United States Government Accountability Office Report to Congressional Requesters MEDICAID June 2023 CMS Oversight and Guidance Could Improve Recovery Audit Contractor Program GAO-23-106025 June 2023 MEDICAID CMS Oversight and Guidance Could Improve Recovery Audit Contractor Program Highlights of GAO-23-106025, a report to congressional requesters Why GAO Did This Study What GAO Found Medicaid has been on GAO's High The Patient Protection and Affordable Care Act established the Medicaid Risk List since 2003, in part due to Recovery Audit Contractor (RAC) program to identify overpayments and concerns about the adequacy of fiscal underpayments and recoup overpayments. The act allowed the Centers for oversight. Medicare & Medicaid Services (CMS) to permit exceptions and exemptions to GAO was asked to review the Medicaid RAC program requirements. GAO's review found that 34 states and the Medicaid RAC program. This report (1) District of Columbia did not participate in this program during fiscal year 2021. describes the status of states' use of Most states cited having other program-integrity initiatives as the reason for the program, (2) evaluates CMS's requesting an exemption, as shown in the table. oversight of states' Medicaid RAC programs, and (3) evaluates any Reasons for State Exemption from the Medicaid Recovery Audit Contractor Program in Fiscal Year 2021 opportunities for CMS to improve the Reasons for exemption approved by Number of states not-participating in the program program. Centers for Medicare & Medicaid for exemption reason Services (population: 35 states)a To do so, GAO analyzed statutes, State has other program integrity initiatives 25 regulations, policies, guidance, and State could not procure a recovery audit 22 CMS reports related to recovery audit contractor contractors. GAO examined certain State Medicaid population is 20 documents covering the Medicaid RAC predominantly enrolled in managed care program for all states and the District Source: GAO analysis of the 50 states' and the District of Columbia's state plan amendments. | GAO-23-106025 of Columbia, during fiscal year 2021 a States include the District of Columbia. In addition, states may have more than one reason for and interviewed CMS and state exemption, but any single approved reason could result in a full exemption. officials from a nongeneralizable sample of 11 states. CMS did not consistently establish or communicate the expiration of its approvals for full exemption from the Medicaid RAC program. CMS officials stated that it is What GAO Recommends their process to not give states a permanent full exemption, but instead include a GAO is making four recommendations, 2-year expiration date on their approval. However, CMS does not have written including that CMS establish and procedures for documenting and monitoring expiration dates. GAO found nine implement written policies and states without a CMS-documented expiration date, and an additional 18 procedures to document and nonparticipating states with expired approvals. As a result, CMS may not be communicate an expiration date for full determining whether states warrant full exemptions and may be missing exemption from the Medicaid RAC opportunities to collect overpayments. program, and conduct a cost- effectiveness study to determine CMS has an opportunity to improve the program by conducting a cost- whether states should include effectiveness study on including managed care, which is a system in which payments to managed care states make fixed payments to managed-care plans to provide health care organizations as part of the program. services. Since 2011, CMS has not determined whether the inclusion of CMS concurred with two, partially managed care payments in the Medicaid RAC program would be cost effective. concurred with one, and disagreed with However, states that have elected to use recovery audit contractors to review one of GAO's recommendations. GAO managed care have reported collecting overpayments, including one selected continues to believe that all of the state that reported collecting more than $177 million in overpayments in 1 year. recommendations are warranted. This suggests that RACs' review of managed care claims could result in recoveries. If CMS were to conduct a study to determine the cost-effectiveness of expanding the program to include managed care, the federal government may identify additional opportunities to recover Medicaid overpayments. View GAO-23-106025. For more information, contact M. Hannah Padilla at (202) 512-5683 or padillah@gao.gov. United States Government Accountability Office Contents Letter 1 Background 3 Status of States' Use of Medicaid Recovery Audit Contractors 7 CMS Provided Inconsistent Oversight and Monitoring of the Medicaid RAC Program 11 CMS Has Not Considered the Opportunity to Improve the RAC Program by Performing a Cost-Effectiveness Study on Including Managed Care in the Scope of RAC Audits 14 Conclusions 16 Recommendations for Executive Action 17 Agency Comments and Our Evaluation 17 Appendix I Objectives, Scope, and Methodology 20 Appendix II Comments from the Department of Health & Human Services 22 Appendix III GAO Contact and Staff Acknowledgments 26 Tables Table 1: Reasons for Requesting a Full Exemption from the Medicaid Recovery Audit Contractor (RAC) Program in Fiscal Year 2021 8 Table 2: Regulatory Exceptions That the Centers for Medicare & Medicaid Services (CMS) Granted to States for Operating Their Recovery Audit Contractor (RAC) Programs in Fiscal Year 2021 10 Figures Figure 1: Example of Recovery Audit Contractor (RAC) Payment Flow for Contingent Fee-Based Audits 5 Figure 2: Participation in the Medicaid Recovery Audit Contractor Program in Fiscal Year 2021 7 Page i GAO-23-106025 Medicaid RAC Program Abbreviations Affordable Care Act Patient Protection and Affordable Care Act CMS Centers for Medicare & Medicaid Services FFS fee-for-service FMAP Federal Medical Assistance Percentage FTE full-time equivalent MCO managed care organization MFCU Medicaid Fraud Control Unit OMB Office of Management and Budget PERM Payment Error Rate Measurement PIIA Payment Integrity Information Act of 2019 RAC Recovery Audit Contractor SPA state plan amendment This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-23-106025 Medicaid RAC Program Letter 441 G St. N.W. Washington, DC 20548 June 28, 2023 The Honorable Mike Braun Ranking Member Special Committee on Aging United States Senate The Honorable Rick Scott United States Senate The Honorable Tim Scott United States Senate Medicaid-a joint, federal-state program that finances health care coverage for certain low-income and medically needy populations- covered an estimated 78 million individuals in fiscal year 2021 at an estimated cost of $709 billion (from both federal and state funds). 1 Federal matching funds are available to states for Medicaid payments that states make according to each state's federal medical assistance percentage. 2 States finance their share of Medicaid payments-called the nonfederal share-with state general funds and, within limits, other sources of funding, such as taxes on health care providers and funds from local governments. The Centers for Medicare & Medicaid Services (CMS), within the Department of Health and Human Services, is responsible for overseeing the Medicaid program. Medicaid has been on our High Risk List since 2003, in part because of concerns about the adequacy of fiscal oversight and the program's improper payments, including payments made for services not actually provided. 3 As such, it is critical that CMS and states take appropriate 1See Department of Health and Human Services, Centers for Medicare & Medicaid Services, 2018 Actuarial Report on the Financial Outlook on Medicaid (Baltimore, Md.). 2The federal medical assistance percentage is based on a formula established by law, such that the federal government pays a larger portion of Medicaid costs in states with lower per capita incomes relative to the national average. See Pub. L. No. 116-127, div. F, § 6008, 134 Stat. 178, 208 (2020). 3See GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress in Most High-Risk Areas, GAO-21-119SP (Washington, D.C.: Mar. 2, 2021). Page 1 GAO-23-106025 Medicaid RAC Program measures to reduce improper payments and ensure Medicaid's fiscal integrity. Enacted in March 2010, the Patient Protection and Affordable Care Act (Affordable Care Act) established the Medicaid Recovery Audit Contractor (RAC) program. 4 The purpose of the Medicaid RAC program is to identify overpayments and underpayments and recoup overpayments. While federal regulations set Medicaid RAC program requirements, states have considerable flexibility regarding program design, procurement, and operation. You asked us to review the Medicaid RAC program. This report 1. describes the status of states' participation in the program; 2. evaluates how CMS oversees states' implementation of the RAC program; and 3. evaluates what opportunities exist for CMS to improve the program. To address our objectives, we examined state plan amendments (SPA) covering the RAC program for all 50 states and the District of Columbia (D.C.) during fiscal year 2021. 5 We analyzed SPA details and identified the number of states participating, or not, in the program, as well as reasons why states requested full exemptions. In addition, we selected a nongeneralizable sample of 11 states-six participating and five nonparticipating states-during fiscal year 2021. 6 For these 11 selected states, we interviewed officials from each state's Medicaid agency, its RAC vendor, and its state Medicaid Fraud Control Unit (MFCU). We also reviewed Medicaid recovery data and state-level RAC policies and procedures for the selected states and interviewed CMS officials. See appendix I for our detailed objectives, scope, and methodology. We conducted this performance audit from June 2022 to June 2023 in accordance with generally accepted government auditing standards. 4Pub. L. No. 111-148, § 6411, 124 Stat. 119, 773 (2010). 5A state plan is an agreement between a state and the federal government describing how that state administers its Medicaid program. When a state is planning to make a change to its program policies, it is required to send state plan amendments to CMS for review and approval. 6Selectedstates participating in the RAC program are Colorado, Hawaii, New Mexico, New York, Texas and West Virginia. Selected states not participating in the RAC program are Alabama, California, Ohio, Oklahoma and Wisconsin. Page 2 GAO-23-106025 Medicaid RAC Program Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Medicaid program, which the states and the federal government Background jointly finance, provides health coverage to eligible low-income adults, children, pregnant women, elderly adults, and people with disabilities. CMS is the primary federal agency providing oversight of state Medicaid activities and facilitating program integrity efforts. A Medicaid state plan is an agreement between a state and the federal government describing the nature and scope of a state's Medicaid program. The state plan also serves as the state's assurance that its program will comply with Medicaid statutory, regulatory, and policy provisions. When a state decides to change its program policies or operational approach, for example, the state is required to send a SPA to CMS for review and approval. Medicaid RAC Program The purpose of the RAC program is to identify overpayments and underpayments and recoup overpayments made on claims for health care services provided to beneficiaries. Medicaid RACs conduct postpayment reviews of claims for improper payments (overpayments and underpayments), consistent with state laws and regulations. Medicaid RACs are intended to be a supplemental approach to Medicaid program integrity efforts already under way to ensure that states make proper payments to health care providers. Medicaid RACs do not replace any existing state program integrity or audit initiatives. States must maintain their existing program integrity efforts, including levels of funding and activity, uninterrupted. The Affordable Care Act established the statutory requirements for the Medicaid RAC program, and included the following provisions: • States will make payments to a recovery audit contractor only from amounts recovered. • States will make payments to the contractor on a contingency-fee basis for overpayments. • States will coordinate recovery audit efforts with other contractors and entities performing audits under the state plan. Page 3 GAO-23-106025 Medicaid RAC Program In general, states pay RACs from amounts recovered on a contingency- fee basis. CMS established a maximum contingency-fee rate of 12.5 percent for which federal financial participation will be available. 7 A state that determines it must pay a contingency-fee rate above CMS's ceiling rate (for example, to better attract qualified Medicaid RAC applicants) may request a waiver from CMS, or may elect to pay the differential amount between the ceiling and contracted fee solely from state funds. 8 States refund to CMS the Federal Medical Assistance Percentage (FMAP) share of the net amount of overpayment recoveries after deducting the fees paid to Medicaid RACs. 9 A state must take a Medicaid RAC's fee payments "off the top" before calculating the FMAP share of the overpayment recovery owed to CMS. Reported overpayment amounts are the balance remaining after fees (contingency and administrative) are paid to the Medicaid RAC. (See fig. 1.) 10 7CMS does not provide federal financial participation with respect to any amount of a state's contingency-fee rate in excess of the then-highest Medicare RAC contingency-fee rate unless a state requests an exception from CMS and provides an acceptable justification. 42 C.F.R. § 455.510(b)(5). 8CMS approved three of our selected states to operate their RAC program with an exception to the contingency-fee limit. 9The federal government and states share in the financing of the Medicaid program, with the federal government matching most state expenditures for Medicaid services based on the FMAP formula. The FMAP is the percentage of expenditures for Medicaid services that the federal government pays; the remainder is referred to as the state share. Federal law specifies that the FMAP will be no lower than 50 percent and no higher than 83 percent. See 42 U.S.C. § 1396d(b). 10CMS will share in states' expenditures through both the contingency-fee rate with respect to payments to the Medicaid RACs and the administrative match for qualified administrative costs associated with the state's implementation and oversight of the Medicaid RAC program. Page 4 GAO-23-106025 Medicaid RAC Program Figure 1: Example of Recovery Audit Contractor (RAC) Payment Flow for Contingent Fee-Based Audits Source: GAO analysis of Centers for Medicare & Medicaid Services information. GAO. (icons) | GAO 23-106025 Note: This example is based on the established a maximum contingency-fee rate of 12.5 percent for which federal financial participation will be available. a This example is based on a Federal Medical Assistance Percentage rate of 56.2 percent. The state receives the percentage of recovery that it originally paid on the claim (43.8 percent). Regulatory Framework for In implementing the Medicaid RAC provisions of the Affordable Care Act, Medicaid RAC Program CMS issued regulations that required states to • report suspected fraud to law enforcement authorities; • designate a contractor medical director who is a doctor of medicine or osteopathy; • include a 3-year maximum claims look-back period; • hire certified coders, unless a state determines that certified coders are not required to review Medicaid claims effectively; and • provide RAC customer service measures. 11 The Social Security Act allows "exceptions or requirements [to the Medicaid RAC program] as the Secretary may require for purposes of a particular state." 12 This provision enables CMS to vary program requirements, or exempt a state from establishing a RAC program, such as when it would be inconsistent with state law. A state is to submit a SPA to CMS for review and approval to make a change to its RAC program. These changes may include a full exemption (completely opting out of the program) or an exception (a modification to one or more 11Medicaid Program; Recovery Audit Contractors, 76 Fed. Reg. 57808 (Sept. 16, 2011) (codified as amended at 42 C.F.R. Part 455, subpart F (2021)). 1242 U.S.C. § 1396a(a)(42)(B)(i). Page 5 GAO-23-106025 Medicaid RAC Program regulatory requirements for operating a RAC program). While federal regulations set program requirements, states retain the flexibility to design, procure, and operate their RAC programs in accordance with state laws and policies. Managed Care States may provide Medicaid services under a managed care model, a fee-for-service (FFS) model, or both. 13 Under managed care, states make capitation payments, which are fixed periodic payments typically paid on a per enrolled Medicaid beneficiary basis, to managed care plans. In turn, the managed care plans are responsible for paying providers for the services delivered to enrolled beneficiaries. Over half of Medicaid expenditures are for managed care. Managed care can help states better predict program costs (since payments from the state are on a capitated basis as opposed to paying for each service). Fraud MFCUs investigate and prosecute Medicaid provider fraud. 14 Federal regulations require each state to report suspected cases of fraud or abuse to the appropriate law enforcement organization; however, recovery of overpayments, not fraud investigations, is the prescribed scope of work for Medicaid RAC vendors. Fraud detection and investigations often require more specialized skills than identifying improper payments does. CMS requires states ensure coordination between Medicaid RACs and federal and state law enforcement organizations so that they process suspected cases of fraud and abuse through the appropriate channels. Law enforcement organizations that may conduct audits or investigations include the Department of Health and Human Services' Office of Inspector General; the Department of Justice, including the FBI; state MFCUs; other federal and state law enforcement agencies as appropriate; and CMS. For example, to aid in coordination, states could establish memorandums of understanding with their MFCUs, their program integrity units, or other law enforcement agencies. 13Under FFS, the state pays providers directly for each covered service a Medicaid beneficiary received. 14Medicaid program integrity regulations define fraud as an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to that person or some other person. It includes any act that constitutes fraud under applicable federal or state law. 42 C.F.R. § 455.2. Page 6 GAO-23-106025 Medicaid RAC Program Status of States' Use of Medicaid Recovery Audit Contractors Most States Did Not Use Our review of CMS documentation from all states found that 34 states Medicaid RACs and D.C. did not participate in the Medicaid RAC program during fiscal year 2021. (See fig. 2). CMS approved full exemptions for each of these non-participating states. 15 Figure 2: Participation in the Medicaid Recovery Audit Contractor Program in Fiscal Year 2021 "States" refers to all 50 states and the District of Columbia (DC). a 15CMS review and subsequent approvals of states requesting full exemptions from the Medicaid RAC program happen on a revolving basis due to the fluid nature of the SPA process. Therefore, these numbers are subject to change periodically. Page 7 GAO-23-106025 Medicaid RAC Program Our analysis found that during fiscal year 2021, 16 states participated in the program. According to CMS, these states recovered and returned $161.1 million of Medicaid overpayments to the federal government through their RAC programs in fiscal year 2021. CMS granted states significant latitude in determining the scope of Medicaid RAC audits. This flexibility helps states to coordinate with other ongoing state and federal audit efforts. A state may also exclude providers from RAC audits and limit claim types. For example, one state limited its Medicaid RAC audits to speech therapy, optometry, and podiatry claims. Officials from the six selected states that participated in the RAC program told us that each of their states had a process in place for the state Medicaid agency to approve the health care providers that its RAC may pursue and the claim types allowed for a RAC audit. An official from one state said that this approval process allowed the state to vet the claims in order to avoid duplicative work among different program integrity initiatives, and to help ensure that the MFCU was not already investigating the provider for fraud. States Cited Managed While federal law requires states to establish a RAC program, the law Care and Other Factors also provides for exceptions. As implemented by CMS, states may request a full exemption through the SPA process by providing written for Not Using Recovery justification, which CMS reviews. Based on our analysis of the CMS- Audit Contractors approved SPAs, most states cited having other program integrity initiatives that already address the issues a RAC would cover as a reason for requesting this exemption. (See table 1.) Table 1: Reasons for Requesting a Full Exemption from the Medicaid Recovery Audit Contractor (RAC) Program in Fiscal Year 2021 Reason for exemption approved by Number of states not participating in the RAC program for exemption reason Centers for Medicare & Medicaid Services (population: 35 states)a State has other program integrity initiatives 25 State could not procure a recovery audit 22 contractor State Medicaid population is predominantly 20 enrolled in managed care Source: GAO analysis of the 50 states' and the District of Columbia's state plan amendments. | GAO-23-106025 a States include the District of Columbia. In addition, states may have more than one reason for exemption, but any single approved reason could result in a full exemption. Page 8 GAO-23-106025 Medicaid RAC Program • Program integrity initiatives. Twenty-four states and D.C. stated in their SPAs that their current program integrity efforts are effective in recovering overpayments, and as such, there is no need for a RAC program. According to the SPAs, these initiatives included robust pre- and postpayment automated review mechanisms and numerous additional audit controls to prevent and detect improper payments, implemented in collaboration with each agency's fiscal agent. According to CMS's 2020 annual report to Congress, the federal share of states' program integrity efforts to recover Medicaid overpayments was $374.5 million. 16 • Inability to procure a contractor. Twenty-one states and D.C. stated in their SPAs that their inability to procure a contractor was a reason for not having a RAC program. In their SPAs, several states said they had issued requests for a proposal but received no bids. Seven states noted that there would not be enough revenue generated to fund an adequate contingency-fee rate to attract a RAC vendor. For example, one state reported that its low Medicaid enrollment and associated expenditures would not generate enough revenue to fund the minimum costs for a RAC vendor, and the state canceled the procurement. 17 Another state reported that its RAC would incur significant operational losses under the allowed fee structure and regulatory restrictions, deterring vendors from presenting any interest in bidding on providing services as a RAC. • Managed care. Twenty states stated in their SPAs that their Medicaid population being predominately enrolled in managed care was a reason for not having a RAC program. Federal regulations allow states to exclude managed care claims from RAC review. 18 As a result, most of the claims would fall outside of the purview of the RAC. For example, in Ohio, more than 92 percent of Medicaid beneficiaries were enrolled in managed care. Therefore, the state did not project any large recoveries for a RAC under current regulations. 16The most recent report was for fiscal year 2020. The fiscal year 2021 and 2022 Medicare and Medicaid Program Integrity Report to Congress had not been finalized or released at the time of our review. According to CMS officials, CMS anticipates issuing the fiscal year 2021 report in 2023 and fiscal year 2022 report in 2024. 17A RAC incurs significant implementation costs, including systems integrations, data access and manipulation, provider outreach and education, and appeals support costs. States with small Medicaid populations, or some claim types-especially low-dollar, high- volume claims-generally do not lend themselves to contingency fee-based audits. 1842 C.F.R. § 455.506(a)(1) (2021). Page 9 GAO-23-106025 Medicaid RAC Program CMS Has Granted While federal regulations set Medicaid RAC program requirements, states Exceptions from Specific have considerable flexibility regarding program design, procurement, and operation. In the years since 2010, the year the RAC requirement went Regulatory Requirements into effect for Medicaid, states have requested and received approval to Most States Using from CMS to receive exceptions from specific regulatory requirements. Of Recovery Audit the 16 states participating in the Medicaid RAC program during fiscal year Contractors 2021, 11 operated their RAC programs with at least one approved regulatory exception (see table 2). According to a RAC vendor, these exceptions can make the RAC proposal more appealing for a vendor bid. Table 2: Regulatory Exceptions That the Centers for Medicare & Medicaid Services (CMS) Granted to States for Operating Their Recovery Audit Contractor (RAC) Programs in Fiscal Year 2021 Regulatory exception Number of participating states (population: 16 states) Operate the RAC program with an exception to 8 the 1.0 full-time equivalent (FTE) medical director requirementa Operate the RAC program with an exception to 7 the 3-year look-back periodb Operate the RAC program with an exception to 3 the contingency-fee limitc Source: GAO analysis of the 50 states' and the District of Columbia's state plan amendments. | GAO-23-106025 a CMS approved eight states' requests to lower the FTE requirement to .50 or less, and three states' requests that CMS remove the requirement completely. b CMS approved an extended look-back period of at least 5 years for seven states and allowed two states' RACs to examine claims for up to 7 years. c States pay contractors from amounts recovered on a contingent-fee rate basis. CMS does not dictate contingency-fee rates, but established a maximum rate of 12.5 percent for which federal financial participation is available. Page 10 GAO-23-106025 Medicaid RAC Program CMS Provided Inconsistent Oversight and Monitoring of the Medicaid RAC Program CMS Did Not Provide Federal regulations require states to receive CMS approval to be fully Guidance and Consistent exempt from the Medicaid RAC program. 19 CMS did not provide states a Communication to States permanent full exemption from the RAC program. Instead, CMS officials stated that it was their process to include a 2-year expiration date on the on Expiration of Approved SPA approval cover letter granting a state full exemption from the RAC SPA Exemptions from program. CMS officials also said that this was sufficient time for the state Medicaid RAC Program and CMS to reevaluate and determine whether the full exemption was still warranted. For example, in January 2022, as part of its 2-year reassessment, one state initiated its RAC program because it saw an opportunity to enhance Medicaid oversight. At the time of our review, CMS did not have written policies and procedures documenting and communicating this expiration date on the cover letters for SPA approvals granting full exemption from the RAC program. Of the 34 states and D.C. fully exempt from the RAC program, CMS did not include an expiration date for nine of the states on their most recently approved SPAs. As a result, states continued to be fully exempt from the Medicaid RAC programs without CMS determining whether the full exemptions were still warranted. For example, CMS granted one state a full exemption in July 2013, but CMS had not subsequently reviewed it by the time of our review in July 2022. GAO's Standards for Internal Control in the Federal Government states that management should implement control activities through policies. In addition, management should externally communicate the necessary quality information to achieve the entity's objectives. 20 Without written policies and procedures for CMS establishing and communicating SPA expiration dates as part of its approval process granting states a full 19See 42 C.F.R. § 455.516. 20GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 2014). Page 11 GAO-23-106025 Medicaid RAC Program exemption, states may not be periodically reconsidering their need to establish a RAC program. In addition, CMS may not be periodically reevaluating whether an exemption is warranted. As a result, the federal government may be missing opportunities to collect Medicaid overpayments where a RAC program may be warranted. CMS Had Inconsistent In addition to the nine fully exempt states without expiration dates on their Monitoring and Oversight SPA approval cover letters, we found an additional 18 fully exempt states with SPAs that had expired. We based our determination on the Controls of SPA expiration date on the SPA cover letter, at the time of our review. For Expirations example, one state's SPA for a full exemption from the RAC program had been expired for about 2 years at the time of our review. CMS officials stated that the agency has an internal tracking system to monitor states' SPA status, but the fully exempt states we identified with SPAs that had expired were likely due to an administrative error. CMS provided policies and procedures related to the processing of SPAs when they are initially received. However, our analysis of these policies and procedures found that they do not address the monitoring of the expiration dates for nonparticipating states. CMS officials stated that it is each state's responsibility to renew its SPA every 2 years. While we recognize that the states have a key role in assuring that their SPAs are not expired, CMS also has oversight responsibility to help ensure that states are taking all appropriate actions in identifying and collecting overpayments in the Medicaid program. According to GAO's Standards for Internal Control in the Federal Government, management should establish and operate activities to monitor the internal control system and evaluate the results. 21 In addition, management should implement control activities through policies. By not establishing and implementing written policies and procedures for monitoring SPA expiration dates and not communicating with states about SPAs that have expired, CMS may not be identifying whether additional states should establish RACs, and consequently may be missing opportunities to collect additional overpayments. 21GAO-14-704G. Page 12 GAO-23-106025 Medicaid RAC Program CMS Reported Limited The Affordable Care Act requires CMS to submit an annual report to Information to Congress Congress concerning the effectiveness of the RAC program, and include recommendations for expanding or improving it. 22 We found that as of our on the Effectiveness of the review, the fiscal year 2020 CMS report to Congress was limited to Medicaid RAC Program describing the number of states that did not participate in the program and the total recovered federal share of Medicaid overpayments identified by Medicaid RACs. In addition, that report did not include other information regarding effectiveness or recommendations for expanding or improving the program. 23 In our discussions with officials from selected states, we found that the states monitor or have plans to monitor the effectiveness of their RAC programs. For example, officials in one state said that it uses performance metrics with its RAC vendor to develop corrective action plans to continuously improve the program. Officials from another state informed us that they are negotiating to place new performance metrics and reporting requirements in the state's RAC contract. CMS officials stated that they do not collect performance metrics from the states, such as recoveries from FFS or from managed care, the amount of underpayments restored, or appeals information. CMS officials stated that they believe it is up to the states to monitor the effectiveness of their Medicaid RAC programs. While we recognize that the states are responsible for administering their respective Medicaid programs' day-to-day operations, CMS also plays a critical role in providing oversight for the Medicaid program. Federal oversight includes ensuring that the design and operation of state programs meet federal requirements and that states make Medicaid payments appropriately. This is especially important given that the federal government pays at least 50 percent of expenditures for Medicaid services. Because CMS has not reported on the effectiveness of the Medicaid RAC program, Congress and other external stakeholders do not have key information to monitor whether the RAC program is identifying and reducing improper payments. In addition, without information related to 22Pub. L. No 111-148, § 6411(c), 124 Stat. at 775. 23Department of Health and Human Services, Centers for Medicare & Medicaid Services, Medicare and Medicaid Program Integrity Annual Report to Congress Fiscal Year 2020 (Baltimore, Md.: 2020). Page 13 GAO-23-106025 Medicaid RAC Program RAC performance, CMS lacks the ability to determine the program's progress and to make informed decisions about potential improvements and expansion for the RAC program. As a result, the federal government may be missing opportunities to further collect Medicaid overpayments. The Payment Integrity Information Act of 2019 (PIIA) requires each CMS Has Not executive agency to conduct recovery audits with respect to each agency Considered the program and activity that expends $1,000,000 or more annually if conducting the audits would be cost effective. 24 According to the Office of Opportunity to Management and Budget's (OMB) implementing guidance for PIIA, an Improve the RAC agency may exclude payments from certain programs from recovery-audit activities if the agency determines that they are not a cost-effective Program by method for identifying and recapturing overpayments, or if the agency Performing a Cost- already has in place other mechanisms to identify and recapture overpayments. 25 Effectiveness Study on Including In 2011, CMS issued the regulations that implemented the Medicaid RAC program. However, the regulations only required states to establish a Managed Care in the RAC program for a portion of their Medicaid payments, those designated Scope of RAC Audits as FFS. The preamble to the final rule noted that "Medicaid RACs will only be required to review FFS claims until that time as a permanent Medicare managed care RAC program is fully operational or a viable state Medicaid model is identified, at which point, we may engage in future rulemaking with regard to the review of managed care claims by Medicaid RACs." 26 Since 2011, CMS has not performed any studies or analyses to determine if the inclusion of managed care payments in the RAC program would be cost effective. According to CMS officials, CMS does not plan to perform such analysis because officials said that it is up to each state to determine if performing recovery audits of managed care payments is cost effective in the state. As stated earlier, CMS plays a key role in helping ensure that states make Medicaid payments appropriately. As part of this role, CMS can determine whether including managed care payments in the Medicaid 2431 U.S.C. §3352(i). 25Office of Management and Budget, Appendix C to OMB Circular A-123, Requirements for Payment Integrity Improvement, OMB Memorandum M-21-19 (Washington, D.C.: Mar. 5, 2021). 2676 Fed. Reg. at 57836. Page 14 GAO-23-106025 Medicaid RAC Program RAC program would be cost effective for the overall program. CMS has also established an exemption framework for the RAC program where states can decide not to include such payments based on other program initiatives. Medicaid's managed care population has grown since the Medicaid RAC program's establishment. In 2011, CMS reported that Medicaid's managed care population had about 42 million enrollees that accounted for about 74 percent of the total Medicaid population. 27 In 2020, the reported figures were about 68 million and about 84 percent, respectively. 28 Many states continue to use the managed care RAC exclusion. As previously discussed, our analysis of SPAs found that most-20 of the 34 RAC-exempt states and D.C.-cited having a predominately managed care population as a reason for requesting the full exemption. In addition, two of our selected states that currently have RAC programs have not included managed care payments in their RAC audit scope. For example, one state told us that the option to include, or not, managed care payments in its RAC program primarily drove its choice not to expand its scope. This state said that the expansion of the RAC program to managed care would require a change in state statute, and that such a change would be difficult to make without a federal requirement. According to RAC vendor officials, RACs can in fact successfully recover overpayments from the managed care sector. The RAC vendor officials stated that depending on the state, the RAC can recover claims directly from the health care provider, similar to FFS overpayments, or it can collect overpayments directly from managed care organizations (MCO). 29 Our prior work found that CMS's Payment Error Rate Measurement for managed care claims does not account for key program integrity risks in 27Department of Health and Human Services, Centers for Medicare & Medicaid Services, Medicaid Managed Care Enrollment Report, Summary Statistics as of July 1, 2011 (Baltimore, Md.: November 2012). 28Department of Health and Human Services, Centers for Medicare & Medicaid Services, Medicaid Managed Care Enrollment and Program Characteristics, 2020 (Baltimore, Md.: Spring 2022). 29In a managed care delivery system, beneficiaries obtain some portion of their Medicaid services from an organization under contract with the state, an MCO, to which payments are made on a predetermined, periodic basis, typically, per person per month. Page 15 GAO-23-106025 Medicaid RAC Program managed care, like unidentified overpayments. 30 The RAC program could be a method to recover some of these overpayments. Three of the five selected states with an active RAC program allowed it to audit MCO claims. 31 One state's Medicaid officials explained that the state decided to expand its RAC audit scope because of its large MCO Medicaid population. This state reported recovering $177.5 million and $81.9 million in overpayments from MCOs and their providers for fiscal years 2021 and 2022, respectively. In addition, another state's contractor reported collecting recoveries totaling about $7.6 million since 2013. Because that state has a predominately managed care population, the RAC primarily focuses on managed care and related payments, recovering over $2 million from duplicate capitation payments alone. By CMS conducting a study to determine the cost effectiveness of expanding RACs to audit managed care claims, the federal government may have additional opportunities to recover Medicaid overpayments from MCOs and their providers. Given Medicaid's persistent vulnerability to improper payments, it is Conclusions important that states use all available means, including the RAC program, to identify and recover such payments. Ineffective CMS oversight and monitoring has hindered the effectiveness of the RAC program, which began with the enactment of the Affordable Care Act. Requiring states to renew their SPA exemptions from the RAC program, establishing written policies and procedures for monitoring SPA expiration dates, gathering and reporting information related to RAC performance, and conducting a study to determine whether it is cost effective to require states to include payments to managed care organizations in their RACs' audit scope would help to reasonably assure an effective Medicaid RAC program. Establishing these improvements would significantly increase the likelihood of identifying and recovering additional improper payments in the Medicaid program. 30GAO,Medicaid: CMS Should Take Steps to Mitigate Program Risks in Managed Care, GAO-18-291 (Washington, D.C.: May 7, 2018). 31The three selected states were Hawaii, New York, and West Virginia. Although West Virginia modified its state plan amendment to allow RACs in fiscal year 2021, the RAC program was not implemented until fiscal year 2022. Page 16 GAO-23-106025 Medicaid RAC Program We are making the following four recommendations to CMS: Recommendations for Executive Action The Administrator of CMS should establish and implement written policies and procedures to document and communicate an expiration date when approving SPAs that have a full exemption from the RAC program. (Recommendation 1) The Administrator of CMS should establish and implement written policies and procedures for the agency to monitor SPA expiration dates. (Recommendation 2) The Administrator of CMS, in collaboration with the states, should describe the effectiveness of the RAC program and include recommendations, if any, for expanding or improving the program in their annual report to Congress. (Recommendation 3) The Administrator of CMS should conduct a study to determine whether it is cost effective to require states to include payments to managed care organizations and their providers as part of the RAC program. (Recommendation 4) We provided a draft of this report to CMS for review and comment. In its Agency Comments written comments, reproduced in appendix II, CMS concurred with two of and Our Evaluation our four recommendations, partially concurred with one, and disagreed with one. CMS also provided technical comments, which we incorporated as appropriate. Specifically, CMS concurred with recommendations 1 and 2, and cited actions that it will take to address them. We believe that if CMS implements them effectively, these actions should address those two recommendations. CMS partially concurred with recommendation 3, which is that CMS, in collaboration with states, should describe the effectiveness of the RAC program and include recommendations, if any, for expanding or improving the program in its annual report to Congress. In its written comments, CMS stated that it concurs with the recommendation to make information available to expand or improve the RAC program. Specifically, it plans to add certain information to the annual Medicare and Medicaid Program Integrity Report to Congress. This added information includes a breakdown of the states with full or partial exemptions, and promising state practices in RAC administration that other states may use when determining if and how to administer a RAC program. CMS further stated Page 17 GAO-23-106025 Medicaid RAC Program that it believes the current identification of RAC overpayment recoveries in the report already satisfies the statutory requirement to report on the effectiveness of states' Medicaid RAC programs. We agree that the reporting of RAC overpayment recoveries is important for determining the effectiveness of the Medicaid RAC program. However, Congress and other external stakeholders do not have other important information that would help them monitor how well the Medicaid RAC program is identifying and reducing improper payments. One such metric is a breakout of overpayments collected, underpayments restored, and amounts overturned on appeal. CMS's planned actions would help meet the intent of our recommendation, if effectively implemented. CMS disagreed with recommendation 4, which is that CMS should conduct a study to determine whether it is cost effective to require states to include payments to managed care organizations and their providers as part of the RAC program. In its written comments, CMS said that states are permitted to tailor their RAC programs to their specific needs and environment. In addition, CMS said states have many other ways to oversee managed care improper payments. While CMS suggested that we remove our recommendation, we stand by our suggested course of action. CMS already has established a framework that allows states to request exemptions from the RAC program to address their specific needs and environment, irrespective of whether managed care is required to be included in Medicaid RAC program. CMS further stated that it must be mindful of time and resources, and that conducting a study regarding the cost-effectiveness of requiring all states to include managed care in their RAC programs may not be the most efficient use of time and resources. CMS stated that many states with large managed care populations have reported that the contingency fee payment methodology is not financially feasible for managed care encounters. While it is important that CMS use its resources efficiently, it is also essential that states use Medicaid funds effectively. CMS plays a key role in helping ensure that states make Medicaid payments appropriately. As part of this role, CMS can determine whether including managed care payments in the RAC program would be cost effective for the overall program. Our report provided examples of states that have incorporated managed care in their Medicaid RAC programs, including one that has Page 18 GAO-23-106025 Medicaid RAC Program collected about $250 million over a 2-year period. Another state told us that the option to include, or not include, managed care payments in its RAC program primarily drove its choice not to expand its scope. This state said that the expansion of the RAC program to managed care would require a change in state statute, and that such a change would be difficult to make without a federal requirement. In addition, states with large managed care populations may request an exemption from the program because the RAC vendor may be limited to only FFS claims, which would not generate enough revenue to fund a RAC vendor. However, if the RAC scope was to include managed care claims, this could generate sufficient revenue to support a RAC program. Therefore, we continue to believe that our recommendation for CMS to conduct a cost-effectiveness study is valid to help ensure that the federal government explores all opportunities to recover Medicaid overpayments. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-5683 or padillah@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. M. Hannah Padilla Director Financial Management and Assurance Page 19 GAO-23-106025 Medicaid RAC Program Appendix I: Objectives, Scope, and Appendix I: Objectives, Scope, and Methodology Methodology Our objectives were to (1) describe the status of states' participation in the Medicaid Recovery Audit Contractor (RAC) program; (2) evaluate how the Centers for Medicare & Medicaid Services (CMS) oversees states' implementation of Medicaid RAC programs; and (3) evaluate what opportunities, if any, exist for CMS to improve the RAC program. For the first objective, we reviewed the 51 state plan amendments (SPA) for all states and the District of Columbia that were in effect during fiscal year 2021. We analyzed details from these SPAs to determine the number of states participating, or not, in the RAC program, as well as reasons for requests for exceptions to the RAC regulatory requirements or full exemptions from the RAC program. For the second and third objectives, we interviewed officials from eleven selected states: Alabama, California, Colorado, Hawaii, New Mexico, New York, Ohio, Oklahoma, Texas, West Virginia, and Wisconsin. We chose this judgmental sample of states to reflect a range of different characteristics, including Medicaid expenditures, delivery systems (both fee-for-service and managed care), participation in the RAC program, and geographic diversity. For each of these 11 selected states, consisting of six participating states and five nonparticipating states, we interviewed officials from state Medicaid agencies, their RAC vendors, and their state Medicaid Fraud Control Units. The experiences of the Medicaid officials in the 11 selected states are not generalizable to other states. For the second objective, to evaluate how CMS oversees the Medicaid RAC program, we reviewed the Patient Protection and Affordable Care Act for CMS oversight and reporting requirements. In addition, we determined that internal controls were significant to our objectives. Specifically, we determined that the control activities component of internal control, along with the underlying principle that management should design control activities to achieve its objectives and respond to risks, was significant to our objective. Further, we determined that the monitoring component of internal control, that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results, was significant to our objective. We interviewed CMS officials and obtained documentation, when available, on their processes for monitoring how CMS oversees states' implementation of RACs. In addition, we interviewed officials from the 11 selected states and their RAC vendors, if applicable, regarding their implementation of the RAC program. For participating states, we also obtained and reviewed contracts, state-level RAC policies and Page 20 GAO-23-106025 Medicaid RAC Program Appendix I: Objectives, Scope, and Methodology procedures, and other supporting documentation to gain an understanding of their RAC programs. For the third objective, we reviewed RAC requirements in the Payment Integrity Information Act of 2019 (PIIA) 1 and the related guidance in appendix C to Office of Management and Budget (OMB) Circular A-123, Requirements for Payment Integrity Improvement. 2 We reviewed these documents to identify key criteria that agencies must meet for a RAC program. In addition, we determined that the information and communication component, from GAO's Standards for Internal Control in the Federal Government, and the principle that management should externally communicate the necessary quality information to achieve the entity's objectives, were significant to our objective. 3 We compared the regulatory framework of CMS's RAC program with statutory PIIA requirements and OMB related guidance to determine if there were opportunities to improve the RAC program. We reviewed Medicaid recovery data obtained from CMS and selected states to determine the effectiveness of the program. We also interviewed officials from the 11 selected states and their RAC vendors, if applicable, about CMS's efforts to share promising practices, and how they learned of other states' strategies to improve the RAC program. We also interviewed CMS officials on their views for improving the RAC program. We conducted this performance audit from June 2022 to June 2023 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 1Pub L. No. 116–117, 134 Sat. 113 (Mar. 2, 2020). 2Officeof Management and Budget, Appendix C to Circular No. A-123, Requirements for Payment Integrity Improvement, OMB Memorandum M-21-19 (Washington, D.C.: Mar. 5, 2021). 3GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 2014). Page 21 GAO-23-106025 Medicaid RAC Program Appendix II: Comments from the Department Appendix II: Comments from the Department of Health & Human Services of Health & Human Services Page 22 GAO-23-106025 Medicaid RAC Program Appendix II: Comments from the Department of Health & Human Services Page 23 GAO-23-106025 Medicaid RAC Program Appendix II: Comments from the Department of Health & Human Services Page 24 GAO-23-106025 Medicaid RAC Program Appendix II: Comments from the Department of Health & Human Services Page 25 GAO-23-106025 Medicaid RAC Program Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments Acknowledgments M. Hannah Padilla, (202) 512-5683 or padillah@gao.gov GAO Contact In addition to the contact named above, Matthew Valenta (Assistant Staff Director), Melanie Darnell (Auditor-in-Charge), Jessica Boucher, Frances Acknowledgments Dagohoy, Tech Le, Laura Pacheco, Michelle Rosenberg, and Carolyn Yocom made key contributions to this report. Page 26 GAO-23-106025 Medicaid RAC Program