Medicaid: Actions Needed to Mitigate Billions in Improper Payments and Program Integrity Risks

Medicaid, a joint federal-state health care program overseen by CMS, is a significant component of federal and state budgets, with total estimated expenditures of $596 billion in fiscal year 2017.

Medicaid allows significant flexibility for states to design and implement program innovations based on their unique needs. The resulting diversity of the program and its size, make the program particularly challenging to oversee at the federal level and also vulnerable to improper payments. In fiscal year 2017, estimated improper payments were $36.7 billion in Medicaid, up from $29.1 billion in fiscal year 2015. Further, the Medicaid program accounted for about 26 percent of the fiscal year 2017 government-wide improper payment estimate.

This testimony focuses on the (1) major risks to the integrity of the Medicaid program, and (2) actions needed to manage these risks. This testimony draws on GAO's reports issued between November 2012 and May 2018 on the Medicaid program.

GAO's work has identified three broad areas of risk in Medicaid that also contribute to overall growth in program spending, projected to exceed $900 billion in fiscal year 2025.

1) Improper payments , including payments made for services not actually provided. Regarding managed care payments, which were nearly half (or $280 billion) of Medicaid spending in fiscal year 2017, GAO has found that the full extent of program risk due to overpayments and unallowable costs is unknown.

2) Supplemental payments , which are payments made to providers—such as local government hospitals—that are in addition to regular, claims-based payments made to providers for specific services. These payments totaled more than $48 billion in fiscal year 2016 and in some cases have shifted expenditures from the states to the federal government.

3) Demonstrations , which allow states to test new approaches to coverage. Comprising about one-third of total Medicaid expenditures in fiscal year 2015, GAO has found that demonstrations have increased federal costs without providing results that can be used to inform policy decisions.

GAO's work has recommended numerous actions to strengthen oversight and manage program risks.

Improve data. The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, needs to make sustained efforts to ensure Medicaid data are timely, complete, and comparable from all states, and useful for program oversight. Data are also needed for oversight of supplemental payments and ensuring that demonstrations are meeting their stated goals.

Target fraud. CMS needs to conduct a fraud risk assessment for Medicaid, and design and implement a risk-based antifraud strategy for the program.

Collaborate. There is a need for a collaborative approach to Medicaid oversight. State auditors have conducted evaluations that identified significant improper payments and outlined deficiencies in Medicaid processes that require resolution.

As a part of this body of work, GAO has made 83 recommendations to address shortcomings in Medicaid oversight and suggested four matters for congressional consideration. The Department of Health and Human Services and CMS have generally agreed with these recommendations and have implemented 25 of them. GAO will continue to monitor implementation of the remaining recommendations.

I appreciate the opportunity to be here today to discuss areas of risk to  the Medicaid program and oversight efforts that can help prevent  improper payments and ensure the program’s fiscal integrity. The  federal-state Medicaid program is one of the nation’s largest sources of  funding for medical and health-related services. In fiscal year 2017, the  program covered acute health care, long-term care, and other services for  over 73 million low income and medically needy individuals. In that same  year, estimated federal and state Medicaid expenditures were $596  billion.

Medicaid has been on our high-risk list since 2003, in part, because of  concerns about the adequacy of fiscal oversight and the program’s  improper payments—including payments made for people not eligible for  Medicaid or services not actually provided. The Medicaid program  accounted for 26.1 percent of the fiscal year 2017 government-wide  improper payment estimate. While efforts to reduce improper payments  have been made by the Centers for Medicare & Medicaid Services  (CMS), the agency within the Department of Health and Human Services  (HHS) that oversees Medicaid, overall improper payments continue to  increase. In fiscal year 2017, improper payments accounted for $36.7  billion of Medicaid spending, up from $29.1 billion in fiscal year 2015. Of  the $36.7 billion in improper payments, $36.4 billion were overpayments  and $283 million were underpayments.

The size, complexity, and diversity of Medicaid make the program  particularly challenging to oversee at the federal level. Medicaid allows  significant flexibility for states to design and implement program  innovations based on their unique needs; however, our prior work has  found that these innovations have grown considerably over time, lack  complete and accurate reporting, and do not always ensure the efficient  use of federal dollars. It is critical that CMS and states take appropriate  measures to reduce improper payments and ensure the fiscal integrity of  Medicaid; as dollars wasted detract from the program’s ability to ensure  that the individuals who rely on Medicaid—including low-income children  and individuals who are elderly or disabled—are provided adequate care.

My testimony today will focus on  1.  major risks to the integrity of the Medicaid program, and  2.  actions needed to manage these risks.

My remarks are based on our large body of work examining the Medicaid  program, particularly reports issued and recommendations made from  November 2012 to May 2018; these reports provide further details on our  scope and methodology. (A list of related reports is included at the end of  this statement.) For further context, my remarks also reference  information reported by state auditors and the HHS Office of Inspector  General (HHS-OIG), including information from two meetings with state  auditors and Inspectors General we hosted in March and May 2018. We  conducted all of the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

Among health care programs, Medicaid is the largest as measured by  enrollment (over 73 million in fiscal year 2017) and the second largest as  measured by expenditures ($596 billion in fiscal year 2017), second only  to Medicare. The CMS Office of the Actuary projected that Medicaid  spending would grow at an average rate of 5.7 percent per year, from  fiscal years 2016 to 2025, with projected Medicaid expenditures reaching  $958 billion by fiscal year 2025. This projected growth in expenditures  reflects both expected increases in expenditures per enrollee and in  levels of Medicaid enrollment. Beneficiaries with disabilities and those  who are elderly constitute the highest per enrollee expenditures, which  are projected to increase by almost 50 percent from fiscal year 2016 to  2025. Medicaid enrollment is also expected to grow by as many as 13.2  million newly eligible adults by 2025—as additional states may expand  their Medicaid programs to cover certain low-income adults under the  Patient Protection and Affordable Care Act (PPACA). (See fig. 1.)

The partnership between the federal government and states is a central  tenet of the Medicaid program. CMS provides oversight and technical  assistance for the program, and states are responsible for administering  their respective Medicaid programs’ day-to-day operations—including  determining eligibility, enrolling individuals and providers, and  adjudicating claims—within broad federal requirements. Federal oversight  includes ensuring that the design and operation of state programs meet  federal requirements and that Medicaid payments are made  appropriately. (See fig. 2 for a diagram of the federal-state Medicaid  partnership framework.) Joint financing of Medicaid is also a fixture of the  federal-state partnership, with the federal government matching most  state Medicaid expenditures using a statutory formula based, in part, on  each state’s per capita income in relation to the national average per  capita income.

States have flexibility in determining how their Medicaid benefits are  delivered. For example, states may (1) contract with managed care  organizations to provide a specific set of Medicaid-covered services to  beneficiaries and pay the organizations a set amount, generally on a per  beneficiary per month basis; (2) pay health care providers for each  service they provide on a fee-for-service basis; or (3) rely on a  combination of both delivery systems. Managed care continues to be a  growing component of the Medicaid program. In fiscal year 2017,  expenditures for managed care were $280 billion, representing almost  half of total program expenditures, compared with 42 percent in fiscal  year 2015. (See fig. 3.)

States also have the flexibility to innovate outside of many of Medicaid’s  otherwise applicable requirements through Medicaid demonstrations  approved under section 1115 of the Social Security Act. These demonstrations allow states to test new approaches to coverage and to  improve quality and access, or generate savings or efficiencies. For  example, under demonstrations, states have extended coverage to certain populations, provided services not otherwise eligible for federal matching funds, made incentive payments to providers for delivery system  improvements.

As of November 2016, nearly three-quarters of states have CMS- approved demonstrations. In fiscal year 2015, total spending under  demonstrations represented a third of all Medicaid spending nationwide.  (See fig. 4.)

In addition to other types of improper payments, Medicaid presents  opportunities for fraud, because of the size, expenditures, and  complexities of the program—including the variation in states’ design and  implementation. Medicaid Fraud Control Units (MFCU)—state entities  responsible for investigating and prosecuting Medicaid fraud—have  reported on Medicaid fraud convictions and recovered monies, in their  annual reports. For example, over the past 5 years, MFCUs have  reported an average of 1,072 yearly Medicaid fraud convictions. They  also reported about $680 million in recoveries related to fraud in fiscal  year 2017—almost double the recoveries from fiscal year 2016.

Three Broad Areas of Risk Threaten the Fiscal Integrity of Medicaid

Our prior work has identified three broad areas of risk to the fiscal  integrity of Medicaid: improper payment rates, state use of supplemental  payments, and oversight of demonstration programs.

Estimated Improper Payments Exceed 10 Percent, and Do Not Fully Account for All Program Risks

CMS annually computes the national Medicaid improper payment  estimate as a weighted average of states’ improper payment estimates  for three component parts—fee-for-service, beneficiary eligibility  determinations, and managed care. The improper payment estimate for  each component is developed under its own methodology. The national  rate in fiscal year 2017 was 10.1 percent, or $36.7 billion. Since 2016,  Medicaid has exceeded the 10 percent criterion set in statute. As such,  the program was not fully compliant with the Improper Payments  Elimination and Recovery Act of 2010.

In May 2018, we reported that the Medicaid managed care component of  the improper payment estimate does not fully account for all program  risks in managed care. We identified 10 federal and state audits and  investigations (out of 27 focused on Medicaid managed care) that cited  about $68 million in overpayments and unallowable managed care  organization costs that were not accounted for by the managed care  improper payment estimate. Another of these investigations resulted in a  $137.5 million settlement to resolve allegations of false claims. We  further noted that the full extent of overpayments and unallowable costs is  unknown, because the 27 audits and investigations we reviewed were  conducted over more than 5 years and involved a small fraction of the  more than 270 managed care organizations operating nationwide as of  September 2017.

Some examples of the state audits that identified overpayments and  unallowable costs include the following:

The Washington State Auditor’s Office found that two managed care  organizations made $17.5 million in overpayments to providers in  2010, which may have increased the state’s 2013 capitation rates.

The Texas State Auditor’s Office found that one managed care  organization reported $3.8 million in unallowable costs for advertising,  company events, gifts, and stock options, along with $34 million in  other questionable costs in 2015.

The New York State Comptroller found that two managed care  organizations paid over $6.6 million to excluded and deceased  providers from 2011 through 2014.

To the extent that such overpayments and unallowable costs are  unidentified and not removed from the cost data used to set managed  care payment rates, they may allow inflated future payments and  minimize the appearance of program risks in Medicaid managed care.  This potential understatement of the program risks in managed care also  may curtail investigations into the appropriateness of managed care  spending. The continued growth of Medicaid managed care makes  ensuring the accuracy of managed care improper payment estimates  increasingly important.

In May 2018, we acknowledged that although CMS has increased its  focus on and worked with states to improve oversight of Medicaid  managed care; its efforts—for example, updated regulations and audits of  managed care providers—did not ensure the identification and reporting  of overpayments and unallowable costs. In May 2016, CMS updated its  regulations for managed care programs, including that states arrange an  independent audit of the data submitted by MCOs, at least once every 3  years. We found that although this requirement has the potential to  enhance state oversight of managed care; CMS was reviewing the rule  for possible revision of its requirements. We also noted that another  effort to address program risks in managed care—the use of CMS  program integrity contractors to audit providers that are paid by managed  care organizations—has been limited. To address the program risks that  are not measured as a part of CMS’s methodology to estimate improper  payments, in May 2018 we recommended that CMS take steps to  mitigate such risks, which could include revising its methodology or  focusing additional audit resources on managed care. HHS concurred  with this recommendation.

Our prior work on Medicaid has also identified other program risks  associated with provider enrollment and beneficiary eligibility that may  contribute to improper payments. In table 1 below, we identify some  examples of the previous recommendations we have made to address  these types of program risks, and what, if any, steps CMS has taken in  response to our recommendations.

Lack of Transparency and Federal Oversight of States’ Use of Supplemental Payments Increase Program Risk

Supplemental payments are payments made to providers—such as local  government hospitals and other providers—that are in addition to the  regular, claims-based payments made to providers for services they  provided. Like all Medicaid payments, supplemental payments are  required to be economical and efficient.

Supplemental payments have been growing and totaled more than $48  billion in 2016. Our prior work has identified several concerns related to  supplemental payments, including the need for more complete and  accurate reporting, criteria for economical and efficient payments, and  written guidance on the distribution of payments.

Complete and accurate reporting. Our prior work has identified  increased use of provider taxes and transfers from local government  providers to finance the states’ share of supplemental payments, which,  although allowed under federal law, effectively shift Medicaid costs from  the states to the federal government. In particular, we previously reported  in July 2014 that states’ share of Medicaid supplemental payments  financed with funds from providers and local governments increased the  federal share from 57 percent in state fiscal year 2008 to 70 percent in  state fiscal year 2012. The full extent of this shift in states’ financing  structure was unknown, because CMS had not ensured that states report  complete and accurate data on the sources of funds they use to finance  their share of Medicaid payments, and CMS’s efforts had fallen short of  obtaining complete data. (See table 2 below for our recommendation  and actions CMS has taken.) For example, in July 2014, we reported that  in one state, a $220 million payment increase for nursing facilities  resulted in an estimated $110 million increase in federal matching funds  to the state, and a net payment increase to the facilities of $105 million.  (See fig. 5.)

Criteria for economical and efficient payments. Our prior work has  demonstrated that CMS lacks the criteria, data, and review processes to  ensure that one type of supplemental payments—non-DSH supplemental  payments—are economical and efficient. For example, in April 2015, we identified public hospitals in one state that received such supplemental  and regular Medicaid payments that, when combined, were hundreds of  millions in excess of the hospitals’ total Medicaid costs and tens of  millions in excess of their total operating costs—unbeknownst to CMS.  Accordingly, we concluded that CMS’s criteria and review processes did  not ensure that it can identify excessive payments and determine if  supplemental payments are economical and efficient. (See table 2 below  for our recommendations and actions CMS has taken.)

Written guidance on the distribution of payments. According to CMS  policy, Medicaid payments, including supplemental payments, should be  linked to the provision of Medicaid services and not contingent on the  provision of local funds. However, in February 2016 we reported that  CMS did not have written guidance that clarifies this policy. In February  2016, we found examples of hospitals with large uncompensated costs  associated with serving the low-income and Medicaid population that  received relatively little in supplemental payments, while other hospitals  with relatively low uncompensated care costs—but that were able to  contribute a large amount of funds for the state’s Medicaid share— received large supplemental payments relative to those costs, raising  questions as to whether CMS policies are being followed. (See table 2  for our recommendation and actions CMS has taken.)

Recognizing that Congress could help address some of the program risks  associated with supplemental payments, in November 2012, we  suggested that Congress consider requiring CMS to  improve state reporting of supplemental payments, including requiring  annual reporting of facility-specific payment amounts;  clarify permissible methods for calculating these supplemental  payments; and  implement annual independent certified audits to verify state  compliance with methods for calculating supplemental payments.

Subsequent to our work highlighting the need for complete and accurate  reporting, in January 2017 a bill was introduced in the House of  Representatives that, if enacted, would require annual state reporting of  non-DSH supplemental payments made to individual facilities, require  CMS to issue guidance to states that identifies permissible methods for  calculating non-DSH supplemental payments to providers, and establish  requirements for such annual independent audits. Another bill was  introduced in October 2017 that would require states to submit annual  reports that identify the sources and amount of funds used to finance the  state share of Medicaid payments. As of May 2018, no action had been  taken on either proposed bill.

Absent Better Oversight, Demonstrations May Increase Federal Fiscal Liability

Demonstration programs, comprising about one-third of total Medicaid  expenditures in fiscal year 2015, can be a powerful tool for states and  CMS to test new approaches to providing coverage and delivering  services that could reduce costs and improve outcomes. However, our  prior work has identified several concerns related to demonstrations,  including the need for ensuring that (1) demonstrations meet the policy  requirements of budget neutrality—that is, they must not increase federal  costs—and (2) evaluations are used to determine whether  demonstrations are having their intended effects.

Budget neutrality of Medicaid demonstrations. Demonstration  spending limits, by HHS policy, should not exceed spending that would  have occurred in the absence of a demonstration. In multiple reports  examining more than a dozen demonstrations between 2002 and 2017,  we have identified a number of questionable methods and assumptions  that HHS has permitted states to use when estimating costs. We found  that federal spending on Medicaid demonstrations could be reduced by  billions of dollars if HHS were required to improve the process for reviewing, approving, and making transparent the basis for spending  limits approved for Medicaid demonstrations. The following are some  examples of what we have previously found:  In August 2014, we reported that HHS had approved a spending limit  for Arkansas’s demonstration—to test whether providing premium  assistance to purchase private coverage through the health insurance  exchange would improve access for newly eligible Medicaid  beneficiaries—that was based, in part, on hypothetical, not actual,  costs. Specifically, the spending limit was based on significantly  higher payment amounts the state assumed it would have to make to  providers if it expanded coverage under the traditional Medicaid  program, and HHS did not request any data to support the state’s  assumptions. We estimated that by allowing the state to use  hypothetical costs, HHS approved a demonstration spending limit that  was over $775 million more than what it would have been if the limit  was based on the state’s actual payment rates for services under the  traditional Medicaid program.

We also reported in August 2014 that HHS officials told us it granted  Arkansas and 11 other states additional flexibility in their  demonstrations in order to increase spending limits if costs proved  higher than expected. We concluded that granting this flexibility to  the states to adjust the spending limit increased the fiscal risk to the  federal government.

More recently, in April 2017, we reported that two states used unspent  federal funds from their previous demonstrations to expand the scope  of subsequent demonstrations by $8 billion and $600 million,  respectively. We concluded that inflating the spending limits in this  way inappropriately increased the federal government’s fiscal liability  for Medicaid.

We have previously made recommendations to improve oversight of  spending on demonstrations, and HHS recently took action that partially  responds to one of these recommendations. (See table 3 for examples of  the recommendations and actions HHS has taken.) Specifically, under a  policy implemented in 2016, HHS restricted the amount of unspent funds  states can accrue for each year of a demonstration, and has also reduced  the amount of unspent funds that states can carry forward to new  demonstrations. For 10 demonstrations it has recently approved, HHS  estimated that the new policy has reduced total demonstration spending  limits by $109 billion for 2016 through 2018, the federal share of which is  $62.9 billion. These limits reduce the effect, but do not specifically  address all, of the questionable methods and assumptions that we have  identified regarding how HHS sets demonstration spending limits.

Evaluation of Medicaid demonstrations. In a January 2018 report, we  questioned the usefulness of both state-led and federal evaluations of  section 1115 demonstrations, particularly with regard to how these  evaluation results may inform policy decisions.

State-led evaluations. We identified significant limitations among  selected state-led demonstration evaluations, including gaps in  reported evaluation results for important parts of the demonstrations.  (See table 4.) These gaps resulted, in part, from CMS requiring final,  comprehensive evaluation reports after the expiration of the  demonstrations rather than at the end of each 3- to 5-year  demonstration cycle. In October 2017, CMS officials stated that the  agency planned to require final reports at the end of each  demonstration cycle for all demonstrations, although it had not  established written procedures for implementing this new policy. We  concluded in January 2018 that without written procedures for  implementing such requirements, gaps in oversight could continue.

Federal evaluations. Evaluations of federal demonstrations led by  CMS have also been limited due to data challenges and a lack of  transparent reporting. For example, delays obtaining data directly  from states, among other things, led CMS to considerably reduce the  scope of a large, multi-state evaluation, which was initiated in 2014 to  examine the impact of state demonstrations in four policy areas  deemed to be federal priorities. In our January 2018 report, we  found that although CMS had made progress in obtaining needed  data, CMS had no policy for making the results public. By not making  these results public in a timely manner, we concluded that CMS was  missing an opportunity to inform important federal and state policy  discussions.

In light of our concerns about state-led and federal demonstration  evaluations, in January 2018, we recommended that CMS (1) establish  written procedures for requiring final evaluation reports at the end of each  demonstration cycle, (2) issue criteria for when it will allow limited  evaluations of demonstrations, and (3) establish a policy for publicly  releasing findings from federal evaluations of demonstrations. HHS  concurred with these recommendations.

Fundamental Actions Needed to Strengthen Oversight and Manage Program Risks

Across our body of work, we have made 83 recommendations to CMS  and HHS and suggested 4 matters for congressional consideration to  address a variety of concerns about the Medicaid program. The agencies  generally agreed with our recommendations and have implemented 25 of  these recommendations to date, and CMS still needs to take fundamental  actions in three areas—having more timely, complete, and reliable data;  conducting fraud risk assessments; and strengthening federal-state  collaboration—to strengthen Medicaid oversight and better manage  program risks.

More Complete, Timely, Reliable Data for Oversight

An overarching challenge for CMS oversight of the Medicaid program is  the lack of accurate, complete, and timely data. Our work has  demonstrated how insufficient data have affected CMS’s ability to ensure  proper payments, assess beneficiaries’ access to services, and oversee  states’ financing strategies.

As part of its efforts to address longstanding data concerns, CMS has  taken some steps toward developing a reliable national repository for  Medicaid data, most notably the Transformed Medicaid Statistical  Information System (T-MSIS). Through T-MSIS, CMS will collect detailed  information on Medicaid beneficiaries—such as their citizenship,  immigration, and disability status—as well as any expanded diagnosis  and procedure codes associated with their treatments. States are to  report data more frequently—and in a timelier manner—than they have  previously, and T-MSIS includes approximately 2,800 automated quality  checks. The T-MSIS initiative has the potential to improve CMS’s ability  to identify improper payments, help ensure beneficiaries’ access to  services, and improve program transparency, among other benefits.

As we reported in December 2017, implementing the T-MSIS initiative  has been—and will continue to be—a multi-year effort. CMS has worked  closely with states and has reached a point where nearly all states are  reporting T-MSIS data. While recognizing the progress made, we noted  that more work needs to be done before CMS or states can use these  data for program oversight:

All states need to report complete T-MSIS data. For our December  2017 report, we reviewed a sample of six states and found that none  were reporting complete data.

T-MSIS data should be formatted in a manner that allows for state  data to be compared nationally. In December 2017, we reported that  state officials had expressed concerns that states did not convert their  data to the T-MSIS format in the same ways, which could limit cross- state comparisons.

In our December 2017 report, we recommended that CMS take steps to  expedite the use of T-MSIS data, including efforts to (1) obtain complete  information from all states; (2) identify and share information across  states to improve data comparability; and (3) implement mechanisms by  which states can collaborate on an ongoing basis to improve the  completeness, comparability, and utility of T-MSIS data. We also  recommended that CMS articulate a specific plan and associated time  frames for using T-MSIS data for oversight. The agency concurred with  our recommendations, but has not yet implemented them.

Our prior work has also noted areas where other data improvements are  critical to program oversight:  In July 2014, we found that there was a need for data on  supplemental payments that states make to individual hospitals and  other providers. In particular, our findings and related  recommendation from July 2014 indicate that CMS should develop a  data collection strategy that ensures that states report accurate and  complete data on all sources of funds used to finance the states’  share of Medicaid payments.

In January 2017, we found limitations in the data CMS collects to  monitor the provision of, and spending on, personal care services— services that are at a high risk for improper payments, including  fraud. In particular, data on the provision of personal care services  were often not timely, complete, or consistent. Data on states’  spending on these services were also not accurate or complete. In  January 2017, we recommended that CMS improve personal care  services data by (1) establishing standard reporting guidance for key  data, (2) ensuring linkage between data on the provision of services  and reported expenditures, (3) ensuring state compliance with  reporting requirements, and (4) developing plans to use data for  oversight. The agency concurred with two recommendations and  neither agreed nor disagreed with the other two recommendations,  and has not yet implemented any.

More Complete Fraud Risk Assessment and Better Fraud Targeting

In December 2017, we examined CMS’s efforts managing fraud risks in  Medicaid and compared it with our Fraud Risk Framework, which  provides a comprehensive set of key components and leading practices  that serve as a guide for agency managers to use when developing  efforts to combat fraud in a strategic, risk-based way. This framework  describes leading practices in four components: commit, assess, design  and implement, and evaluate and adapt. (See fig. 6.) The Fraud  Reduction and Data Analytics Act of 2015, enacted in June 2016,  requires the Office of Management and Budget (OMB) to establish  guidelines incorporating the leading practices from our Fraud Risk  Framework for federal agencies to create controls to identify and assess  fraud risks, and design and implement antifraud control activities. In July  2016, OMB published guidance, and among other things, this guidance  affirms that managers should adhere to the leading practices identified in  our Fraud Risk Framework.

In a December 2017 report, we found that CMS’s efforts partially aligned  with our fraud risk framework. In particular, CMS had  shown a commitment to combating fraud, in part, by establishing a  dedicated entity—the Center for Program Integrity—to lead antifraud  efforts, and offering and requiring antifraud training for stakeholder  groups, such as providers, beneficiaries, and health-insurance plans;  and  taken steps to identify fraud risks, such as by designating specific  provider types as high risk and developing associated control  activities.

However, CMS had not conducted a fraud risk assessment for Medicaid,  and had not designed and implemented a risk-based antifraud strategy.  A fraud risk assessment allows managers to fully consider fraud risks to  their programs, analyze their likelihood and impact, and prioritize risks.  Managers can then design and implement a strategy with specific control  activities to mitigate these fraud risks, as well as design and implement  an appropriate evaluation. We concluded that through these actions,  CMS could better ensure that it is addressing the full portfolio of risks and  strategically targeting the most-significant fraud risks facing Medicaid. As  a result, in December 2017 we made three recommendations to CMS,  two of which were to conduct fraud risk assessments, and create an  antifraud strategy for Medicaid, including an approach for evaluation.  HHS concurred with our recommendations, but has not yet implemented  them.

Greater Federal-State Collaboration to Strengthen Program Oversight

The federal government and the states play important roles in reducing  improper payments and overseeing the Medicaid program, including  overseeing spending on Medicaid supplemental payments and  demonstrations. Our prior work shows that oversight of the Medicaid  program could be further improved through leveraging and coordinating  program integrity efforts with state agencies, state auditors, and other  partners.

Collaborative audits with state agencies. As we have previously  reported, CMS has made changes to its Medicaid program integrity  efforts, including a shift to collaborative audits—in which CMS’s  contractors and states work in partnership to audit Medicaid providers. In  March 2017, we reported that collaborative audits had identified  substantial potential overpayments to providers, but barriers—such as  staff burden or problems communicating with contractors—had limited  their use and prevented states from seeking audits or hindered the  success of audits. We recommended that CMS address the barriers that  limit state participation in collaborative audits, including their use in  managed care delivery systems. CMS concurred with this recommendation and has taken steps to address them for a number of  states, but has not yet made such changes accessible to a majority of  states.

State auditors and federal partners. We have found that state auditors  and the HHS-OIG offer additional oversight and information that can help  identify program risks. To that end, we routinely coordinate our audit  efforts with the state auditors and the HHS-OIG. For example, we have  convened and facilitated meetings between CMS and state audit officials  to discuss specific areas of concern in Medicaid and future opportunities  for collaboration. The state auditors and CMS officials commented on the  benefits of such coordination, with the state auditors noting that they can  assist CMS’s state program integrity reviews by identifying program risks.

State auditors also have conducted program integrity reviews to identify  improper payments and deficiencies in the processes used to identify  them. We believe that these reviews could provide insights into program  weaknesses that CMS could learn from and potentially address  nationally. Coordination also provides an opportunity for state auditors to  learn methods for conducting program integrity reviews. The following are  recent examples of reviews conducted:  In 2017, the Oregon Secretary of State Audits Division found  approximately 31,300 questionable payments to Coordinated Care  Organizations (which receive capitated monthly payments for  beneficiaries, similar to managed care organizations), based on a  review of 15 months of data. In addition, the state auditor found that  approximately 47,600 individuals enrolled in Oregon’s Medicaid  program were ineligible, equating to $88 million in avoidable  expenditures.

Massachusetts’ Medicaid Audit Unit’s recent annual report (covering  the time period from March 15, 2017, through March 14, 2018)  reported that the state auditor identified more than $211 million in  unallowable, questionable, duplicative, unauthorized, or potentially  fraudulent billing in the program.

A 2017 report released by the Louisiana Legislative Auditor’s Office  stated that the office reviewed Medicaid eligibility files and claims data  covering January 2011 through October 2016, and found $1.4 million  in questionable duplicate payments.

In fiscal year 2017, the Mississippi Division of Medicaid reported that  they recovered more than $8.6 million through various audits of  medical claims paid to health care providers. The division also  referred seven cases to the state’s attorney general’s office, in which  the division had identified $3.1 million in improper billing.

At a May 2018 federal and state auditor coordination meeting that we  participated in, the HHS-OIG provided examples of the financial impact of  its work related to improper payments, including one review of managed care long term services and supports that  identified $717 million potential federal savings,  three reviews of managed care payments made after beneficiaries’  death that identified $18.2 million in federal funds to be recovered,  and  two reviews of managed care payments made for beneficiaries with  multiple Medicaid IDs that identified $4.3 million in federal funds to be  recovered.

Healthcare Fraud Prevention Partnership. The Healthcare Fraud  Prevention Partnership (HFPP) is an important tool to help combat  Medicaid fraud. In 2012, CMS created the HFPP to share information with  public and private stakeholders, and to conduct studies related to health  care fraud, waste, and abuse. According to CMS, as of October 2017, the  HFPP included 89 public and private partners—including Medicare—and  Medicaid-related federal and state agencies, law enforcement agencies,  private health insurance plans, and antifraud and other health care  organizations. The HFPP has conducted studies that pool and analyze  multiple payers’ claims data to identify providers with patterns of suspect  billing across private health insurance plans. In August 2017, we reported  that the partnership participants separately told us the HFPP’s studies  helped them identify and take action against potentially fraudulent  providers and payment vulnerabilities of which they might not otherwise  have been aware, and fostered both formal and informal information  sharing.

Chairman Johnson, Ranking Member McCaskill, and Members of the  Committee, this concludes my prepared statement. I would be pleased to  respond to any questions you may have.

If you or your staff members have any questions concerning this  testimony, please contact Carolyn L. Yocom, who may be reached at  202-512-7114 or yocomc@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this statement. Other individuals who made key contributions to this  testimony include Leslie V. Gordon (Assistant Director), Deirdre Gleeson  Brown (Analyst-in-Charge), Muriel Brown, Helen Desaulniers, Melissa  Duong, Julianne Flowers, Sandra George, Giselle C. Hicks, Drew Long,  Perry Parsons, Russell Voth, and Jennifer Whitworth.

Improper Payments: Actions and Guidance Could Help Address Issues  and Inconsistencies in Estimation Processes. GAO-18-377. Washington,  D.C.: May 31, 2018.

Medicaid: CMS Should Take Steps to Mitigate Program Risks in  Managed Care. GAO-18-291. Washington, D.C.: May 7, 2018.

Medicaid: Opportunities for Improving Program Oversight. GAO-18-444T.  Washington, D.C.: April 12, 2018.

Medicaid Demonstrations: Evaluations Yielded Limited Results,  Underscoring Need for Changes to Federal Policies and Procedures.  GAO-18-220. Washington, D.C.: January 19, 2018.

Medicaid: Further Action Needed to Expedite Use of National Data for  Program Oversight. GAO-18-70. Washington, D.C.: December 8, 2017.

Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts  with the Fraud Risk Framework. GAO-18-88. Washington, D.C.:  December 5, 2017.

Improper Payments: Additional Guidance Could Provide More Consistent  Compliance Determinations and Reporting by Inspectors General.   GAO-17-484. Washington, D.C.: May 31, 2017.

Medicaid Demonstrations: Federal Action Needed to Improve Oversight  of Spending. GAO-17-312. Washington, D.C.: April 3, 2017.

Medicaid Program Integrity: CMS Should Build on Current Oversight  Efforts by Further Enhancing Collaboration with States. GAO-17-277.  Washington, D.C.: March 15, 2017.

High-Risk Series: Progress on Many High-Risk Areas, While Substantial  Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15,  2017.

Medicaid: CMS Needs Better Data to Monitor the Provision of and  Spending on Personal Care Services. GAO-17-169. Washington, D.C.:  January 12, 2017.

Medicaid: Program Oversight Hampered by Data Challenges,  Underscoring Need for Continued Improvement. GAO-17-173.  Washington, D.C.: January 6, 2017.

Improper Payments: Strategy and Additional Actions Needed to Help  Ensure Agencies Use the Do Not Pay Working System as Intended.  GAO-17-15. Washington, D.C.: October 14, 2016.

Medicaid Program Integrity: Improved Guidance Needed to Better  Support Efforts to Screen Managed Care Providers. GAO-16-402.  Washington, D.C.: April 22, 2016.

Medicaid: Federal Guidance Needed to Address Concerns About  Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.:  February 5, 2016.

Medicaid: Additional Efforts Needed to Ensure that State Spending is  Appropriately Matched with Federal Funds. GAO-16-53. Washington,  D.C.: October 16, 2015.

Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care.  GAO-15-481. Washington, D.C.: May 29, 2015.

Medicaid: Additional Actions Needed to Help Improve Provider and  Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14,  2015.

Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited  Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.

Medicaid Demonstrations: HHS’s Approval Process for Arkansas’s  Medicaid Expansion Waiver Raises Cost Concerns. GAO-14-689R.  Washington, D.C.: August 8, 2014.

Medicaid Financing: States’ Increased Reliance on Funds from Health  Care Providers and Local Governments Warrants Improved CMS Data  Collection. GAO-14-627. Washington, D.C.: July 29, 2014.

Medicaid Demonstration Waivers: Approval Process Raises Cost  Concerns and Lacks Transparency. GAO-13-384. Washington, D.C.:  June 25, 2013.

Medicaid: More Transparency of and Accountability for Supplemental  Payments Are Needed. GAO-13-48. Washington, D.C.: November 26,  2012.

Medicaid Demonstration Waivers: Recent HHS Approvals Continue to  Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.:  January 31, 2008.

Medicaid and SCHIP: Recent HHS Approvals of Demonstration Waiver  Projects Raise Concerns. GAO-02-817. Washington, D.C.: July 12, 2002.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The Medicaid program helped provide health care to an estimated 73 million people in fiscal 2017 at a cost of about $596 billion. This joint federal and state program continues to grow, and remains on our high risk list due to concerns about the adequacy of federal oversight and the program's vulnerability to fraud.

This testimony focuses on the major risks to the integrity of Medicaid. Efforts needed to strengthen oversight include:

expansion of a national Medicaid data system that will allow comparisons across states,

greater collaboration between state and federal auditors.