Medicaid Managed Care: CMS's Oversight of States' Rate Setting Needs Improvement

Medicaid managed care rates are required to be actuarially sound. A state is required to submit its rate-setting methodology, including a description of the data used, to the Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services (CMS) for approval. The Children's Health Insurance Program Reauthorization Act of 2009 required GAO to examine the extent to which states' rates are actuarially sound. GAO assessed CMS oversight of states' compliance with the actuarial soundness requirements and efforts to ensure the quality of data used to set rates. GAO reviewed documents, including rate-setting review files, from 6 of CMS's 10 regional offices. The selected offices oversaw 26 of the 34 states with comprehensive managed care programs; the states' programs varied in size and accounted for over 85 percent of managed care enrollment. GAO interviewed CMS officials and Medicaid officials from 11 states that were chosen based in part on variation in program size and geography.

CMS has been inconsistent in reviewing states' rate setting for compliance with the Medicaid managed care actuarial soundness requirements, which specify that rates must be developed in accordance with actuarial principles, appropriate for the population and services, and certified by actuaries. Variation in CMS regional office practices contributed to this inconsistency in oversight. For example, GAO found significant gaps in CMS's oversight of two states. 1) First, the agency had not reviewed Tennessee's rate setting for multiple years and only determined that the state was not in compliance with the requirements through the course of GAO's work. According to CMS officials, Tennessee received approximately $5 billion a year in federal funds for rates that GAO determined had not been certified by an actuary, which is a regulatory requirement. 2) Second, CMS had not completed a full review of Nebraska's rate setting since the actuarial soundness requirements became effective, and therefore may have provided federal funds for rates that were not in compliance with all of the requirements. Variation in a number of CMS regional office practices contributed to these gaps and other inconsistencies in the agency's oversight of states' rate setting. For example, regional offices varied in the extent to which they tracked state compliance with the actuarial soundness requirements, their interpretations of how extensive a review of a state's rate setting was needed, and their determinations regarding sufficient evidence for meeting the actuarial soundness requirements. As a result of our review, CMS took a number of steps that may address some of the variation that contributed to inconsistent oversight, such as requiring regional office officials to use a detailed checklist when reviewing states' rate setting. However, additional steps are necessary to prevent further gaps in oversight and additional federal funds from being paid for rates that are not in compliance with the actuarial soundness requirements. CMS's efforts to ensure the quality of the data used to set rates were generally limited to requiring assurances from states and health plans--efforts that did not provide the agency with enough information to ensure the quality of the data used. CMS's regulations do not include standards for the type, amount, or age of the data used to set rates, and states are not required to report to CMS on the quality of the data. When reviewing states' descriptions of the data used to set rates, CMS officials focused primarily on the appropriateness of the data rather than their reliability. With limited information on data quality, CMS cannot ensure that states' managed care rates are appropriate, which places billions of federal and state dollars at risk for misspending. States and other sources have information on the quality of data used for rate setting--information that CMS could obtain. In addition, CMS could conduct or require periodic audits of data used to set rates; CMS is required to conduct such audits for the Medicare managed care program. GAO recommends that CMS implement a mechanism to track state compliance with the requirements, clarify guidance on rate-setting reviews, and make use of information on data quality in overseeing states' rate setting. HHS agreed with our recommendations and described initiatives underway that are aimed at improving CMS's oversight.