VA Disability Benefits: Some Progress, but Further Steps Needed to Improve Appeals Reform Planning

VA's disability compensation program pays cash benefits to veterans with disabilities connected to their military service. In recent years, the time needed to complete appeals of VA's decisions on claims has increased. For appeals resolved in fiscal year 2017, veterans waited an average of 3 years. The subset of appeals resolved by the Board of Veterans Appeals—a separate VA agency that provides a higher level of appeals review—took on average 7 years to resolve.

The Veterans Appeals Improvement and Modernization Act of 2017 makes changes to VA's current (legacy) process, giving veterans options to have their claims further reviewed by VA or appeal directly to the Board. The Act requires VA to submit a plan to Congress and GAO for implementing a new appeals process (which VA submitted in November 2017) and periodic updates (which VA submitted in February and May 2018). The Act also includes a provision for GAO to assess VA's original plan.

In March 2018, GAO found that VA could help ensure successful implementation of appeals reform by addressing gaps in planning and made four recommendations, with which VA agreed. This testimony focuses on the steps VA has taken to address GAO's recommendations and what aspects remain unaddressed.

For this statement, GAO reviewed VA's May 2018 updated plan, and interviewed VA officials and reviewed information they provided about steps taken to implement GAO's recommendations.

In a March 2018 report, GAO assessed the Department of Veterans Affairs' (VA) November 2017 plan for changing how veterans appeal disability claim decisions and found that VA could do more to successfully implement these reforms. The March 2018 report made four recommendations to address planning gaps. Since then, VA has updated its plan and taken some steps to address aspects of these recommendations, but further steps are needed:

Address all legally required elements . GAO reported that VA's plan did not address one and partially addressed four of 22 elements required by the Veterans Appeals Improvement and Modernization Act of 2017 (Act), and recommended VA fully address them all. In a May 2018 update to its plan, VA took steps to address the five elements, such as developing productivity projections and a model to forecast resource needs for processing appeals. These steps address one element related to projecting productivity, and partially address the four remaining elements.

Articulate performance measurement . GAO also recommended VA clearly articulate how it will monitor and assess the new appeals process relative to the legacy process. This recommendation includes specifying timeliness goals for five new appeals options to be made available to veterans, and additional goals or measures of performance, such as accuracy in processing appeals. VA's updated plan states that the agency will develop goals and measures for all appeals options after fully implementing appeals reform. Contrary to sound planning practices, it does not articulate these performance goals and measures now, which would provide a vision for what successful implementation would look like. Lacking this vision, VA does not have an “end state” to guide its implementation and help establish accountability.

Augment project plan . GAO recommended VA augment its master schedule for implementing appeals reform to include all key activities and reflect other sound practices for guiding implementation and establishing accountability. Although VA's May 2018 updated master schedule added activities, it omitted a pilot test of the new Board of Veterans' Appeals (Board) options. More generally, the plan does not reflect interdependencies among activities. Until all key activities are accounted for and the master schedule reflects sound practices, VA cannot provide reasonable assurance that it has the essential information needed to manage its appeals reform implementation.

Address risk fully . GAO recommended that VA's appeals plan more fully address risks in implementing a new process by, for example, testing all appeals options prior to full implementation. In its updated plan, VA stated it will pilot all five new appeals options. By taking these steps, VA should be better positioned to assess implementation risks. However, the updated plan does not have well-defined, measurable criteria for assessing lessons learned from these pilots and does not articulate how well these lessons translate to a broader context. Taking these steps would improve VA's ability to assess and mitigate risks as it implements its reforms.

I appreciate the opportunity today to provide an update on the  Department of Veterans Affairs’ (VA) plans for implementing a new  disability appeals process while still attending to appeals under the  current, or legacy, process.

VA provides cash benefits to veterans for disabling conditions incurred in  or aggravated by military service, paying about $72 billion to about 4.5  million veterans in fiscal year 2017. If veterans are dissatisfied with VA’s  initial decision they can appeal—first to the Veterans Benefits  Administration (VBA) and then, if not satisfied there, to the Board of  Veterans’ Appeals (Board), a separate agency within VA. For appeals  resolved in fiscal year 2017, veterans waited an average of approximately  3 years from the date they initiated their appeal to resolution by either  VBA or the Board—and an average of 7 years for appeals resolved by the  Board. Due in part to the challenges VA faces managing large workloads  and deciding disability claims and appeals in a timely manner, GAO in  2003 designated VA disability compensation, along with other federal  disability programs, as one of the government’s highest risk areas.

The Veterans Appeals Improvement and Modernization Act of 2017 (Act)  makes changes to VA’s disability appeals process by replacing the  current appeals process with one that gives veterans various options for  further review by VBA or to bypass VBA and appeal directly to the  Board. The Act further requires VA to submit a comprehensive plan for  implementing the new appeals process to the appropriate committees of  Congress and GAO. (VA submitted its plan to GAO on November 22,  2017.) The Act delineates 22 legally required elements of this plan. In  addition, the Act requires VA to provide progress reports to the  appropriate committees of Congress and GAO at least every 90 days,  until the Act’s changes to the appeals process generally go into effect and  then at least every 180 days after this date for 7 years. VA submitted  progress reports in February and May 2018, and its next progress report  is due in August 2018.

The Act also includes a provision for GAO to assess whether VA’s  appeals plan comports with sound planning practices and identify any  gaps in the plan. In our March 2018 report assessing VA’s plan, we  concluded that while VA’s November 2017 plan reflected aspects of  sound planning, improvements in planning are still needed to ensure  successful appeals reform. We recommended VA’s plan (1) address all  legally required elements in the Act; (2) articulate how it will monitor and  assess the performance of appeals processes; (3) augment its project  plan for implementation; and (4) address risk more fully. VA agreed with  our recommendations. Subsequently, in April 2018 we designated two of  our four recommendations—monitoring and assessing performance as  well as addressing risks—as “priority recommendations” for VA to  implement.

My statement today addresses VA’s progress in implementing the four  recommendations. Specifically, it summarizes steps VA has taken to  address GAO’s recommendations identified in our March 2018 report,  and what aspects of our recommendations that VA has yet to address.

For this statement, we reviewed VA’s May 2018 updated appeals reform  plan and information we received from VA officials about any significant  steps taken to implement our March 2018 recommendations. We also  interviewed relevant VA officials and reviewed information related to VA’s  progress in addressing four related recommendations from work that we  conducted prior to enactment of the Act. The work upon which this  statement is based was conducted in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.

VA’s Current Disability Compensation Appeals Process

VA’s process for deciding veterans’ eligibility for disability compensation  begins when a veteran submits a claim to VA. Staff in one of VBA’s 56  regional offices assist the veteran by gathering additional evidence, such  as military and medical records, that is needed to evaluate the claim.  Based on this evidence, VBA decides whether the veteran is entitled to  compensation and, if so, how much. A veteran dissatisfied with the initial  claim decision can generally appeal within 1 year from the date of the  notification letter sent by VBA.

Under the current appeals process (now referred to by VA as the legacy  process), an appeal begins with the veteran filing a Notice of  Disagreement. VBA then re-examines the case and generally issues a  Statement of the Case that represents its decision. A veteran dissatisfied  with VBA’s decision can file an appeal with the Board. In filing that  appeal, the veteran can indicate whether a Board hearing is desired.

Before the Board reviews the appeal, VBA prepares the file and certifies it  as ready for Board review. If the veteran requests a hearing to present  new evidence or arguments, the Board will hold a hearing by  videoconference or at a local VBA regional office. The Board reviews the  evidence and either issues a decision to grant or deny the veteran’s  appeal or refers (or remands) the appeal back to VBA for further work.

The Act made changes to VA’s appeals process that will generally take  effect no earlier than February 2019, which is approximately 18 months  after enactment. According to its appeals plan, VA intends to implement  the Act by February 2019, by replacing the current appeals process with a  process offering veterans who are dissatisfied with VBA’s decision on  their claim five options: two of those options afford the veteran an  opportunity for an additional review of VBA’s decision within VBA, and the  other three options afford them the opportunity to bypass additional VBA  review and appeal directly to the Board.

Under the new appeals process, the two VBA options will be:  1. Request higher-level review: The veteran asks VBA to review its initial decision based on the same evidence but with a higher-level official reviewing and issuing a new decision. 2. File supplemental claim: The veteran provides additional evidence and files a supplemental claim with VBA for a new decision on the claim. The veteran could also request a VBA hearing.

The three Board options will be:  3. Request Board review of existing record: The veteran appeals to the Board and asks it to review only the existing record without a hearing. 4. Request Board review of additional evidence, without a hearing. 5. Request Board review of additional evidence, with a hearing.

In November 2017, VA initiated a pilot test of the new VBA higher-level  review and supplemental claim options. According to VA’s appeals plan, a  purpose of this pilot—the Rapid Appeals Modernization Program  (RAMP)—is to reduce legacy appeals by providing veterans with a  chance for early resolution of their claims within VBA’s new process.

Participation in RAMP is voluntary, but veterans must withdraw their  pending legacy appeal to participate, according to VA’s appeals plan.

VA Has Addressed Some Aspects of GAO’s Recommendations on Appeals Reform Planning

In our March 2018 report, we found that VA could help ensure successful  implementation of appeals reform by addressing gaps in its planning. We  recommended four actions that VA should take: (1) address all legally  required elements required by the Act; (2) articulate how it will monitor  and assess the performance of the new appeals process compared to the  legacy process, (3) augment its master schedule to manage the project,  and (4) address risk more fully. VA has taken steps in response to all  four, but has not fully addressed our recommendations.

VA Has Yet to Provide Complete Information on GAO’s Recommendation to Address the Act’s Required Elements

In our March 2018 report, we found that VA’s November 2017 plan for  implementing a new disability appeals process while attending to appeals  under way in the current (legacy) process, addressed most, but not all,  elements required by the Veterans Appeals Improvement and  Modernization Act of 2017. Specifically, we found that VA’s appeals  plan addressed 17 of 22 elements required by the Act. For the five  remaining elements, it partially addressed 4 elements related to  monitoring implementation, projecting productivity, and workforce  planning, and did not address 1 element related to identifying total  resources. This element called for delineating the resources needed by  VBA and the Board to implement the new appeals process and address  legacy appeals.

We recommended in March 2018 that the Secretary of Veterans Affairs  address all 22 required elements in the Act in VA’s appeals plan to  Congress. This included delineating resources required for all VBA and  Board appeals options using sensitivity analyses and results from the  RAMP test where appropriate and needed.

Since our 2018 report, VA has taken some action on the five elements  that were not fully addressed. For example, VA’s updated plan added  details related to projecting staff productivity, identifying total resources,  as well as about personnel requirements and projections for processing  legacy appeals. For identifying total resources, VA added FTE information  for other offices that help implement the appeals process and prepared a  model to project resource needs.

VA’s updated plan, however, continues to only partially address 3  elements related to monitoring implementation and workforce planning,  and now addresses the 1 element related to projecting productivity and  partially addresses the 1 element related to delineating the total  resources. For total resources, VA’s updated plan does not delineate the  total resources required by VBA and the Board. Until VA’s appeals plan  provides complete information on all required elements, Congress may  not have the information needed to conduct oversight of the agency’s  efforts to implement and administer the new process while addressing  legacy appeals.

VA Has Partially Addressed GAO’s Recommendation to Measure, Monitor, and Assess Performance

In our 2018 report, we found that VA could improve its planning practices  related to monitoring and assessing performance on a range of key  dimensions of success. Specifically, the plan had not (1) established  timeliness goals for two of the three Board options (i.e., Board review of  additional evidence without a hearing and Board review of additional  evidence with a hearing); (2) articulated additional aspects of  performance important for managing appeals, such as accuracy of  decisions, veteran satisfaction with the process, or cost; (3) provided  important details about what aspects of the new appeals’ performance  would be compared to what aspects of the legacy process’ performance;  or (4) explained how the agency would monitor whether resources are  being appropriately devoted to both the new and legacy appeals  processes and how it will track both sets of workloads.

To address these gaps, we recommended that the Secretary of Veterans  Affairs clearly articulate in VA’s appeals plan how VA will monitor and  assess the new appeals process compared to the legacy process. These  include specifying a balanced set of goals and measures with related  baseline data, such as timeliness goals for all VBA appeals options and  Board dockets, and measures of accuracy, veteran satisfaction, and cost.

In its May 2018 updated plan, VA addressed some but not all aspects of  this recommendation. Specifically:  Timeliness goals and balanced measures. VA’s updated plan states  that the agency is collecting data to inform its development of a complete  and balanced set of measures for all new appeals options (e.g., timely  and accurate processing of appeals while ensuring veteran satisfaction).  VA’s original plan had outlined timeliness goals for the two VBA options  and for the Board option that does not include new evidence or a hearing.  However, VA does not intend to establish timeliness goals or balanced  measures for all options until after fully implementing the new appeals  process. Further, VA officials told us they are working to produce metrics  required under the Act, but have yet to fully articulate a plan for  monitoring. For example, there is not a specific plan to monitor the  accuracy of decisions under or veteran satisfaction with the new  process. Until VA identifies a complete set of timeliness goals and  balanced measures, the agency will not have a way to determine how  well the new process is performing.

Comparison of new and legacy processes. VA’s updated plan states  that VA is working toward capturing the metrics listed in section 5 of the  Act, which could help VA measure relative performance of the new and  legacy processes. However, VA’s updated plan does not state how VA  will assess whether the new process addresses problems in the legacy  process. For example, according to VA’s updated plan and agency  officials we interviewed, VA believes it cannot measure the timeliness of  legacy appeals processing from when an appeal is filed to its resolution.  According to VA, developing this measure is not feasible because the  legacy process has no defined endpoint. Submission of additional  evidence by veterans can, at any point, cause additional cycles of re- adjudication. However, VA has not articulated other options for comparing  the timeliness of the new and legacy processes in its May 2018 update to  its plan. Without this assessment, VA cannot determine the extent to  which the new process, which also allows for multiple appeal  opportunities, will achieve final resolution of veterans’ appeals sooner, on  average, than the legacy process. Moreover, VA’s updated plan does not  fully explain how the agency will use the Act’s metrics to assess relative  performance of the new and legacy appeals processes on issues like  accuracy, veteran satisfaction, or cost.

Monitoring processing of legacy versus new appeals. VA’s updated  plan articulates VA’s intention to use sensitivity and other analyses to  monitor and address workload changes in its legacy and new appeals  processes. These analyses could better position VA to manage the two  parallel processes.

Nevertheless, VA has not established complete and balanced goals and  measures or developed a plan for comparing the new and legacy  processes. In recent communications on the status of implementing our  recommendations, VA officials indicated they plan to address some of  these monitoring and performance issues in the next update. Until VA  does so, the agency risks not fully understanding whether the new  process is an improvement, or whether veterans with appeals in the  legacy process are experiencing poor results.

VA Has Made Little Progress in Addressing GAO’s Recommendation to Augment Its Master Schedule for Implementation

Our March 2018 report also identified elements of a high-quality and  reliable implementation schedule that were missing from VA’s master  schedule for appeals reform. Specifically, we reported that VA’s master  schedule—which the agency included with its November 2017 plan—did  not (1) include all key activities; (2) show which activities must finish prior  to the start of other activities, or the amount of time an activity could be  delayed before the delay affects VA’s estimated implementation date; (3)  reflect interim goals and milestones for monitoring implementation; or (4)  assign resources for activities.

We recommended that the Secretary of Veterans Affairs augment the  master schedule for VA’s appeals plan to reflect all activities—such as  modifications to IT systems—as well as assigned responsibilities,  interdependencies, start and end dates for key activities for each  workgroup, and resources. These steps establish accountability and  reduce overall risk of implementation failures.

In its updated plans, VA took steps to develop interim goals and  milestones for monitoring implementation, among other positive actions,  but the master schedule still included gaps in sound practices for project  management. Specifically:  Key activities and their duration. The updated master schedule VA  provided in its May 2018 plan added activities, but VA continues to  exclude some major activities—including those beyond the planned  February 2019 implementation date—and their duration. For example:  The updated master schedule does not include a small-scale pilot of the new Board options, even though this pilot is occurring at the same time VA is preparing for full implementation. In response to our questions about this issue, as of July 2018, VA officials said they are adding related pilot test activities to the master schedule.

Many activities in the master schedule have the same label or description, such as “communications,” “change management,” “implementation,” “training,” and “hosting,” that do not clearly identify their associated end product without the need to review high-level summary or predecessor activity names.

The updated master schedule lacks details and transparency regarding Caseflow, the new information technology system for VA’s appeals process. While VA identified the overall functionality and general timing needed for Caseflow, the steps to accomplish them lack specificity. Further, VA’s updated plan indicates Caseflow will be “minimally ready” by the end of calendar year 2018. At a June 2018 meeting with VA, we asked officials to define the term “minimally ready” and what additional activities or functionality, if any, they planned after reaching this milestone. In response, VA officials pointed us to another source that they said outlined the remaining functionality to complete Caseflow. However, when we consulted this source, we could not determine what functionality listed was to be implemented before or after October 2018.

The updated master schedule also lacks start and finish dates as well as status information (e.g., not started, in planning, in progress, complete, etc.) for many of the activities.

Sequencing and linkages among activities. VA’s updated plan  provided new details about some sub-activities related to processing  legacy appeals, monitoring implementation, drafting Board policies, and  training. Moreover, the May 2018 updated master schedule was  reorganized to improve its flow and alignment, according to VA officials.  However, the overall updated master schedule generally does not  indicate logical relationships regarding the sequence in which activities  should occur, and whether any delays in one activity will dynamically  affect other activities linked to it. This type of logic is necessary to define  both when an activity may start and finish and when an activity must start  and finish for meeting a specified program completion date. These are  known as early and late dates, respectively. For example, the plan does  not indicate the latest date regulations can fall behind schedule before the  planned February 2019 implementation date is impacted, or related  activities such as training. This sound planning practice is especially  important because VA officials said the agency is concurrently executing  many of the activities. Without logical relationships, the master schedule  is less effective for modeling the impact of delayed or accelerated  activities on related activities, and ultimately for estimating the final  implementation date.

Interim goals and milestones for monitoring implementation. VA has  taken steps to address this aspect of the recommendation. In addition to  reiterating the use of an agency-wide governance structure to coordinate  implementation of its new appeals process, VA in its updated May 2018  plan added indicators to monitor and assess its readiness for full  implementation. Indicators include monitoring the status of implementing  regulations and information technology as well as considering any  lessons learned through its piloting of the new process. These “readiness  indicators” could help VA better identify potential issues related to  implementation of the new appeals process. However, the master  schedule does not show sequencing and linkages for these indicators.

Establishing resources. VA’s updated plan states the agency will use  existing resources to implement the new appeals process. Moreover, the  master schedule identifies the “owners” or parts of the organization that  are playing a role in appeals reform, such as the Veterans Health  Administration (VHA). However, other than identifying the “owners” for the  activities, resources needed are not identified for the groups of related  activities identified in the master schedule or for processing legacy and  new appeals processes once implemented in February 2019. By not  estimating these resources, VA’s plan does not illuminate resource  constraints and indicate whether other parts of the organization or  workgroups are dedicated full-time to the tasks or activities for which they  are responsible, or whether other constraints exist on funding or time. In  general, neither the plan nor the master schedule refers to underlying  budget or cost documents or information.

In recent discussions on the status of implementing our  recommendations, VA officials indicated they plan to address some of  these issues in the August 2018 update. Until all necessary activities are  accounted for, VA cannot be certain whether key activities are scheduled  in the correct order, resources are properly allocated, and key risks have  been identified, among other sound practices for guiding implementation  and accountability. Furthermore, to the extent that the master schedule is  used for internal coordination, the absence of necessary elements could  hinder coordination, increasing the likelihood of disruption or delay.

VA Has Addressed Many, but Not All Aspects of GAO’s Recommendation to More Fully Assess Risk

In our 2018 report, we found that VA’s November 2017 appeals plan  could more fully assess key risks related to implementing the new  appeals process. In particular, we found that VA’s plan did not include  testing of new Board options or clearly define how it would assess the  RAMP pilot test of the VBA-only options before implementing the process  more broadly. Further, we reported that VA’s plan had not  comprehensively reflected key risks because the agency had not  established a complete and balanced set of goals and measures, which  are a necessary pre-condition to effectively assessing risk.

We recommended the Secretary of Veterans Affairs ensure that the  appeals plan more fully addresses risk associated with appeals reform by,  for example, assessing risks against a balanced set of goals and  measures, articulating an assessment plan for RAMP, and testing or  conducting sensitivity analyses of all appeals options—prior to fully  implementing the new appeals process.

In its updated May 2018 plan, VA took many steps to address our  recommendation, although opportunities exist to better assess risks  associated with implementing appeals reform and managing appeals  workloads in the legacy process. Specifically:  Testing all aspects of the new appeals process. Since our March 2018  report, VA has taken steps to pilot test the three new Board appeals  options. In its May 2018 updated plan, VA describes a small-scale test  program—the Board’s Early Applicability of Appeals Modernization  (BEAAM)—to collect information about what options veterans choose and  their experiences using the new appeals options. For BEAAM, the Board  is partnering with veterans service organizations to identify 50 veterans  who are dissatisfied with a recent claim decision, and allowing these  veterans to appeal directly to the Board. Participating veterans have  begun opting in, and VA plans to collect information on adjudication of  these appeals. In addition, for veterans dissatisfied with their RAMP  decisions, as of October 2018 the Board will begin adjudicating their  appeals to further test new Board processes and technology.

VA officials also reported progress with developing new sensitivity  analyses that will allow the agency to change assumptions related to key  variables—both individually and in conjunction with one another. VA  anticipates these analyses will allow the agency to project potential  budget needs and staffing requirements and more accurately predict  resolution of legacy appeals given certain assumptions. Further, VA  anticipates using the analyses to determine distribution of resources, and  quickly react to changes in its pending legacy and new appeals  processes, and other trends. By taking these steps, VA may be better  positioned to estimate future disability appeals inventories, timeliness,  and resource needs as well as assess risks associated with implementing  a new appeals process.

Defining success criteria and articulating how to assess RAMP and  BEAAM. In its updated plan, VA broadly defines what it hopes to achieve  with the RAMP and BEAAM pilots, such as providing information on  veterans’ choices in the new process, testing new technology and  procedures, and estimating workloads. It also states that VA will use the  results to inform the assumptions in its sensitivity analyses. In addition,  the updated plan states that VBA is refining the methods to evaluate  RAMP.

The applicability of BEAAM results to a fully implemented appeals  process may be limited. For example, the BEAAM pilot and the Board’s  implementation of RAMP provide limited time in which to conduct and  assess the results. Moreover, because VA’s test is very small in scale (up  to 50 veterans), it will be important for VA to consider, for example,  whether these appeals reflect the complexity of cases and the range of  circumstances expected in a fully implemented new appeals process. In a  mid-May 2018 meeting with VA officials, we raised these and similar  concerns. VA officials said they would consider these concerns.

Finally, although VA’s updated plan includes a timeline for testing and  assessing the new processes, VA’s updated schedule indicates that VA is  planning to assess RAMP results between February 15, 2019 and May  10, 2019. These dates occur after VA intends to fully implement its new  process. Our recommendation specifies that testing and assessment of  pilot results should occur prior to full implementation.

Comprehensively assess risks. Within VA’s updated plan, VA has  added to its “risk register,” which describes risks associated with many  elements of its plan and related mitigation strategies. However, VA’s  updated plan has not established a complete and balanced set of goals  and measures as discussed above, which are a necessary pre-condition  to effectively assessing risk. Having a complete set of goals and  measures would allow VA to better identify and target risks associated  with reaching these goals while concurrently managing two processes.  Thus, VA may not have comprehensively reflected key risks in its updated  plan.

In conclusion, although VA intends to fully implement the new disability  appeals process in about 6 months (February 2019), VA still has an  opportunity to create a stronger foundation of sound planning practices.  To its credit, VA has taken a number of positive steps toward  implementing our prior recommendations to improve its planning for  disability appeals reform while it attends to legacy appeals. Efforts such  as testing Board appeals options and resuming sensitivity analysis will  provide useful information to guide VA through the uncertainty often  associated with process change. However, VA needs to fully address our  four recommendations to reasonably assure smooth implementation of  appeals reform. As we noted in our prior work, VA is undertaking a  complex endeavor that involves updating and creating new processes  while on-boarding hundreds of new staff and implementing new  technology—an endeavor that will affect the lives of hundreds of  thousands of veterans with disabilities. Such an undertaking requires an  appropriate level of planning to improve VA’s chance of success. VA’s  continued efforts to address our recommendations will better position the  agency in its implementation of new appeals processes.

Chairman Roe, Ranking Member Walz, and Members of the Committee,  this concludes my prepared statement. I would be pleased to respond to  any questions you may have at this time.

For further information about this testimony, please contact Elizabeth H.  Curda at (202) 512-7215 or curdae@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this testimony. Other key contributors to this testimony  include James Whitcomb (Assistant Director), Daniel Concepcion  (Analyst in Charge), and Michele Grgich. In addition, key support was  provided by Susan Aschoff, Mark Bird, Grace Cho, Alex Galuten, Joel  Green, Sheila R. McCoy, Karen Richey, Almeta Spencer, and Walter  Vance.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Medicaid: CMS Should Take Steps to Mitigate Program Risks in Managed Care

The improper payment rate is a sentinel measure of program integrity risks for the Medicaid program. CMS and the states oversee Medicaid, whose size, structure, and diversity make it vulnerable to improper payments. CMS estimates the Medicaid improper payment rate annually through its PERM, which includes an estimate for Medicaid managed care, in which states contract with MCOs to provide services to Medicaid enrollees.

GAO was asked to study the PERM methodology for managed care. In this report, GAO examined the extent to which the PERM accounts for program integrity risks in Medicaid managed care, including CMS's and states' oversight. GAO identified program integrity risks reported in 27 federal and state audits and investigations issued between January 2012 and September 2017; reviewed federal regulations and guidance on the PERM and CMS's Focused Program Integrity Reviews; and contacted program integrity officials in the 16 states with a majority of 2016 Medicaid spending for managed care, as well as CMS officials and program integrity experts.

The Centers for Medicare & Medicaid Services' (CMS) estimate of improper payments for Medicaid managed care has limitations that are not mitigated by the agency's and states' current oversight efforts. One component of the Payment Error Rate Measurement (PERM) measures the accuracy of capitated payments, which are periodic payments that state Medicaid agencies make to managed care organizations (MCO) to provide services to enrollees and to cover other allowable costs, such as administrative expenses. However, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data. Further, GAO's review of the 27 federal and state audits and investigations identified key program risks.

Ten of the 27 federal and state audits and investigations identified about $68 million in overpayments and unallowable MCO costs that were not accounted for by PERM estimates; another of these investigations resulted in a $137.5 million settlement.

These audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017.

To the extent that overpayments and unallowable costs are unidentified and not removed from the cost data used to set capitation rates, they may allow inflated MCO payments and minimize the appearance of program risks in Medicaid managed care.

CMS and states have taken steps to improve oversight of Medicaid managed care through updated regulations, focused reviews of states' managed care programs, and federal program integrity contractors' audits of managed care services.

However, some of these efforts went into effect only recently, and others are unlikely to address the risks in managed care across all states.

Furthermore, these efforts do not ensure the identification and reporting of overpayments to providers and unallowable costs by MCOs.

Federal internal control standards call for agency management to identify and respond to risks. Without addressing key risks, such as the extent of overpayments and unallowable costs, CMS cannot be certain that its estimated improper payment rate for managed care (0.3 percent compared with 12.9 percent in Medicaid fee-for-service) accurately reflects program risks.

The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. HHS concurred with this recommendation. HHS also provided technical comments, which were incorporated as appropriate.

The improper payment rate is a sentinel measure of program integrity  risks for Medicaid—a federal-state health financing program for low  income and medically needy individuals. The federal government and  states play key roles in oversight of the Medicaid program—with the  Centers for Medicare & Medicaid Services (CMS) providing broad federal  oversight, and states administering day-to-day operations, including  ensuring the integrity of the program by preventing, identifying, and  recouping improper payments. The size, structure, and diversity of  Medicaid make it particularly vulnerable to improper payments, and our  work has identified Medicaid as a high-risk program since 2003 due to  concerns about the adequacy of fiscal oversight.

To develop the Medicaid improper payment rate, CMS uses the Payment  Error Rate Measurement (PERM)—a methodology that is reviewed and  approved by the Office of Management and Budget (OMB). The PERM  computes the rate as the weighted average of states’ improper payment  rate estimates for three key components of the Medicaid program—fee- for-service (FFS), managed care, and eligibility determinations.

Medicaid managed care expenditures have grown significantly; in fiscal  year 2017, they were $171 billion, almost 50 percent of total federal  Medicaid expenditures. This growth makes ensuring the accuracy of  managed care improper payment estimates increasingly important. In  fiscal year 2017, using the PERM, CMS estimated the Medicaid managed  care improper payment rate at 0.3 percent, or about $500 million of  federal expenditures. This is a small portion of overall estimated Medicaid  improper payments, which CMS estimated at about $37 billion, or 10.1  percent of $364 billion in federal spending on Medicaid in fiscal year  2017. At the same time, however, the FFS estimated improper payment  rate was 12.9 percent or about $25 billion in federal expenditures. Due,  in part, to this disparity in the estimated improper payment rates, we have  questioned whether the managed care estimate fully reflects the program  integrity risks that exist in Medicaid managed care.

You asked us to provide information on CMS’s PERM methodology for  Medicaid managed care. In this report, we examine the extent to which  the PERM accounts for program integrity risks in Medicaid managed care,  including CMS’s and states’ oversight.

To examine the extent to which the PERM accounts for program integrity  risks in Medicaid managed care, we reviewed publications from the  Department of Health and Human Services’ Office of Inspector General  (HHS-OIG) and our prior work; conducted literature searches and key  word searches of online databases; and obtained input from the National  State Auditor’s Association and the National Association of State  Auditors, Comptrollers, and Treasurers. Through these reviews, we found  27 audits and investigations that identified program integrity risks related  to Medicaid managed care—16 federal and state audits, and 11 notices  of investigations issued between January 2012 and September 2017.  These audits and investigations were conducted by (1) HHS-OIG, (2) a  CMS federal contractor that performs claims reviews in Medicaid to  identify overpayments, (3) the Department of Justice, (4) state auditors,  (5) state Offices of Attorney General, (6) other state agencies, and (7)  GAO. (See app. I for a complete list of the audits and investigations we  identified.) Of the 27 audits and investigations, 24 found program integrity  risks in a single state or with a single provider, covering a total of 10  states, and 3 found program integrity risks across multiple states. We  also reviewed CMS regulations on the PERM, the most recent PERM  Manual, Medicaid managed care regulations, applicable improper  payment laws, 2016 and 2017 PERM estimates of improper payments,  and other related OMB and CMS guidance. We then compared the  program integrity risks reported in the 27 audits and investigations with  the steps taken to estimate improper payments for the PERM’s managed  care component. In addition, we reviewed all the published reports of  CMS’s Focused Program Integrity Reviews on managed care in 27  states, other CMS documents related to oversight of states’ Medicaid  managed care programs, and federal internal control standards— specifically those related to identifying, analyzing, and responding to  risks. Also, we contacted program integrity officials in the16 states for  which more than half of their 2016 Medicaid expenditures were for  services delivered under managed care, and analyzed responses from  the 13 states that replied; the information from these states is not  generalizable. Lastly, we interviewed CMS officials and experts on  program integrity in Medicaid managed care, including one state auditor.

We conducted this performance audit from April 2017 to May 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

In accordance with the Improper Payments Information Act of 2002  (IPIA), as amended, and OMB guidance, CMS developed the PERM to  estimate the national Medicaid improper payment rate. CMS has other  mechanisms to review and assess program integrity risks in state  Medicaid managed care programs, and it uses information from the  PERM to target its program integrity activities and oversight of states’  Medicaid programs.

IPIA and OMB Guidance for Estimating Improper Payments

IPIA requires federal executive branch agencies to, among other things,  (1) identify programs and activities that may be susceptible to significant  improper payments; and (2), on an annual basis, estimate the amount of  improper payments for susceptible programs and activities. Agency  heads must produce a statistically valid estimate or an estimate that is  otherwise appropriate, using an OMB-approved alternate methodology.  Those agencies with programs identified by OMB as being high priority  for additional oversight and review are required to submit annual reports  to their Inspectors General detailing the actions the agency plans to take  to recover improper payments and prevent future improper payments.  The Inspector General of each agency submitting such a report is  required to review the quality of the improper payment estimates and  methodology, among other things. OMB designated Medicaid as a high  priority program. In addition, the Improper Payments Elimination and  Recovery Act of 2010 requires the Inspector General of each agency to  conduct a compliance review to report on the agency’s compliance with  several criteria, one of which is that an agency has reported an improper  payment rate of less than 10 percent for each program and activity. IPIA  also directed OMB to issue guidance for agencies in implementing the  IPIA improper payments requirements. Among other things, the OMB  guidance requires that agencies review payments made at the point that  federal funds are transferred to nonfederal entities and report on the root  causes of identified improper payments.

To calculate the Medicaid improper payment rate through the PERM,  CMS computes an annual rolling average of improper payment rates  across all states based on a 17-state, 3-year rotation cycle. In accordance  with IPIA, as amended, OMB approved CMS’s PERM methodology, and  the HHS-OIG conducts annual compliance reviews. Beginning with its  annual improper payment compliance review for fiscal year 2014, the  HHS-OIG established a rotating approach to reviewing the estimation  methodology for high-priority programs, including Medicaid, that OMB  deemed susceptible to improper payments. Due to the number and  complexity of the programs, the HHS-OIG methodology reviews are  scheduled to be performed over a 4-year period; the PERM estimation  methodology will be reviewed as a part of its fiscal year 2017 compliance  review.

Each of the three components of the Medicaid PERM—FFS, managed  care, and eligibility—is estimated differently:

The FFS component of the PERM measures errors in a sample of  FFS claims, which are records of services provided and the amount  the Medicaid program paid for these services. For the majority of  sampled FFS claims, the PERM review contractor performs a medical  review, which includes a review of the medical documentation to  determine errors that do not meet federal and state policies, such as  medically unnecessary services, diagnosis coding errors, and policy  violations. Any FFS claims that were paid for services that should  have been covered under a managed care plan’s capitated payment  are also considered errors.

The managed care component of the PERM measures errors that  occur in the capitated payments that state Medicaid agencies make to  managed care organizations (MCO) on behalf of enrollees. Capitated  payments are periodic payments approved by CMS that state  Medicaid agencies make to contracted MCOs to cover the provision of  medical services to enrollees, as well as the MCOs’ administrative  expenses and their profits or earnings. The PERM assesses whether  any payments made to the MCOs were in amounts different than  those the state agency is contractually required to pay, which are  approved by CMS. In contrast to the FFS component, the managed  care component of the PERM neither includes a medical review of  services delivered to enrollees, nor reviews of MCO records or data.

The eligibility component of the PERM measures errors in state  determinations of whether enrollees meet categorical and financial  criteria for receipt of benefits under the Medicaid program. The  eligibility component assesses determinations for both FFS and  managed care enrollees. This component has not been calculated  since 2014; instead, CMS piloted different approaches to update the  methodologies used to assess enrollee eligibility, as the Patient  Protection and Affordable Care Act changed income eligibility  requirements for nonelderly, nonpregnant individuals who qualify for  Medicaid. Beginning in the 2019 reporting year, eligibility reviews  under the PERM will resume and will be conducted by a federal  contractor.

Medicaid Program Integrity and Oversight in Managed Care

Medicaid program integrity consists of efforts to ensure that federal and  state expenditures are used to deliver quality, necessary care to eligible  enrollees, and efforts to prevent fraud, waste, and abuse. We have found  in prior work that CMS’s and states’ program integrity efforts focused  primarily on payments and services delivered under FFS and did not  closely examine program integrity in Medicaid managed care. For  Medicaid managed care, CMS has largely delegated program integrity  oversight of MCOs to the states. States, in turn, generally oversee MCOs  and the providers under contract to MCOs through their contracts with the  MCOs and reporting requirements.

Some program integrity risks for managed care are similar to those in  FFS, including payments made for nonenrolled, ineligible, or deceased  individuals; payments to ineligible, excluded, or deceased providers; and payments to providers for improper or false claims, such as payments for  services that are not medically necessary. Other program integrity risks  are more unique to managed care. For example, capitated payments  generally reflect the average cost to provide covered services to  enrollees, rather than a specific service. Federal law requires capitation  rates to be actuarially sound, meaning that, among other things, they  must be reasonably calculated for the populations expected to be covered  and for the services expected to be furnished under contract. In order to  receive federal funds for its managed care program, a state is required to  submit the rates it pays MCOs and the methodology it uses to set those  rates to CMS for review and approval. Additionally, federal and state  oversight of Medicaid managed care can include ensuring that MCOs  fulfill contractual provisions within their managed care contracts. In some  cases, these provisions relate directly to program integrity activities,  including plans and procedures for identifying, recovering, and reporting  on overpayments made to providers.

Payment Error Rate Measurement for Managed Care Has Limitations, Which Are Not Mitigated by Current CMS and State Oversight

The managed care component of the PERM measures the accuracy of  the capitated payments state Medicaid agencies make to MCOs.  Specifically, a CMS contractor examines whether the state agency made  capitated payments only for eligible enrollees, made capitated payments  for the correct amount based on the contract and coverage requirements  (time period and geographic location), made capitated payments based  on the correct rate for enrollees, and did not make any duplicate  payments for enrollees.

CMS’s Payment Error Rate Measurement Measures the Accuracy of Medicaid Managed Care Payments, but Does Not Account for Overpayments and Unallowable Costs

CMS officials noted that the agency established capitated payments as  the level of review, because the capitation rate is the transaction used to  determine the federal match in managed care. In general, the federal  government matches most state expenditures for Medicaid services on  the basis of a statutory formula. In FFS, the federal match is provided  for the amount the state pays a health care provider for delivering  services to enrollees. With managed care, the federal match is provided  for the amount of the capitation rate the state pays the MCO. Capitated  payments do not directly relate to the provision of a specific service, but  reflect the average cost to provide covered services to enrollees. As a  result, CMS officials maintain that the capitated payment is the lowest  transaction level at which the agency can clearly identify federal funds  without making significant assumptions.

Because the managed care component of the PERM review is limited to  measuring capitated payments, it does not account for other program  integrity risks—such as overpayments to providers and unallowable MCO  costs.

In addition to errors in capitated payments included in PERM reviews,  CMS regulations state that overpayments in managed care include  any payment made to an MCO or provider under contract to an MCO  to which the MCO or provider is not entitled under Medicaid. Such  overpayments included payments for services that were not provided  or medically necessary; or to ineligible, excluded, or deceased  providers, which are not measured by the PERM.

Unallowable MCO costs refers to operating costs that MCOs cannot  claim under their managed care contracts, such as certain marketing  costs, or that the MCO reported incorrectly.

Among the 27 audits and investigations of Medicaid managed care  programs we reviewed, 10 identified about $68 million in MCO  overpayments to providers and unallowable MCO costs that were not  accounted for in PERM estimates. In addition, one investigation of an  MCO operating in nine states resulted in a $137.5 million settlement to  resolve allegations of false claims. (See app. I for a complete list of the  audits and investigations we identified.) However, the full extent of these  overpayments and unallowable costs is unknown, because these audits  and investigations were conducted over more than 5 years and involved a  small fraction of the more than 270 MCOs operating nationwide as of  September 2017. Specifically, 24 of the audits and investigations  represented reviews in 10 states and, in many cases, focused on  individual providers or MCOs; there were about 90 MCOs operating in the  10 states as of September 2017, according to the Kaiser Family  Foundation. Some examples of the audits and investigations that  identified overpayments and unallowable costs include the following:

The Washington State Auditor’s Office found that two MCOs made  $17.5 million in overpayments to providers in 2010, which may have  increased the state’s 2013 capitation rates.

The New York State Comptroller found that two MCOs paid over $6.6  million to excluded and deceased providers from 2011 through  2014.

The Massachusetts State Auditor found that one MCO paid $420,000  for health care services and unauthorized prescriptions from excluded  providers in 2013 and 2014.

The Department of Justice alleged that an MCO operating in several  states submitted inflated expenditure information to the state Medicaid  agencies, falsified encounter data, and manipulated claims costs and  service provision costs in nine states. The MCO agreed to pay over  $137.5 million to resolve these claims.

The Texas State Auditor’s Office found that an MCO reported $3.8  million in unallowable costs for advertising, company events, gifts, and  stock options, along with $34 million in other questionable costs in  2015.

The New York State Comptroller also found that an MCO claimed  over $260,000 in unallowable administrative expenses, which  contributed to an increase in capitation rates across the state.

To the extent that the state does not identify or know of MCO  overpayments to providers or unallowable MCO costs, the overpayments  and unallowable costs could inflate future capitation rates, as the  Washington State Auditor and New York State Comptroller noted in their  findings. The PERM assesses the accuracy of capitated payments that  states make to MCOs. States set capitation rates based on cost data— historical utilization and spending—that MCOs submit to the state  Medicaid agencies, but the PERM does not consider these data. Unless  removed from these cost data, unidentified overpayments and  unallowable costs would likely inflate the MCO cost data that states use  to set capitation rates. (See fig. 1.) As a result, future capitation rates  would also be inflated, resulting in higher state and federal spending.

In fiscal year 2017, the Medicaid managed care improper payment rate  was 0.3 percent, while the FFS improper payment rate was 12.9 percent,  leading to an assumption that the estimated risks in managed care are  less significant than those estimated in FFS. However, the managed care  component of the PERM does not determine whether MCO payments to  providers were for services that were medically necessary, actually  provided, accurately billed and delivered by eligible providers, or whether  the MCO costs were allowable and appropriate. As a result, the PERM  improper payment estimate potentially understates the extent of program  integrity risks in Medicaid managed care.

Moreover, this potential understatement in the PERM’s improper payment  rate estimate may curtail investigations into the appropriateness of MCO  spending. We previously reported that CMS and state program integrity  efforts did not closely examine program integrity in Medicaid managed  care, focusing primarily on payments and services delivered under FFS.

Our current review of the 27 audits we identified encompassed a 5-year  period, suggesting that reviews of managed care continue to be limited.  An official from a state auditor’s office we spoke with suggested that  some states may not audit services delivered under managed care,  because of a low improper payment rate. In addition, he noted that his  state Medicaid agency used the relatively low payment error rate in  managed care as an indicator of few program integrity problems.

CMS and State Oversight of Managed Care Do Not Ensure the Identification and Reporting of Overpayments and Unallowable Costs

As noted, CMS has increased its focus on and worked with states to  improve oversight of Medicaid managed care; however, these efforts and  the oversight efforts of states do not ensure the identification and  reporting of overpayments and unallowable costs. In recent years, the  agency has sought to strengthen oversight of managed care programs  through updated regulations; reviews of states’ managed care programs  (Focused Program Integrity Reviews) and collaborative audits, which are  conducted jointly by federal program integrity contractors and states; and  state monitoring of overpayments.

Regulations. In May 2016, CMS updated its regulations for managed  care programs in order to strengthen oversight. The updated regulations  require a number of additional program integrity activities, such as those  listed below. If fully implemented, these updated regulations may help  with the identification and removal of overpayments and unallowable  costs from data used to set future capitation rates. Under these  regulations

States must arrange for an independent audit of the accuracy,  truthfulness, and completeness of the encounter and financial data  submitted by MCOs, at least once every 3 years.

Through contracts with MCOs, states must require MCOs to have a  mechanism through which providers report and return overpayments  to the MCOs. States must also require MCOs to promptly report any  identified or recovered overpayments—specifying those that are  potentially fraudulent—and submit an annual report on recovered  overpayments to their state. States must use this information when  setting actuarially sound capitation rates.

Through contracts with MCOs, states must also require MCOs to  report specific data, information, and documentation. In addition, the  MCO’s chief executive officer or authorized representative must certify  the accuracy and completeness of the reported data, information, and  documentation.

States must enroll MCO providers that are not otherwise enrolled with  the state to provide services to enrollees in Medicaid FFS, and  revalidate the enrollment at least once every 5 years. Initially this  requirement was to start for MCO contracts beginning on July 1, 2018.  Subsequently enacted legislation codified this requirement in statute  and moved the implementation to January 1, 2018.

It is too early to know if these regulations will assure better oversight of  MCO payments to providers and the data used to set future capitation  rates. The above program integrity requirements only went into effect  recently—for contracts starting on or after July 1, 2017, and January 1,  2018. In addition, CMS issued a notice in June 2017 stating that the  agency will use its enforcement discretion to assist states that are unable  to implement new requirements by the required compliance date. Also,  CMS has delayed issuance of implementing guidance for certain  provisions until the agency completes its review, a step that may further  delay states’ implementation. The agency has designated Medicaid  managed care for “deregulatory action” and plans to propose a new rule,  but has not indicated which of these provisions, if any, would be revised.

Focused Program Integrity Reviews. In fiscal year 2014, CMS  implemented its Focused Program Integrity Reviews in order to target  high-risk program integrity areas in each state, including managed care.  As we previously reported, these focused reviews are narrower in scope  than the prior reviews conducted by CMS, but they still involve on-site  visits to states.

In its focused reviews of managed care, CMS found that several states  had incomplete oversight of MCO payments to providers, even though the  agency relies on states to verify reported MCO overpayments and to  ensure the overpayments are excluded from the data used to set  capitation rates. In the 27 focused reviews of managed care from 2014 to  2017, CMS found that MCOs in 17 states reported fewer overpayments to  their state Medicaid agencies than CMS would expect. For example,  MCOs in at least 5 states reported that overpayments were less than 0.1  percent of their total managed care expenditures; while CMS noted in 1  focused review that overpayments typically equal 1 to 10 percent of total  expenditures in managed care. CMS also found that 5 of the 27 states did  not verify that MCOs excluded overpayments from these data, and 1 state  did not exclude overpayments from the capitation rate setting. This is  consistent with our March 2017 report in which we noted that CMS  commonly found that MCOs reported low amounts of recovered  overpayments and conducted few reviews to identify overpayments.  Also, officials from three of the five states we interviewed for that report  said the focused reviews gave them leverage in dealing with MCOs or led  MCOs to focus more on program integrity. We also reported that CMS  officials recommended states take steps to improve their oversight of  MCOs, based on the focused review findings.

The findings from CMS’s focused reviews of managed care also highlight  the need for greater federal oversight of states. Without these reviews, it  is unclear if states would independently identify MCOs’ reporting of  overpayments or work to strengthen MCO reporting. Yet, CMS has not  yet published the focused reviews of managed care in 13 states, and it  may only conduct a focused review in a state once every three or more  years. Given CMS’s timeline for the focused reviews, it may take years to  determine if corrective actions result in improved program integrity in  services delivered through managed care.

Collaborative audits. CMS has expanded the federal-state collaborative  audits beyond FFS, and has begun to engage states to participate in  collaborative audits of MCOs and providers under contract to MCOs. As a  part of the collaborative audit process, the state volunteers to jointly  develop the audit processes the federal contractors follow. CMS officials  told us that federal contractors have completed 14 collaborative audits of  providers under contract to MCOs in three states—Arizona, the District of  Columbia, and Tennessee. Only the audit of Trusted Healthcare, an MCO  in the District of Columbia, has been published. That audit identified  $129,000 in overpayments in a sample of MCO payments to providers,  which, if generalized to all of the MCO’s payments over 6 months, would  equate to over $4 million in overpayments. According to CMS, three  additional states—Louisiana, Nebraska, and New Hampshire—have  shown interest in collaborative audits of their MCOs, although such audits  require states to prepare data files for the federal contractor and commit  staff time. In our March 2017 report, we found that states’ participation in  FFS collaborative audits varied and some states reported barriers to their  participation. Expanding collaborative audits in managed care will  require commitment from and coordination with states.

State monitoring of overpayments in managed care. States are  required to report overpayments they have identified and recouped along  with state expenditures on a quarterly basis. However, based on the  responses of the program integrity officials in 13 of the 16 states we  contacted, most officials were unable to define the magnitude of  overpayments in their managed care programs, which may signify a need  for greater federal oversight or coordination. Specifically, officials in 7 of  the 13 states could not or did not identify the share of total reported  Medicaid overpayments that occurred in managed care. In 11 of the 13  states, officials responded that they did not directly monitor MCO  payments to providers. Of those 11 states, officials in 4 said they depend  on MCOs to report overpayments and exclude the overpayments from the  data used to set capitation rates. As long as states are not taking action  to identify overpayments in managed care, they cannot be assured that  they are accurately paying MCOs for medically necessary services  provided to enrollees.

Federal internal control standards call for agency management to identify,  analyze, and respond to risks. CMS has taken some steps to identify,  analyze, and respond to risks through its regulations, Focused Program  Integrity Reviews, and collaborative audits. However, key CMS and state  oversight efforts fall short of mitigating the limitations of the PERM  estimates of improper payments for managed care, because they do not  ensure the identification and reporting of overpayments to providers and  unallowable MCO costs. Without addressing these key risks, CMS and  states cannot ensure the integrity of Medicaid managed care programs.

The 0.3 percent improper payment rate for Medicaid managed care, as  measured by the PERM, is significantly lower than the improper payment  rate of 12.9 percent for Medicaid FFS. However, this difference does not  signal better oversight; rather, it represents differences in the review  criteria between FFS and managed care, which result in a less complete  accounting for the program integrity risks in managed care. The PERM  does not account for key program integrity risks in Medicaid managed  care: specifically, unidentified overpayments and unallowable costs. One  federal investigation of an MCO operating in nine states resulted in a  settlement of $137.5 million to resolve allegations of false claims that  were not captured in the national Medicaid improper payment rate  estimate. Further, CMS found that MCOs and states do not provide  sufficient oversight in Medicaid managed care to address the risks that  are not accounted for in the PERM, findings that are reinforced by our  reports on Medicaid managed care program integrity. CMS has taken  steps to improve its oversight of Medicaid managed care, yet these efforts  fall short of ensuring that the agency and states will be able to identify  and address overpayments to providers and unallowable MCO costs.  Without better measurement of program risks—particularly as  expenditures for Medicaid managed care continue to grow—CMS cannot  be certain that the low improper payment rate for managed care, as  measured by the PERM, accurately reflects lower risks in managed care.

The Administrator of CMS should consider and take steps to mitigate the  program risks that are not measured in the PERM, such as overpayments  and unallowable costs; such an effort could include actions such as  revising the PERM methodology or focusing additional audit resources on  managed care. (Recommendation 1)

We provided a draft of this report to the Department of Health and Human  Services (HHS) for comment. In its written comments, HHS concurred  with our recommendation, and indicated that it will review regulatory  authority and audit resources to determine the best way to account for  Medicaid program risks that are not accounted for in the PERM.   However, HHS stated that the PERM is not intended to measure all  Medicaid program integrity risks, and utilizing the PERM measurement in  that way would be a misunderstanding and misuse of the reported rate.  HHS also commented that a review of payments from MCOs to providers  is outside the scope of IPIA. In addition, HHS asserted that including such  a review would diminish the value of PERM reporting—because it would  require significant assumptions about the amount of federal share in MCO  payments to providers. Further, HHS maintained that such a review also  would result in a measurement that was not comparable to other  programs or agencies, which would diminish the value of government- wide improper payment rate reporting. We acknowledge that the current  PERM methodology has been approved by OMB. However, we maintain  that the PERM likely underestimates program integrity risks in Medicaid  managed care. To ensure the appropriate targeting of program integrity  activities, CMS needs better information about these risks. Given the size  of the Medicaid program, its vulnerability to improper payments, and the  growth in managed care, it is critical to have a full accounting of program  integrity risks in managed care in order to best ensure the integrity of the  whole Medicaid program.

In its written comments, HHS also summarized several activities it uses to  oversee and support states’ Medicaid program integrity efforts, including  state program integrity reviews; collaborative audits conducted by federal  contractors; Medicaid Integrity Institute training for state employees; and  the Medicaid Provider Enrollment Compendium.  HHS also provided  technical comments, which we incorporated as appropriate. HHS’s  comments are reprinted in appendix II.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff that made key contributions to  this report are listed in appendix III.

Appendix I: Federal and State Audits and Investigations of Medicaid Managed Care

We reviewed 16 federal and state audits and 11 notices of investigations  of Medicaid managed care organizations (MCO) and providers issued  from January 2012 to September 2017. As the findings below show, the  audits and investigations represent a limited number of reviews that, in  many cases, focused on individual states and individual providers or  MCOs within that state. Given the limited scope and number of states  reviewed, the amount of the overpayments and unallowable costs  occurring nationwide is unknown.

These audits and investigations show  cases of MCO overpayments to providers or unallowable costs, which  are not accounted for by the Centers for Medicare & Medicaid  Services’ Payment Error Rate Measurement (PERM) ; errors in capitated payments (e.g., capitated payments made for  deceased individuals), which are accounted for in the PERM; and gaps in managed care oversight.

When reporting overpayments and unallowable costs identified in the  audits and investigations, we only include amounts specifically attributed  to MCOs in our total. This total does not include the following: overpayments and unallowable costs identified in those audits and  investigations that did not distinguish between the amounts  attributable to MCOs, Medicaid fee-for-service, or Medicare; overpayments and unallowable costs identified in criminal  proceedings that are not yet resolved; and errors in capitated payments, as those payments would be reviewed  by the PERM.

As a result, the total amount of overpayments and unallowable costs and  capitated payment errors in this appendix exceed what we report.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contacts and Staff Acknowledgments

In addition to the contact named above, Leslie V. Gordon (Assistant  Director), Pauline Adams (Analyst-in-Charge), Erika Huber, and Drew  Long made key contributions to this report. Also contributing were Muriel  Brown and Jennifer Whitworth.

Medicaid paid $171 billion—about half its total 2017 federal expenditures—to managed care organizations. The Centers for Medicare & Medicaid Services estimated that about 0.3% of that amount were improper payments.

For the entire Medicaid program, CMS estimated about 10% of payments were improper, which led us to question the managed care rate.

We examined state and federal reviews of managed care and the estimating method. We found that the estimation does not fully account for key risks such as overpayments and unallowable costs.

We recommended that CMS take steps to mitigate such risks.