MCO payments and minimize the appearance of program risks in Medicaid managed care.
CMS and states have taken steps to improve oversight of Medicaid managed care through updated regulations, focused reviews of states' managed care programs, and federal program integrity contractors' audits of managed care services.
However, some of these efforts went into effect only recently, and others are unlikely to address the risks in managed care across all states.
Furthermore, these efforts do not ensure the identification and reporting of overpayments to providers and unallowable costs by MCOs.
Federal internal control standards call for agency management to identify and respond to risks. Without addressing key risks, such as the extent of overpayments and unallowable costs, CMS cannot be certain that its estimated improper payment rate for managed care (0.3 percent compared with 12.9 percent in Medicaid fee-for-service) accurately reflects program risks.

What GAO Recommends

The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. HHS concurred with this recommendation. HHS also provided technical comments, which were incorporated as appropriate.