Federal Health-Insurance Marketplace: Analysis of Plan Year 2015 Application, Enrollment, and Eligibility-Verification Process

The Patient Protection and Affordable Care Act (PPACA) offers subsidized health-care coverage for qualifying applicants. States may operate their own health-care marketplaces or rely on the FFM, maintained by CMS. In PY 2015, 37 states relied on the FFM and over 8 million plan selections were made through the FFM. PPACA represents a significant fiscal commitment for the federal government, which pays subsidies to issuers on participants' behalf.

GAO was asked to examine enrollment into the FFM for PY 2015, the most current data available at the time of GAO's review. This report examines the extent to which indications of potentially improper or fraudulent enrollments existed in the FFM's application, enrollment, and eligibility-verification process for the 2015 enrollment period.

GAO reviewed relevant federal statutes, regulations, and policies for PY 2015 and interviewed CMS officials. GAO analyzed eligibility and enrollment data for about 8.04 million applicants in PY 2015 to identify applicants (1) who had a citizenship, status as a national, or lawful presence inconsistency; (2) whose information did not match SSA records; or (3) who were reportedly deceased. GAO also reviewed a nongeneralizable sample of 45 applicants to more fully understand verification processes.

A small percentage—about 1 percent—of plan year (PY) 2015 enrollments were potentially improper or fraudulent. These applicants had unresolved inconsistencies related to citizenship, status as a national, lawful presence, or Social Security number (SSN), or received coverage while reportedly deceased, according to GAO's analysis of federally facilitated marketplace (FFM) eligibility and enrollment data. To verify applicant information, such as citizenship, status as a national, or lawful presence, and SSNs, the FFM uses data from the Department of Homeland Security (DHS) and Social Security Administration (SSA), among other sources. When an applicant's information does not match the available data sources, the FFM generates an inconsistency, and the FFM should take steps, such as requesting applicant documentation, to resolve it. Having an SSN is not a condition of eligibility; however, unresolved inconsistencies could indicate that an enrollment is potentially improper or fraudulent. The FFM did not actively resolve SSN inconsistencies for PY 2015, but the Centers for Medicare & Medicaid Services (CMS) has since completed system upgrades and established procedures for verifying SSNs with applicant-provided documentation, according to CMS officials.

Note: Some applicants may be included in more than one category.

GAO found that applicants or enrollees may have received or maintained coverage with an associated subsidy after their reported death because the FFM did not always identify individuals as deceased in a timely manner, such as prior to automatic reenrollment. CMS relied on third parties, such as family members, to report the death of an enrollee to the FFM, but did not always receive adequate notification to verify the death. According to CMS officials, CMS is exploring approaches to identify enrollees who may be deceased and should therefore be unenrolled from coverage. The FFM checks applicants' information against death information from SSA before initial enrollment but does not recheck death information prior to reenrollment. According to CMS officials, the FFM does not reverify information, other than income, when automatically reenrolling applicants to help encourage individuals to maintain enrollment in coverage from one year to the next. Without rechecking SSA death information prior to automatic reenrollment, the FFM remains at risk of providing subsidized coverage to deceased individuals with related costs to the federal government.

GAO recommends that CMS assess and document the feasibility of approaches to identify the deaths of individuals prior to automatic reenrollment. HHS concurred with GAO's recommendation.

The Patient Protection and Affordable Care Act (PPACA), signed into law  on March 23, 2010, offers subsidized health-care coverage for qualifying  applicants, expands the availability of Medicaid, and provides for the  establishment of health-insurance exchanges, or marketplaces, to assist  consumers in comparing and selecting among insurance plans offered by  participating private issuers of health-care coverage. Under PPACA,  states and the District of Columbia may elect to operate their own health- care marketplaces, or may rely on the federally facilitated marketplace  (FFM), known to the public as HealthCare.gov. The Centers for Medicare  & Medicaid Services (CMS), a unit of the Department of Health and  Human Services (HHS), is responsible for overseeing the establishment  of these online marketplaces, and the agency maintains the FFM.

Under PPACA, heath-care marketplaces are the mechanisms through  which applicants enroll in qualified health plans. To help pay the cost of  insurance premiums for taxpayers and their dependents, PPACA  provides a premium tax credit (PTC) to individuals who meet certain  income and other requirements. Individuals can have the federal  government pay PTC to their issuers in advance on their behalf, known  as advance premium tax credit (APTC), which lowers their monthly  premium payments. APTC is based on estimates of household income.  Subsidies and other costs to eligible individuals under PPACA represent  a significant fiscal commitment for the federal government. As of January  2017, the Congressional Budget Office projected that the cost of  coverage provisions to the federal government will increase to $51 billion  for fiscal year 2017 for the FFM and state-based marketplaces. Subsidy  costs are contingent on eligibility for coverage. Therefore, enrollment  controls that help ensure only qualified applicants are approved for  subsidized coverage are a key factor in determining federal expenditures  under the act.

To enroll in health-insurance coverage offered through a marketplace  created by PPACA, individuals must complete an application and meet  certain eligibility requirements. For example, an individual must be a U.S.  citizen or national, or be otherwise lawfully present in the United States.  The marketplaces are required by law to take several steps to verify the  information in individuals’ applications to determine their eligibility to enroll  in coverage and, if applicable, qualify for federal subsidies. Verification  steps include validating an applicant’s Social Security number (SSN), if  one is provided; verifying citizenship, status as a U.S. national, or lawful  presence; and verifying household income and family size.

In light of findings in our recent reports related to the FFM’s application,  enrollment, and eligibility-verification process, you asked that we examine  PPACA enrollment into the FFM for plan year 2015 (the most current data  available at the time of our review). This report examines the extent to  which indications of potentially improper or fraudulent enrollments existed  in the FFM’s application, enrollment, and eligibility-verification process for  the 2015 enrollment period.

To identify indications of potentially improper or fraudulent enrollments in  the FFM’s application, enrollment, and eligibility-verification process, we  reviewed relevant federal statutes, HHS regulations, and CMS policies for  plan year 2015; interviewed CMS officials; and analyzed eligibility and  enrollment data for about 8.04 million applicants with effectuated  enrollments in plan year 2015 with an associated APTC or Cost Sharing  Reduction (CSR). We focused our analyses on three areas based on the  eligibility and verification requirements marketplaces must use to  determine whether individuals are eligible to enroll and maintain  coverage. Specifically, we identified and analyzed data for applicants  receiving coverage with an associated subsidy (1) with inconsistencies  related to citizenship, status as a national, or lawful presence; (2) whose  information, including SSN, did not match the Social Security  Administration’s (SSA) records; or (3) who were reportedly deceased. For  the purposes of this report, we define applicants receiving coverage with  an associated subsidy as applicants receiving coverage in plan year 2015  with an associated APTC or CSR. Because APTC is based on, among  other things, estimates of household income, and taxpayers must  reconcile the amount of APTC paid by the federal government to issuers  on their behalf with the PTC they are eligible for on their tax returns, the  number of applicants receiving coverage with an associated subsidy and  the amount of associated subsidies identified through our analysis may  differ from the number of applicants who ultimately received subsidized  coverage and the amount of subsidies paid to issuers on their behalf.

To complete our analysis of these three areas, we compared about 8.04  million applicants that received coverage with an associated subsidy for  plan year 2015 to the Department of Homeland Security’s (DHS)  Systematic Alien Verification for Entitlements (SAVE) system from  November 15, 2014, through December 31, 2015, to identify applicants  with unresolved inconsistencies related to citizenship, status as a  national, or lawful presence; SSA’s Enumeration Verification System  (EVS) from November 16, 2016, through December 29, 2016, and SSA’s  Affordable Care Act (ACA) batch file output from March 2017, to identify  potentially invalid personal information; and SSA’s full death file from  June 2016, to identify reportedly deceased individuals. For reporting  purposes, we present the results of our data-matching analyses as  approximate whole numbers. Additionally, we selected a  nongeneralizable sample of 45 applicants from our results to more fully  understand the verification and inconsistency-resolution process.

To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  FFM and other federal data files that we used to perform our work. We  also interviewed officials responsible for their respective databases, and  reviewed documentation related to the databases and literature related to  the quality of the data. On the basis of our own testing and our  discussions with agency officials, we concluded that the data elements  used for this report were sufficiently reliable for the purposes of our  reporting objectives.

As discussed above, we focused our analyses on three areas. We did not  perform analyses using independent data sources to verify other types of  information required for applicants to enroll in qualified health plans and  qualify for subsidies, which we have discussed in previous GAO reports.  Specifically, we did not perform analysis on the following:  Income. Internal Revenue Service (IRS) household income  information is necessary in determining subsidy amounts, but can be  up to 2 years old. Due to the age of the data, there may be  discrepancies between applicants’ attested information and what the  marketplace obtains through the federal data services hub (data  hub). According to HHS regulations and CMS guidance, if electronic  data are unavailable or an applicant’s attestation of projected annual  household income is more than 10 percent below the annual  household income as computed using available data sources, the  marketplace must follow inconsistency-resolution procedures. These  procedures will accept differences of up to 20 percent of an  applicant’s attested income from what CMS is able to recalculate  using supporting documentation.

Residency. Individuals must intend to reside in the state in which they  are applying for coverage and are not required to have a fixed  address in the state. The marketplace can accept self-attestation  unless the information provided by the applicant is not reasonably  compatible with other information provided by the applicant or in the  records of the marketplace. HHS has recently stated that its previous  assessments of available sources did not identify any comprehensive  data source for verifying residency. However, we previously reported  that CMS did not document an evaluation of available external  sources to determine the quality, relevance, and reliability of the data,  and we recommended that it do so.

Incarceration. Individuals must not be incarcerated (unless  incarcerated while awaiting disposition of charges). We have  previously reported that there are many challenges associated with  using incarceration data, including the risk of false positives.

For more detailed information on our scope and methodology, see  appendix I.

We conducted this performance audit from November 2015 to December  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

CMS operates the FFM consistent with PPACA and relevant HHS  regulations. In plan year 2015, 37 states relied on the FFM. The  remaining 14 states, including the District of Columbia, operated their own  state-based marketplaces. According to published HHS figures, the FFM  accounted for about 76 percent, or approximately 8.8 million, of plan  selections made via marketplaces from November 15, 2014, through  February 22, 2015. Overall, we found that about 8.04 million applicants  selected a plan, effectuated enrollment, and received coverage with an  associated subsidy for plan year 2015. We discuss these 8.04 million  applicants later in this report. More than half of the 8.8 million plans in  plan year 2015 were applicants who did not have a plan via the FFM in  plan year 2014, which was the FFM’s first year. Of the 8.8 million total  plans, 87 percent qualified for an APTC with an average APTC of $263  per application per month.

All marketplaces, including the FFM, are required by PPACA to verify  applicant information to determine eligibility for enrollment and income- based subsidies, if applicable. Marketplaces, among other things, must  check for Medicaid eligibility before determining eligibility for qualified  health plans;  validate an applicant’s SSN, if one is provided, by comparing with  SSA records;  verify citizenship, status as a U.S. national, or lawful presence by  comparing with SSA or DHS records, respectively; and  verify household income and family size by comparing with tax-return  data from the IRS, as well as data on Social Security benefits from  SSA.

If the information the applicant provided on the application does not  match the information contained in the data source, or if a data source is  not available to verify the information, the FFM generates an  inconsistency. The FFM then sends a notification to the applicant, who  generally has 90 days to present satisfactory documentary evidence to  resolve the inconsistency, and grants the applicant conditional eligibility if  the applicant is otherwise qualified. While waiting for supporting  documentation, the FFM attempts to review and resolve the  inconsistency, which can include looking for obvious errors on the  application. The FFM will generally categorize inconsistencies as expired  if the applicant was not able to provide the supporting documentation to  resolve the inconsistency within the allotted time frame and the FFM was  not able to resolve the inconsistency. Depending on the type of  inconsistency and availability of data sources, an applicant with an  expired inconsistency may have his or her coverage terminated, or the  applicant’s subsidy amount may be recalculated based on the trusted  source information or eliminated. In other circumstances, the applicant’s  situation may change such that no additional action is required by the  FFM to address the inconsistency. These inconsistencies are categorized  as overcome by events (OBE) and can include situations where the  application changes to a non-financial-assistance application or another  inconsistency has expired. Inconsistencies that the FFM cannot resolve,  expire, or categorize as OBE remain open.

We previously made recommendations to improve the FFM’s enrollment  and eligibility-verification process. Specifically, in 2016, we made eight  recommendations, including that CMS consider analyzing outcomes of  the verification system, take steps to resolve inconsistencies related to  SSNs, and conduct a risk assessment of the potential for fraud in  marketplace applications. HHS concurred with our recommendations. In  2017, we made 10 recommendations to HHS involving the annual  reporting of APTC improper-payments estimates, improving control  activities related to eligibility determinations, and calculations of APTC  based on incomes and family sizes. HHS concurred with 7 of the  recommendations and neither agreed nor disagreed with the remaining 3  recommendations, which related to improving control activities for  verifying identities of individuals, preventing duplicate coverage of  individuals receiving minimum essential coverage through their  employers, and verifying household incomes and family sizes. As of  November 2017, HHS has not provided us with documentation to support  the implementation of recommendations made in 2016 or 2017. As a  result, the 18 recommendations remain open.

Analyses Identified about 1 Percent of Enrollments during Plan Year 2015 as Potentially Improper or Fraudulent, with Challenges Remaining in the Identification and Reenrollment of Reportedly Deceased Individuals

About 1 Percent of Enrollments for Plan Year 2015 Were Identified as Potentially Improper or Fraudulent

Our analysis of plan year 2015 FFM enrollment and eligibility data  identified a small percentage—about 1 percent—of enrollments that were  potentially improper or fraudulent because they had an unresolved issue  related to citizenship, status as a national, or lawful presence, or to SSN,  or were reportedly deceased. The presence of an unresolved data- matching inconsistency could indicate that an enrollment is potentially  improper or fraudulent because an unresolved inconsistency indicates  that the FFM could not verify information provided by the applicant. When  a data-matching inconsistency is generated, HHS regulations require that  the applicant provide supporting documentation generally within 90 days  to resolve the inconsistency. If the applicant does not provide requested  documentation within the time frame and the FFM cannot otherwise verify  the information provided by the applicant, the inconsistency may be  expired, which could lead to termination from coverage or a recalculation  or elimination of subsidy amounts based on the trusted data source  information, depending on the type of inconsistency. In addition, in our  prior undercover work, we were able to obtain and maintain coverage for  fictitious applicants by submitting fictitious or no documents to resolve a  data-matching inconsistency. Our undercover work has also previously  shown that the FFM did not verify the authenticity or accuracy of the  documents we submitted to resolve inconsistencies. As part of our current  analyses, we did not independently verify the instances where the FFM  resolved inconsistencies when applicants provided the requested  documentation during this engagement. However, if the FFM did not  corroborate information on applicant-provided documentation with the  appropriate agency, some applicants with resolved data-matching  inconsistencies may have received coverage with an associated subsidy  potentially improperly or fraudulently.

Verification of Citizenship, Status as a National, or Lawful Presence Status

Most of the about 8.04 million applicants who received coverage with an  associated subsidy in plan year 2015 provided information that allowed  the FFM to verify an applicant’s status as a U.S. citizen or national, or  lawfully present in the United States. Nevertheless, the FFM did identify  some inconsistencies related to citizenship, status as a national, or lawful  presence. The FFM flags applicants as having an inconsistency if they  attested to being a citizen but their status as a citizen could not be  verified—for example, because their SSN and other information does not  match SSA records—or they attest to an eligible immigration status but  their lawful presence could not be immediately verified. Specifically,  based on our analysis of enrollment data provided by CMS, the FFM  initially identified approximately 88 percent of about 8.04 million  applicants as a U.S. citizen or national, or lawfully present in the United  States. The FFM identified the remaining approximately 961,000  applicants (12 percent), as having inconsistencies related to citizenship,  status as a national, or lawful presence.

The FFM was able to obtain information from the DHS SAVE program to  address some inconsistencies related to citizenship, status as a national,  or lawful presence, but issues with applicant-provided information  precluded the FFM from querying all of the inconsistencies. The FFM  queried DHS SAVE records for about 242,000 of the 961,000 applicants  with inconsistencies (25 percent), but we were not able to identify queries  for about 719,000 (75 percent). See figure 1 below for a comparison of  FFM inconsistencies related to citizenship, status as a national, or lawful  presence to DHS SAVE records.

We found that the FFM could not query these 719,000 applicants mostly  because of the quality of information submitted by applicants. Specifically,  many of the applicants the FFM could not query were missing information  such as immigration numbers that the DHS SAVE program requires. For  example, we found applicants who provided their name and date of birth  but did not provide an immigration number, which prevented the FFM  from using the DHS SAVE program to verify citizenship or lawful  presence status. Such cases required the FFM to request supporting  documentation from the applicant.

After the initial comparison to the DHS SAVE program, the FFM attempts  to resolve remaining inconsistencies by first looking for obvious errors  and then by using additional documentation requested from the applicant.  See figure 2 below for an overview of inconsistencies related to  citizenship, status as a national, or lawful presence that remained  unresolved (i.e., open), as of December 31, 2015.

As shown in figure 2, CMS addressed some, but not all, inconsistencies.  Specifically, about 43,000 inconsistencies related to citizenship, status as  a national, or lawful presence (less than 1 percent of total applicants)  remained in an open status as of December 31, 2015. An open status  indicates that CMS was unable to resolve or obtain documentation to  clarify the issues that led to the inconsistency. In some cases, an  inconsistency generated late in the year may have remained open but,  according to CMS officials, would have carried forward and generated a  new inconsistency for plan year 2016. Inconsistencies that remained  open because they were not resolved within the required time frame  represent potentially improper or fraudulent applicants who retained  coverage without providing sufficient supporting documentation to resolve  their inconsistency. However, the number of potentially improper or  fraudulent applicants may be understated since we only took into  consideration those with inconsistencies in an open status and not  applicants with expired inconsistencies who may have continued to  receive coverage and had subsidies paid to issuers on their behalf before  CMS was able to terminate their coverage and subsidies.

To examine steps taken by the FFM when processing inconsistencies  related to citizenship, status as a national or lawful presence, we selected  a nongeneralizable sample of 15 of the 961,000 applicants that the FFM  identified. For 13 out of the 15, the FFM verified the applicant’s  information through supporting documentation or DHS SAVE and  resolved or expired the inconsistency in accordance with its standard  operating procedures, or the FFM categorized the applicant as OBE  because of an application update that made the inconsistency no longer  relevant. We did note that in 2 of the 13 cases, the FFM did not perform a  DHS SAVE program query to corroborate the supporting documentation.  However, this was not required at the time the applicants enrolled, which  was prior to June 2015 when CMS established that procedure.

In the remaining cases, the FFM did not verify the applicants’ information  in plan year 2015, but the applicants received coverage beyond the 95- day inconsistency-resolution period. For example, in one case we found  that the applicant obtained multiple policies for different periods during the  year without ever providing sufficient information to verify his or her status  as a U.S. citizen or national, or being lawfully present in the United  States. As a result, the applicant was able to obtain coverage for two- thirds of the coverage year. According to CMS, this inconsistency was  carried over to plan year 2016, when the inconsistency was expired and  the applicant’s coverage was terminated.

Most applicants for plan year 2015 who received coverage with an  associated subsidy submitted SSNs and other information that matched  SSA records, and the FFM identified SSN inconsistencies for most of the  applicants whose information did not match SSA records. As shown in  figure 3, our analysis found that over 96 percent of applicants (7.74  million out of about 8.04 million) submitted information that was consistent  with SSA records, but about 139,000 (1.7 percent of total applicants) did  not. The other 166,000 applicants (2.1 percent) did not provide an SSN  on their application.

Of the approximately 139,000 applicants (1.7 percent) whose information  did not match SSA records in our analysis, we found that the FFM  identified an SSN inconsistency for about 109,000 (1.4 percent of total  applicants). The FFM did not designate the remaining applicants whose  information did not match SSA records in our analysis (about 31,000 of  139,000 applicants) as having an SSN inconsistency for plan year 2015,  indicating that the FFM did not flag the applicant’s information as not  matching SSA records. The FFM may not have flagged an applicant’s  information for plan year 2015 as not matching SSA records if the  applicant’s information matched SSA records at the time of enrollment but  the applicant later changed his or her name with SSA.

The FFM did not address all SSN inconsistencies for plan year 2015.  Specifically, about 33,000 of the 109,000 applicants for whom the FFM  identified an SSN inconsistency for plan year 2015 (less than 1 percent of  total applicants) had an open SSN inconsistency only (see fig. 4).

An open SSN inconsistency may indicate a potentially improper or  fraudulent enrollment because it indicates that the FFM did not verify the  applicant’s identity information but the applicant retained coverage.  Applicants may have had open SSN inconsistencies in plan year 2015  because the FFM did not take steps to actively resolve SSN  inconsistencies at that time. In some cases, an inconsistency generated  late in the year may have remained open but, according to CMS officials,  would have carried forward and generated a new inconsistency for plan  year 2016. According to CMS officials, the FFM did not actively take steps  to resolve SSN inconsistencies in plan year 2015 primarily because the  FFM could not update SSNs in the data system at the time, as discussed  in more detail later in this section. We previously reported that open SSN  inconsistencies are indicators of potentially fraudulent applications.  Specifically, we reported that we had successfully enrolled and received  coverage with an associated subsidy in plan year 2015 for eight  undercover identities that either did not provide an SSN or had an invalid  Social Security identity. Further, HHS regulations state that the FFM  must follow its standard inconsistency procedures if it is unable to validate  an individual’s SSN through SSA. To address this issue we  recommended that CMS design and implement procedures to resolve  SSN inconsistencies. In May 2017, CMS established written procedures  for verifying SSNs with documents submitted by applicants, as discussed  in more detail later in this report.

The remaining applicants with an SSN inconsistency for plan year 2015  had either a resolved SSN inconsistency (14,000 applicants) or an SSN  inconsistency that was expired or OBE (62,000 applicants). Although the  FFM was not actively resolving SSN inconsistencies in plan year 2015,  according to CMS officials, most applicants with an SSN inconsistency  also had an inconsistency related to citizenship, status as a national, or  lawful presence, and documentation submitted to resolve those  inconsistencies may also resolve SSN inconsistencies. For example,  according to CMS officials, if an applicant submitted a Social Security  card to the FFM, an SSN inconsistency could be resolved based on that  documentation. If an inconsistency related to citizenship, status as a  national, or lawful presence expired, the FFM automatically expired the  SSN inconsistency, according to CMS procedures. According to CMS  officials, the FFM closed SSN inconsistencies as OBE if no action needed  to be taken on the inconsistency because it was no longer relevant to the  application, such as in cases where the applicant corrected his or her  SSN on the application.

To examine steps taken to verify SSNs and process SSN inconsistencies,  we reviewed a nongeneralizable sample of 15 applicants of the 139,000  applicants who received coverage with an associated subsidy in plan year  2015 whose information did not match SSA records in our analysis. In 3  of the 15 cases, additional information provided by CMS indicates that the  FFM verified that the SSN on the application was correct. Specifically, in  two of the cases, our analysis found that the applicant’s information did  not match SSA records but the FFM verified the applicant’s information  and did not generate an SSN inconsistency. As previously discussed, the  FFM may not have identified an SSN inconsistency if the applicant’s  information matched SSA records at the time of enrollment but the  applicant later changed his or her name with SSA. In both of these cases,  we found that the applicant’s date of birth matched SSA records but the  name did not, indicating that the applicant may have changed his or her  name. In the third case, the FFM resolved the SSN inconsistency in plan  year 2015 when the applicant submitted a Social Security card showing  the same name and SSN as the application.

In 5 of the 15 cases, the applicant had an SSN inconsistency in plan year  2015 that was not resolved. Specifically, in two of the five cases, the SSN  inconsistency expired when an inconsistency related to citizenship, status  as a national, or lawful presence was expired, in accordance with CMS  procedures. In one case, the SSN inconsistency remained open because,  as previously noted, the FFM did not take direct action to resolve SSN  inconsistencies in plan year 2015, according to CMS officials. In two  cases, the SSN inconsistency was OBE. According to CMS officials, an  inconsistency status may be changed to OBE when the inconsistency no  longer needs to be addressed as a result of changes to the application,  such as when an applicant updates information on his or her application  or the application changes to a non-financial-assistance application. CMS  officials did not specify what circumstances resulted in the status of these  two SSN inconsistencies being changed to OBE; however, one of the  applicants had a subsequent health-insurance policy that did not provide  financial assistance.

We found that in 5 of the 15 cases, the FFM either resolved an SSN  inconsistency in plan year 2015 when the applicant submitted a Social  Security card or did not generate an SSN inconsistency for plan year  2015 because the applicant had provided a Social Security card in plan  year 2014, but information on the applicant-provided Social Security card  did not match information in CMS’s data system. CMS officials did not  indicate that the FFM had verified the name and SSN on the applicant- provided Social Security cards in these five cases with SSA records. The  SSN on applicant-provided documentation may not have matched the  SSN in CMS’s data because, as discussed previously, system limitations  existed prior to March 2017. Specifically, even if the FFM received a  Social Security card to resolve an inconsistency, the FFM did not reflect  this change in CMS’s data system because the system did not have the  capability to modify or update SSN information at the time, according to  CMS officials. For example, if an applicant mistyped his or her SSN, the  inconsistency may have been subsequently resolved if the applicant  submitted a Social Security card, but CMS’s data system would continue  to reflect the incorrect SSN that had been originally submitted.

Finally, we found that in 2 of the 15 cases, the FFM resolved the SSN  inconsistency in plan year 2015 or the FFM did not generate an SSN  inconsistency in 2015 because it resolved an SSN inconsistency in plan  year 2014, but information provided by CMS did not support the  resolution of the SSN inconsistency. Specifically, in one case in which the  FFM resolved an SSN inconsistency for plan year 2015, we could not  determine how the SSN inconsistency was resolved because, according  to CMS officials, the applicant did not provide documentation of his or her  SSN. In another case, the FFM automatically reenrolled an applicant for  plan year 2015 without an SSN inconsistency after identifying an SSN  inconsistency in plan year 2014 because, according to CMS officials, the  applicant submitted a passport to resolve a citizenship inconsistency.  While submission of a U.S. passport can be used to verify citizenship,  CMS procedures do not permit using a passport to resolve an SSN  inconsistency, and the applicant’s passport did not contain an SSN.  Because the applicant did not provide any other documentation to resolve  the SSN inconsistency in plan year 2014 and the FFM did not generate  an SSN inconsistency in plan year 2015, even though the applicant’s  information did not match SSA records, we could not determine whether  CMS’s data system reflects the correct SSN for this applicant.

According to CMS officials, having an incorrect SSN on the application  does not affect eligibility, since having an SSN is not a requirement for  eligibility. However, as previously discussed, resolving data-matching  inconsistencies without corroborating information with the appropriate  agency puts the FFM at risk of approving potentially fraudulent or  improper applications for subsidized coverage. We identified  approximately $59 million in APTC for plan year 2015 associated with the  applications of the 14,000 applicants who provided SSNs and other  information that did not match SSA records and had a resolved SSN  inconsistency. The $59 million may include APTC associated with  applicants whose SSN inconsistencies were resolved without sufficient  documentation, applicants who had SSN inconsistencies that were  resolved based on applicant-submitted documentation that does not  match the SSN in CMS’s data system, and applicants whose SSN  inconsistencies were resolved appropriately. We identified $112 million  in APTC associated with the applications of applicants who did not have  an SSN inconsistency flagged in plan year 2015, although some  information did not match SSA records in our analysis. We could not  associate APTC subsidies with individual applicants because applications  may include more than one person.

Further, inaccurate SSNs in CMS’s system potentially impede the IRS’s  ability to reconcile APTC. The IRS is responsible for processing tax  returns to determine the final amount of PTC to which taxpayers are  entitled and for recovering APTC overpayments. To enable the IRS to  reconcile APTC, PPACA requires marketplaces to report certain  information on individuals with marketplace coverage, including the name,  address, and taxpayer-identification number—an SSN in cases where the  individual has one—to the IRS. The IRS compares information provided by the marketplace on the APTC paid to issuers on taxpayers’ behalf to  the amount for which taxpayers qualify based on actual household  income and family size reported on their tax returns.

In March 2017, system functionality upgrades were completed and  deployed to enable the FFM to modify or update SSNs, according to CMS  officials. In addition, as noted previously, CMS established procedures in  May 2017 for verifying SSNs with documents submitted by applicants.  These procedures require the FFM to take steps to update and verify  SSNs by (1) obtaining documentation of the SSN or processing  previously received SSN documents, (2) entering the SSN shown on  documentation into CMS’s data system, and (3) trying to verify the newly  entered or corrected SSN with SSA records. Further, the procedures  direct the FFM to escalate cases for CMS review if the SSN cannot be  verified, or documentation submitted to verify the SSN matches the  information originally provided by the applicant that could not be verified  with SSA records, as this may indicate potential fraud. We did not  independently verify that the procedures have been implemented  because the changes occurred outside the scope of our review; however,  if properly implemented, these changes may help reduce the risk that  potentially improper or fraudulent applicants could obtain subsidized  coverage by helping to ensure that SSNs are appropriately verified and  corrected in CMS’s data system.

Relatively Few Reportedly Deceased Individuals Received Coverage with an Associated Subsidy, but Challenges Remain with Identifying Deceased Individuals before Automatic Reenrollment

We found relatively few indicators that reportedly deceased individuals  received coverage with an associated subsidy during plan year 2015.  Specifically, we identified about 19,000 out of the approximately 7.74  million applicants who provided SSNs and other information that matched  SSA records (about 0.24 percent) who received coverage with an  associated subsidy on or after the date listed in the full death file as their  date of death. HHS regulations state that in the case of termination of  coverage due to death, the last day of enrollment in a qualified health  plan through the FFM is the date of death. However, the FFM did not  always terminate the enrollment of individuals through the exchange as of  the date reported in the full death file as their date of death. Specifically,  we found that the coverage for about 2,000 of the 19,000 reportedly  deceased individuals ended on their reported date of death, but the  remaining approximately 17,000 received or maintained coverage with an  associated subsidy—APTC or CSR, which the federal government pays  to issuers on behalf of enrollees—after their reported date of death (see  fig. 5).

Most insurance policies associated with reportedly deceased applicants  began when they were alive and continued after their deaths, but in some  cases the date of submission of the application for coverage occurred  after the individual’s reported date of death. Specifically, through our  analysis, we found about 14,000 (82 percent) of the 17,000 policies that  continued beyond the applicant’s reported date of death began while the  individual was alive (see fig. 6). However, the remaining policies began  after the applicant’s reported date of death, including about 1,000 policies  (5 percent) for which the applicant reportedly died after the application  was submitted but before coverage started and about 2,000 policies (13  percent) in which the applicant died before the application was submitted.

We identified about $23.0 million in APTC—which the federal government  pays to issuers on behalf of enrollees—after the date of death of the  applicant associated with the 17,000 policies that started or continued  after the applicant’s reported date of death, of which about a fifth (about  $4.7 million) was associated with the 2,000 policies of applicants who  were reported as deceased before their application was submitted. We  could not determine the portion of APTC associated with each individual  on a policy or the extent to which the total APTC amount would have  changed if the policy had been terminated as of the reportedly deceased  individual’s date of death. As previously discussed, taxpayers who  choose to have APTC must reconcile the amount of APTC paid to issuers  on their behalf with PTC they are eligible for on their income-tax returns.  Therefore, the final PTC amount may differ from the amount of APTC  paid to issuers because changes in circumstances, such as the death of  an enrollee, may affect the amount of PTC for which an enrollee is  eligible. We did not determine the extent to which APTC paid on behalf of  reportedly deceased individuals was reconciled with PTC for which these  individuals were ultimately eligible as the reconciliation process was  outside the scope of our review. However, we previously found that not all  individuals correctly filed their federal income-tax returns, as required,  and the federal government is missing opportunities to recover  overpayments of APTC as part of the reconciliation process. As a result,  APTC overpayments that the federal government improperly provides to  issuers on behalf of deceased enrollees may not be fully recovered  through the reconciliation process.

In the majority of cases in which the applicant reportedly died before the  application was submitted (about 1,700 out of 2,000 policies), we found  that the FFM had automatically submitted the application to reenroll the  applicant. We reviewed five sample cases in which the date of the  application submission occurred after the individual’s reported date of  death. For all five cases, the individual had received coverage with an  associated subsidy in plan year 2014 and the FFM automatically  reenrolled the individual for plan year 2015 after the reported date of  death. According to additional information provided by CMS officials, the  federal government paid APTC to issuers on behalf of all five of these  individuals in plan year 2015 after their reported date of death.

Deceased individuals may receive coverage with an associated subsidy  beyond their reported date of death—or the FFM may automatically  reenroll deceased individuals after their reported date of death—because  the FFM does not always identify applicants as deceased after their initial  enrollment in a qualified health plan. The FFM checks applicants’  information against SSA’s full death file to identify reportedly deceased  individuals before enrolling them for coverage and subsidies. However,  we previously found that the FFM does not conduct periodic checks  during the year to determine whether any individuals have subsequently  died. Further, according to CMS officials, the FFM does not recheck the  full death file before automatically reenrolling applicants for subsequent  plan years or reverify information, but rather only rechecks income, to  help encourage individuals to maintain enrollment in coverage from one  year to the next and align with the process for individuals with employer- sponsored health insurance. HHS regulations require marketplaces to  periodically examine certain available data sources to identify changes— such as the enrollee’s death—to determine whether individuals receiving  coverage with an associated subsidy remain eligible.

CMS does not always identify deaths of enrollees in time to terminate  enrollment through the exchange as of the date of death or to prevent  automatic reenrollment, because CMS relies on third parties, such as  family members, to report the death of an enrollee to the FFM. The FFM  has procedures in place for individuals to report an enrollee’s death in  order to remove the enrollee from coverage. We reviewed a  nongeneralizable sample of 15 of the 17,000 reportedly deceased  individuals who received coverage with an associated subsidy after the  date reported in the full death file as their date of death, including the five  cases we reviewed in which the FFM automatically reenrolled the  individuals after their reported date of death. In 8 of the 15 sample cases  we reviewed, a family member or other individual contacted the FFM and  reported the enrollee’s death. In two of these cases, the individual  reporting the death did not provide sufficient documentation of the death,  as required by CMS. In three cases, the FFM received notification and a  death certificate to verify the death, but did not terminate the policy as of  the date of death. The FFM did not receive the death certificates for two  of the three cases until 2016—after the 2015 plan year had ended. In the  other case, the deceased individual received coverage and subsidies for  3 months in 2015 after the reported date of death but the FFM did not  receive the death certificate to verify the death until almost 2 months after  the coverage was terminated. We could not determine the reason the  individual’s coverage had been terminated. According to CMS officials, in  plan year 2015, the FFM received notification of policy termination and  policy end dates from plan issuers but did not always receive information  on the reason coverage was terminated.

When the FFM does not receive sufficient notification of a death, the  policy may be terminated by the issuer for nonpayment, according to  CMS officials. According to HHS regulations, when individuals stop  paying their premiums, such as in the case of death, there is a 3-month  grace period, after which the individuals’ policies would be terminated for  failure to pay premiums retroactively to the last day of the first month of  the grace period. For example, as shown in figure 7, if an individual dies  on February 15 and the premium for the policy is not paid for months after  the individual’s death, the individual would enter a 3-month grace period  covering March, April, and May. The issuer would terminate the policy for  nonpayment on May 31, with a policy end date set retroactively to March  31—the last day of the first month of the grace period. As a result, in  cases in which the policy for a deceased individual is not paid for months  occurring after the individual’s date of death, the deceased individual may  still receive subsidized coverage for 1 full month after the month of death.

However, deceased individuals may receive subsidized coverage beyond  the end of the first month after their date of death if the policy is not  terminated by the issuer for nonpayment of premium. According to CMS  officials, the plan issuer may continue to report a deceased individual as  covered if the premium continues to be paid. For example, another  individual may be authorized to make payments on the policy, such as a  spouse who is also covered by the policy. We identified instances in  which policies continued beyond the end of the first month after the date  of death reported in the full death file, with some policies continuing until  the end of the plan year. In 7 of our 15 sample cases—including one case  in which the applicant was automatically reenrolled for plan year 2015  after his reported date of death in October 2014—the policy continued for  more than 1 complete month in 2015 after the individual’s reported date  of death. In four of the seven sample cases in which coverage  continued beyond the end of the first month after the individual’s death,  the policy also covered the deceased individual’s spouse. In other  instances, an individual may have set up payments covering future  months prior to death. For example, in the case in which the applicant  had been receiving coverage with an associated subsidy in 2014 and was  then automatically reenrolled for plan year 2015 after his reported date of  death in October 2014, the individual received subsidized coverage for  the entirety of plan year 2015. According to CMS officials, the individual  may have set up automated payments to pay the premium.

We recommended in July 2017 that CMS assess and document the  feasibility of approaches for periodically verifying individuals’ continued  eligibility by working with other government agencies to identify changes  in life circumstances that affect APTC eligibility, such as death, that may  occur during the plan year and, if appropriate, design and implement  these verification processes. The agency agreed with the  recommendation and stated that it was exploring approaches to identify  enrollees who may be deceased and should therefore be unenrolled from  coverage. Effectively addressing this recommendation is necessary to  help ensure that the FFM does not provide coverage with associated  subsidies to deceased individuals. However, as of September 2017, CMS  officials could not confirm whether the approaches CMS was exploring  would include rechecking the full death file prior to automatically  reenrolling individuals. Without rechecking the full death file prior to  automatic reenrollment to identify individuals who died during the plan  year, the FFM remains at risk of providing coverage to deceased  individuals, potentially for prolonged periods of time following their deaths,  and of paying APTC to issuers on their behalf that may not be fully  recovered through the reconciliation process.

Effective implementation of PPACA eligibility and enrollment provisions is  a complex undertaking. As subsidies for insurance coverage through the  FFM cost billions of dollars to the federal government annually, effective  controls to ensure that only qualified applicants receive subsidized  coverage under the act are especially important. For plan year 2015, the  FFM generally verified citizenship, status as a national, or lawful presence  and SSN information appropriately, with few indications that individuals  received coverage with an associated subsidy fraudulently or improperly.  However, in some instances, applicant-submitted documentation used to  verify applicant information did not match CMS data. CMS has taken  steps since 2015 to improve verification of applicant information, including  taking steps to improve verification of SSNs using documentation  submitted by applicants and adding capability to modify or update SSNs  in its data system. These procedures and system upgrades, if properly  implemented, should help improve verification of applicant SSNs that  initially did not match SSA records.

Further, while relatively few enrollees reportedly died prior to or during  plan year 2015, some individuals received or maintained coverage with  an associated subsidy after their reported deaths and some individuals  were automatically reenrolled for the 2015 plan year after their reported  death. The FFM checks the full death file prior to initial enrollment, but  does not recheck the full death file to identify enrollee deaths during the  plan year or prior to reenrolling individuals for the following plan year.  Without processes to identify the deaths of enrollees in a timely manner,  including prior to reenrollment for the following plan year, CMS is at risk of  providing additional months of subsidized coverage improperly with  related costs to the federal government. In 2017, we recommended that  CMS assess the feasibility of approaches for periodically verifying  changes, such as death, that affect eligibility for subsidies. Implementing  our 2017 recommendation, and taking the additional step of assessing  whether to check the full death file prior to automatically reenrolling  individuals for the following plan year, could help ensure the FFM is not  paying APTC on behalf of deceased individuals, especially for prolonged  periods following their deaths.

As part of its efforts to assess and document the feasibility of approaches  to identify the deaths of enrollees that may occur during the plan year, the  Administrator of CMS should specifically assess and document the  feasibility of approaches—including rechecking the full death file—to  identify the deaths of individuals prior to automatic reenrollment for  subsequent plan years and, if appropriate, design and implement these  verification processes. (Recommendation 1)

We provided a draft of this product to HHS for comment. In its written  comments, which are reprinted in appendix II, HHS concurred with our  recommendation. HHS also provided technical comments, which we  incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS, and other interested  parties. In addition, the report will be available at no charge on the GAO  website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objective of this review was to examine the extent to which  indications of potentially improper or fraudulent enrollments exist in the  federally facilitated marketplace’s (FFM) application, enrollment, and  eligibility-verification process for the 2015 enrollment period.

To identify indications of potentially improper or fraudulent enrollments in  the FFM’s application, enrollment, and eligibility-verification process, we  reviewed relevant federal statutes, Department of Health and Human  Services (HHS) regulations, and Centers for Medicare & Medicaid  Services (CMS) policies for plan year 2015. We also met with CMS  officials that oversee enrollment into the FFM.

In addition, we obtained and analyzed eligibility and enrollment data for  applicants enrolled from November 15, 2014, through December 31,  2015, and identified about 8.04 million applicants with an associated  subsidy who effectuated enrollments in plan year 2015. For the purposes  of this report, we define applicants receiving coverage with an associated  subsidy as applicants receiving coverage in plan year 2015 with an  associated advance premium tax credit (APTC) or Cost Sharing  Reduction (CSR). The number of applicants receiving coverage with an  associated subsidy and the amount of associated subsidies identified through our analysis may differ from the number of applicants who  ultimately received subsidized coverage and the amount of subsidies  received. In addition, we obtained and analyzed information on  inconsistencies associated with these applicants as of December 31,  2015.

We focused our analyses on three areas based on the eligibility and  verification requirements the FFM must use to determine whether  individuals are eligible to enroll and maintain coverage. Specifically, we  identified and analyzed data for applicants receiving coverage with an  associated subsidy (1) with inconsistencies related to citizenship, status  as a national, or lawful presence; (2) whose information, including Social  Security number (SSN), did not match the Social Security  Administration’s (SSA) records, and (3) who were reportedly deceased.

Applicants who had inconsistencies related to citizenship, status  as a national, or lawful presence. To review applicants with  inconsistencies, we used data from the Department of Homeland  Security’s (DHS) Systematic Alien Verification for Entitlements  (SAVE) system. Specifically, we obtained queries made by the FFM  from November 15, 2014, through December 31, 2015, and compared  them to approximately 961,000 applicants the FFM identified as  having inconsistencies related to citizenship, status as a national, or  lawful presence. For the purposes of this report, we considered  applicants with open inconsistencies related to citizenship, status as a  national, or lawful presence, or SSN, to be potentially improper or  fraudulent. However, the number of potentially improper or fraudulent  applicants may be understated since we did not take into  consideration applicants with expired inconsistencies who may have  continued to receive coverage and had subsidies paid to issuers on  their behalf before CMS was able to terminate their coverage and  subsidies.

Applicants whose information, including SSN, did not match  SSA’s records. To identify applicants whose personal information— name, date of birth, or SSN—did not match SSA’s records, we used  the SSA Enumeration Verification System (EVS) from November 16,  2016, through December 29, 2016, and SSA’s Affordable Care Act  (ACA) batch file from March 2017. Specifically, we processed the  approximately 7.9 million applicants who provided an SSN of the  about 8.04 million total applicants through SSA EVS and the SSA  ACA batch file and analyzed the output codes to determine whether  the information matched SSA’s records. To determine whether the  FFM had also identified an SSN-related inconsistency, we compared  the SSA EVS analysis results to the FFM eligibility information.  Although having an SSN is not a condition of eligibility, we consider  applicants with open SSN inconsistencies to be potentially improper  or fraudulent because open SSN inconsistencies indicate that the  FFM was not able to verify the applicant’s identity information, but the  applicant retained coverage.

Applicants who were reportedly deceased. To identify applicants  who were reportedly deceased prior to or during plan year 2015, we  compared the approximately 7.74 million applicants whose  information matched SSA records of the about 8.04 million total  applicants in the eligibility and enrollment data to the SSA full death  file from June 2016. We matched records using the SSN, name, and  date of birth. We limited our review to those applicants already verified  through SSA EVS. We considered applicants to be potentially  improper or fraudulent if they received or maintained coverage with an  associated subsidy after the date reported in SSA’s full death file as  their date of death.

To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  FFM and other federal data files that we used to perform our work. We  also interviewed officials responsible for their respective databases, and  reviewed documentation related to the databases and literature related to  the quality of the data. On the basis of our own testing and our  discussions with agency officials, we concluded that the data elements  used for this report were sufficiently reliable for our purposes. For  reporting purposes, we present the results of our data-matching analyses  as approximate whole numbers.

To review the results of our matches, we selected a nongeneralizable  sample of 45 applicants that contained

15 cases with inconsistencies related to citizenship, status as a  national, or lawful presence;

15 cases where the applicant SSN information did not match SSA

15 cases where the applicant’s information matched the SSA full  death file.

For all 45 cases, we requested and reviewed copies of available  supporting documentation from CMS. Our review of applicant cases  provides illustrative examples, and the results are not projectable to the  entire population of applicants to the FFM.

Residency. Individuals must intend to reside in the state in which they  are applying for coverage and are not required to have a fixed  address in the state. The marketplace can accept self-attestation  unless the information provided by the applicant is not reasonably  compatible with other information provided by the applicant or in the  records of the marketplace. HHS has recently stated that its previous  assessments of available sources did not identify any comprehensive  data source for verifying residency. However, we previously reported  that CMS did not document an evaluation of available external  sources to determine the quality, relevance, and reliability of the data,  and recommended that it do so.

Incarceration. Individuals must not be incarcerated (unless  incarcerated while awaiting disposition of charges). We have  previously reported that there are many challenges associated with  using incarceration data, including the risk of false positives.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, the following staff members  made key contributions to this report: Philip Reiff, Assistant Director; Colin  Fallon; Suellen Foth; Kristen Juskiewicz; Maria McMullen; Madeline  Messick; James Murphy; Ariel Vega; Erin McLaughlin Villas; and  Elizabeth Wood.

Stated Health-Insurance Marketplaces: Three States Used Varied Data  Sources for Eligibility and Had Few Indications of Potentially Improper  Enrollments. GAO-17-694. Washington, D.C.: September 7, 2017.

Improper Payments: Improvements Needed in CMS and IRS Controls  over Health Insurance Premium Tax Credit. GAO-17-467. Washington,  D.C.: July 13, 2017.

Patient Protection and Affordable Care Act: Results of Enrollment Testing  for the 2016 Special Enrollment Period. GAO-17-78. Washington, D.C.:  November 17, 2016.

Patient Protection and Affordable Care Act: Results of Undercover  Enrollment Testing for the Federal Marketplace and a Selected State  Marketplace for the 2016 Coverage Year. GAO-16-784. Washington,  D.C.: September 12, 2016.

Patient Protection and Affordable Care Act: Most Enrollees Reported  Satisfaction with Their Health Plans, Although Some Concerns Exist.  GAO-16-761. Washington, D.C.: September 12, 2016.

Patient Protection and Affordable Care Act: Final Results of Undercover  Testing of the Federal Marketplace and Selected State Marketplaces for  Coverage Year 2015. GAO-16-792. Washington, D.C.: September 9,  2016.

Patient Protection and Affordable Care Act: CMS Should Act to  Strengthen Enrollment Controls and Manage Fraud Risk. GAO-16-29.  Washington, D.C.: February 23, 2016.

Patient Protection and Affordable Care Act: Preliminary Results of  Undercover Testing of the Federal Marketplace and Selected State  Marketplaces for Coverage Year 2015. GAO-16-159T. Washington, D.C.:  October 23, 2015.

Patient Protection and Affordable Care Act: IRS Needs to Strengthen  Oversight of Tax Provisions for Individuals. GAO-15-540. Washington,  D.C.: July 29, 2015.

Patient Protection and Affordable Care Act: Observations on 18  Undercover Tests of Enrollment Controls for Health-Care Coverage and  Consumer Subsidies Provided under the Act. GAO-15-702T. Washington,  D.C.: July 16, 2015.

Patient Protection and Affordable Care Act: Status of CMS Efforts to  Establish Federally Facilitated Health Insurance Exchanges.  GAO-13-601. Washington, D.C.: June 19, 2013.