Strengthening Medicaid Program Integrity
The size, growth, and diversity of the joint federal-state Medicaid program present oversight challenges and we designated Medicaid a high-risk program in 2003. Since then, we have made more than 270 recommendations related to the program.
In fiscal year 2018, Medicaid covered an estimated 75 million low-income and medically needy individuals at a cost of $629 billion, of which $393 billion was financed by the federal government. Services are increasingly delivered through managed care, under which organizations are paid a set amount per beneficiary for care.
Our recent work highlights oversight challenges in three areas: improper payments, appropriate use of program dollars, and data. First, Medicaid improper payments represented about 9.8 percent of federal program spending—$36.2 billion—in fiscal year 2018. Second, CMS can waive certain Medicaid requirements and authorize states to incur new types of expenditures through demonstrations; as of November 2016, CMS had done so for nearly three-quarters of states. Supplemental payments—made to providers, such as local government hospitals and not linked to specific beneficiary services—grew to over $48 billion in 2016, the most recent year for which data are available. Third, CMS’s oversight of Medicaid often relies on state-reported expenditure and utilization data. Incomplete and inconsistent state data complicate program oversight.
Since our 2017 High-Risk Report, CMS has taken important steps to strengthen Medicaid program integrity. Further, leadership has demonstrated a commitment to continuing these efforts by outlining a high-level program integrity strategy. Still, work remains to fully “meet” all of the high-risk criteria.
As of November 2018, more than 70 of our recommendations related to Medicaid remain open, and several major steps remain to improve Medicaid program integrity. For example, more efforts are needed to mitigate the risks not captured in CMS’s improper payment estimate—particularly for managed care. CMS can also do more to target risk in overseeing the use of program dollars and to expedite the use of improved Medicaid data in program oversight. For this report, we are rating three segments of the Medicaid program, all of which are priority areas identified by CMS. CMS has met our criteria for leadership commitment for improper payments, the one segment we rated in 2017, and the other four criteria remain partially implemented. For the remaining two segments—the appropriate use of Medicaid dollars and Medicaid data—CMS partially meets nearly all criteria.
Since our 2017 High-Risk Report, we have increased one of the five criteria.
Leadership commitment: met. CMS has shown an increased commitment to oversight of improper payments. In June 2018, CMS communicated the agency’s strategy for improving program integrity, including plans for a number of new and enhanced efforts to detect and respond to improper payments. For example, the strategy highlighted a commitment to enhanced auditing efforts and monitoring compliance with new managed care rules established in 2016. Further, CMS has taken important steps towards coordinating oversight with state auditors as a means of expanding its oversight of improper payments.
Capacity: partially met. CMS has taken actions to enhance the resources and guidance available to states for program integrity purposes. Based on its reviews of states’ program integrity activities, CMS has targeted high-risk areas in each state, including managed care, and expanded federal-state collaborative audits to include Medicaid managed care organizations (MCO). In 2018, CMS reported working to improve federal-state collaborative audits, such as by meeting with all states to discuss how operational audit issues will be handled moving forward, including planning for new collaborative audits. However, efforts to date do not ensure CMS can estimate an improper payment rate for managed care that reflects all program risks. Additionally, as we reported in July 2018, impediments to conducting audits of managed care—such as a focus on states with certain provisions around overpayments in MCO contracts—continue.
Action plan: partially met. In June 2018, CMS outlined a strategy to reduce Medicaid improper payments, including plans to check the accuracy of MCO’s financial statements, assist states with screening Medicaid providers, and initiate audits of certain state beneficiary eligibility determinations. If fully implemented, these steps could address some of the concerns we raised in January 2017 and May 2018. However, CMS has not detailed the scope and timing of this strategy. For example, the strategy does not include how many states will be part of the targeted audits for MCO financial statements nor does it specify implementation dates.
Monitoring: partially met. Our work has detailed concerns related to the accuracy of provider eligibility and beneficiary enrollment, both of which can have an impact on CMS’s ability to monitor improper payments. To improve the effectiveness of managed care provider screening, CMS analyzed 22 databases used by MCOs and formally incorporated 6 into the agency’s provider screening process. However, efforts to enhance screening are ongoing and the agency does not require states to report MCO overpayments. Gaps also remain in CMS’s efforts to ensure that only eligible individuals are enrolled and expenditures for enrollees, mainly those eligible through the Patient Protection and Affordable Care Act expansion, are matched appropriately by the federal government.
Demonstrated progress: partially met. CMS’s overall estimated Medicaid improper payment rate declined from 10.5 percent in fiscal year 2016 to 9.8 percent in fiscal year 2018. This rate is comprised of three components: (1) fee-for-service (FFS) payments to providers, (2) payments to MCOs, and (3) the accuracy of beneficiary eligibility determinations. The FFS component of the error rate is 14.3 percent, primarily due to state’s non-compliance with provider screening, enrollment, and identification requirements. The reduction in the overall error rate occurred as spending shifted from FFS to managed care, where estimates of improper payments—at 0.22 percent in 2018—do not account for all program risks. In particular, CMS’s estimates of MCO improper payments do not include a medical review of services or reviews of MCO records or data, which likely minimizes the appearance of program risks in Medicaid managed care. The beneficiary eligibility component of the error rate is 3.1 percent, a rate that CMS has not updated since 2014, raising further questions regarding the accuracy of the overall rate. CMS plans to resume eligibility component measurement in 2019.
Appropriate Use of Medicaid Dollars
We are rating this segment for the first time. CMS has taken important steps—such as improved reporting of payments and steps to mitigate federal financial exposure—to better ensure the appropriate use of Medicaid dollars. Our work has identified risks—and potential actions to mitigate these risks—related to oversight of demonstration spending under section 1115 of the Social Security Act, supplemental payments, and Medicaid expenditures more broadly.
Leadership commitment: partially met. With respect to demonstrations, CMS began implementing a policy in 2016 that significantly improves efforts to assure demonstrations are budget neutral—that is, that the demonstration does not increase federal costs. Further, as we previously recommended in June 2013 and April 2017, the agency issued guidance to states in August 2018 articulating the agency’s budget neutrality policy, which improves transparency in how CMS approves demonstration spending limits and consistency in oversight of demonstration spending. However, additional policy changes are needed to address other questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set spending limits and to provide policymakers with timely findings from evaluations of demonstrations.
With regard to supplemental payments—payments made to providers such as local government hospitals and other providers in addition to claims-based payments—CMS anticipates issuing a proposed rule in early 2019 designed to increase transparency by establishing new requirements for states. However, until CMS issues a final rule, its potential effect on program integrity efforts will remain unclear.
Capacity: partially met. With regard to demonstrations, CMS actions show promise, but are, to date, incomplete. As of November 2018, CMS had developed a standard reporting tool to ensure that states consistently report the data elements needed for CMS to assess compliance with demonstration spending limits and was beginning to test this tool. The agency also was developing procedures for CMS staff to consistently track spending compared with spending limits. Until these procedures are fully implemented, the impact on oversight of demonstrations remains unclear.
With regard to supplemental payments, as of November 2018, CMS had issued letters to some states clarifying that the distribution of supplemental payments must be linked to the provision of Medicaid-covered services. Because supplemental payments are not linked directly to services for beneficiaries, there is risk that they may not be made for Medicaid activities or services. CMS has not taken action on our recommendation that the agency issue guidance on the appropriate distribution of supplemental payments to all states, nor has it issued other needed guidance, including criteria to assure that payments meet statutory requirements.
With regard to oversight of states’ reported expenditures and in response to our findings, CMS plans to conduct a national assessment of whether oversight resources are adequate and target areas of greatest risk. This is critical, as the complexity of expenditure reporting has increased while staff resources used to review states’ expenditures has decreased, thus hindering CMS’s ability to target risk and protect federal and state dollars.
Action plan: partially met. With respect to demonstrations, the agency has issued guidance to states in 2017 and 2018 with the intent to improve efforts to ensure demonstrations are budget neutral and effectively evaluated. However, this guidance addresses some, but not all, of the concerns we raised in January 2018 about how CMS sets spending limits and evaluates demonstrations. For example, CMS has not yet implemented its plan to establish written procedures for all states to submit a final evaluation report at the end of each demonstration cycle, nor has it established criteria for when the agency will allow limited evaluations. Further, CMS has not made progress with regard to an action plan for improving its oversight of supplemental payments.
Monitoring: partially met. For demonstrations, CMS has begun assessing the effect of its new budget neutrality policy with the renewal of each demonstration. Agency officials told us that CMS has developed a reporting tool for states that will allow for monitoring of the policy over time. Until CMS implements the tool, it will lack the data it needs to effectively monitor this new policy.
For supplemental payments, CMS has taken action when we and others identified questionable payments (payments where the appropriateness of the amounts or use of funds were questionable). CMS reviewed excessive payments we identified in April 2015 in New York and made retroactive payment reductions totaling more than $1.5 billion, of which the federal share was about $771 million. However, CMS continues to lack a strategy for systematically identifying questionable payments.
Demonstrated progress: partially met. CMS has not made significant progress towards improving its oversight of supplemental payments, for which reporting remains incomplete. With regard to oversight of demonstration spending, CMS estimated its budget neutrality policy reduced total demonstration spending limits by $109 billion for 2016 through 2018, the federal share of which is $62.9 billion. Another component of that policy does not take effect until 2021 and will be implemented as demonstrations come up for renewal—which should further reduce federal liabilities.
We are rating the Medicaid data segment for the first time. CMS has taken steps to improve data quality across the Medicaid program, primarily through a re-envisioning of states’ data reporting. However, CMS needs to take additional steps to ensure data quality and specify how and when it will use improved data for oversight. Accurate and complete data on beneficiary access and use of services and the costs of providing such services are critical to effectively managing and overseeing this multibillion dollar program.
Leadership commitment: partially met. CMS has made progress in improving Medicaid data through the ongoing implementation of the Transformed Medicaid Statistical Information System (T-MSIS). As of June 2018, all states, the District of Columbia, and Puerto Rico were submitting at least some T-MSIS data. However, we reported in December 2017 that these data were not complete, nor were they comparable across states. We recommended CMS take steps to expedite the use of T-MSIS data for oversight. CMS noted in July 2018 that its primary goal is to improve data quality, and more work is needed before it can use these data for oversight.
Capacity: partially met. The 2016 managed care final rule includes several requirements that could improve the reliability of state-collected MCO utilization data, known as encounter data. These requirements include requiring states to conduct an independent audit of the encounter data reported by each MCO, providing CMS with an annual assessment of these data, and validating data reliability. However, it remains unclear whether state efforts to validate encounter data will be sufficient, in part because CMS has not provided minimum standards to states for doing so.
Action plan: not met. CMS needs to develop an action plan for using quality program data for program oversight. In December 2017, we recommended CMS articulate a plan and associated time frames for using T-MSIS data for oversight. The agency concurred, but has yet to specify such a plan. It notes the use of these data for oversight is contingent upon ongoing CMS and state efforts to ensure their quality. Similarly, in January 2017, we recommended CMS develop a plan for using data on personal care services (PCS)—assistance with activities of daily living such as bathing, dressing, and toileting, for beneficiaries with limited ability to care for themselves—to inform oversight efforts. CMS has yet to develop this plan.
Monitoring: partially met. In February 2018, CMS issued guidance on Medicaid PCS reported by states, which suggests that states include key data elements in PCS claims reported through T-MSIS and could address information gaps we identified. T-MSIS also includes data elements for states to report provider-specific supplemental payments, which CMS did not previously collect. However, we reported in December 2017 that several selected states were not reporting all these data elements. Without complete information, CMS’s oversight of PCS and supplemental payments will be limited.
Demonstrated progress: partially met. The ongoing implementation of T-MSIS has been a significant, multi-year effort. With all states now reporting at least some T-MSIS data, CMS is focused on assessing and improving data quality. CMS identified 12 top priority items and issued a State Health Official letter in August 2018 that informed states they are expected to resolve data quality issues related to these priority items within 6 months. CMS stated that it will request states that do not meet this time frame to submit a corrective action plan. CMS also noted that it intends to expand data reviews beyond the 12 top priority items, but has not specified a time frame for completing this and other data quality efforts or its plans for using these data for oversight.
Since designating Medicaid as a high-risk area in 2003, we have made at least 45 recommendations related to improper payments, 17 of which were open as of November 2018. To reduce improper payments, CMS needs to:
- mitigate program risks not measured through its estimate of MCO improper payments, such as overpayments and unallowable costs—such efforts could include actions such as revising the payment error rate methodology or focusing additional audit resources on managed care;
- expedite the issuance of planned guidance on MCO program integrity, address impediments to MCO audits, and ensure states account for overpayments when setting future payment rates; and
- review federal determinations of Medicaid eligibility for accuracy, use the information obtained from the eligibility reviews to inform expenditure reviews, and increase assurances that expenditures for different eligibility groups are correctly reported and appropriately matched.
Appropriate Use of Medicaid Dollars
Since designating Medicaid as a high-risk area in 2003, we have made at least 55 recommendations related to the appropriate use of program dollars, 18 of which were open as of November 2018. CMS needs to take the following steps to better assure the appropriate use of Medicaid dollars:
- address questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set demonstration spending limits, develop and document standard operating procedures for monitoring spending under demonstrations, assure timely state evaluation of demonstrations, and develop a policy for publicly releasing findings from federal evaluations of demonstrations;
- ensure complete and accurate reporting on supplemental payments made to individual hospitals and institutional providers, as well as the sources of funds states use to finance their share of Medicaid payments; outline clear criteria, data, and a review process to ensure supplemental payments are economical and efficient; and write guidance clarifying its policy that requires a link between the distribution of supplemental payments and Medicaid-covered services; and
- complete a risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated according to risk.
Congressional Actions Needed
Congressional action could improve oversight of Medicaid expenditures, particularly related to supplemental payments and demonstrations:
- Congress should consider establishing statutory requirements for the Secretary of the Department of Health and Human Services to improve the demonstration review process to more clearly outline the methods used to demonstrate budget neutrality, and
- Congress should consider broadening supplemental payment requirements around reporting and auditing to include all types of supplemental payments.
Since designating Medicaid as a high-risk area in 2003, we have made over 35 recommendations related to Medicaid data, 13 of which were open as of November 2018. To improve the quality of Medicaid data for use in program oversight, CMS needs to:
- provide states with guidance that includes minimum standards for encounter data validation procedures;
- provide states with information on scope and methodology requirements for MCO encounter data audits, required content of the annual assessment report, and circumstances for deferring or disallowing matching funds in response to noncompliant encounter data submissions; and
- continue efforts to assess and improve T-MSIS data, such as refining the overall data priority areas to identify those variables most critical for reducing improper payments, and articulate specific plans and associated timeframes for using T-MSIS data.
GAO-19-10: Published: Oct 19, 2018. Publicly Released: Nov 19, 2018.
States collect data on Medicaid services to help the Centers for Medicare & Medicaid Services (CMS) oversee the managed care program. For example, this data can help set managed care payment rates, identify inappropriate billing patterns, and ensure access to services. But what if the data isn’t reliable? CMS started requiring states to have independent audits of their data to help ensure reli...
GAO-18-564: Published: Aug 6, 2018. Publicly Released: Sep 5, 2018.
The Centers for Medicaid & Medicare Services (CMS) review state spending reports to verify that states appropriately spent their federal Medicaid funds. CMS reviewers have saved over $5 billion in the past 4 years by identifying errors in state spending reports—finding expenditures that lacked supporting data or were not allowed under Medicaid rules. Could they be finding more? CMS may be miss...
GAO-18-528: Published: Jul 26, 2018. Publicly Released: Jul 26, 2018.
Almost half—$171 billion—of Medicaid spending in 2017 went to managed care organizations (MCO). In Medicaid managed care, states pay a set periodic amount to MCOs for each enrollee, and MCOs pay health care providers for the services delivered to enrollees. Used effectively, managed care can help states reduce Medicaid costs. However, managed care still is at risk of making incorrect payments...
GAO-18-220: Published: Jan 19, 2018. Publicly Released: Feb 20, 2018.
About one-third of Medicaid's spending goes toward demonstrations, which allow states to test new approaches to delivering Medicaid services. Do they save money? Improve care? The short answer is that states and the federal government don't fully know. We found that the federal government did not require complete and timely evaluations from the states, so conclusive results were not available. Mo...
GAO-18-70: Published: Dec 8, 2017. Publicly Released: Jan 8, 2018.
State-reported data help the federal government oversee the Medicaid program, which made an estimated $36.7 billion in payment errors in 2017. However, there have been longstanding concerns that those data are not sufficient for effective oversight. To help, federal administrators established a new data repository. Nearly all states now submit data that could be used to improve oversight and prog...
GAO-17-312: Published: Apr 3, 2017. Publicly Released: May 3, 2017.
Many states conduct Medicaid demonstrations, which allow them to test new approaches for delivering Medicaid services. The Centers for Medicare & Medicaid Services monitors spending under these demonstrations to ensure that the federal government does not pay more for them than it would have paid for the state's traditional Medicaid program. We found that, over the last decade, Medicaid has spent...
GAO-17-173: Published: Jan 6, 2017. Publicly Released: Feb 6, 2017.
Medicaid made an estimated $36 billion in payment errors in 2016—underscoring the need for improved oversight. Federal Medicaid administrators rely on state-reported data to inform oversight activities, but we found continuing concerns regarding such data's completeness, accuracy, and timeliness. Although Medicaid administrators cite a key initiative to gather new, better data and improve prog...
GAO-16-108: Published: Feb 5, 2016. Publicly Released: Mar 7, 2016.
Not all selected hospitals in the four states GAO reviewed tracked their use of revenues from the large supplemental payments they received and tracking of revenues is generally not required. Based on information obtained from hospital officials and a review of demonstration approval documents, GAO determined that the revenues were used for a broad range of purposes. For example,Officials from nin...
GAO-16-53: Published: Oct 16, 2015. Publicly Released: Oct 23, 2015.
PPACA-expansion and state-expansion enrollees—individuals who were not eligible under historic Medicaid eligibility rules but are eligible under (1) a state option to expand Medicaid under the Patient Protection and Affordable Care Act (PPACA), or (2) a state's qualifying expansion of coverage prior to PPACA's enactment—comprised about 14 percent of Medicaid enrollees and about 10 percent of M...
GAO-15-322: Published: Apr 10, 2015. Publicly Released: May 11, 2015.
GAO's assessment of Medicaid payments to government and private hospitals in three selected states was hampered by inaccurate and incomplete data on payments. States must capture but are not required to report all payments they make to individual institutional providers, nor are states required to report ownership information. For example, large supplemental payments states often make to hospitals...
GAO-13-48: Published: Nov 26, 2012. Publicly Released: Dec 21, 2012.
The recently implemented annual audits and reports for states' disproportionate share hospital (DSH) payments could improve oversight by the Centers for Medicare & Medicaid Services (CMS)--the federal agency that oversees Medicaid--by illuminating needed changes. States are required to submit audits and reports to CMS as a condition for receiving federal funds for their DSH payments. The first set...
GAO-08-87: Published: Jan 31, 2008. Publicly Released: Mar 3, 2008.
Medicaid, a joint federal and state program, finances health care for 60 million low-income people. Section 1115 of the Social Security Act authorizes the Secretary of Health and Human Services to waive certain federal Medicaid requirements and allow demonstration projects that are likely to promote Medicaid objectives. Under federal policy, states must show that federal spending for proposed demo...