House Energy and Commerce Subcommittee on Oversight and Investigations Hearing

Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee:

I am pleased to be here today to discuss program integrity efforts intended to prevent improper payments in the Medicaid program. n1 Medicaid is a federal-state health financing program projected to cover about 72 million people in fiscal year 2016 and a significant component of federal and state budgets. In fiscal year 2016, Medicaid expenditures were estimated to total about $576 billion, with the federal government spending about $363 billion and combined state spending of about $213 billion. n2 As a result of flexibility in the program's design, Medicaid consists of 56 distinct state-based programs. n3

The program's size and diversity make it particularly vulnerable to improper payments, including payments made for treatments or services that were not covered by the program, that were not medically necessary, or that were never provided. In fiscal year 2016, improper payments totaled an estimated 10.5 percent ($36 billion) of federal Medicaid expenditures, an increase from an estimated 9.8 percent ($29 billion) in fiscal year 2015. While the percentage of improper payments is increasing, the concerns are not new; we added Medicaid to our list of high-risk programs in January 2003, because of the program's risk of improper payments, as well as insufficient federal and state oversight. n4

States are the first line of defense against Medicaid improper payments. Specifically, they must comply with federal requirements to ensure the qualifications of the providers who bill the program, detect improper payments, recover overpayments, and refer suspected cases of fraud and abuse to law enforcement authorities. At the federal level, the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is responsible for supporting and overseeing state Medicaid program integrity activities. The Deficit Reduction Act of 2005 (DRA) expanded CMS's oversight role by, for example, establishing the Medicaid Integrity Program and including other provisions designed to increase CMS's support for state activities to address Medicaid fraud, waste, and abuse. The DRA provided appropriations to implement the Medicaid Integrity Program, and the Patient Protection and Affordable Care Act (PPACA), enacted in March 2010, gave CMS and states additional provider and program integrity oversight tools. In particular, PPACA and its implementing regulations require state Medicaid agencies to terminate the participation of any provider that has been terminated on or after January 1, 2011, under Medicare, any other state Medicaid program, or Children's Health Insurance Program.

Beginning in 2014, PPACA also provided millions of low-income Americans new options for obtaining health insurance coverage--through the Medicaid program or through an exchange, which is a marketplace where eligible individuals may compare and purchase private health insurance. Because many low-income individuals experience income volatility, they are likely to transition between Medicaid and subsidized exchange coverage. PPACA required the creation of a coordinated eligibility and enrollment process for Medicaid and the exchanges to streamline the eligibility determination process, and to ensure that individuals are enrolled in the coverage for which they are eligible, and transferred to the appropriate form of coverage if their eligibility changes.

Streamlining eligibility determinations necessitated the adoption of new policies and information technology systems by the states, and can require significant coordination between states and the federal government. CMS oversight is crucial to ensure that determinations of Medicaid eligibility are appropriate, and that the risk of coverage gaps and duplicate coverage--generally not permitted under federal law--is minimized.

You asked GAO to testify today on program integrity issues in Medicaid, including issues associated with the Medicaid expansion. My remarks focus on four key Medicaid program integrity issues we have identified, as well as the progress CMS has made addressing them, and the related challenges the agency and states continue to face.

My remarks today are based on our large body of work on the Medicaid program, including our 2015 report on key issues facing the Medicaid program, as well as agency responses to recommendations that we have made. See appendix I for a list of related GAO products and appendix II for selected recommendations. Those reports provide further details on our scope and methodology. We conducted all of the work on which this statement is based in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Under the Medicaid program's federal-state partnership, CMS is responsible for overseeing the program, while state Medicaid agencies are responsible for the day-to-day administration of the program. Although subject to federal requirements, each state develops its own Medicaid administrative structure for carrying out the program, including its approach to program integrity. To monitor program integrity in Medicaid, CMS estimates the national improper payment rate on an annual basis through the Payment Error Rate Measurement (PERM) program. The PERM involves reviews of sampled fee for service claims, payments to managed care entities, and beneficiary eligibility determinations in the states; the national improper payment rate is a weighted average of states' rates in each of these components.

State Medicaid programs do not work in isolation on program integrity; instead, there are a large number of federal agencies, other state entities, and contractors with which states must coordinate. (See fig. 1.) Recognizing the importance of federal state collaboration on program integrity issues, in November 2016, along with the Office of Management and Budget, we convened a meeting with state auditors, CMS, and other federal officials to discuss ways to strengthen collaboration between the federal government and the states.

In recent years, Medicaid expenditures and enrollment grew under PPACA. Growth in enrollment is primarily due to more than half of the states choosing to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under PPACA. In addition to expanding Medicaid eligibility, PPACA required the establishment of health insurance exchanges in all states, and provided for federal subsidies to assist qualifying low-income individuals in paying for exchange coverage. n5 States may elect to establish and operate an exchange, known as a state-based exchange, or allow CMS--which is responsible for overseeing the exchanges--to do so within the state, known as a federally facilitated exchange (FFE). n6 As of March 2015, CMS operated an FFE in 34 states, and 17 states were approved to operate state-based exchanges.

Despite Steps Taken, Additional Efforts Are Needed to Control Medicaid Improper Payments

CMS has taken steps to improve Medicaid program integrity and reduce improper payments; however, additional actions should be taken to help further prevent improper payments. Specifically, our work has identified four key program integrity issues for the Medicaid program--enrollment verification, managed care, provider screening, and coordination between Medicaid and the exchanges--along with CMS's progress in addressing them, and additional necessary actions.

Ensuring that Only Eligible Beneficiaries Are Enrolled in Medicaid

Since 2011, CMS has taken steps to make the Medicaid enrollment-verification process more data-driven to improve the accuracy of eligibility determinations. n7 For example, in response to PPACA, CMS established a more rigorous approach to verifying financial and nonfinancial information needed to determine Medicaid beneficiary eligibility. n8 CMS created a tool called the Data Services Hub that was implemented in fiscal year 2014 to help verify beneficiary applicant information used to determine eligibility for enrollment in qualified health plans and insurance-affordability programs, including Medicaid. The hub routes to and verifies application information in various external data sources, such as the Social Security Administration and the Department of Homeland Security. According to CMS, the hub can verify key application information, including household income and size, citizenship, state residency, incarceration status, and immigration status.

Despite CMS's efforts, there continue to be gaps in the agency's efforts to ensure that only eligible individuals are enrolled into Medicaid. In particular, our work found that federal and selected state-based marketplaces approved health insurance coverage and subsidies for 9 of 12 fictitious applications made during the 2016 special enrollment period. n9 In another study, we found that CMS also had gaps in ensuring that Medicaid expenditures for enrollees--including enrollees eligible as a result of the PPACA expansion--are matched appropriately by the federal government. n10 Specifically, we found that CMS had excluded from review federal Medicaid eligibility determinations in the states that have delegated authority to the federal government to make Medicaid eligibility determinations through the federally facilitated exchange. To address this gap in oversight of eligibility determinations, we recommended that CMS conduct reviews of federal Medicaid eligibility determinations to ascertain the accuracy of these determinations and institute corrective action plans where necessary. In October 2016, HHS provided additional information indicating that the department is relying upon operational controls within federal marketplaces to ensure accurate eligibility determinations as well as new processes that would identify duplicate coverage. However, we continue to believe that without a systematic review of federal eligibility determinations, the agency lacks a mechanism to identify and correct errors and associated payments.

Lastly, CMS requires all states to participate annually in the Eligibility Review Pilots to test different approaches to measuring the accuracy of eligibility determinations under the new beneficiary enrollment processes. n11 Oversight of beneficiary eligibility is important to program integrity. Our prior work has identified thousands of Medicaid beneficiaries involved in potential improper or fraudulent payments. Some of the concerns that we identified included beneficiaries having payments made on their behalf concurrently by two or more states, and payments made for claims that were dated after a beneficiary's death. n12

Improving Oversight of Managed Care

CMS has taken steps to provide states with additional guidance on their oversight of Medicaid managed care organizations. n13 In October 2014, CMS made available on its website the managed care plan compliance toolkit to provide further guidance to states and managed care plans on identifying improper payments to providers. In May 2016, CMS issued a final rule on Medicaid managed care, which requires states to conduct periodic audits of financial data submitted by, or on behalf of each Medicaid managed care plan. n14 The final rule takes additional steps to improve oversight of Medicaid managed care, with some provisions applying after 2018. CMS has also taken action in response to recommendations that we made with regard to increasing guidance for states, requiring states to audit managed care organizations, and providing states with additional audit support. n15

Oversight of Medicaid managed care is increasing in importance as states' use of managed care plans to deliver services has been growing. n16 More than half of all Medicaid beneficiaries are now enrolled in managed care plans, and nearly 40 percent of Medicaid expenditures are for health care services delivered through managed care. n17 The estimated improper payment rate for managed care is currently less than one percent; however, this estimate is based on a review of the payments made to managed care organizations and does not review any underlying medical documentation. Additional actions on the part of CMS and the states are critical to improving program integrity in Medicaid. In particular, we and the HHS Office of Inspector General have identified incomplete and untimely managed care encounter data. n18 Encounter data are data that managed care organizations are expected to report to state Medicaid programs, allowing states to track the services received by beneficiaries enrolled in managed care. Our work found that encounter data for 11 states were not available in a timely manner, and that 6 states had encounter data that we deemed were unreliable.

Ensuring that Only Eligible Providers Are Enrolled in Medicaid.

PPACA included multiple provisions aimed at strengthening the screening of providers who enroll to participate in Medicaid. While the act requires that all providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures. According to CMS's risk-based screening, moderate- and high-risk providers and suppliers additionally must undergo pre-enrollment and post-enrollment site visits, while high-risk providers and suppliers also will be subject to fingerprint-based criminal-background checks. This requirement may address some of the potentially fraudulent or improper payments. Additionally, CMS regulations now require that the state Medicaid agency enroll all Medicaid managed care providers, which has the potential to improve oversight of providers in managed care.

Prior to PPACA, if one state terminated a provider from its Medicaid program, a provider could potentially enroll in or continue participation in another state's Medicaid program, leaving the latter state's program vulnerable to potential fraud, waste, and abuse. Our prior work has identified hundreds of Medicaid providers who were potentially improperly receiving Medicaid payments. n19 Potential improper behavior included providers with suspended or revoked licenses, improper mailing addresses, or deceased providers.

Actions to ensure appropriate oversight of Medicaid providers, however, continue to require additional action on the part of CMS and the states. Our work, which was based on 2 states and 16 health plans, found that these states and health plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers--and that these databases did not always have unique identifiers. n20 Our work resulted in in a recommendation that CMS identify databases best suited for oversight of provider eligibility and coordinate with other agencies to explore the use of a unique identifier. CMS regulations now require that the state Medicaid agency enroll all Medicaid managed care providers, which has the potential to improve oversight of providers in managed care. However, CMS has not yet evaluated whether the additional database merit further action or considered ways to ensure that a unique identifier is available so that providers can be accurately identified. We also found that the 10 selected states that we reviewed used inconsistent practices to make data on ineligible providers publicly available, which could result in provider screening efforts that do not identify ineligible providers. CMS has taken action that is responsive to another recommendation on providing guidance to state Medicaid programs, establishing expectations and best practices on sharing provider screening data among states and Managed care plans. In addition, the recently enacted 21st Century Cures Act takes important steps to address this recommendation including requiring CMS to establish a provider termination notification database by July 2018 and requiring the agency to establish uniform terminology for reasons for provider terminations.

Minimizing Duplicate Coverage between Medicaid and the Exchanges

Regarding coordination between Medicaid and the exchanges, CMS implemented policies and procedures to ensure that individuals do not have duplicate coverage (enrolled in Medicaid and in subsidized exchange coverage). Due to changes in income and other factors, it is likely that under PPACA many low-income individuals will transition between Medicaid and subsidized exchange coverage. Our prior work found that despite CMS policies and procedures designed to prevent duplicate coverage, it was occurring. In response, CMS has conducted three checks to identify individuals with duplicate coverage. CMS has also reported that the agency intends to complete these checks at least two times per coverage year, which has the potential to save federal--as well as beneficiary--dollars.

While CMS has made progress by implementing checks for duplicate coverage, weaknesses remain. CMS has not developed a plan for assessing whether the checks and other procedures are sufficient to prevent and detect duplicate coverage. In March 2016, CMS reported that it was reviewing data on the number of people identified as having duplicate coverage through the first CMS check who subsequently disenrolled from subsidized exchange coverage. CMS reported reviewing these data as a means of assessing the effectiveness of the checks for duplicate coverage. We are continuing to monitor CMS's efforts in this area, particularly whether CMS develops a plan, including thresholds for the level of duplicate coverage it deems acceptable, to routinely monitor the effectiveness of the checks and other planned procedures to prevent and detect duplicate coverage.

In closing, Medicaid represents significant expenditures for the federal government and states, and is the source of health care for tens of millions of Americans. Its long-term sustainability is critical, and will require, among other things, effective federal and state oversight.

Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions that you might have.

n1 An improper payment is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. It includes any payment to an ineligible recipient, any payment for an ineligible service, any duplicate payment, payment for services not received (except where authorized by law), and any payment that does not account for credit for applicable discounts. Improper Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-204, [Sec.] 2(e), 124 Stat. 2224, 2227 (codified at 31 U.S.C. [Sec.] 3321 note). Office of Management and Budget guidance also instructs agencies to report as improper payments any payments for which insufficient or no documentation is found.

n2 Department of Health and Human Services, Centers for Medicare & Medicaid Services, Office of the Actuary, 2015 Actuarial Report on the Financial Outlook for Medicaid (Washington, D.C.: 2015).

n3 The federal government matches states' expenditures for most Medicaid services using a statutory formula based on each state's per capita income. The 56 Medicaid programs include one for each of the 50 states, the District of Columbia, Puerto Rico, Samoa, Guam, the Commonwealth of the Northern Mariana Islands, and the United States Virgin Islands.

n4 See GAO, Major Management Challenges and Program Risks: Department of Health and Human Services, GAO-03-101 (Washington, D.C.: Jan. 2003).

n5 CMS commonly refers to the exchanges as marketplaces. Where we discuss exchanges in this testimony, we are referring only to the exchanges that offer coverage directly to individuals, rather than the exchanges that offer coverage to small businesses and are also required under PPACA. We refer to health plans purchased through the exchanges as exchange coverage and enrollment in exchange coverage with federal subsidies as subsidized exchange coverage. Federal subsidies for exchange coverage include premium tax credits, which are available to eligible individuals with incomes between 100 and 400 percent of the federal poverty level (FPL) and who do not have access to minimum essential coverage, including most Medicaid coverage. In addition, subsidies may include cost-sharing reductions for eligible individuals with incomes between 100 and 250 percent of the FPL. Medicaid plans that provide less than full benefits do not constitute minimum essential coverage and therefore do not preclude individuals from being eligible for subsidized exchange coverage.

n6 In this testimony, we refer to states with federally facilitated exchanges as FFE states. States with state-based exchanges may use the FFE information technology systems for eligibility and enrollment functions. In 2014, two states with state-based exchanges used the FFE information technology systems for eligibility and enrollment, while in 2015 three states with state-based exchanges did so.

n7 See GAO, Medicaid: CMS Could Take Additional Actions to Help Improve Provider and Beneficiary Fraud Controls, GAO-15-665T (Washington, D.C.: June 2, 2015).

n8 78 Fed. Reg. 42160 (July 15, 2013); 81 Fed. Reg. 86382 (Nov. 30, 2016).

n9 See GAO, Patient Protection and Affordable Care Act: Results of Enrollment Testing for the 2016 Special Enrollment Period, GAO-17-78 (Washington, D.C.: Nov. 17, 2016).

n10 See GAO, Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds, GAO-16-53 (Washington, D.C.: Oct. 16, 2015). States that chose to expand eligibility to nearly all adults with incomes at or below 133 percent of the federal poverty level are eligible for increased federal matching rates for enrollees receiving coverage through the state option to expand Medicaid under PPACA, and where applicable, enrollees in states that expanded coverage prior to PPACA's enactment.

n11 In light of the changes to Medicaid eligibility standards and state eligibility systems necessitated by PPACA, CMS announced that the agency has suspended the eligibility portion of the PERM until fiscal year 2018.

n12 See GAO, Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls, GAO-15-313 (Washington, D.C.: May 14, 2015). These results were from fiscal year 2011, which at the time of our reporting was the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states had about 9.2 million beneficiaries and accounted for 13 percent of all fiscal year 2011 Medicaid payments.

n13 See GAO, Medicaid: Key Issues Facing the Program. GAO-15-677 (Washington, D.C.: July 30, 2015).

n14 81 Fed. Reg. 27,498 (May 6, 2016).

n15 See GAO, Medicaid Program Integrity: Increased Oversight Needed to Ensure Integrity of Growing Managed Care Expenditures, GAO-14-341 (Washington, D.C.: May 19, 2014).

n16 States may have different types of managed care arrangements in Medicaid. In this report, where we refer to Medicaid managed care plans, we are referring to managed care plans or organizations that provide services under a comprehensive, risk-based managed care arrangement, the most common type of managed care arrangement.

n17 See GAO, Medicaid Managed Care: Trends in Federal Spending and State Oversight of Costs and Enrollment, GAO-16-77 (Washington, D.C.: Dec. 17, 2015).

n18 See GAO, Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care, GAO-15-481 (Washington, D.C.: May 29, 2015). See also Department of Health and Human Service, Office of Inspector General, Not All States Reported Medicaid Managed Care Encounter Data as Required, OEI-07-13-00120 (July 2015).

n19 See GAO-15-313.

n20 See GAO, Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers, GAO-16-402 (Washington, D.C.: Apr. 22, 2016).

Read this original document at: http://docs.house.gov/meetings/IF/IF02/20170131/105493/HHRG-115-IF02-Wstate-YocomC-20170131.pdf