Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk
Highlights
What GAO Found
The Patient Protection and Affordable Care Act (PPACA) requires applicant information be verified to determine eligibility for enrollment or income-based subsidies. To implement this verification process, the Centers for Medicare & Medicaid Services (CMS) created an electronic system called the “data services hub” (data hub), which, among other things, provides a single link to federal sources, such as the Internal Revenue Service and the Social Security Administration, to verify consumer application information. Although the data hub plays a key role in the eligibility and enrollment process, CMS does not, according to agency officials, track or analyze aggregate outcomes of data hub queries—either the extent to which a responding agency delivers information responsive to a request, or whether an agency reports that information was not available. In not doing so, CMS foregoes information that could suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management. In addition, PPACA also establishes a process to resolve “inconsistencies”—instances where individual applicant information does not match information from marketplace data sources. GAO found CMS did not have an effective process for resolving inconsistencies for individual applicants for the federal Health Insurance Marketplace (Marketplace). For example, according to GAO analysis of CMS data, about 431,000 applications from the 2014 enrollment period, with about $1.7 billion in associated subsidies for 2014, still had unresolved inconsistencies as of April 2015—several months after close of the coverage year. In addition, CMS did not resolve Social Security number inconsistencies for about 35,000 applications (with about $154 million in associated subsidies) or incarceration inconsistencies for about 22,000 applications (with about $68 million in associated subsidies). With unresolved inconsistencies, CMS is at risk of granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified health plans. In addition, according to the Internal Revenue Service, accurate Social Security numbers are vital for income tax compliance and reconciliation of advance premium tax credits that can lower enrollee costs.
During undercover testing, the federal Marketplace approved subsidized coverage under the act for 11 of 12 fictitious GAO phone or online applicants for 2014. The GAO applicants obtained a total of about $30,000 in annual advance premium tax credits, plus eligibility for lower costs at time of service. The fictitious enrollees maintained subsidized coverage throughout 2014, even though GAO sent fictitious documents, or no documents, to resolve application inconsistencies. While the subsidies, including those granted to GAO's fictitious applicants, are paid to health-care insurers, and not directly to enrolled consumers, they nevertheless represent a benefit to consumers and a cost to the government. GAO found CMS relies upon a contractor charged with document processing to report possible instances of fraud, even though CMS does not require the contractor to have any fraud detection capabilities. CMS has not performed a comprehensive fraud risk assessment—a recommended best practice—of the PPACA enrollment and eligibility process. Until such an assessment is done, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level.
Why GAO Did This Study
PPACA provides for the establishment of health-insurance marketplaces where consumers can select private health-insurance plans. The Congressional Budget Office estimates the cost of subsidies and related spending under PPACA at $37 billion for fiscal year 2015. GAO was asked to examine the enrollment process and verification controls of the federal Marketplace. For the act's first open-enrollment period ending in March 2014, this report (1) examines the extent to which applicant information is verified through an electronic system, and the extent to which the federal Marketplace resolved “inconsistencies” where applicant information does not match information from federal data sources and (2) describes, by means of undercover testing and related work, potential vulnerabilities to fraud in the federal Marketplace's application, enrollment, and eligibility verification processes. GAO analyzed 2014 data from the Marketplace and federal agencies, interviewed CMS officials, and conducted undercover testing. To perform the undercover testing, GAO submitted or attempted to submit 12 fictitious Marketplace applications. The undercover results, while illustrative, cannot be generalized to the full population of enrollees.
Recommendations
GAO makes eight recommendations, including that CMS consider analyzing outcomes of the verification system, take steps to resolve inconsistencies, and conduct a risk assessment of the potential for fraud in Marketplace applications. The Department of Health and Human Services concurred with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to conduct a comprehensive feasibility study on actions that CMS can take to monitor and analyze, both quantitatively and qualitatively, the extent to which data hub queries provide requested or relevant applicant verification information, for the purpose of improving the data-matching process and reducing the number of applicant inconsistencies; and for those actions identified as feasible, create a written plan and schedule for implementing them. |
In May 2019, HHS provided us with a study it performed in response to our recommendation. The study contained broad-scale statistical analyses of the data-matching performance of the data services Hub used in the application process for health care coverage established under PPACA; qualitative discussion of the results of the analyses; and actions implemented to improve the data-matching process. We reviewed the study and concluded it was responsive to our recommendation. By undertaking this study, CMS has taken steps to improve the applicant data-matching process as described in our report. These steps should lead to improved data-matching capability, which should in turn enhance program efficiency and help ensure that applicants meet program eligibility requirements.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to track the value of advance premium tax credit and cost-sharing reduction (CSR) subsidies that are terminated or adjusted for failure to resolve application inconsistencies, and use this information to inform assessments of program risk and performance. (See related recommendation 7.) |
Tracking CSR subsidies is no longer a relevant recommendation due to programmatic changes. The Attorney General of the United States provided HHS and the Department of the Treasury with a legal opinion regarding CSR payments made to issuers of Qualified Health Plans. In light of that opinion, and the absence of any other appropriation that could be used to fund CSR payments, CSR payments to issuers were stopped as of October 2017. Therefore, CSR payments are currently prohibited unless and until a valid appropriation exists. Also, CMS cannot track the advance premium tax credit (APTC) provided to consumers during the inconsistency period unless they are granted access to IRS tax reconciliation data.
|
| Department of Health and Human Services | To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to, in the case of CSR subsidies that are terminated or adjusted for failure to resolve application inconsistencies, consider and document, in conjunction with other agencies as relevant, whether it would be feasible to create a mechanism to recapture those costs, including whether additional statutory authority would be required to do so; and for actions determined to be feasible and reasonable, create a written plan and schedule for implementing them. |
Tracking cost-sharing reduction (CSR) subsidies is no longer a relevant recommendation due to programmatic changes. The Attorney General of the United States provided HHS and the Department of the Treasury with a legal opinion regarding CSR payments made to issuers of Qualified Health Plans. In light of that opinion, and the absence of any other appropriation that could be used to fund CSR payments, CSR payments to issuers were stopped as of October 2017. Therefore, CSR payments are currently prohibited unless and until a valid appropriation exists.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to identify and implement procedures to resolve Social Security number inconsistencies where the Marketplace is unable to verify Social Security numbers or applicants do not provide them. |
In January of 2019, CMS finalized the implementation of functionality to validate and save an SSN to a consumer's application when either an SSN inconsistency was generated as part of the original eligibility determination or an SSN was not entered at the time of application. CMS updated the application user interface to require applicants to input either an SSN or to check a box affirming (under penalty of perjury) that they do not have an SSN in order to proceed through the application without providing it. CMS anticipates that this mechanism will significantly decrease the number of applicants for whom CMS cannot use validated SSNs as part of the verification process. CMS also implemented a process to obtain a consumer's SSN from acceptable consumer-provided documents. These new functionalities substantially address our recommendation that the agency identify and implement procedures to resolve Social Security number inconsistencies where the Marketplace is unable to verify Social Security numbers or applicants do not provide them. By resolving Social Security number inconsistencies as described above, the Centers for Medicare and Medicaid Services strengthens its eligibility determination process, making sure that PPAC benefits are properly granted to eligible individuals.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to reevaluate CMS's use of Prisoner Update Processing System (PUPS) incarceration data and make a determination to either (a) use the PUPS data, among other things, as an indicator of further research required in individual cases, and to develop an effective process to clear incarceration inconsistencies or terminate coverage, or (b) if no suitable process can be identified to verify incarceration status, accept applicant attestation on status in all cases, unless the attestation is not reasonably compatible with other information that may indicate incarceration, and forego the inconsistency process. |
CMS determined that it is not practical to use the information from the Social Security Administration (SSA) Prisoner Update Processing System (PUPS) as an indicator of further research to clear incarceration inconsistencies or terminate coverage. When actively processing incarceration inconsistencies based on the information, CMS found there to be a high degree of false positives. Additionally, they do not have a readily available source through which to conduct follow-up investigations. CMS is currently accepting attestation in alignment with the recommendation.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to create a written plan and schedule for providing Marketplace call center representatives with access to information on the current status of eligibility documents submitted to CMS's documents processing contractor. |
In 2018 CMS completed integration of the Document Storage and Retrieval System (DSRS) into the Call Center's Desktop system. DSRS provides access to consumer submitted documents. This functionality allows Call Center Representatives to see the type of supporting document that a consumer submitted to the Eligibility Support Worker. By providing this access to consumer submitted documents, the Centers for Medicare and Medicaid Services makes the application process more efficient, strengthens its eligibility determination process, and helps to make sure PPAC determinations are completed in a timely manner.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to conduct a fraud risk assessment, consistent with best practices provided in GAO's framework for managing fraud risks in federal programs, of the potential for fraud in the process of applying for qualified health plans through the federal Marketplace. |
In December 2018, CMS officials told GAO they had completed the fraud risk assessment of the Marketplace application process, based on GAO's Fraud Risk Framework. GAO reviewed documentation submitted by the agency, and concurred. By conducting a fraud risk assessment, CMS is better equipped to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level. The action also helps to lower the risk of improperly providing benefits and to reduce reputational risks to the program that could arise through perceptions that program integrity is not a priority.
|
| Department of Health and Human Services |
Priority Rec.
To better oversee the efficacy of PPACA's enrollment control process; to better monitor costs, risk, and program performance; to assist with tax compliance; to strengthen the eligibility determination process; to provide applicants with improved customer service and up-to-date information about submission of eligibility documentation; and to better document agency activities, the Secretary of Health and Human Services should direct the Acting Administrator of CMS to fully document prior to implementation, and have readily available for inspection thereafter, any significant decision on qualified health plan enrollment and eligibility matters, with such documentation to include details such as policy objectives, supporting analysis, scope, and expected costs and effects. |
CMS prepares an annual Marketplace and Related Programs Cycle Memo to fulfill reporting requirements for internal control. The Memo describes all significant eligibility and enrollment policy and process changes, including new internal key controls associated with these changes. In addition, each year CMS publishes its Notice of Benefit and Payment Parameters (i.e., 'Payment Notice') in draft, and then in final. This regulation provides a comprehensive description of major proposed Marketplace changes that allows CMS to document prior to implementation and in a public forum, any significant decisions on qualified health plan enrollment and eligibility matters, including such information as policy objectives, supporting analysis, scope, and expected costs and impact. The draft regulation provides an opportunity for both the public and government oversight entities to review and comment on these proposals prior to the rule being issued in final. By providing these program policy reporting vehicles, the Centers for Medicare and Medicaid Services makes changes to the application process more transparent and efficient, and helps to make sure PPAC features and options are available to and understood by both applicants and program administrators.
|