United States Government Accountability Office Testimony Before the Committee on Homeland Security and Governmental Affairs, U.S. Senate MEDICAID For Release on Delivery Expected at 10:00 am ET Tuesday, August 21, 2018 CMS Has Taken Steps to Address Program Risks but Further Actions Needed to Strengthen Program Integrity Statement of Gene L. Dodaro Comptroller General of the United States GAO-18-687T August 21, 2018 MEDICAID CMS Has Taken Steps to Address Program Risks but Further Actions Needed to Strengthen Program Highlights of GAO-18-687T, a testimony Integrity before the Committee on Homeland Security and Governmental Affairs, U.S. Senate. Why GAO Did This Study What GAO Found Medicaid, a joint federal-state health GAO’s work has identified three broad areas of risk to Medicaid program integrity care program overseen by CMS, is a as it reported in its June 2018 testimony before this Committee. For today’s significant component of federal and testimony, GAO provides examples of actions taken and plans by the Centers for state budgets, with total estimated Medicare & Medicaid Services (CMS) to address these areas of risk, and expenditures of $596 billion in fiscal highlights additional efforts needed to strengthen program oversight. year 2017. Medicaid allows significant flexibility for states to design and 1) Improper payments. To reduce improper payments and ensure only eligible implement program innovations based individuals enroll, CMS plans to resume audits of beneficiary eligibility on their unique needs. The resulting determinations and conduct new types of audits starting in three states. diversity of the program and its size However, given the growth in Medicaid managed care, which was nearly half make the program particularly of Medicaid spending in fiscal year 2017, additional actions are needed to challenging to oversee at the federal ensure that managed care payments are appropriate. For example, CMS still level. For example, in fiscal year 2017 needs to establish processes to ensure that overpayments to providers are estimated improper payments were identified and accounted for by states when setting future payment rates. $36.7 billion. Further, the Medicaid 2) Supplemental payments. Supplemental payments—which totaled $48 billion program accounted for about 26 percent of the fiscal year 2017 in fiscal year 2016—are payments made to providers in addition to regular, government-wide improper payment claims-based payments for specific services. Partially in response to GAO estimate. recommendations, CMS plans to issue a proposed rule in spring 2019 to establish new reporting requirements for supplemental payments. To address This testimony focuses on the (1) GAO’s recommendations, the rule would need to clearly establish approval major risks to the integrity of the criteria and review processes to ensure these payments are economical and Medicaid program, and examples of efficient, as well as arrange for more accurate reporting of how states are actions CMS has taken to address financing their share of these payments, among other things. these risks; and (2) other actions needed to strengthen oversight of the 3) Demonstrations. Demonstrations—which made up one-third of Medicaid program. This testimony draws on spending in fiscal year 2015—allow states and CMS to test new coverage and GAO’s reports issued between service delivery approaches. CMS recently limited states’ ability to accrue November 2012 and July 2018 on the unspent demonstration funds, resulting in an estimated $63 billion in federal Medicaid program, and information on savings from 2016 through 2018. Additional actions by CMS, such as a program integrity strategy CMS ensuring demonstration budget neutrality—that demonstrations do not announced in June 2018. increase federal costs—and state evaluations of demonstrations are properly conducted, could result in significant savings and better informed policy What GAO Recommends decisions. As a part of its body of work on As reported in GAO’s June 2018 testimony, GAO’s prior work has also identified Medicaid, GAO has made 86 the following fundamental actions needed to strengthen oversight. recommendations to address shortcomings in oversight and • Improve data. CMS’s Transformed Medicaid Statistical Information System suggested four matters for initiative has the potential to improve program oversight, but more needs to be congressional consideration. CMS has done to collect complete and comparable data from all states. generally agreed with these recommendations and has • Implement a fraud-risk strategy. CMS established the Center for Program implemented 30 of them. GAO will Integrity to lead antifraud efforts and has required antifraud training for continue to monitor implementation of stakeholders. However, CMS still needs to conduct a fraud risk assessment the remaining recommendations. and implement a risk-based antifraud strategy for Medicaid. • Collaborate. Increased collaboration between the federal government and the View GAO-18-687T. For more information, states can help reduce improper payments. State auditors are uniquely contact Carolyn L. Yocom at (202) 512-7114 qualified to partner with CMS in its oversight of Medicaid. CMS could help or yocomc@gao.gov. improve program integrity by providing state auditors with a substantive and ongoing role in auditing state Medicaid programs. United States Government Accountability Office Letter Letter Chairman Johnson, Ranking Member McCaskill, and Members of the Committee: I appreciate the opportunity to be here today along with the Administrator of the Centers for Medicare & Medicaid Services (CMS) to discuss areas of risk to the Medicaid program and efforts that can help ensure the program’s fiscal integrity. 1 The Administrator and I have met on two occasions to discuss the risks facing the Medicaid program, and the senior leadership teams from our agencies meet quarterly to discuss these risks, CMS’s actions to address these risks, and GAO’s open recommendations. I appreciate the constructive dialogue that our agencies have established on oversight of the Medicaid program. The federal-state Medicaid program is one of the nation’s largest sources of funding for medical and health-related services. In fiscal year 2017, Medicaid covered acute health care, long-term care, and other services for over 73 million low-income and medically needy individuals. In that same year, estimated federal and state Medicaid expenditures were $596 billion. Medicaid has been on our high-risk list since 2003, in part, because of concerns about the adequacy of fiscal oversight and the program’s improper payments—including payments made for people not eligible for Medicaid and services not actually provided. 2 The Medicaid program accounted for 26.1 percent of the fiscal year 2017 government- wide improper payments estimate, or $36.7 billion. 3 Of the $36.7 billion in improper payments, $36.4 billion were overpayments and $283 million were underpayments. 1 CMS, within the Department of Health and Human Services (HHS), oversees the Medicaid program at the federal level. 2 See GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017). 3 See GAO, Improper Payments: Actions and Guidance Could Help Address Issues and Inconsistencies in Estimation Processes, GAO-18-377 (Washington, D.C.: May 31, 2018). An improper payment is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. It includes any payment to an ineligible recipient, any payment for an ineligible service, any duplicate payment, payment for services not received (except where authorized by law), and any payment that does not account for credit for applicable discounts. See 31 U.S.C. § 3321 note. Office of Management and Budget guidance also instructs agencies to report as improper payments any payments for which insufficient or no documentation is found. Page 1 GAO-18-687T Medicaid The partnership between the federal government and states is a central tenet of the Medicaid program. Within broad federal requirements, states have significant flexibility to design and implement their programs based on their unique needs, resulting in 56 distinct state Medicaid programs. 4 These programs are administered at the state level and overseen at the federal level by CMS. The resulting variability of state Medicaid programs complicates federal efforts to oversee program payments and beneficiaries’ access to services, making collaborative activities a necessary strategy to improving Medicaid oversight. It is critical that CMS and states leverage available federal and state resources, as dollars wasted detract from the program’s ability to ensure that the individuals who rely on Medicaid—including low-income children and individuals who are elderly or disabled—are provided adequate care. In my June 2018 testimony before this Committee, I laid out major risks to the integrity of the Medicaid program and actions needed to manage these risks. 5 Today, I will provide examples of actions CMS has taken to address these major risks, and identify where additional actions are needed. Specifically, my testimony will focus on 1. major risks to the integrity of the Medicaid program, and examples of actions CMS has taken to address these risks; and 2. other actions needed to strengthen oversight of the program. My statement is based on our large body of work examining the Medicaid program, particularly reports issued and recommendations made from November 2012 to July 2018; these reports provide further details on our scope and methodology. (A list of related reports is included at the end of this statement.) It is also based on information from CMS’s June 2018 planned program integrity strategy, as well as interviews with and documents from CMS officials. We conducted all of the work on which this statement is based in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable 4 Medicaid programs are administered by the 50 states, the District of Columbia, American Samoa, Guam, the Commonwealth of the Northern Mariana Islands, Puerto Rico, and the U.S. Virgin Islands. 5 See GAO, Medicaid: Actions Needed to Mitigate Billions in Improper Payments and Program Integrity Risks, GAO-18-598T (Washington, D.C.: June 27, 2018). Page 2 GAO-18-687T Medicaid basis for our findings and conclusions based on our audit objectives. We obtained agency views on the information in this statement and have incorporated comments as appropriate. Among health care programs, Medicaid is the largest as measured by Background enrollment and the second largest as measured by expenditures, second only to Medicare. The CMS Office of the Actuary projected that Medicaid spending would grow at an average rate of 5.7 percent per year, from fiscal years 2016 to 2025, with projected Medicaid expenditures reaching $958 billion by fiscal year 2025. 6 This projected growth in expenditures reflects both expected increases in expenditures per enrollee and in levels of Medicaid enrollment. Beneficiaries with disabilities and those who are elderly constitute the highest per enrollee expenditures, which are projected to increase by almost 50 percent from fiscal year 2016 to 2025. Medicaid enrollment is also expected to grow by as many as 13.2 million newly eligible adults by 2025—as additional states may expand their Medicaid programs to cover certain low-income adults under the Patient Protection and Affordable Care Act (PPACA). 7 (See fig. 1.) 6 Data are from the most recently issued CMS actuarial report. See Centers for Medicare & Medicaid Services, Office of the Actuary, 2016 Actuarial Report on the Financial Outlook for Medicaid (Washington, D.C.: 2016). 7 The Patient Protection and Affordable Care Act, enacted on March 23, 2010, permits states to expand their Medicaid programs to cover nonelderly, nonpregnant adults who are not eligible for Medicare, and whose income does not exceed 133 percent of the federal poverty level. Because of the way the limit is calculated, using what is known as an “income disregard,” the level is effectively 138 percent of the federal poverty level. Pub. L. No. 111-148, 124 Stat. 119 (2010), as amended by the Health Care and Education Reconciliation Act of 2010 (HCERA), Pub. L. No. 111-152, 124 Stat. 1029 (2010). Page 3 GAO-18-687T Medicaid Figure 1: Growth Trends in Total Medicaid Spending by Eligibility Group Note: Data after fiscal year 2012 are projected expenditures. Under the federal-state partnership, CMS provides oversight and technical assistance for the Medicaid program, and states are responsible for administering their respective programs’ day-to-day operations— including determining eligibility, enrolling individuals and providers, and adjudicating claims—within broad federal requirements. Federal oversight includes ensuring that the design and operation of state programs meet federal requirements and that Medicaid payments are made appropriately. Joint financing of Medicaid is also a fixture of the federal- state partnership, with the federal government matching most state Medicaid expenditures using a statutory formula known as the federal medical assistance percentage, that is based, in part, on each state’s per capita income in relation to the national average per capita income. Page 4 GAO-18-687T Medicaid States have flexibility in determining how their Medicaid benefits are delivered. For example, states may (1) contract with managed care organizations (MCO) to provide a specific set of Medicaid-covered services to beneficiaries and pay the organizations a set amount, generally on a per beneficiary per month basis; (2) pay health care providers for each service they provide on a fee-for-service (FFS) basis; or (3) rely on a combination of both delivery systems. 8 Managed care continues to be a growing component of the Medicaid program. In fiscal year 2017, expenditures for managed care were $280 billion, representing almost half of total program expenditures, compared with 42 percent in fiscal year 2015. Another growing component of Medicaid spending is supplemental payments to providers—such as local government hospitals and other providers—that are in addition to the regular, claims-based payments to providers for specific services. Supplemental payments have increased over the last decade and totaled more than $48 billion in 2016. States also have the flexibility to innovate outside of many of Medicaid’s otherwise applicable requirements through Medicaid demonstrations approved under section 1115 of the Social Security Act. 9 These demonstrations allow states to test new approaches to coverage and to 8 CMS has also been developing and testing a variety of value-based payment models, under which physicians and other providers are paid and responsible for the care of a beneficiary for a long period of time and accountable for the quality and efficiency of the care provided. Examples of these models include accountable care organizations—groups of physicians and other health care providers who voluntarily work together to provide coordinated care—and bundled payment models, which provide a “bundled” payment intended to cover the multiple services beneficiaries receive during an episode of care for certain health conditions, such as hip replacements, congestive heart failure, and pregnancy. 9 Under section 1115 of the Social Security Act, the Secretary of Health and Human Services may waive certain Medicaid requirements and approve new types of expenditures that would not otherwise be eligible for federal Medicaid matching funds for experimental, pilot, or demonstration projects that, in the Secretary’s judgment, are likely to promote Medicaid objectives. See 42 U.S.C. § 1315(a). The Secretary has delegated the approval and administration of Medicaid section 1115 demonstrations to CMS, which requires that such demonstrations be budget neutral to the federal government; that is, the federal government should spend no more for Medicaid under a state’s demonstration than it would have spent without the demonstration. There are other types of waivers that states can apply for and use, including those approved under section 1915(c) of the Social Security Act, which authorizes the Secretary of Health and Human Services to waive requirements that states provide home and community based services that they would otherwise need to meet in the absence of the waiver. Page 5 GAO-18-687T Medicaid improve quality and access, or generate savings or efficiencies. For example, under demonstrations, states have • extended coverage to certain populations, • provided services not otherwise eligible for federal matching funds, and • made incentive payments to providers for delivery system improvements. As of November 2016, nearly three-quarters of states had CMS-approved demonstrations. In fiscal year 2015, total spending under demonstrations represented a third of all Medicaid spending nationwide. (See fig. 2.) Figure 2: Total Expenditures under Medicaid Section 1115 Demonstrations, Fiscal Years 2005, 2010, and 2015 Page 6 GAO-18-687T Medicaid In our June 2018 testimony before this Committee, we identified three Additional Actions broad areas of risk to Medicaid program integrity. These risk areas are Could Enhance improper payments, supplemental payments, and demonstrations. CMS has taken or plans to take specific steps to address these risks, but CMS’s Efforts to additional actions are still needed to manage these risks and strengthen Address Major Risks oversight of the Medicaid program, as we have recommended previously. to the Medicaid Program Improper Payments In fiscal year 2017, the estimate of improper payments was 10.1 percent of Medicaid spending, or $36.7 billion. 10 CMS annually computes the Medicaid improper payment estimate as a weighted average of states’ improper payment estimates for three component parts—fee-for-service, managed care, and beneficiary eligibility determinations. The improper payment estimate for each component is developed under its own methodology within CMS’s Payment Error Rate Measurement (PERM) program, with each having different improper payment estimates and oversight concerns. Fee-for-Service. The FFS component of improper payments measures errors in a sample of FFS claims, which are records of services provided and the amount the Medicaid program paid for these services. For the majority of sampled FFS claims, the PERM review contractor performs a medical review, which includes a review of the medical documentation to determine errors that do not meet federal and state policies, such as medically unnecessary services, diagnosis coding errors, and policy violations. 11 In fiscal year 2017, CMS reported a FFS improper payment estimate of 12.9 percent, or $25 billion. CMS’s analysis of improper payments in FFS notes that many claims deemed improper lacked adequate 10 Since 2016, Medicaid has exceeded the 10 percent criterion set in statute by the Improper Payments Elimination and Recovery Act of 2010. When an agency is determined to not be in compliance with one or more of the Improper Payments Elimination and Recovery Act criteria by its Inspector General, it must submit a plan to Congress describing the actions it will take to come into compliance. 11 All FFS claims are also subject to a data processing review, which includes a verification of provider eligibility, beneficiary information, and that the payment for a covered service was accurately calculated and paid. Page 7 GAO-18-687T Medicaid provider documentation, such as not having national provider identification numbers on claims. 12 Our work has also detailed concerns related to the accuracy of provider enrollment, as well as broader concerns regarding the data available to CMS to ensure proper oversight of providers. 13 According to information provided by CMS about its June 2018 program integrity strategy, the agency plans to assist states with screening Medicaid providers, as well as conduct Medicaid provider education to reduce erroneous billing. However, we have previously noted that without better data, CMS may not be able to identify patterns that indicate inappropriate provider billing. Our prior recommendations in this area have focused on data improvements; CMS has agreed with these recommendations and we are tracking their implementation. Our concerns about provider oversight, however, are longstanding and will require significant and consistent efforts on the part of CMS and the states. Addressing our concerns would require efforts to develop systems that can accurately track and screen providers, as well as ensure that any ineligible providers are appropriately excluded and that such exclusions are communicated across states. Managed Care. The managed care component measures errors that occur in the payments that state Medicaid agencies make to MCOs on behalf of enrollees. The PERM assesses whether any payments made to the MCOs were in amounts different than those the state Medicaid agency is contractually required to pay, which are approved by CMS. In contrast to the FFS component, the managed care component of the PERM includes neither a medical review of services delivered to enrollees, nor reviews of MCO records or data. In fiscal year 2017, CMS reported a managed care improper payment estimate of 0.3 percent or $500 million, an estimate that does not 12 Specifically, 46.6 percent of estimated Medicaid improper payments in fiscal year 2017 were caused by non-compliance with provider screening and national provider identification requirements. 13 See GAO, Medicaid: CMS Needs Better Data to Monitor the Provision of and Spending on Personal Care Services, GAO-17-169 (Washington, D.C.: Jan. 12, 2017) and Medicaid: Program Oversight Hampered by Data Challenges, Underscoring Need for Continued Improvement, GAO-17-173 (Washington, D.C.: Jan. 6, 2017). Personal care services provide assistance to beneficiaries of all ages who have limited ability to care for themselves because of physical, developmental, or intellectual disabilities. Personal care services assist beneficiaries with activities of daily living such as bathing, dressing, and toileting. Page 8 GAO-18-687T Medicaid determine whether MCO payments to providers were for services that were medically necessary, actually provided, accurately billed and delivered by eligible providers, or whether the MCO costs were allowable and appropriate. We have previously recommended that CMS take steps to mitigate the program risks that are not measured in the PERM, which could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. CMS agreed with our recommendation and information on its June 2018 program integrity strategy mentions plans to check whether MCOs’ reported financial statements accurately reflect the services provided. CMS plans to compare encounter claims to the services provided by MCOs. It also noted plans to implement reviews of high- risk vulnerabilities that we and the Department of Health and Human Services’ (HHS) Office of the Inspector General (HHS-OIG) have identified. We will review the particulars of how CMS plans to implement these actions when they become available. In July 2018, we reported on key payment risks in Medicaid managed care and found that, while CMS has taken some steps to improve program integrity in managed care—including strengthening regulations, and beginning to include managed care in the monitoring and auditing process—these efforts remain incomplete. For example, CMS had not developed a process to help ensure that overpayments to providers are identified by the states. We made three recommendations including that CMS ensure states account for overpayments in setting future MCO payment rates. CMS agreed with our recommendations. Beneficiary Eligibility. The beneficiary eligibility component of improper payments measures errors in state determinations of whether enrollees meet categorical and financial criteria for receipt of benefits under the Medicaid program. The eligibility component assesses determinations for both FFS and managed care enrollees. Prior to 2014, to assess improper payments attributable to erroneous eligibility determinations, the PERM relied on state-conducted eligibility reviews that are reported to CMS. Since 2014, the beneficiary eligibility component estimate has been set at 3.1 percent. This represents $11.3 billion of improper payments estimated for 2017. Beginning in the 2019 reporting year, CMS plans to resume improper payment estimates for eligibility determinations, but these reviews will be performed by CMS contractors, not states. Our prior work has identified gaps in CMS’s efforts to ensure that only eligible individuals Page 9 GAO-18-687T Medicaid are enrolled in Medicaid, and that Medicaid expenditures for enrollees—particularly those eligible as a result of the PPACA expansion—are matched appropriately by the federal government. 14 CMS concurred with these recommendations and has taken action to establish a more rigorous approach for verifying financial and nonfinancial information needed to determine Medicaid beneficiaries’ eligibility. Information on CMS’s June 2018 program integrity strategy mentions plans to initiate audits of state beneficiary eligibility determinations in three states previously reviewed by the HHS-OIG (California, Kentucky and New York). These audits will include an assessment of the impact of changes to state eligibility policy as a result of Medicaid expansion; for example, CMS plans to review whether beneficiaries were found eligible for the correct Medicaid eligibility category. However, our recommendations from October 2015 remain unimplemented and—without knowing the results of the 2019 beneficiary eligibility estimates and details of CMS’s actions—it remains unclear whether CMS policies and actions will improve oversight of states’ eligibility determinations. Supplemental Payments In our June 2018 testimony before this Committee, we described several concerns related to supplemental payments, which are payments made to providers—such as local government hospitals and other providers—that are in addition to the regular, claims-based payments made to providers. 15 Supplemental payments have been growing and totaled more than $48 billion in 2016. According to CMS officials, CMS plans to take steps to address program risks associated with supplemental payments. For example, CMS officials indicated that it anticipates issuing a proposed rule in early 2019 that would establish new reporting requirements for 14 See, for example, GAO, Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds GAO-16-53 (Washington, D.C.: Oct 16, 2015); and Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls GAO-15-313 (Washington, D.C.: May 14, 2015). 15 See, for example, GAO, Medicaid: Federal Guidance Needed to Address Concerns about Distribution of Supplemental Payments, GAO-16-108 (Washington, D.C.: Feb. 5, 2016); and Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited Data and Unclear Policy, GAO-15-322 (Washington, D.C.: April 10, 2015). Also, see GAO-18-598T. Page 10 GAO-18-687T Medicaid supplemental payments. 16 We will examine the rule, once finalized to determine the extent to which it addresses the program risks we have identified including, for example, the need for • more complete and accurate reporting on the sources of funds states use to finance their share of Medicaid payments; • criteria, data, and a review process to ensure that certain supplemental payments are economical and efficient; and • written guidance clarifying CMS’s policy that requires a link between the distribution of supplemental payments and the provision of Medicaid-covered services. Demonstration Programs Demonstration programs, which comprised about one-third of total Medicaid expenditures in 2015, can be a powerful tool for states and CMS to test new approaches to providing coverage and delivering services that could reduce costs and improve outcomes. However, our prior work has identified several concerns related to demonstrations, including the need to ensure that (1) demonstrations meet the policy requirements of budget neutrality—that is, they must not increase federal costs—and (2) evaluations are used to assess whether demonstrations are having their intended effects. 17 We have also identified a number of questionable methods used to establish spending limits for demonstration programs, and CMS has taken important steps to improve oversight of spending on demonstrations and address some of the concerns we have raised. CMS policy limits demonstration spending to the costs estimated to have occurred without the demonstration. In our prior work, we identified a number of questionable methods and assumptions that CMS permitted 16 See also, Office of Management and Budget, Medicaid Supplemental Payment and Accountability, Spring 2018 Unified Agenda of Regulatory and Deregulatory Actions, (CMS-2392-P), RIN 0938-AT50, see https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201804&RIN=0938-AT50 (accessed July 27, 2018). 17 See, for example, GAO, Medicaid Demonstrations: Evaluations Yielded Limited Results, Underscoring Need for Changes to Federal Policies and Procedures, GAO-18-220 (Washington, D.C.: Jan 19, 2018); and Medicaid Demonstrations: Federal Action Needed to Improve Oversight of Spending, GAO-17-312 (Washington, D.C.: April 3, 2017). Also, see GAO-18-598T. Page 11 GAO-18-687T Medicaid states to use when estimating these costs. 18 Under a policy implemented in 2016, CMS restricted states’ ability to accrue unspent funds—the difference between estimated costs and demonstration spending—for each year a demonstration operates, and reduced the amount of unspent funds that states can carry forward to new demonstrations. CMS estimated that this policy reduced total demonstration spending limits by $109 billion for 2016 through 2018, the federal share of which was $62.9 billion. This policy change reduces the effect, but does not specifically address all, of the questionable methods that we have identified regarding how CMS sets demonstration spending limits. 19 Additional actions that address states’ methods of estimating costs could result in significant savings. For example, as we have previously reported, CMS continues to need written guidance on the methodologies for demonstrating budget neutrality and updates to policies to reflect the actual criteria and processes CMS uses to develop and approve demonstration spending limits. 20 In a January 2018 report, we also raised concerns about state-led and federal evaluations of demonstration programs, particularly with regard to how results from these evaluations may inform policy decisions. We identified gaps in reported results from state-led evaluations that were due, in part, to CMS requiring final, comprehensive evaluation reports after the expiration of the demonstrations rather than at the end of each 3- to 5-year demonstration cycle. We also found that evaluations of federal demonstrations led by CMS have been limited due to data challenges and a lack of transparent reporting. We recommended that CMS (1) establish written procedures for requiring final evaluation reports at the end of each demonstration cycle, (2) issue criteria for when it will allow limited evaluations of demonstrations, and (3) establish a policy for publicly releasing findings from federal evaluations of demonstrations. In 18 See, for example, GAO, Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns, GAO-08-87 (Washington, D.C.: Jan. 31, 2008). 19 For example, CMS did not ensure budget neutrality in its approval of a demonstration that involved using premium assistance to purchase private coverage. The CMS-approved spending limit was based, in part, on hypothetical costs that were significantly higher than they would have been under the traditional Medicaid program, and CMS did not request any data to support these assumptions. See GAO, Medicaid Demonstrations: HHS’s Approval Process for Arkansas’s Medicaid Expansion Waiver Raises Cost Concerns, GAO-14-689R (Washington, D.C.: Aug. 8, 2014). 20 See, GAO-18-598T. Page 12 GAO-18-687T Medicaid April 2018, HHS reported that CMS had begun developing and piloting procedures and criteria related to these recommendations, and we will continue to monitor CMS’s progress in this area. Across our body of work, we have made 86 recommendations to CMS Improving Data, and suggested 4 matters for congressional consideration to strengthen Implementing a oversight of the Medicaid program, particularly from reports issued from November 2012 through July 2018. CMS has generally agreed with these Fraud-Risk Strategy, recommendations and has implemented 30 of them to date. Among the and Increasing open recommendations, opportunities exist for CMS to fundamentally strengthen program oversight by improving data about Medicaid’s Collaboration Would performance, implementing a strategy to address the risk of fraud, and Further Strengthen strengthening federal-state collaboration. Medicaid Oversight Improving data CMS’s oversight of the Medicaid program relies heavily on state-reported data on multiple aspects of the program, including expenditures and service utilization. However, our work has demonstrated how the lack of timely, accurate, and comparable data has affected CMS’s ability to ensure proper payments, assess beneficiaries’ access to services, and oversee states’ financing strategies. As part of its efforts to address longstanding data concerns, CMS has taken steps toward developing a reliable national repository for Medicaid data, most notably the Transformed Medicaid Statistical Information System (T-MSIS). Through T-MSIS, CMS has said that • it will collect detailed information on Medicaid beneficiaries—such as their citizenship, immigration, and disability status—as well as any expanded diagnosis and procedure codes associated with their treatments; and • states are to report data more frequently—and in a timelier manner— than they have previously. 21 21 In particular, we found that the usefulness of CMS data on Medicaid is limited because of issues with completeness, accuracy, and timeliness. With regard to timeliness, we found that available data were reported up to 3 years late and were previously submitted on a quarterly basis. Under T-MSIS, data are to be electronically transmitted to CMS on a monthly basis. Page 13 GAO-18-687T Medicaid Implementing the T-MSIS initiative has been a significant, multi-year effort. CMS has worked closely with states and has reached a point where all states, the District of Columbia, and Puerto Rico are reporting T-MSIS data. The T-MSIS initiative has the potential to improve CMS’s ability to identify improper payments, help ensure beneficiaries’ access to services, and improve program transparency, among other benefits. In addition, CMS noted as part of its June 2018 program integrity strategy that one of its priorities is to ensure that Medicaid data are accurate and complete. CMS also noted that the agency has an ongoing goal to use advanced analytics to improve Medicaid eligibility and payment data in T- MSIS and use these data for program integrity purposes. As we reported in December 2017, CMS has made progress toward implementing T-MSIS, but more work needs to be done before the agency or states can use these data for program oversight. 22 For example, we recommended in our December 2017 report that CMS take steps to expedite the use of T-MSIS data, including efforts to obtain complete and comparable data from all states. We also recommended that CMS articulate a specific plan and associated time frames for using T-MSIS data for oversight. The agency concurred with our recommendations, and has taken some steps but has not fully implemented them. For example, the agency reported in March 2018 that it has developed a database on data quality findings, which could be used to identify solutions for common problems across states. HHS stated that it has begun to develop a data quality scorecard for T-MSIS users, which aggregates data quality findings in a user-friendly tool. HHS stated that it will (1) continue to work to obtain complete T-MSIS information from all states; (2) take additional steps to share information across states on T- MSIS data limitations; and (3) implement ways for states to collaborate regarding T-MSIS. We will continue to monitor CMS’s efforts to improve its data systems and their use for oversight. Implementing a Fraud- As we reported in December 2017, CMS had taken steps to manage Risk Strategy fraud risks facing Medicaid. 23 In that report we determined that CMS had shown commitment to combating fraud, in part, by establishing a 22 See GAO, Medicaid: Further Action Needed to Expedite Use of National Data for Program Oversight, GAO-18-70 (Washington, D.C.: Dec. 8, 2017). 23 GAO, Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework, GAO-18-88 (Washington, D.C.: Dec. 5, 2017). Page 14 GAO-18-687T Medicaid dedicated entity—the Center for Program Integrity—to lead antifraud efforts, and offering and requiring antifraud training for stakeholder groups, such as providers, beneficiaries, and health insurance plans. 24 We identified training as a way to help CMS further create a culture of integrity and compliance, and recommended that CMS provide and require fraud-awareness training to its employees. In response to this recommendation, CMS officials stated in August 2018 that the agency has developed a training video related to fraud, and is developing annual training for all CMS employees on fraud, waste, and abuse. We will continue to monitor the implementation of this recommendation. Additionally, in our December 2017 report, we determined that CMS had taken steps to identify some fraud risks through several control activities that target areas the agency has designated as higher risk within Medicaid. However, we found that CMS had not conducted a fraud risk assessment or designed and implemented a risk-based antifraud strategy for Medicaid. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as design and implement an appropriate evaluation. We identified a significant opportunity for CMS to organize and focus its antifraud and program integrity activities and related resources. We recommended that CMS conduct a fraud risk assessment and create an antifraud strategy for Medicaid, including an approach for evaluation. CMS concurred with our recommendations. CMS officials stated they are exploring how to apply the fraud risk framework to the Medicaid program more broadly; however, the agency has not yet implemented these recommendations. Strengthening Federal- The federal government and the states, together, play important roles in State Collaboration reducing improper payments and overseeing the Medicaid program. Our prior work has shown that oversight of the Medicaid program could be further improved through leveraging and coordinating program integrity efforts with state agencies, state auditors, and other partners. Given their roles and responsibilities—which can include carrying out or overseeing their state’s single audits—state auditors are uniquely positioned to help 24 Fraud involves obtaining something of value through willful misrepresentation. Page 15 GAO-18-687T Medicaid CMS in its oversight of state Medicaid programs. 25 Through their program integrity reviews, state auditors have identified improper payments in the Medicaid program and deficiencies in the processes used to identify them. Some examples of the state auditors’ work include the following: • In 2017, the Oregon Secretary of State Audits Division found approximately 31,300 questionable payments to Coordinated Care Organizations (which receive capitated monthly payments for beneficiaries, similar to MCOs), based on a review of 15 months of data. In addition, the state auditor found that approximately 47,600 individuals enrolled in Oregon’s Medicaid program were ineligible, equating to $88 million in avoidable expenditures. 26 • Massachusetts’ Medicaid Audit Unit’s recent annual report (covering the time period from March 15, 2017 through March 14, 2018) reported that the state auditor identified more than $211 million in unallowable, questionable, duplicative, unauthorized, or potentially fraudulent billing in the program. 27 • A 2017 report released by the Louisiana Legislative Auditor’s Office stated that the office reviewed Medicaid eligibility files and claims data covering January 2011 through October 2016, and found $1.4 million in questionable duplicate payments. 28 25 Organizations based in the United States with expenditures of federal funding of $500,000 or more ($750,000 or more for fiscal years beginning on or after December 26, 2014) within the organization’s fiscal year are required to send an audit report to the Office of Management and Budget (OMB), in accordance with the Single Audit Act, as amended, and OMB implementing guidance. See 31 U.S.C. §§ 7501-7507; 2 C.F.R., pt. 200, subpt. F. (2017) (as added by 78 Fed. Reg. 78590, 78608 (Dec. 26, 2013)). A single audit consists of (1) an audit and opinions on the fair presentation of the financial statements and the schedule of expenditures of Federal awards; (2) gaining an understanding of and testing internal control over financial reporting, and the entity’s compliance with laws, regulations, and contract or grant provisions that have a direct and material effect on certain federal programs (i.e., the program requirements); and (3) an audit and an opinion on compliance with applicable program requirements for certain federal programs. 26 State of Oregon, Secretary of State, Dennis Richardson and Oregon Audits Division Director, Kip Memmott, Oregon Health Authority Should Improve Efforts to Detect and Prevent Improper Medicaid Payments, Report 2017- 25 (Salem, Ore.: November 2017). 27 Commonwealth of Massachusetts, Office of the State Auditor Suzanne M. Bump, Office of the State Auditor—Annual Report Medicaid Audit Unit, March 15, 2017-March 14, 2018 (Boston, Mass.: March 15, 2018). 28 Louisiana Legislative Auditor, State of Louisiana, Duplicate Payments for Medicaid Recipients with Multiple Identification Numbers Louisiana Department of Health (Baton Rouge, La.: March 29, 2017). Page 16 GAO-18-687T Medicaid • In fiscal year 2017, the Mississippi Division of Medicaid reported that it recovered more than $8.6 million through various audits of medical claims paid to health care providers. The division also referred seven cases to the state’s attorney general’s office, in which the division had identified $3.1 million in improper billing. 29 Many state auditors are uniquely positioned to help CMS and state Medicaid agencies identify program risks and provide additional oversight of the program. These auditors have detailed knowledge of and experience with auditing their state Medicaid programs, including managed care organizations, as well as Medicaid financial and data systems. We have made recommendations to CMS regarding improving its capacity to audit Medicaid providers and MCOs. As such, CMS could help improve program integrity by providing state auditors with a substantive and ongoing role in auditing their state Medicaid programs. We will continue to monitor CMS’s efforts to strengthen its oversight of Medicaid and its progress in addressing our open recommendations. Chairman Johnson, Ranking Member McCaskill, and Members of the Committee, this concludes my prepared statement. I would be pleased to respond to any questions you may have. If you or your staff members have any questions concerning this GAO Contacts and testimony, please contact Carolyn L. Yocom, who may be reached at Staff 202-512-7114 or yocomc@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page Acknowledgments of this statement. Other individuals who made key contributions to this testimony include William Black (Assistant Director), Deirdre Brown, Kristin Ekelund, Mary Giffin, Leslie V. Gordon, Drew Long, Vikki Porter, Russell Voth, and Jennifer Whitworth. 29 Mississippi Division of Medicaid, Medicaid Recovers $8.6 Million in Fiscal Year 2017 (Jackson, Miss.), accessed May 29, 2018, https://medicaid.ms.gov/medicaid-recovers-8-6- million-in-fiscal-year-2017/. Page 17 GAO-18-687T Medicaid Related GAO Reports Related GAO Reports Medicaid Managed Care: Improvements Needed to Better Oversee Payment Risks. GAO-18-528. Washington, D.C.: July 26, 2018. Medicaid: Actions Needed to Mitigate Billions in Improper Payments and Program Integrity Risks. Statement of Gene Dodaro, Comptroller General of the United States. GAO-18-598T. Washington, D.C.: June 27, 2018. Improper Payments: Actions and Guidance Could Help Address Issues and Inconsistencies in Estimation Processes. GAO-18-377. Washington, D.C.: May 31, 2018. Medicaid: CMS Should Take Steps to Mitigate Program Risks in Managed Care. GAO-18-291. Washington, D.C.: May 7, 2018. Medicaid: Opportunities for Improving Program Oversight. GAO-18-444T. Washington, D.C.: April 12, 2018. Medicaid Demonstrations: Evaluations Yielded Limited Results, Underscoring Need for Changes to Federal Policies and Procedures. GAO-18-220. Washington, D.C.: January 19, 2018. Medicaid: Further Action Needed to Expedite Use of National Data for Program Oversight. GAO-18-70. Washington, D.C.: December 8, 2017. Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework. GAO-18-88. Washington, D.C.: December 5, 2017. Improper Payments: Additional Guidance Could Provide More Consistent Compliance Determinations and Reporting by Inspectors General. GAO-17-484. Washington, D.C.: May 31, 2017. Medicaid Demonstrations: Federal Action Needed to Improve Oversight of Spending. GAO-17-312. Washington, D.C.: April 3, 2017. Medicaid Program Integrity: CMS Should Build on Current Oversight Efforts by Further Enhancing Collaboration with States. GAO-17-277. Washington, D.C.: March 15, 2017. High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017. Page 18 GAO-18-687T Medicaid Related GAO Reports Medicaid: CMS Needs Better Data to Monitor the Provision of and Spending on Personal Care Services. GAO-17-169. Washington, D.C.: January 12, 2017. Medicaid: Program Oversight Hampered by Data Challenges, Underscoring Need for Continued Improvement. GAO-17-173. Washington, D.C.: January 6, 2017. Improper Payments: Strategy and Additional Actions Needed to Help Ensure Agencies Use the Do Not Pay Working System as Intended. GAO-17-15. Washington, D.C.: October 14, 2016. Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers. GAO-16-402. Washington, D.C.: April 22, 2016. Medicaid: Federal Guidance Needed to Address Concerns About Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: February 5, 2016. Medicaid: Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C.: October 16, 2015. Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. GAO-15-481. Washington, D.C.: May 29, 2015. Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C.: May 14, 2015. Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015. Medicaid Demonstrations: HHS’s Approval Process for Arkansas’s Medicaid Expansion Waiver Raises Cost Concerns. GAO-14-689R. Washington, D.C.: August 8, 2014. Medicaid Financing: States’ Increased Reliance on Funds from Health Care Providers and Local Governments Warrants Improved CMS Data Collection. GAO-14-627. Washington, D.C.: July 29, 2014. Page 19 GAO-18-687T Medicaid Related GAO Reports Medicaid Demonstration Waivers: Approval Process Raises Cost Concerns and Lacks Transparency. GAO-13-384. Washington, D.C.: June 25, 2013. Medicaid: More Transparency of and Accountability for Supplemental Payments Are Needed. GAO-13-48. Washington, D.C.: November 26, 2012. Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.: January 31, 2008. Medicaid and SCHIP: Recent HHS Approvals of Demonstration Waiver Projects Raise Concerns. GAO-02-817. Washington, D.C.: July 12, 2002. (102940) Page 20 GAO-18-687T Medicaid This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. The Government Accountability Office, the audit, evaluation, and investigative GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO GAO Reports and posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to https://www.gao.gov Testimony and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at https://www.gao.gov. Contact: To Report Fraud, Website: https://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in Automated answering system: (800) 424-5454 or (202) 512-7700 Federal Programs Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125, Relations Washington, DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.