Medicaid Managed Care: Improvements Needed to Better Oversee Payment Risks

Federal spending on services paid for under Medicaid managed care was $171 billion in 2017, almost half of the total federal Medicaid expenditures for that year. Federal and state program integrity efforts have largely focused on Medicaid fee-for-service delivery where the state pays providers directly, rather than managed care, where it pays MCOs. As a result, less is known about the types of payment risks under managed care.

GAO was asked to examine payment risks in Medicaid managed care. In this report, GAO (1) identified payment risks; (2) identified any challenges to state oversight and strategies to address them; and (3) assessed CMS efforts to help states address payment risks and oversight challenges. To do this work, GAO reviewed findings on managed care payment risks and oversight challenges from federal and state audits and other sources. GAO also interviewed 49 state program integrity stakeholders in 10 states selected based on size, the percent of population in managed care, and geography. Stakeholders included the state Medicaid managed care office, state Medicaid program integrity unit, state auditor, Medicaid Fraud Control Unit, and an MCO.

Under Medicaid managed care, managed care organizations (MCO) receive a periodic payment per beneficiary in order to provide health care services. Managed care has the potential to help states reduce Medicaid program costs and better manage the use of health care services. However, managed care payments also have the potential to create program integrity risks. GAO identified six types of payment risks associated with managed care, including four related to payments that state Medicaid agencies make to MCOs, and two related to payments that MCOs make to providers. Of the six payment risks GAO identified, state stakeholders responsible for ensuring Medicaid program integrity more often cited the following two as having a higher level of risk:

incorrect fee-for-service payments from MCOs, where the MCO paid providers for improper claims, such as claims for services not provided; and

inaccurate state payments to MCOs resulting from using data that are not accurate or including costs that should be excluded in setting payment rates.

GAO also identified multiple challenges to program integrity oversight for managed care programs. Stakeholders most frequently cited challenges related to (1) appropriate allocation of resources, (2) quality of the data and technology used, and (3) adequacy of state policies and practices. Some stakeholders offered strategies to address these challenges, including collaborating with other entities to identify problem providers and fraud schemes, as well as having effective data systems to better manage risks.

The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has initiated efforts to assist states with program integrity oversight for managed care. However, some of these efforts have been delayed, and there are also gaps in oversight.

CMS's planned Medicaid managed care guidance to states has been delayed due to the agency's internal review of the regulations; as of May 2018, no issuance date had been set for the guidance.

CMS established a new approach for conducting managed care audits beginning in 2016. However, only a few audits have been conducted, with none initiated in the past 2 years. In part, this is due to certain impediments identified by states, such as the lack of some provisions in MCO contracts.

CMS has updated standards for its periodic reviews of the state capitation rates set for MCOs. However, overpayments to providers by MCOs are not consistently accounted for in determining future state payments to MCOs, which can result in states' payments to MCOs being too high.

Lack of guidance and gaps in program integrity oversight are inconsistent with federal internal control standards, as well as with CMS's goals to (1) improve states' oversight of managed care; (2) use audits to investigate fraud, waste, and abuse of providers paid by MCOs; and (3) hold MCOs financially accountable. Without taking action to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will help mitigate payment risks in Medicaid managed care.

GAO recommends that CMS (1) expedite issuing planned guidance on Medicaid managed care program integrity, (2) address impediments to managed care audits, and (3) ensure states account for overpayments in setting future MCO payment rates. The Department of Health and Human Services concurred with these recommendations.

Federal spending on services delivered and paid for under Medicaid  managed care totaled $171 billion in 2017, almost half of the total $364  billion in federal Medicaid expenditures for that year. Under Medicaid  managed care, states pay a set periodic amount per beneficiary to  managed care organizations (MCO) for each enrolled beneficiary, and  MCOs pay health care providers for the services delivered to enrollees.  Used effectively, managed care may help states reduce Medicaid  program costs and better manage utilization of health care services.

The Centers for Medicare & Medicaid Services (CMS)—an agency within  the Department of Health and Human Services (HHS)—and the states  have implemented program integrity policies and processes in an effort to  address payment risks in Medicaid, such as those related to fraud, waste,  and abuse. However, these program integrity efforts have remained  largely focused on fee-for-service arrangements, where states pay health  care providers directly for services rendered. Payments for these services  provided under fee-for-service arrangements are audited by multiple entities and reviewed for incorrect or fraudulent patterns at the federal  and state levels. In contrast, under managed care, states do not pay  providers directly, but rather pay MCOs, which are responsible for  providing services through their provider networks; MCOs are responsible  for overseeing the appropriateness of the payments they make to  providers. Less is known about the types of Medicaid payment risks and  the program integrity process and challenges under managed care. We  recently reported on certain payment risks in Medicaid managed care that  are not adequately accounted for in determining the scope of Medicaid  improper payments to MCOs. This lack of knowledge is of particular  concern, given the recent rapid growth in enrollment in Medicaid  managed care. Between 2013 and 2016 (the most recent year for which  data are available), Medicaid enrollment in comprehensive, risk-based  managed care increased by 56 percent, or from 35.0 million beneficiaries  to 54.6 million beneficiaries.

You asked us to identify payment risks and oversight challenges  associated with Medicaid managed care. In this report, we  1.  identify any potential payment risks that exist in Medicaid managed  2.  identify any potential oversight challenges associated with identified  payment risks, and the strategies states use to address them; and  3.  assess CMS’s efforts to assist states in addressing these payment  risks and associated oversight challenges.

To address the first two objectives, we first reviewed reports resulting  from federal and state audits and investigations, regarding payment risks  and improper payments in Medicaid managed care and managed care in  general. Through a literature search and outreach to state auditing  organizations, we identified and reviewed audit reports of Medicaid  managed care programs—such as those issued by HHS’s Office of  Inspector General (HHS-OIG) and state audit agencies—as well as  investigations involving payments to MCOs and MCO providers. We also  reviewed our prior work and reports related to Medicaid program integrity.  Based on this review, we identified different types of payment risks, as  well as reported challenges to program integrity oversight of these risks.  We next interviewed officials from a non-generalizable sample of 10  states regarding their views about the level of risk of each type of  payment risk; the extent they experienced the challenges to oversight;  and whether they had used any oversight strategies to address Medicaid  managed care payment risks. We selected states that had a significant  share of their Medicaid populations enrolled in MCOs, and to provide a  mix of population sizes and geographic locations. Within each state, we  conducted structured interviews with a total of 49 stakeholders from the  following five entities that have oversight responsibilities related to  Medicaid program integrity: (1) the state Medicaid managed care office;  (2) the state Medicaid program integrity unit; (3) the state auditor; (4) the  state Medicaid Fraud Control Unit (MFCU); and (5) an MCO.

To assess CMS’s efforts to assist states in addressing these payment  risks and associated oversight challenges, we reviewed CMS’s managed  care regulations and guidance; current program integrity plan; and  documents relating to training, technical assistance, monitoring and  oversight. We conducted interviews with CMS officials and CMS audit  contractors regarding their roles, responsibilities, and oversight activities.  Additionally, we reviewed our prior work related to program integrity risks  in Medicaid managed care and identified applicable federal internal  control standards—specifically those related to communicating guidance  and to conducting effective monitoring—that we could use to assess  CMS’s efforts.

We conducted this performance audit from October 2016 to July 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Medicaid is jointly financed by the federal government and the states, with  the federal government reimbursing states for a share of their  expenditures for Medicaid covered services provided to eligible  beneficiaries. The federal share of spending is based on a statutory  formula that determines a federal matching rate for each state.

States may provide Medicaid services under either or both a fee-for- service model and a managed care model. Under a fee-for-service  delivery model, states make payments directly to providers for services  provided, and the federal government reimburses the state its share of  spending based on these payments. Under a managed care service  delivery model, states pay MCOs a capitation payment, which is a fixed  periodic payment per beneficiary enrolled in an MCO—typically, per  member per month. The federal government reimburses its share of  spending based on the capitation payments states made to the MCO. In  return for the capitated payment, each MCO is responsible for arranging  for and paying providers’ claims for all covered services provided to  Medicaid beneficiaries. For example, MCOs may pay providers on a fee- for-service basis or with a monthly capitation payment per beneficiary, or  through some other payment approach in which the provider assumes  some risk for providing covered services. In either case, MCOs are  required to report to the states information on services utilized by  Medicaid beneficiaries—information typically referred to as encounter  data. Figure 1 illustrates these models.

State and MCO Program Integrity Responsibilities

Program integrity refers to the proper management and function of the  Medicaid program to ensure that quality and efficient care is being  provided, while Medicaid payments are used appropriately and with  minimal waste. Program integrity efforts encompass a variety of  administrative, review, and law enforcement strategies.

State stakeholders—Medicaid managed care offices, state Medicaid  program integrity units, Medicaid Fraud Control Units (MFCUs), and in  many cases state auditors—and MCO stakeholders—MCOs that contract  with states to deliver Medicaid services—play important roles in the  oversight of managed care payment risks and have a variety of program  integrity responsibilities. A stakeholder’s program integrity responsibilities  can be specialized—such as for MFCUs, which focus on fraudulent  behavior—or varied—such as for state Medicaid managed care offices  and MCOs, which are responsible for monitoring fraud and other issues,  such as compliance with quality standards or ensuring MCOs meet  contract requirements. (See table 1.)

Two of the stakeholders—state Medicaid managed care offices and  MCOs—have responsibilities for program operation in addition to program  integrity oversight responsibilities. For example, state Medicaid managed  care offices’ program operations responsibilities include enrolling  beneficiaries, negotiating contracts with MCOs, developing capitation  rates, and making monthly capitation payments to MCOs. MCOs’  program operation responsibilities include establishing contracts with  providers, creating provider networks, ensuring that enrollees have an  ongoing source of primary care and timely access to needed services,  and processing and paying provider claims.

In a previous report, we found that state Medicaid program integrity  efforts focus primarily on payments and services delivered under fee-for- service, and do not closely examine program integrity in managed care.  For example, officials from five of seven states that we spoke to for that  report said that they primarily focused their program integrity efforts on  fee-for-service claims. They also noted that program integrity in Medicaid  managed care was more complex than for fee-for-service.

CMS’s Program Integrity Responsibilities

CMS’s program integrity responsibilities take a variety of forms. CMS  issues program requirements for states through regulations and  guidance; for example, regulations requiring states to establish actuarially  sound capitation rates and to ensure that MCOs have an adequate  network of providers, as well as to ensure that all covered services are  available and accessible to beneficiaries in a timely manner. CMS also  requires states to submit MCO contracts and capitation rates to CMS for  review and approval, and report key information such as encounter data  collected from MCOs. The agency provides technical assistance and  educational support to states, including having staff available to help  states with specific issues or questions, and providing courses on  program integrity issues. The agency also conducts periodic reviews to  assess state program integrity policies, processes, and capabilities. In  addition, CMS has engaged audit contractors to help states audit  providers receiving Medicaid payments, including payments made by  MCOs to providers.

Six Types of Payment Risks Exist for Managed Care, with Stakeholders Viewing Some Risks as Greater than Others

We identified six types of payment risks through our review of Medicaid  audit reports and other sources. Most of the stakeholders we spoke to  agreed that these payment risks exist in Medicaid managed care. Four of  these risks relate to the payments state Medicaid agencies make to  MCOs, and two relate to payments that MCOs make to providers. (See  figs. 2 and 3.)

In terms of the relative importance of these payment risks, two payment  risks were more frequently cited by stakeholders as having a higher level  of risk than other types—incorrect MCO fee-for-service payments to  providers and inaccurate state capitation rates. The remaining four  payment risks were more frequently cited as having lower or unknown  levels of risk: improper state capitation payments, state payments to  noncompliant MCOs, incorrect MCO capitation payments, and duplicate  state payments. (See fig. 4.) When we asked stakeholders to designate a  level of risk, stakeholders whose primary responsibility is program  integrity—state auditors, MFCU officials, and state Medicaid program  integrity staff—were more likely to assign a higher level of risk for certain  types of payment risks than state Medicaid managed care officials and  MCO officials. (See app. I for additional information on risk level  designation by stakeholder group.)

Stakeholders provided the following examples of payment risks that they  rated as having “some” or “high” risk in the state. (See table 2.) See  appendix II for further examples of payment risks identified as part of our  review of audits and other reports.

Multiple Challenges Exist for Effective Program Integrity Oversight and Stakeholders Identified Strategies to Address Them Key Challenges to Oversight Included Resource Allocation, the Quality of Data and Technology, and the Adequacy of State Policies and Practices

We identified six challenges to effective program integrity oversight in  Medicaid managed care based on our review of Medicaid audit reports  and other sources. Among these six challenges, stakeholders most  frequently cited allocation of resources, quality of data and technology,  and adequacy of state policies and practices as key challenges. Some  stakeholders also described strategies to address these challenges.

Through our research on examples of payment risks in Medicaid  managed care, we identified six areas that can present challenges to  program integrity oversight, including (1) availability and allocation of  resources; (2) access to and quality of data and technology; (3) state  policies and practices; (4) provider compliance with program  requirements; (5) MCO management of program integrity; and (6) federal  regulations, guidance, and review. Allocation of resources, quality of data  and technology, and state policies and practices were the three most  commonly cited challenges to program integrity oversight by  stakeholders. (See fig. 5.)

Stakeholders described the following examples of challenges to program  integrity oversight they had observed. See appendix III for more  information on the particular challenges for each of the payment risks.

Availability and allocation of resources. Stakeholders who cited  resource allocation as an oversight challenge to managed care cited  several key issues, such as the number of staff allocated to an activity,  the expertise needed, and the ability to retain and replace staff. (See  table 3.) Some stakeholders identified resource issues within their own  organizations, while some identified resource issues they said existed in  other organizations.

Access to and quality of data and technology. Stakeholders who cited  the quality of data and technology as oversight challenges to managed  care provided examples related to timely access to data, inaccurate and  unreliable data, and problems with information systems and interfaces.  (See table 4.)

State policies and practices. Stakeholders who cited state policies and  practices as an oversight challenge to managed care described  insufficient contract requirements, lack of state monitoring, and problems  with state oversight. (See table 5.) Stakeholders from the state program  integrity office, the MFCU, and the state auditor’s office more frequently  identified state policies and practices as a challenge than stakeholders  from the state Medicaid managed care agency.

MCO management of program integrity. Stakeholders who cited MCO  management as an oversight challenge to managed care described how  inadequate MCO oversight and monitoring—as well as incomplete MCO  reporting to the state agency—can increase the risk of different types of  payment risks. (See table 6.) Stakeholders from the state Medicaid  managed care agency, the state program integrity office, and the MFCU  were more likely than MCO stakeholders to cite these issues as  challenges. In particular, a few state officials noted that there was  variation in size and resources among the MCOs in their respective  states.

Provider compliance with program requirements. Stakeholders who  cited provider compliance as a challenge to oversight indicated that  providers are the primary source of inaccurate payments, because of  improper billing, which may include fraudulent billing. These stakeholders  also stated that some types of providers presented a higher risk than  others in their state. Several stakeholders pointed out that certain  providers intentionally commit fraud, while others may be unaware of  changes in policies or procedures and therefore unintentionally submit  inaccurate claims. Several stakeholders noted that it is the responsibility  of providers to bill correctly, while a few others pointed out that because  the payment process is complicated, MCOs and state agencies may not  identify inaccurate payments. Stakeholders also selected from a list of 19  types of providers the 3 or 4 that in their view represented the highest  payment risks in the state. The two most frequently mentioned health  care providers or services were (1) durable medical equipment, and (2)  psychiatric and behavioral health care providers. (See table 7.)

Federal regulations, guidance, and review. Over half of the  stakeholders who identified federal regulations, guidance, and review as  oversight challenges to managed care cited the complexity of federal  regulations and the lack of federal guidance as key issues. For example,  one stakeholder said that there needed to be more clarity about the new  regulations for setting capitation rates for MCOs, while another said that  there was a lack of clarity about the respective roles of states and MCOs  in program integrity oversight. One stakeholder noted that most of the  responsibility for operating the Medicaid program lies with the state, not  with the federal government.

Strategies Identified by Stakeholders to Address Managed Care Oversight Challenges Included Ensuring High Quality Data and Collaboration among State Agencies and MCOs

Some stakeholders we interviewed identified strategies, controls, or best  practices to address the challenges to oversight of Medicaid managed  care payment risks. As shown in table 8, they identified a variety of  strategies such as ensuring high quality data, collaboration among state  agencies and MCOs, imposing sanctions on noncompliant MCOs,  enhancing contract requirements, and conducting regular monitoring.

CMS Has Assisted States in Addressing Payment Risks, but Some Efforts Have Been Delayed and There Are Gaps in Oversight

CMS has taken important steps to address payment risks in Medicaid  managed care, issuing a final rule, increasing guidance, and conducting  oversight activities. However, some efforts are incomplete, and there are  gaps in key oversight activities.

CMS Issued a Final Rule, Provided Additional Guidance, and Updated Certain Oversight Activities Related to Managed Care Program Integrity

In May 2016, CMS issued a final rule on Medicaid managed care.  According to CMS, the rule is intended to enhance regulatory provisions  related to program integrity and payment risks, among other things.  These regulatory provisions varied in terms of when the requirements  were applicable. For example, for contracts beginning on or after July 1,  2017, the rule requires  state contracts with MCOs to require MCOs to promptly report all  overpayments made to providers, and to specify the  overpayments due to potential fraud;   states to account for overpayments when setting capitation  payment amounts;  and  states to establish procedures and quality assurance protocols to  ensure that MCOs submit encounter data that is complete and  accurate.

These requirements have the potential to enhance MCO and state  oversight of managed care, and address payment risks involving incorrect  MCO payments to providers and inaccurate state capitation rates for  MCOs. CMS is currently reviewing the rule for possible revision of its  requirements and an announcement on the results of the review is  expected in 2018.

Most stakeholders we spoke to identified ways in which the managed  care rule could have a positive impact on managed care program integrity oversight. Of the 49 stakeholders we spoke to, 28 made positive  statements about the rule’s potential impact on program integrity  oversight of payment risks in managed care, 9 stakeholders said they  were not familiar enough with the managed care rule to comment on it,  and the remaining 12 stakeholders provided a range of comments about  the rule. The 28 stakeholders with positive comments identified a variety  of ways in which they said the managed care rule would help, including establishing transparency in setting state capitation rates; providing clear guidelines for MCO reporting, and clear authority  for states to require reporting; obtaining information on overpayments identified and collected by holding MCO leadership accountable for meeting program  reducing medical costs, despite additional short-term  administrative costs.

Comments by the other 12 stakeholders who were familiar with  the rule included statements that the rule  should have been more aggressive in requiring MCOs to  implement efforts related to program integrity; would have limited impact for them, because many of its  requirements were already in place in their state; and  set time frames for implementation that were hard to meet.

In addition to issuing the rule, CMS has sought to increase guidance  available to states through training, technical assistance, and other  educational resources. (See table 9.)

Lastly, CMS efforts have included updating the requirements used in  capitation rate setting reviews, contract oversight, and other types of  audits and reviews, as described below.

Review of state capitation rates for Medicaid MCOs. CMS  reviews states’ capitation rates at least once every year, and in  2017 made revisions to its rate review guidance to states,  incorporating new requirements from the managed care rule.  According to CMS officials, the agency typically conducts between  250 and 300 rate reviews annually to determine whether states’  rate development methodologies meet generally accepted  actuarial principles, as well as federal laws and requirements.

Review of state Medicaid MCO contracts. CMS regularly  reviews state contracts with MCOs to ensure that contract  provisions meet federal requirements. In 2017, CMS updated its  criteria for Medicaid managed care contract review and approval,  and revised the guide that it provides to states to help them  develop effective MCO contracts.

CMS contracted audits. In 2016, CMS began to transition and  consolidate audits of providers to a type of contractor called  Unified Program Integrity Contractors (UPIC). This transition is  intended to integrate contracted audit activities across CMS health  care programs, such as Medicaid and Medicare, according to  CMS. Additionally, UPIC audits can include health care providers  who participate in multiple federal programs. Within the Medicaid  program, UPICs may conduct audits with states interested in  pursuing what are called “collaborative audits.” CMS’s contract  with UPICs allows for audits of providers in MCO networks.

Focused program integrity reviews. CMS officials said that in  2016, the agency updated the review guide used to conduct  focused program integrity reviews of state Medicaid managed  care programs. CMS program integrity reviews have identified  some common issues, such as a low number of investigations of  overpayments conducted by managed care plans and a low  amount of recoveries by plans. However, CMS officials stated  these reviews are not focused primarily on assessing specific  payment risks. For example, these reviews do not involve an  actual review or audit of MCO payments to providers to assess  the extent that inaccurate payments were made. Instead, they  review program integrity policies and processes, such as whether  and how the state monitors overpayments, and whether MCOs  comply with state requirements.

CMS Efforts to Address Payment Risks Have Been Delayed and Gaps Exist in Key Oversight Activities.

Despite CMS’s efforts to improve oversight of program integrity in  Medicaid managed care, there have been delays in issuing guidance, and  gaps in key auditing and monitoring activities. These delays and gaps are  inconsistent with the agency’s current program integrity plan, which  established goals for improving state oversight of program integrity in  Medicaid managed care, as well as the financial accountability of  Medicaid MCOs.

Delays in the Development and Issuance of Guidance

Publication of CMS guidance that would assist states in oversight of  payment risks has been delayed. CMS officials told us in April 2017 that  they planned to issue a compendium of guidance related to the managed  care rule’s program integrity regulations. The compendium is intended to  provide guidance on (1) MCO program integrity requirements, (2) state  audits of MCO encounter data that must be conducted at least every 3  years, and (3) MCO overpayments to providers. However, in September  2017, CMS officials told us that although they had a draft of the  compendium, they did not have a timeline for issuing it, because the  managed care rule was under review. As of May 2018, no issuance date has been set for the guidance. Over half of the stakeholders we  interviewed who identified federal responsibilities as an oversight  challenge to managed care cited the complexity of federal regulations and  the lack of federal guidance as key issues. The lack of available federal  guidance resulting from delays in issuing such guidance is inconsistent  with federal internal control standards that call for federal agencies to  communicate quality information to those responsible for program  implementation for the purposes of achieving program objectives and  addressing program risks. Until such guidance is issued, stakeholders’  ability to effectively address challenges to payment risks in Medicaid  managed care will continue to be hindered.

Although audits of providers that bill and are paid by MCOs can provide  important information about payment risks and are included in the UPIC  statement of work, only 14 of the 762 audits initiated by CMS contractors  during the period of fiscal year 2014 through 2017 were managed care  audits. Our review of three CMS contracted managed care audits  indicated that the amount of inaccurate MCO payments to providers—as  well as MCO and provider noncompliance with contracts—can be  significant. For example, one audit of an MCO’s payments to selected  providers found that 8.94 percent of payments were in error, representing  over $4 million in overpayments for a 6-month period. This audit also  identified a lack of provider compliance with requirements to provide  preventive care services and care coordination to members, and a lack of  MCO compliance with requirements to monitor member enrollment,  resulting in the MCO paying providers for individuals who were not  enrolled.

CMS officials shared plans to increase collaborative audits in managed  care in the future. CMS officials said the agency is in the early planning  stages to pilot an audit of MCO providers in one state, with the goal of  addressing challenges encountered in prior managed care audits. CMS is  also in discussions with states and audit contractors to conduct potential  audits and investigations in fiscal years 2018 and 2019.

However, CMS and audit contractor officials identified several  circumstances related to states’ contracts with MCOs that they said have  created gaps in their auditing activity.

According to CMS officials, states have reported a reluctance to  conduct provider audits when states’ contracts with MCOs (1)  allow the MCO to retain identified overpayments, or (2) do not  explicitly discuss how identified overpayments are addressed.

Officials with the two operating UPICs told us that CMS’s general  guidance to them was to restrict their audits to states with MCO  contracts where the states can recoup overpayments from the  MCOs.  According to one contractor, because few states have  such contracts, the vast majority of the contractors’ audits are of  providers paid on a fee-for-service basis. However, overpayments  to providers can affect state and federal expenditures regardless  of a state’s particular recoupment policy, because if they are not  accounted for, they may increase future capitation rates paid to  MCOs.

Audit contractor officials also said the lack of access to MCO  coverage and policy materials, and the inability to directly access  encounter or claims data, prevent them from doing analyses to  identify potential provider fraud, abuse, and waste for  investigation.

While CMS officials said they encourage states to participate in additional  collaborative audits of managed care, they did not identify steps the agency  is taking to address the circumstances that limit collaborative audits  conducted. The lack of sufficient auditing in managed care is inconsistent  with federal internal control standards that require federal agencies to identify  risks through such activities as auditing.

CMS has incomplete information on the scope and extent of MCO  overpayments to providers, which results in a gap in monitoring MCO  payments. Gaps in monitoring also exist because CMS lacks a process  for consistently collecting information about overpayments and  documenting that states account for overpayments when setting  capitation rates. A few examples of these issues include the following:

While CMS regularly reviews states’ proposed capitation rates, it  lacks a process to consistently ensure any overpayments are  accounted for by the states. According to an official with CMS’s  Office of the Actuary, their review of state capitation rates does  not require documentation of the amount of overpayments that  occurred the prior year, how they were determined, or how they  were incorporated into setting capitation rates. According to this  official, issues between states and MCOs—such as contractual  issues related to how overpayments are handled—are beyond the  scope of their review and responsibilities. However, such  information could be important to program integrity oversight; for  example, 11 stakeholders we interviewed said that state capitation  rates did not account for overpayments, because they had  observed that overpayments were not reported by MCOs, were  not monitored by the state, or both.

Although some of CMS’s focused program integrity reviews have  suggested that there is under-reporting of MCO overpayments to  providers, CMS officials explained that these reviews are intended  to assess state compliance with regulations, and not to determine  the extent of under-reporting or why overpayments are under- reported.

States’ and CMS’s contracted auditors have conducted only a few  collaborative audits in managed care, even though such audits  can identify overpayments made by MCOs to providers.

These gaps in monitoring of overpayments are inconsistent with federal  internal control standards that require federal agencies to monitor  operating effectiveness through audits and reviews. Without more  complete information on the extent of overpayments and a process to  ensure they are accounted for in state capitation rates, CMS is unable to  ensure that MCOs are effectively identifying overpayments and  documenting that they are accounted for when reviewing and approving  state capitation rates. As a result, CMS cannot be sure that states are  holding MCOs financially accountable for making proper payments, that  states are paying accurate capitation payments to MCOs, or that the  federal government’s share of Medicaid expenditures is accurate.

Managed care has the potential to help states reduce Medicaid program  costs and better manage utilization of health care services. However,  oversight of managed care is critical to achieving these goals. Payment  risks are not eliminated under managed care; in fact, they are more  complex and difficult to oversee. While CMS has taken important steps to  improve program integrity in managed care—including strengthening  regulations, developing guidance for states on provider enrollment in  Medicaid managed care, and beginning to include managed care in the  monitoring and auditing process—the efforts remain incomplete, because  of delays and limited implementation. To date, CMS has not issued its  planned compendium with guidance on program integrity in Medicaid  managed care, taken steps to address known factors limiting  collaborative audits, or developed a process to help ensure that  overpayments to providers are identified by the states. Without taking  actions to address these issues, CMS is missing an opportunity to  develop more robust program integrity safeguards that will best mitigate  payment risks in managed care.

We are making the following three recommendations to CMS:

The Administrator of CMS should expedite the planned efforts to  communicate guidance, such as its compendium on Medicaid  managed care program integrity, to state stakeholders related to  Medicaid managed care program integrity. (Recommendation 1)

The Administrator of CMS should eliminate impediments to  collaborative audits in managed care conducted by audit  contractors and states, by ensuring that managed care audits are  conducted regardless of which entity—the state or the managed  care organization—recoups any identified overpayments.  (Recommendation 2)

The Administrator of CMS should require states to report and  document the amount of MCO overpayments to providers and  how they are accounted for in capitation rate-setting.  (Recommendation 3)

We provided a draft of this product to the Department of Health and  Human Services for comment.  HHS concurred with these  recommendations, stating that it is committed to Medicaid program  integrity.  HHS also cited examples of activities underway to improve  oversight of the Medicaid program, such as training offered through the  Medicaid Integrity Institute, and guidance provided in the Medicaid  Provider Enrollment Compendium. The full text of HHS’s comments is  reproduced in appendix IV.  HHS also provided technical comments,  which we incorporated as appropriate.

We are sending copies of this report to the Secretary of Health and  Human Services and the Administrator of CMS. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff that made key contributions to  this report are listed in appendix V.

Appendix I: Risk Level Designations by Stakeholder Group

We asked stakeholders involved in program integrity oversight to assign a  level of risk—either low, some, or high—to six types of payment risks in  Medicaid managed care. We interviewed officials in the following five  organizations in each of 10 states: state Medicaid managed care office,  state program integrity unit, Medicaid Fraud Control Unit (MFCU), state  auditor’s office, and a managed care organization (MCO). (See table 1  for a description of each of these entities.) Figures 6 through 9 below  illustrate the risk level stakeholders assigned to the four types of payment  risk that are associated with states’ periodic capitation payments to  MCOs. Figures 10 and 11 illustrate the risk level stakeholders assigned  the two types of payment risks associated with MCO payments to  providers. In some cases, stakeholders said they did not have enough  information to assign a level of risk (“Don’t know”) or that one of the  payment risks did not apply in their state (“Not applicable”).

For some payment risks, the stakeholders whose primary responsibility is  program integrity—state auditors, MFCU officials, and state Medicaid  program integrity staff—were more likely to assign a higher level of risk  than state Medicaid managed care officials and MCO officials who have  responsibilities both for program operation and program integrity. For  example, some of the risk levels cited in our interviews by state auditors,  MFCU officials, and state Medicaid program integrity staff included the  following:

State auditors most frequently cited improper state capitation  payments as high risk in the state.

Three state auditors identified duplicate state payments as high  risk.

Just over half of all state auditors, MFCU officials, and state  Medicaid program integrity staff identified inaccurate state  capitation rates as some or high risk.

In contrast, state Medicaid managed care officials and MCO officials were  less likely to assign high risk to payment types. Some examples include  the following:

No state Medicaid managed care officials cited a high level of risk  for any of the six payment types.

Two MCO officials cited a high level of risk for incorrect MCO fee- for-service payments. No other MCO officials cited a high level of  risk for any of the other payment types.

Stakeholder views on the risk level of different payment risks are outlined  in the figures that follow.

Improper state capitation payments may occur when the state makes  monthly capitation payments to an MCO for beneficiaries who are  ineligible for or not enrolled in Medicaid, or who have died. (See fig. 6.)

Inaccurate state capitation rates occur when a state established a  capitation rate that is inaccurate primarily due to issues with the data  used to set the rates. Data issues could include inaccurate encounter  data, unallowable costs, overpayments that are not adjusted for in the  rate, or older data that do not reflect changes in care delivery practices  that affect MCO costs. (See fig. 7.)

State payments to noncompliant MCOs occur when a state pays MCOs a  periodic capitation per beneficiary even though the MCO has not fulfilled  state contract requirements. Examples of unfulfilled contract requirements  include an MCO failing to establish an adequate provider network,  reporting inaccurate encounter data for services, or failing to report the  amount of overpayments the MCO has made to providers. (See fig. 8.)

Duplicate state payments to an MCO occur when a health care provider  submits a fee-for-service claim to the state Medicaid program for services  that were covered under the MCO contract. (See fig. 9.)

Incorrect MCO fee-for-service payments occur when the MCO pays  providers for improper claims, such as claims for services (1) not  provided, or provided by ineligible providers; or (2) that represent  inappropriate billing, such as billing individually for bundled services or for  a higher intensity of services than needed. (See fig. 10.)

Incorrect MCO capitation payments occur when MCOs pay providers a  periodic fixed payment without assurances they have provided needed  services. (See fig. 11.)

Appendix II: Examples of Different Types of Payment Risks in Medicaid Managed Care

To identify examples of payment risks in Medicaid managed care, we  reviewed Department of Health and Human Services’ (HHS) Office of  Inspector General (HHS-OIG) publications and our prior work; obtained  input from the National State Auditor’s Association; and conducted  literature searches and key word searches of online databases, which  identified additional state audits and investigations involving Medicaid  managed care payment. We grouped these examples of payment risks  into six broad categories or types based on similar key characteristics.  Tables 10 through 15 provide examples of each of the six types of  payment risks we identified: (1) improper state capitation payments,  which are state capitation payments to MCOs for ineligible or deceased  individuals; (2) inaccurate state capitation rates; (3) state payments to  non-compliant managed care organizations (MCO); (4) duplicate state  payments to MCOs and providers; (5) incorrect MCO fee-for-service  payments to providers; and (6) incorrect MCO capitation payments to  providers that have not complied with program requirements.

Appendix III: Challenges to Effective Program Integrity Oversight in Medicaid Managed Care

We asked 49 stakeholders involved in program integrity oversight to  consider the following six challenges to effective program integrity  oversight: (1) availability and allocation of resources; (2) access to and  quality of data and technology; (3) state policies and practices; (4)  provider compliance with program requirements; (5) managed care  organization (MCO) management of program integrity; and (6) federal  regulations, guidance, and review. Stakeholders were asked whether  any of these presented a challenge to each of six types of payment risks  in Medicaid managed care in their state, including (1) improper state  capitation payments to MCOs for ineligible or deceased individuals; (2)  inaccurate state capitation rates; (3) state payments to MCOs that have  not fulfilled contract requirements; (4) state duplicate payments to MCOs  and providers; (5) incorrect MCO fee-for-service payments to providers  for improper claims; and (6) incorrect MCO capitation payments to  providers that have not complied with program requirements.

Figure 12 illustrates the number of times stakeholders cited a particular  challenge for each of the payment risks. The frequency with which each  of the challenges was identified differed to some extent for different  payment risks. Some examples include the following:

Quality of data and technology was the most cited challenge for  duplicate state payments.

State policies and practices was the most cited challenge for  inaccurate state capitation rates.

Provider compliance with program requirements was the most  cited challenge for two payment types: (1) incorrect MCO fee-for- service payments to providers, and (2) incorrect MCO capitation  payments to providers.

Resource allocation was the second most cited challenge for five  of the six payment risk types, although it was not the most cited  challenge for any one payment risk type.

Appendix IV: Comments from the Department of Health and Human Services

In addition to the contact name above, Tim Bushfield (Assistant Director),  Mary Giffin (Analyst-in-Charge), Arushi Kumar, Julie Flowers, Drew Long,  Vikki Porter, Katie Thomson made key contributions to this report. Other  staff who made contributions to the report were Jessica Broadus, Barbie  Hansen and Erika Huber.

Almost half—$171 billion—of Medicaid spending in 2017 went to managed care organizations (MCO). In Medicaid managed care, states pay a set periodic amount to MCOs for each enrollee, and MCOs pay health care providers for the services delivered to enrollees.

Used effectively, managed care can help states reduce Medicaid costs. However, managed care still is at risk of making incorrect payments, such as duplicate payments or payments for ineligible patients.

We identified 6 types of payment risks: 4 related to state payments to MCOs, and 2 related to MCO payments to providers.

We recommended ways to improve oversight of managed care payments.